OEM threat intelligence for your product
Build Q-Feeds threat intelligence into your firewall, security platform or managed service. OEM use requires written approval from Q-Feeds, so talk to us first.
Why build Q-Feeds in
Collecting threat data is the easy part. Scoring it, removing duplicates and false positives, adding context and keeping it current every day is a job on its own. Q-Feeds does that work, so your team can spend its time on your product.
Vendors and service providers ask us more and more often whether they can build our intelligence into what they sell. They can, in several ways, and this page explains how.
Typical OEM use cases
Firewalls and network appliances
Ship malicious IP, domain and URL feeds to the devices you sell. Plain text or CSV over HTTPS, with incremental updates for the IP feed.
Security platforms and SaaS
Enrich alerts in your SIEM, XDR, SOAR or email security product through the IOC Lookup API, one value at a time or in bulk, or pull STIX 2.1 over TAXII 2.1.
Under your own brand
The intelligence arrives as plain data. Whether and how the Q-Feeds name appears in your product is something we agree with you in advance.
Managed security services
Use one intelligence source across the customer environments your SOC runs. If you would rather resell licences per customer, see our page for MSPs and MSSPs.
How the intelligence reaches your product
Feeds over HTTPS
Malicious IPs, domains and URLs as lists your product downloads on a schedule, authenticated with an API key. About the feeds
IOC Lookup API
A REST API that returns the verdict, the score, the reasons behind the score and MITRE ATT&CK context as JSON. An OpenAPI specification is available. About the IOC Lookup API
STIX 2.1 over TAXII 2.1
Collections of IPs, domains, URLs and file hashes for any TAXII 2.1 client. About TAXII
Before you start
Written approval required
No OEM, embedded or white-label use without written approval from Q-Feeds. A standard licence does not cover it.
Hosted in the EU
European data centres operated from the Netherlands, by a Dutch company.
Pricing on request
The price depends on what you build in and at what scale. We give you a quote once we know your case.
From first conversation to release
Tell us what you are building
Describe your product, how you want to receive the data and the volumes you expect.
Evaluate
Test against real data with a free Community key or with evaluation access from us.
Get written approval
We agree the scope, the terms and the price with you and confirm the approval in writing.
Integrate and release
Build against the documented API and feeds. Our engineers help where needed.
Questions about OEM use
Can we build Q-Feeds into our product with a standard licence?
No. Standard licences cover internal use only. Any OEM, embedded or white-label use needs written approval from Q-Feeds beforehand. Contact us and we will look at your case.
What can we build Q-Feeds into?
Firewalls and other network appliances, security platforms such as SIEM, XDR, SOAR and email security, and managed security services. If your product is something else, tell us what you have in mind.
Which data and formats are available?
Malicious IP, domain and URL feeds as plain text or CSV, the IOC Lookup API as JSON over REST, and STIX 2.1 collections over TAXII 2.1, which also include file hashes.
Can we offer the intelligence under our own brand?
Only as part of an OEM arrangement we have approved in writing. How the data is named and shown in your product is one of the things we agree with you.
How is OEM use priced?
On request. Tell us what you want to build in and at what scale, and we will give you a quote. Prices exclude VAT.
We resell Q-Feeds licences to our customers. Is this page for us?
No. Reselling licences runs through our reseller programme. OEM is for building the intelligence into a product or service of your own.
Request approval for OEM use
OEM use starts with a conversation. Send us the details and we will reply by email.
- What your product or service does and who uses it
- How you want to receive the data: feeds, API or TAXII
- The number of devices, customers or lookups you expect
Tell us about your product
Tell us what you need and the right person will follow up by email.