Indicators

Threat indicator search and retrieval (generated from buf/proto)

Search Indicators

POST

https://api.reyhford.com

/v1/indicators/search

Search threat indicators with filters. Supports filtering by protocol, sensor type, confidence, and time range.

Search Indicators › Headers

Authorization

string · required

The Authorization header is used to authenticate with the API using your API key. Value is of the format Bearer YOUR_KEY_HERE.

Search Indicators › Request Body

v1SearchIndicatorsRequest

query

string

Free-text query matched against value, tags and enrichment summary.

v1IndicatorFilter

Declarative filter; all set fields are ANDed together.

v1Pagination

Cursor-based pagination request parameters.

Search Indicators › Responses

A successful response.

v1SearchIndicatorsResponse

v1ThreatIndicator[]

v1PageInfo

Pagination metadata returned with list responses.

POST/v1/indicators/search

curl https://api.reyhford.com/v1/indicators/search \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <token>' \
  --data '{
  "query": "query",
  "filter": {
    "types": [
      "INDICATOR_TYPE_UNSPECIFIED"
    ],
    "categories": [
      "THREAT_CATEGORY_UNSPECIFIED"
    ],
    "minSeverity": "SEVERITY_UNSPECIFIED",
    "minConfidenceScore": 0,
    "states": [
      "INDICATOR_STATE_UNSPECIFIED"
    ],
    "tags": [
      "string"
    ],
    "lastSeenWindow": {
      "start": "2024-08-25T15:00:00Z",
      "end": "2024-08-25T15:00:00Z"
    },
    "sourceIds": [
      "string"
    ],
    "protocols": [
      "PROTOCOL_UNSPECIFIED"
    ],
    "sensorTypes": [
      "SENSOR_TYPE_UNSPECIFIED"
    ]
  },
  "pagination": {
    "pageSize": 0,
    "pageToken": "pageToken"
  }
}'

Example Request Body

{
  "query": "query",
  "filter": {
    "types": [
      "INDICATOR_TYPE_UNSPECIFIED"
    ],
    "categories": [
      "THREAT_CATEGORY_UNSPECIFIED"
    ],
    "minSeverity": "SEVERITY_UNSPECIFIED",
    "minConfidenceScore": 0,
    "states": [
      "INDICATOR_STATE_UNSPECIFIED"
    ],
    "tags": [
      "string"
    ],
    "lastSeenWindow": {
      "start": "2024-08-25T15:00:00Z",
      "end": "2024-08-25T15:00:00Z"
    },
    "sourceIds": [
      "string"
    ],
    "protocols": [
      "PROTOCOL_UNSPECIFIED"
    ],
    "sensorTypes": [
      "SENSOR_TYPE_UNSPECIFIED"
    ]
  },
  "pagination": {
    "pageSize": 0,
    "pageToken": "pageToken"
  }
}

json

Example Responses

{
  "indicators": [
    {
      "id": "id",
      "type": "INDICATOR_TYPE_UNSPECIFIED",
      "value": "value",
      "categories": [
        "THREAT_CATEGORY_UNSPECIFIED"
      ],
      "severity": "SEVERITY_UNSPECIFIED",
      "confidenceScore": 0,
      "tlp": "TLP_MARKING_UNSPECIFIED",
      "state": "INDICATOR_STATE_UNSPECIFIED",
      "firstSeen": "2024-08-25T15:00:00Z",
      "lastSeen": "2024-08-25T15:00:00Z",
      "validUntil": "2024-08-25T15:00:00Z",
      "sources": [
        {
          "id": "id",
          "name": "name",
          "reliability": 0,
          "reportedAt": "2024-08-25T15:00:00Z"
        }
      ],
      "sightings": [
        {
          "sourceId": "sourceId",
          "observedAt": "2024-08-25T15:00:00Z",
          "count": "count"
        }
      ],
      "enrichment": {
        "geo": {
          "countryCode": "countryCode",
          "city": "city",
          "latitude": 0,
          "longitude": 0
        },
        "asn": {
          "number": 0,
          "organization": "organization"
        },
        "reverseDns": "reverseDns",
        "malwareFamilies": [
          "string"
        ],
        "attackTechniques": [
          "string"
        ],
        "aiSummary": "aiSummary",
        "riskScore": 0,
        "enrichedAt": "2024-08-25T15:00:00Z",
        "ipReputationJson": "ipReputationJson"
      },
      "tags": [
        "string"
      ],
      "labels": [
        {
          "key": "key",
          "value": "value"
        }
      ],
      "createdAt": "2024-08-25T15:00:00Z",
      "updatedAt": "2024-08-25T15:00:00Z",
      "protocol": "PROTOCOL_UNSPECIFIED",
      "sensorType": "SENSOR_TYPE_UNSPECIFIED"
    }
  ],
  "pageInfo": {
    "nextPageToken": "nextPageToken",
    "totalCount": "totalCount"
  }
}

json

application/json

Get Indicator

GET

https://api.reyhford.com

/v1/indicators/{id}

Get Indicator › path Parameters

id

string · required

Get Indicator › Headers

Authorization

string · required

The Authorization header is used to authenticate with the API using your API key. Value is of the format Bearer YOUR_KEY_HERE.

Get Indicator › Responses

A successful response.

v1GetIndicatorResponse

v1ThreatIndicator

A threat indicator (IOC) — the core entity of the platform.

GET/v1/indicators/{id}

curl https://api.reyhford.com/v1/indicators/:id \
  --header 'Authorization: Bearer <token>'

Example Responses

{
  "indicator": {
    "id": "id",
    "type": "INDICATOR_TYPE_UNSPECIFIED",
    "value": "value",
    "categories": [
      "THREAT_CATEGORY_UNSPECIFIED"
    ],
    "severity": "SEVERITY_UNSPECIFIED",
    "confidenceScore": 0,
    "tlp": "TLP_MARKING_UNSPECIFIED",
    "state": "INDICATOR_STATE_UNSPECIFIED",
    "firstSeen": "2024-08-25T15:00:00Z",
    "lastSeen": "2024-08-25T15:00:00Z",
    "validUntil": "2024-08-25T15:00:00Z",
    "sources": [
      {
        "id": "id",
        "name": "name",
        "reliability": 0,
        "reportedAt": "2024-08-25T15:00:00Z"
      }
    ],
    "sightings": [
      {
        "sourceId": "sourceId",
        "observedAt": "2024-08-25T15:00:00Z",
        "count": "count"
      }
    ],
    "enrichment": {
      "geo": {
        "countryCode": "countryCode",
        "city": "city",
        "latitude": 0,
        "longitude": 0
      },
      "asn": {
        "number": 0,
        "organization": "organization"
      },
      "reverseDns": "reverseDns",
      "malwareFamilies": [
        "string"
      ],
      "attackTechniques": [
        "string"
      ],
      "aiSummary": "aiSummary",
      "riskScore": 0,
      "enrichedAt": "2024-08-25T15:00:00Z",
      "ipReputationJson": "ipReputationJson"
    },
    "tags": [
      "string"
    ],
    "labels": [
      {
        "key": "key",
        "value": "value"
      }
    ],
    "createdAt": "2024-08-25T15:00:00Z",
    "updatedAt": "2024-08-25T15:00:00Z",
    "protocol": "PROTOCOL_UNSPECIFIED",
    "sensorType": "SENSOR_TYPE_UNSPECIFIED"
  }
}

json

application/json

List Indicators

GET

https://api.reyhford.com

/v1/indicators

List Indicators › query Parameters

filter.types

string[] · explode: true

Enum values:

INDICATOR_TYPE_UNSPECIFIED

INDICATOR_TYPE_IPV4

INDICATOR_TYPE_IPV6

INDICATOR_TYPE_DOMAIN

INDICATOR_TYPE_URL

INDICATOR_TYPE_FILE_HASH_MD5

INDICATOR_TYPE_FILE_HASH_SHA1

INDICATOR_TYPE_FILE_HASH_SHA256

filter.categories

string[] · explode: true

Enum values:

THREAT_CATEGORY_UNSPECIFIED

THREAT_CATEGORY_MALWARE

THREAT_CATEGORY_PHISHING

THREAT_CATEGORY_COMMAND_AND_CONTROL

THREAT_CATEGORY_BOTNET

THREAT_CATEGORY_SCANNER

THREAT_CATEGORY_SPAM

THREAT_CATEGORY_BRUTE_FORCE

filter.minSeverity

string · enum

Enum values:

SEVERITY_UNSPECIFIED

SEVERITY_INFO

SEVERITY_LOW

SEVERITY_MEDIUM

SEVERITY_HIGH

SEVERITY_CRITICAL

Default: SEVERITY_UNSPECIFIED

filter.minConfidenceScore

integer · int64

Minimum confidence score in [0, 100].

filter.states

string[] · explode: true

INDICATOR_STATE_RAW: Sensor event received, nothing computed yet.
INDICATOR_STATE_SCORED: pipeline-worker computed the confidence score.
INDICATOR_STATE_ENRICHED: ai-enricher attached MITRE ATT&CK context.
INDICATOR_STATE_VERIFIED: Confirmed by a human analyst.

Enum values:

INDICATOR_STATE_UNSPECIFIED

INDICATOR_STATE_RAW

INDICATOR_STATE_SCORED

INDICATOR_STATE_ENRICHED

INDICATOR_STATE_VERIFIED

filter.tags

string[] · explode: true

filter.lastSeenWindow.start

string · date-time

filter.lastSeenWindow.end

string · date-time

filter.sourceIds

string[] · explode: true

filter.protocols

string[] · explode: true

Restrict to indicators observed over these protocols; empty means all.

Enum values:

PROTOCOL_UNSPECIFIED

PROTOCOL_MODBUS

PROTOCOL_DNP3

PROTOCOL_BACNET

PROTOCOL_S7

PROTOCOL_OPC_UA

PROTOCOL_SSH

PROTOCOL_HTTP

filter.sensorTypes

string[] · explode: true

Restrict to indicators observed by these sensor kinds; empty means all.

SENSOR_TYPE_ICS: Industrial control system honeypot (Conpot etc.).
SENSOR_TYPE_NETWORK: Generic network honeypot.
SENSOR_TYPE_ENDPOINT: Endpoint / host-based sensor.

Enum values:

SENSOR_TYPE_UNSPECIFIED

SENSOR_TYPE_ICS

SENSOR_TYPE_NETWORK

SENSOR_TYPE_ENDPOINT

pagination.pageSize

integer · int64

Maximum number of items to return. Server may cap this value.

pagination.pageToken

string

Opaque cursor from a previous response; empty for the first page.

List Indicators › Responses

A successful response.

v1ListIndicatorsResponse

v1ThreatIndicator[]

v1PageInfo

Pagination metadata returned with list responses.

GET/v1/indicators

curl https://api.reyhford.com/v1/indicators \
  --header 'Authorization: Bearer <token>'

Example Responses

{
  "indicators": [
    {
      "id": "id",
      "type": "INDICATOR_TYPE_UNSPECIFIED",
      "value": "value",
      "categories": [
        "THREAT_CATEGORY_UNSPECIFIED"
      ],
      "severity": "SEVERITY_UNSPECIFIED",
      "confidenceScore": 0,
      "tlp": "TLP_MARKING_UNSPECIFIED",
      "state": "INDICATOR_STATE_UNSPECIFIED",
      "firstSeen": "2024-08-25T15:00:00Z",
      "lastSeen": "2024-08-25T15:00:00Z",
      "validUntil": "2024-08-25T15:00:00Z",
      "sources": [
        {
          "id": "id",
          "name": "name",
          "reliability": 0,
          "reportedAt": "2024-08-25T15:00:00Z"
        }
      ],
      "sightings": [
        {
          "sourceId": "sourceId",
          "observedAt": "2024-08-25T15:00:00Z",
          "count": "count"
        }
      ],
      "enrichment": {
        "geo": {
          "countryCode": "countryCode",
          "city": "city",
          "latitude": 0,
          "longitude": 0
        },
        "asn": {
          "number": 0,
          "organization": "organization"
        },
        "reverseDns": "reverseDns",
        "malwareFamilies": [
          "string"
        ],
        "attackTechniques": [
          "string"
        ],
        "aiSummary": "aiSummary",
        "riskScore": 0,
        "enrichedAt": "2024-08-25T15:00:00Z",
        "ipReputationJson": "ipReputationJson"
      },
      "tags": [
        "string"
      ],
      "labels": [
        {
          "key": "key",
          "value": "value"
        }
      ],
      "createdAt": "2024-08-25T15:00:00Z",
      "updatedAt": "2024-08-25T15:00:00Z",
      "protocol": "PROTOCOL_UNSPECIFIED",
      "sensorType": "SENSOR_TYPE_UNSPECIFIED"
    }
  ],
  "pageInfo": {
    "nextPageToken": "nextPageToken",
    "totalCount": "totalCount"
  }
}

json

application/json

Health

Search Indicators

POST

https://api.reyhford.com

/v1/indicators/search

Search threat indicators with filters. Supports filtering by protocol, sensor type, confidence, and time range.

Search Indicators › Headers

Authorization

string · required

The Authorization header is used to authenticate with the API using your API key. Value is of the format Bearer YOUR_KEY_HERE.

Search Indicators › Request Body

v1SearchIndicatorsRequest

query

string

Free-text query matched against value, tags and enrichment summary.

v1IndicatorFilter

Declarative filter; all set fields are ANDed together.

v1Pagination

Cursor-based pagination request parameters.

Search Indicators › Responses

A successful response.

v1SearchIndicatorsResponse

v1ThreatIndicator[]

v1PageInfo

Pagination metadata returned with list responses.

Get Indicator

GET

https://api.reyhford.com

/v1/indicators/{id}

Get Indicator › path Parameters

id

string · required

Get Indicator › Headers

Authorization

string · required

The Authorization header is used to authenticate with the API using your API key. Value is of the format Bearer YOUR_KEY_HERE.

Get Indicator › Responses

A successful response.

v1GetIndicatorResponse

v1ThreatIndicator

A threat indicator (IOC) — the core entity of the platform.

List Indicators

GET

https://api.reyhford.com

/v1/indicators

List Indicators › query Parameters

filter.types

string[] · explode: true

Enum values:

INDICATOR_TYPE_UNSPECIFIED

INDICATOR_TYPE_IPV4

INDICATOR_TYPE_IPV6

INDICATOR_TYPE_DOMAIN

INDICATOR_TYPE_URL

INDICATOR_TYPE_FILE_HASH_MD5

INDICATOR_TYPE_FILE_HASH_SHA1

INDICATOR_TYPE_FILE_HASH_SHA256

filter.categories

string[] · explode: true

Enum values:

THREAT_CATEGORY_UNSPECIFIED

THREAT_CATEGORY_MALWARE

THREAT_CATEGORY_PHISHING

THREAT_CATEGORY_COMMAND_AND_CONTROL

THREAT_CATEGORY_BOTNET

THREAT_CATEGORY_SCANNER

THREAT_CATEGORY_SPAM

THREAT_CATEGORY_BRUTE_FORCE

filter.minSeverity

string · enum

Enum values:

SEVERITY_UNSPECIFIED

SEVERITY_INFO

SEVERITY_LOW

SEVERITY_MEDIUM

SEVERITY_HIGH

SEVERITY_CRITICAL

Default: SEVERITY_UNSPECIFIED

filter.minConfidenceScore

integer · int64

Minimum confidence score in [0, 100].

filter.states

string[] · explode: true

INDICATOR_STATE_RAW: Sensor event received, nothing computed yet.
INDICATOR_STATE_SCORED: pipeline-worker computed the confidence score.
INDICATOR_STATE_ENRICHED: ai-enricher attached MITRE ATT&CK context.
INDICATOR_STATE_VERIFIED: Confirmed by a human analyst.

Enum values:

INDICATOR_STATE_UNSPECIFIED

INDICATOR_STATE_RAW

INDICATOR_STATE_SCORED

INDICATOR_STATE_ENRICHED

INDICATOR_STATE_VERIFIED

filter.tags

string[] · explode: true

filter.lastSeenWindow.start

string · date-time

filter.lastSeenWindow.end

string · date-time

filter.sourceIds

string[] · explode: true

filter.protocols

string[] · explode: true

Restrict to indicators observed over these protocols; empty means all.

Enum values:

PROTOCOL_UNSPECIFIED

PROTOCOL_MODBUS

PROTOCOL_DNP3

PROTOCOL_BACNET

PROTOCOL_S7

PROTOCOL_OPC_UA

PROTOCOL_SSH

PROTOCOL_HTTP

filter.sensorTypes

string[] · explode: true

Restrict to indicators observed by these sensor kinds; empty means all.

SENSOR_TYPE_ICS: Industrial control system honeypot (Conpot etc.).
SENSOR_TYPE_NETWORK: Generic network honeypot.
SENSOR_TYPE_ENDPOINT: Endpoint / host-based sensor.

Enum values:

SENSOR_TYPE_UNSPECIFIED

SENSOR_TYPE_ICS

SENSOR_TYPE_NETWORK

SENSOR_TYPE_ENDPOINT

pagination.pageSize

integer · int64

Maximum number of items to return. Server may cap this value.

pagination.pageToken

string

Opaque cursor from a previous response; empty for the first page.

List Indicators › Responses

A successful response.

v1ListIndicatorsResponse

v1ThreatIndicator[]

v1PageInfo

Pagination metadata returned with list responses.