---
title: "Indicators tagged with a CVE"
method: GET
path: "/cve/{id}/indicators"
tags: ["cve"]
---

# Indicators tagged with a CVE

`GET /cve/{id}/indicators`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/cve/{id}/indicators`
- Auth: one of:
  - none
  - API key in header `X-API-KEY`
  - HTTP bearer

From the CVE→IOC index built by `load-metrics` (threat listings only,
benign scanners and other infrastructure listings removed), newest
first, with a per-day count over the window. `updatedAt: null` means no
index — unknown, not zero. Anonymous callers get at most 10 indicators;
with an API key (one request) up to 500.

## Path parameters

- `id` string, required

## Query parameters

- `window` string
- `limit` integer

## Response `200`

`{cveId, window, updatedAt, total, perDay[], indicators[], truncated}`

- CveIndicatorsResponse
  - `cveId` string, required
  - `indicators` CveIndicator[], required
    - `lastSeen` string, date-time, required
    - `role` string, nullable: `payload_delivery`, `exploitation_scan`, `exploit_url`, `c2`…
    - `sources` string[], required
    - `type` string, required: `ip`, `domain`, `url`, `hash`.
    - `value` string, required
  - `perDay` IndicatorsPerDay[], required
    - `count` integer, required
    - `day` string, required: `YYYY-MM-DD` (UTC).
  - `total` integer, required
  - `truncated` boolean, required
  - `updatedAt` string, date-time, nullable: When the index was built; `None` = no index (the page hides the section).
  - `window` string, required: `24h`, `7d`, `14d`.

## Other responses

- `400`: Malformed id or window
- `429`: Rate limit exceeded
- `500`: Index read error

## Changes

- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/:id/indicators/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)