Trust

STIX 2.1 Indicator-of-Compromise feed

Public IoC feed returned as a STIX 2.1 Bundle. Per-indicator SDOs carry a Mnemom extensions block with internal type/TLP labelling. Rate-limited at the gateway and best-effort in-handler (1 req/min/IP). Pagination via after=<ISO8601> (resume from the last seen last_seen_at).

get/trust/iocs

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/trust/iocs
  • Auth: none required

Query parameters

type'substrate_fingerprint' | 'sha256' | 'domain' | 'url' | 'technique_id'
afterstring date-time

Cursor — ISO-8601 timestamp; rows with last_seen_at < after are returned.

limitinteger

Response

STIX 2.1 Bundle (possibly empty at GA — see calm-at-GA contract).

type'bundle' required
idstring required

STIX 2.1 bundle identifier (UUID-suffixed).

objectsobject[] required

STIX 2.1 indicator SDOs. Each carries a Mnemom extension with the internal indicator type + TLP + linkage to a related advisory.

next_afterstring date-time

Mnemom-extension pagination cursor. Present iff the response was capped at limit. Pass as ?after= to fetch the next page.

Changes

No recorded changes to this operation across all 1 revision of this API.