SERVICE / DETAILdata-enrichment

threat-ioc-enrichment

GET api.agentstools.dev/threat/ioc

OPEN SERVICE ↗
SONAR SCORE0.815
LIVE PRICE0.010000
BAZAAR LIVEcompatible
CDP INDEXEDno
DECISION EVIDENCE

Why an agent can trust this route.

23 observations in the last 24h
HANDSHAKE SUCCESS91.3%402 challenge reachable
PAID DELIVERY0.0%settlement observed
P90 LATENCY3571msrecent response window
PRICE DRIFT0.0%advertised vs observed

Sonar evidence is advisory. Paid delivery is shown as verified only when paid probes are available; otherwise route estimates use the unpaid handshake as a clearly labeled proxy.

SONAR PROBE HISTORY / 30D

Observed outcomes

JSON ↗
LIVE ENDPOINT METADATA

Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.

Resource: api.agentstools.dev/threat/ioc

Network: eip155:8453 · Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 · Pay to: 0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493

Payment methods: — · Last validation: 2026-09-14 08:24:38.473+00

{
  "input": {
    "type": "object",
    "required": [
      "type",
      "method"
    ],
    "properties": {
      "type": {
        "type": "string",
        "const": "http"
      },
      "method": {
        "enum": [
          "GET",
          "HEAD",
          "DELETE"
        ],
        "type": "string"
      },
      "queryParams": {
        "type": "object",
        "required": [
          "indicator"
        ],
        "properties": {
          "type": {
            "enum": [
              "md5",
              "sha1",
              "sha256",
              "hash",
              "ip",
              "ipv4",
              "ipv6",
              "domain",
              "url",
              "cve"
            ],
            "type": "string",
            "description": "Optional type override; auto-detected if omitted"
          },
          "indicator": {
            "type": "string",
            "description": "The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id"
          }
        }
      }
    },
    "additionalProperties": false
  },
  "output": {
    "type": "object",
    "required": [
      "type"
    ],
    "properties": {
      "type": {
        "type": "string"
      },
      "example": {
        "type": "object"
      }
    }
  },
  "paymentRequirements": [
    {
      "raw": {
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "payTo": "0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493",
        "amount": "10000",
        "scheme": "exact",
        "network": "eip155:8453",
        "maxTimeoutSeconds": 300
      },
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493",
      "scheme": "exact",
      "network": "eip155:8453",
      "amountAtomic": "10000"
    }
  ]
}
METADATA PROVENANCE

Source catalog records are retained separately from live endpoint observations. Sonar score, uptime, and latency are advisory metrics. CDP indexing is not inferred from validation.