DFIRLab
PLATFORM
Self-serve · $0 – $99/mo
ENDPOINTS
24 · REST · v1
SOURCES
11 threat-intel feeds
LATENCY
312 ms · p50
THREAT INTEL · BRIEFINGS · RESEARCH · TOOLS · WIKI

Threat intel, vulnerability briefings, research, and tools in one intelligence platform.

DFIR Lab is a cybersecurity intelligence platform: briefing-style threat intel, vulnerability briefings, original research and blog posts, a hands-on security tool suite, and a wiki for the fundamentals — backed by a self-serve API for IOC enrichment, phishing triage, and exposure scans.
Explore threat briefingsRead the researchBrowse the free tools
SOURCESper IP lookup
ENDPOINTSREST · v1
QUESTIONSacross our research
FREE CREDITSevery month, no card
UPTIME% over 30 days
THE PRODUCT

Three endpoints do most of the work.

Most analyst workflows reduce to phishing triage, IOC enrichment, or attack-surface review. The platform ships a self-serve REST API for each — shown here with real requests and the response shape you'll actually get.

Shared across endpoints

  • Bearer-token auth, one key per environment.
  • JSON in, JSON out — batch-friendly where it matters.
  • Metered in credits, not in seats or events.
POST /v1/phishing/analyze
# 1 credit · returns verdict, risk_score, spf/dkim/dmarc, indicators
curl -X POST https://api.dfir-lab.ch/v1/phishing/analyze \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"raw_email":"'"$(base64 -i suspicious.eml)"'"}'
These are real endpoints — copy the curl, replace the key, run it.
→ HTTP 200 · example responseapplication/json
{
  "verdict": "malicious",
  "risk_score": 0.92,
  "auth": { "spf": "fail", "dkim": "fail", "dmarc": "fail" },
  "indicators": 3
}
CAPABILITIES

Four pillars, one API key.

Every capability is self-serve, batch-friendly, and metered in credits. Combine them in your SOAR, n8n, or a Python cron — the platform doesn't care.
IOC ENRICHMENT

Eleven sources, one normalized response.

A single /v1/enrichment/lookup call aggregates up to 11 threat-intel sources per IP (8 per domain/URL, 6 per hash) and returns a normalized verdict you can branch on. Batch up to 50 IOCs at 3 credits each — built for incident-speed triage.

Sources
virustotalabuseipdbgreynoiseshodanurlscan+6 more
Coverage by indicator typesources
IP
11
Domain
8
URL
8
Hash
6
3 CR / IOCBatch up to 50
See the use case
PHISHING TRIAGE

Parse an .eml, get a verdict.

Deterministic SPF/DKIM/DMARC checks and extracted indicators in one call. Add an AI rationale when you want human-readable reasoning on the borderline ones.

1–10 CRDeterministic · AI optional
See workflow
ATTACK SURFACE

What the internet can see of you.

One domain in, full exposure map out: subdomains, services, TLS findings, severity counts. Scheduled per-client for MSSPs.

10 CRPer scan · schedulable
See MSSP use case
AI TRIAGE & DETECTION

Claude-powered summaries, threat-actor profiles, detection-rule drafts.

Feed enrichment JSON + MITRE TTPs into /v1/ai/triage, /ai/threat-profile, or /ai/detect to get an analyst-grade write-up or a Sigma/YARA/KQL draft. Opt-in — deterministic endpoints are the default.

See engineer's use case
TRIAGE
10CR
THREAT-PROFILE
20CR
DETECT
15CR
EXPLORE

Twelve use cases, eight comparisons — pick your entry point.

The catalog pages are long-form. These are the most-requested entries; click through for the full list.
RESEARCH

Fresh from the lab.

Deep-dive field notes on threats, tools, and the workflow — long enough to matter, short enough to read on a train.
Sep 14, 2026

Understanding Authentication vs. Access: Windows Account Logon and Logon Events

A deep dive into the critical distinction between Account Logon (authentication) and Logon (resource access) events in Windows Security logs, covering essential Event IDs for Kerberos, NTLM, RDP sessions, and detecting potential compromises.

Aug 9, 2026

Why Memory Acquisition Matters in Digital Forensics

Volatile memory captures reveal critical artifacts including active processes, network connections, cached credentials, and hidden malware that are essential for thorough incident response investigations.

Jul 23, 2026

Memory Analysis with the Volatility Framework

An introduction to analyzing memory dumps using the Volatility Memory Forensics Framework, including platform support and compatible dump formats for Windows forensic investigations.

Dispatches archive

Runs alongside

TheHiveWazuhSplunkn8nTinesShuffleElasticMISP
See integration use cases →
PRICING

Three tiers cover most teams.

Transparent, self-serve, metered in credits. No sales call. Full pricing lives on the platform — this is the short version.
FREE FOREVER100 CR / MO

Free

$0 / month

  • 100 API credits every month
  • Every public tool (/ioc-check, /phishing-check, /file-analyzer)
  • 1 API key · 1 user
  • No credit card
Create free account →
STARTER500 CR / MO

Starter

$29 / month

  • 500 API credits every month
  • Every endpoint (IOC, phishing, exposure, AI triage)
  • 5 API keys · 10 team members
  • Priority email support
Start on Starter →
PROFESSIONAL2,500 CR / MO

Professional

$99 / month

  • 2,500 API credits every month
  • Unlimited API keys · unlimited team members
  • Priority support · AI endpoints
  • Everything in Starter, higher volume
Upgrade to Professional →

Academic $9/mo · Enterprise custom. All tiers self-serve.

Evidence over vibes.

Colophon

Start reading the API.

Solo-maintained. Open about sources, honest about limits. Pull the curl, ship an integration, send feedback.

Create free account About the founder