Threat intelligence

Exploit chatter and threat actor lookup

Two actions on one endpoint, selected with action.

exploit-chatter detects pre-publication CVE proof-of-concept discussion in criminal channels, with EPSS score and CISA KEV status.

actor-lookup (the default) resolves a threat actor or malware campaign to its MITRE ATT&CK group, associated malware, and live indicators from RelayShield's corpus.

Billing. $0.30 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

post/v1/metered/threat-actor

Request

  • Base URL: https://api.relayshield.net
  • URL: https://api.relayshield.net/v1/metered/threat-actor
  • Auth: one of:
    • API key in header X-RS-API-KEY
    • HTTP bearer

Request body

action'actor-lookup' | 'exploit-chatter'

Which lookup to run.

cve_idstring

Required when action is exploit-chatter. Format CVE-YYYY-NNNNN, case-insensitive.

actorstring

Actor or campaign name. Used when action is actor-lookup.

actorsstring[]

Up to 5 actor names, used when actor is not supplied.

Response

Success. ok is true and data holds the result.

oktrue required

Changes

No recorded changes to this operation across all 1 revision of this API.