{
  "x402Version": 2,
  "id": 29195,
  "slug": "29195",
  "resource": "https://api.agentstools.dev/threat/ioc",
  "description": "Type-agnostic threat-intelligence enrichment for a SOC or DFIR agent. Give one indicator of compromise of any kind — a file hash, IP, domain, URL or CVE id — and get one normalized, cited verdict. Auto-detects the type, dispatches to the right grain, fuses the sources and returns a verdict, an is_malicious flag, a confidence, malware family when known, per-source citations and reasons. Not a guarantee.",
  "type": "http",
  "serviceName": "threat-ioc-enrichment",
  "resourceType": "Identity & Enrichment",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0xF22e558a00D91Ee12A1F50C52186FecB8dDFf493",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "10000",
      "amountUsd": 0.01,
      "maxTimeoutSeconds": 300
    }
  ],
  "outputSchema": {
    "properties": {
      "example": {
        "type": "object"
      },
      "type": {
        "type": "string"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "method": "GET",
          "queryParams": {
            "indicator": "8.8.8.8"
          },
          "type": "http"
        },
        "output": {
          "example": {
            "citations": [
              {
                "attribution": "iptoasn + Spamhaus DROP",
                "source": "IP reputation"
              }
            ],
            "confidence": 0.25,
            "disclaimer": "Reputation indicators, not a guarantee.",
            "indicator": "8.8.8.8",
            "is_malicious": null,
            "malware_family": [],
            "reasons": [
              "No positive reputation signal from the available sources."
            ],
            "source_count": 1,
            "sources": [
              "fraud_ip"
            ],
            "tags": [],
            "type": "ipv4",
            "verdict": "unknown"
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "method": {
                "enum": [
                  "GET",
                  "HEAD",
                  "DELETE"
                ],
                "type": "string"
              },
              "queryParams": {
                "properties": {
                  "indicator": {
                    "description": "The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id",
                    "type": "string"
                  },
                  "type": {
                    "description": "Optional type override; auto-detected if omitted",
                    "enum": [
                      "md5",
                      "sha1",
                      "sha256",
                      "hash",
                      "ip",
                      "ipv4",
                      "ipv6",
                      "domain",
                      "url",
                      "cve"
                    ],
                    "type": "string"
                  }
                },
                "required": [
                  "indicator"
                ],
                "type": "object"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "threat-intelligence",
    "ioc",
    "soc",
    "dfir",
    "malware",
    "bazaar"
  ],
  "sourceHost": "api.agentstools.dev",
  "lastUpdated": "2026-10-08T06:08:36.912Z",
  "quality": {
    "calls30d": 4,
    "uniquePayers30d": 3,
    "lastCalledAt": "2026-10-08T06:08:36.673Z"
  },
  "metadata": {
    "serviceName": "threat-ioc-enrichment",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "indicator": "8.8.8.8"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "citations": [
                {
                  "attribution": "iptoasn + Spamhaus DROP",
                  "source": "IP reputation"
                }
              ],
              "confidence": 0.25,
              "disclaimer": "Reputation indicators, not a guarantee.",
              "indicator": "8.8.8.8",
              "is_malicious": null,
              "malware_family": [],
              "reasons": [
                "No positive reputation signal from the available sources."
              ],
              "source_count": 1,
              "sources": [
                "fraud_ip"
              ],
              "tags": [],
              "type": "ipv4",
              "verdict": "unknown"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET",
                    "HEAD",
                    "DELETE"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "indicator": {
                      "description": "The indicator of compromise: a file hash (md5/sha1/sha256), IP, domain, URL or CVE id",
                      "type": "string"
                    },
                    "type": {
                      "description": "Optional type override; auto-detected if omitted",
                      "enum": [
                        "md5",
                        "sha1",
                        "sha256",
                        "hash",
                        "ip",
                        "ipv4",
                        "ipv6",
                        "domain",
                        "url",
                        "cve"
                      ],
                      "type": "string"
                    }
                  },
                  "required": [
                    "indicator"
                  ],
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "api.agentstools.dev",
    "manifest_name": "api.agentstools.dev",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-14T01:15:01.050Z"
  },
  "exampleResponse": {
    "example": {},
    "type": "string"
  }
}