Skip to main content

Network threat intelligence

The Network Threat Intelligence APIs provide comprehensive capabilities for investigating and analyzing network-based indicators of compromise (IOCs), including URLs, domains, and IP addresses. These APIs enable security teams to assess threats, retrieve reputation data, and correlate network indicators with malicious files.

Common Use Cases​

Check and manage network reputation​

Quick reputation lookups for URLs, domains, and IP addresses to get an immediate assessment of whether a network location is associated with malicious activity.

Investigate a suspicious URL​

Use TCA-0404 Analyze URL to submit URLs for analysis and get detailed reports through TCA-0403 URL threat intelligence. TCA-0403 can also retrieve intelligence reports for any URL in our database.

  • Analyze URL (TCA-0404) - Submit URLs for analysis. Downloads and analyzes content, captures screenshots, and resolves infrastructure details.
  • URL threat intelligence (TCA-0403) - Retrieve comprehensive threat intelligence reports for URLs in single or bulk requests, including classification, analysis metadata (site categorization, threat type details, site availability, DOM, redirect paths..etc.), screenshots, downloaded files, and third-party reputation data.

Investigate a domain or IP address​

Understand threat profiles, associated files, DNS records, and relationships with other network indicators.

  • Domain threat intelligence (TCA-0405) - Retrieve domain reports in single or bulk requests, including reputation data, downloaded file statistics, DNS records, SSL certificates, related URLs, subdomains, and domain resolutions.
  • IP threat intelligence (TCA-0406) - Retrieve IP address reports in single or bulk requests, including reputation data, downloaded file statistics, WHOIS information, GeoIP data, related URLs, and domain resolutions.

Find malware samples associated with a network indicator​

Correlate network indicators with file samples. These APIs help identify which files contain references to specific URIs, enabling threat hunting and malware analysis workflows.

  • URI-to-hash search (TCA-0401) - Find file hashes that contain references to a specific URI (email, URL, IPv4 address, or domain) discovered during static analysis.
  • URI statistics (TCA-0402) - Get statistical counts of known, malicious, and suspicious files associated with a specific URI.

All Networking APIs​