Which one do I need?
- IOC Lookup API: best when you want to ask about a specific indicator from your own code or script, for example to enrich an alert in your SIEM or SOAR.
- TAXII 2.1: best when you want to consume the whole feed in a standard format. Many threat intelligence platforms can subscribe to a TAXII server out of the box.
Getting access
Both use your Q-Feeds API key. Create one under Manage API Keys in the portal (see Get your threat feeds). Full API and TAXII access depends on your license, so if an endpoint is not available to you, check your package on the pricing page or contact us.
Authentication uses your Q-Feeds API key as a Bearer token. Send it in the request header as Authorization: Bearer YOUR_TOKEN.
IOC Lookup API
The IOC Lookup API lets you query indicators such as IPs, domains, URLs and hashes and get back the same context you see in Threat Lookup. The interactive documentation lists every endpoint, parameter and response, and lets you try calls in the browser.
TAXII 2.1 server
The TAXII server delivers our indicators as STIX 2.1 objects, the common language for threat intelligence. A few things worth knowing:
- The api root is
default. - Collections hold the STIX 2.1 objects you can pull.
- You can filter what you fetch, for example
match[type]=indicatorto get only indicators, andadded_afterto fetch only what is new since your last poll.