curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs?type=ipv4&confidence=high&since=2026-05-16T00:00:00Z&limit=500"

{
  "meta": {
    "total": 1523,
    "limit": 100,
    "offset": 0,
    "generated_at": "2024-12-09T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders",
    "filters": {
      "type": "all",
      "category": "all",
      "confidence": "all",
      "since": "2024-12-08T00:00:00Z",
      "until": "2024-12-09T10:30:00Z"
    }
  },
  "data": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "type": "ipv4",
      "value": "192.168.1.1",
      "confidence": "high",
      "first_seen": "2024-12-08T14:30:00Z",
      "last_seen": "2024-12-09T08:15:00Z",
      "source": {
        "article_id": "abc123",
        "article_title": "New APT Campaign Targeting Financial Sector",
        "article_url": "https://socdefenders.ai/item/abc123",
        "feed_name": "Krebs on Security",
        "category": "news"
      },
      "context": "C2 server used in APT28 campaign",
      "tags": [
        "apt28",
        "c2",
        "financial"
      ],
      "mitre_techniques": [
        "T1071",
        "T1059"
      ]
    }
  ],
  "links": {
    "self": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=0",
    "next": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=100"
  }
}

IOCs

List IOCs (Indicators of Compromise)

The primary IOC export endpoint. Returns indicators of compromise — IPs, domains, URLs, file hashes, email addresses, CVEs, and MITRE ATT&CK technique IDs — extracted from articles and ingested from threat feeds (URLhaus, Feodo Tracker, ThreatFox).

What’s an IOC?

An Indicator of Compromise is a forensic artifact that suggests a system has been compromised. The feed mixes:

Article-extracted IOCs: pulled out of writeups by our extraction pipeline (source.origin: "article")
Feed-sourced IOCs: ingested directly from threat-intel feeds (source.origin: "feed")

Common use cases

1. SIEM block-list ingestion (recent IPs)

GET /api/v1/iocs?type=ipv4&confidence=high&since=2026-05-16T00:00:00Z&format=txt

Returns one IP per line — perfect for piping into a firewall block-list.

2. Hash IOCs for EDR detection

GET /api/v1/iocs?type=sha256&confidence=high&limit=1000

3. APT-tagged IOCs for threat hunting

GET /api/v1/iocs?industry=finance&since=2026-05-01T00:00:00Z&limit=500

4. CSV export for spreadsheet analysis

GET /api/v1/iocs?type=domain&format=csv&limit=1000

Output formats

json (default): structured response with metadata + pagination
csv: 10-column CSV — id, type, value, confidence, first_seen, last_seen, source_article, source_feed, category, tags
txt: bare IOC values one per line — for direct firewall/EDR ingestion

Tier behavior

Tier	Per request	Lookback	Formats
Free	100	1 day	json only
Pro	10,000	365 days	json, csv, txt

Pagination

Standard offset + limit. For walks past ~1k offsets, use the Articles endpoint pattern (cursor) or narrow your time window.

GET

api

iocs

curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs?type=ipv4&confidence=high&since=2026-05-16T00:00:00Z&limit=500"

{
  "meta": {
    "total": 1523,
    "limit": 100,
    "offset": 0,
    "generated_at": "2024-12-09T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders",
    "filters": {
      "type": "all",
      "category": "all",
      "confidence": "all",
      "since": "2024-12-08T00:00:00Z",
      "until": "2024-12-09T10:30:00Z"
    }
  },
  "data": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "type": "ipv4",
      "value": "192.168.1.1",
      "confidence": "high",
      "first_seen": "2024-12-08T14:30:00Z",
      "last_seen": "2024-12-09T08:15:00Z",
      "source": {
        "article_id": "abc123",
        "article_title": "New APT Campaign Targeting Financial Sector",
        "article_url": "https://socdefenders.ai/item/abc123",
        "feed_name": "Krebs on Security",
        "category": "news"
      },
      "context": "C2 server used in APT28 campaign",
      "tags": [
        "apt28",
        "c2",
        "financial"
      ],
      "mitre_techniques": [
        "T1071",
        "T1059"
      ]
    }
  ],
  "links": {
    "self": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=0",
    "next": "https://socdefenders.ai/api/v1/iocs?limit=100&offset=100"
  }
}

Authorizations

X-API-Key

string

header

required

API key in X-API-Key header

Query Parameters

type

enum<string>

Filter by IOC type. Common: ipv4, domain, sha256. Less common: email, cve (use /api/v1/articles?cve_text_search= for CVE search), mitre_attack (technique IDs).

Available options:

ipv4,

ipv6,

domain,

url,

md5,

sha1,

sha256,

sha512,

email,

cve,

mitre_attack

Example:

"ipv4"

Response

Successful response