One threat intelligence API for your SIEM, detections, and dashboards

In-house TI aggregation is a maintenance tax

The endpoints that solve it

The canonical detection-engineering integration

import os, requests

API = "https://api.dfir-lab.ch"
KEY = os.environ["DFIR_API_KEY"]
HDRS = {
    "Authorization": f"Bearer {KEY}",
    "Content-Type": "application/json",
}

def enrich(indicators: list[dict]) -> dict:
    """Called from the SIEM adapter when a rule fires."""
    r = requests.post(
        f"{API}/v1/enrichment/lookup",
        json={"indicators": indicators},
        headers=HDRS,
        timeout=30,
    )
    r.raise_for_status()
    return r.json()

# Example: a detection rule fires on outbound traffic to an unusual IP
result = enrich([
    {"type": "ip",     "value": "45.155.205.233"},
    {"type": "domain", "value": "update-services.top"},
])

# result["indicators"][i] includes:
#   verdict          -> clean | suspicious | malicious
#   confidence       -> 0.0 .. 1.0
#   sources          -> per-source raw detail
#   sources_consulted, first_seen, last_seen, tags

# Optional: generate a detection-rule draft for this pattern
rule_draft = requests.post(
    f"{API}/v1/ai/detect",
    json={"indicators": result["indicators"], "format": "sigma"},
    headers=HDRS,
).json()

1. 01
   Step 01

   Adapter

   Drop a thin HTTP wrapper into your detection pipeline or SIEM ingestion layer. One function, one auth scheme, one retry path.

2. 02
   Step 02

   Enrich on rule fire

   When a detection rule fires, submit the observed IOCs to /v1/enrichment/lookup. Attach the normalized verdict to the alert payload.

3. 03
   Step 03

   Route

   Use the aggregated verdict and confidence score to drive routing — malicious + high-confidence escalates to on-call; clean + high-confidence suppresses the alert with an audit trail.

4. 04
   Step 04

   Contextualize

   For analyst-facing dashboards, pull threat-actor context with /v1/ai/threat-profile and attach it to the alert detail view.

5. 05
   Step 05

   Iterate

   For novel patterns, /v1/ai/detect drafts a Sigma / YARA / KQL rule scoped to the observed IOCs. Review, tune, promote to production.

Pricing that tracks your workload

1. 01

   Lean detection team — 40 alerts/day × 2 IOCs each

   40 × 2 × 3 × 22 business days = 5,280 credits/month

   Exceeds Professional (2,500) — move to Professional + 5,000-credit top-up, or Enterprise if traffic grows.
2. 02

   Dashboard-only usage — 20 enrichments/day

   20 × 3 × 22 = 1,320 credits/month

   Fits Professional ($99, 2,500 credits) with headroom; Starter ($29, 500) is too tight for sustained daily use.
3. 03

   Small team evaluation — 5 enrichments/day

   5 × 3 × 22 = 330 credits/month

   Fits Starter ($29, 500 credits) comfortably with ~170 credits spare for occasional AI rule drafts.

Three ways to evaluate

Frequently asked

Q / 01

Is this a TI feed or a TI API?

It is an on-demand enrichment API — you submit indicators and receive normalized verdicts. It is not a push feed of curated indicators. If your architecture expects a STIX/TAXII stream, this is complementary rather than a replacement.

Q / 02

What happens when one upstream source is down?

The endpoint is designed to degrade gracefully. Each response includes a sources_consulted array — if GreyNoise or AbuseIPDB times out on a request, the aggregate verdict is computed from the sources that did respond, and the missing source is flagged in the response rather than failing the whole call.

Q / 03

How stable is the response schema?

All endpoints are versioned under /v1. Additive changes (new fields) are announced in the changelog; breaking changes bump the major version and run both versions in parallel during the migration window. You should not need to rewrite parsers on a regular cadence.

Q / 04

Can I use this from Splunk / Elastic / Sentinel?

Yes — the endpoint is a plain HTTP POST with a Bearer token, which every major SIEM can call from a search command, an ingest enrichment action, or a playbook. The Splunk-specific pattern is covered in a separate use case.

Q / 05

Is there a STIX / OpenCTI bridge?

The response JSON maps cleanly to STIX 2.1 Indicator objects — there is no first-party STIX renderer yet, but the field mapping is documented and teams commonly run the translation in their own pipeline. A native bridge is on the roadmap.

Q / 06

How does pricing compare to buying VT + AbuseIPDB + Shodan separately?

Commercial tiers of the big three TI sources run into four-to-five-figure annual spend before you count the engineering time to stitch them together. A Professional plan covers most detection-engineering workloads at $99/mo flat with no glue code, which is usually the real win — the money saved is secondary to the team-hours not spent on adapter maintenance.