curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs/search?q=192.168.1.1"

{
  "meta": {
    "generated_at": "2026-05-17T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "found": true,
    "query": "192.168.1.1",
    "matches": [
      {
        "id": "6fc99fbc-2c24-4ce2-8b42-48065d4976e7",
        "type": "ipv4",
        "value": "192.168.1.1",
        "confidence": "high",
        "first_seen": "2026-05-15T08:21:30Z",
        "last_seen": "2026-05-16T18:42:11Z",
        "source": {
          "article_id": "c59a6bb4-f69a-4b90-babe-ca1afcda3514",
          "article_title": "New botnet observed beaconing to home routers",
          "article_url": "https://socdefenders.ai/item/c59a6bb4-f69a-4b90-babe-ca1afcda3514",
          "reference_url": "https://krebsonsecurity.com/...",
          "feed_name": "Krebs on Security",
          "category": "threat-intel",
          "origin": "article"
        },
        "context": "C2 server IP referenced in botnet writeup.",
        "tags": [
          "c2",
          "botnet"
        ],
        "mitre_techniques": [
          "T1071"
        ]
      }
    ],
    "relatedIOCs": [
      {
        "id": "...",
        "type": "domain",
        "value": "c2.example.com",
        "confidence": "high",
        "first_seen": "2026-05-15T08:21:30Z",
        "last_seen": "2026-05-15T08:21:30Z",
        "source": {
          "article_id": "c59a6bb4-...",
          "article_title": "New botnet observed beaconing to home routers",
          "article_url": "https://socdefenders.ai/item/c59a6bb4-...",
          "reference_url": null,
          "feed_name": "Krebs on Security",
          "category": "threat-intel",
          "origin": "article"
        },
        "tags": [
          "c2",
          "botnet"
        ],
        "mitre_techniques": [
          "T1071"
        ]
      }
    ],
    "meta": {
      "total_matches": 1,
      "related_count": 1,
      "search_time_ms": 12
    }
  }
}

{
  "error": {
    "code": "invalid_parameter",
    "message": "Invalid IOC type: invalid",
    "details": {
      "valid_types": [
        "ipv4",
        "ipv6",
        "domain",
        "url",
        "md5",
        "sha1",
        "sha256"
      ]
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\"",
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Please wait before making more requests.",
    "details": {
      "limit": 10,
      "reset_at": "2024-12-09T10:31:00Z",
      "tier": "free",
      "upgrade_url": "https://socdefenders.ai/export#pricing"
    },
    "request_id": "req_abc123"
  }
}

IOCs

Search for a specific IOC value

Look up a specific IOC (IP, domain, hash, URL, CVE, etc.) and get back every record from across the feed plus related indicators from the same article or campaign.

Strategy

Two-stage lookup:

Exact match against ioc_value_normalized (btree-indexed, ~5ms). Lowercased + URL-canonicalized + IPv6-zero-compressed.
Trigram fallback if no exact match. Requires ≥3 characters and uses the pg_trgm GIN index on the value column.

Use cases

Triage: pasted IP from an alert → “is this in our threat intel?”
Pivot: found a hash → fetch the article + the other IOCs from the same report
Verification: confirm a domain hasn’t been flagged elsewhere

Related IOCs

When include_related=true (default), the response includes up to 10 IOCs from the same source article. Useful for hash → campaign expansion.

GET

api

iocs

curl -H "Authorization: Bearer sk_live_..." \
  "https://socdefenders.ai/api/v1/iocs/search?q=192.168.1.1"

{
  "meta": {
    "generated_at": "2026-05-17T10:30:00Z",
    "feed_version": "1.0",
    "source": "SOC Defenders"
  },
  "data": {
    "found": true,
    "query": "192.168.1.1",
    "matches": [
      {
        "id": "6fc99fbc-2c24-4ce2-8b42-48065d4976e7",
        "type": "ipv4",
        "value": "192.168.1.1",
        "confidence": "high",
        "first_seen": "2026-05-15T08:21:30Z",
        "last_seen": "2026-05-16T18:42:11Z",
        "source": {
          "article_id": "c59a6bb4-f69a-4b90-babe-ca1afcda3514",
          "article_title": "New botnet observed beaconing to home routers",
          "article_url": "https://socdefenders.ai/item/c59a6bb4-f69a-4b90-babe-ca1afcda3514",
          "reference_url": "https://krebsonsecurity.com/...",
          "feed_name": "Krebs on Security",
          "category": "threat-intel",
          "origin": "article"
        },
        "context": "C2 server IP referenced in botnet writeup.",
        "tags": [
          "c2",
          "botnet"
        ],
        "mitre_techniques": [
          "T1071"
        ]
      }
    ],
    "relatedIOCs": [
      {
        "id": "...",
        "type": "domain",
        "value": "c2.example.com",
        "confidence": "high",
        "first_seen": "2026-05-15T08:21:30Z",
        "last_seen": "2026-05-15T08:21:30Z",
        "source": {
          "article_id": "c59a6bb4-...",
          "article_title": "New botnet observed beaconing to home routers",
          "article_url": "https://socdefenders.ai/item/c59a6bb4-...",
          "reference_url": null,
          "feed_name": "Krebs on Security",
          "category": "threat-intel",
          "origin": "article"
        },
        "tags": [
          "c2",
          "botnet"
        ],
        "mitre_techniques": [
          "T1071"
        ]
      }
    ],
    "meta": {
      "total_matches": 1,
      "related_count": 1,
      "search_time_ms": 12
    }
  }
}

{
  "error": {
    "code": "invalid_parameter",
    "message": "Invalid IOC type: invalid",
    "details": {
      "valid_types": [
        "ipv4",
        "ipv6",
        "domain",
        "url",
        "md5",
        "sha1",
        "sha256"
      ]
    },
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "missing_api_key",
    "message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\"",
    "request_id": "req_abc123"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Please wait before making more requests.",
    "details": {
      "limit": 10,
      "reset_at": "2024-12-09T10:31:00Z",
      "tier": "free",
      "upgrade_url": "https://socdefenders.ai/export#pricing"
    },
    "request_id": "req_abc123"
  }
}

Authorizations

X-API-Key

string

header

required

API key in X-API-Key header

Query Parameters

string

required

IOC value to search for. Accepts any type (IPv4/IPv6, domain, URL, MD5/SHA1/SHA256/SHA512, email, CVE ID, MITRE technique). Auto-normalized for lookup.

Minimum string length: 2

Example:

"192.168.1.1"

When true (default), the response includes up to 10 IOCs from the same source article — useful for pivot/expansion workflows.

Example:

true

Response

Search results

Overview

IOC Endpoints

Articles Endpoints

TAXII 2.1

IOCs

Statistics

Export Formats

Detection Rules

Lookup

API Keys

TAXII

Articles