2018-01-09 19:58:44 +00:00
# security-apis
A collective list of public JSON APIs for use in security. https://alexanderjaeger.de
2018-03-19 10:27:10 +00:00
Learn about REST: https://github.com/marmelab/awesome-rest
2018-01-09 20:05:48 +00:00
2018-01-09 20:25:28 +00:00
# Index
* [Online ](#online )
2018-01-09 20:25:51 +00:00
* [Tools ](#tools )
2018-01-09 21:05:50 +00:00
* [SIEM ](#siem )
2018-01-09 20:05:48 +00:00
* [Various ](#various )
2018-01-09 20:25:28 +00:00
## Online
2018-01-09 20:49:07 +00:00
API | Description | Auth | HTTPS | Link | Free / Commercial|
|---|---|---|---|---|---|
2018-01-14 15:55:41 +00:00
| Apility.IO API | Threat Intelligence Anti-Abuse API | `apiKey` | Yes | [Link! ](https://apidocs.apility.io/ ) |Free|
2018-01-09 20:49:07 +00:00
| Alexa | Alexa Top Sites | `apiKey` | Yes | [Link! ](https://docs.aws.amazon.com/AlexaTopSites/latest/ ) |?|
2018-01-12 14:40:38 +00:00
| Bluecoat Site Review | URL Analysis | `none` | Yes | [Link! ](https://sitereview.bluecoat.com/sitereview.jsp ) |Free|
2018-01-14 15:55:41 +00:00
| bgpmon.net | Bgp monitoring | `?` | Yes | [Link! ](https://bgpmon.net/bgpmon-web-services-api/ ) |?|
2018-01-12 14:40:38 +00:00
| censys.io | Free for Researchers Threat Intel | `apiKey` | Yes | [Link! ](https://censys.io/api ) |?|
2018-01-09 20:49:07 +00:00
| Certly | Certly Guard | `apiKey` | Yes | [Link! ](https://guard.certly.io/ ) |?|
2018-01-14 16:48:22 +00:00
| CIRCL CVE Search | CVE Search | `none` | Yes | [Link! ](https://cve.circl.lu/api/ ) |Free|
2018-01-14 15:55:41 +00:00
| Cloidsploit | Vuln Scanner | `apiKey` | Yes | [Link! ](https://cloudsploit.com/api ) |Free|
2018-01-14 15:56:30 +00:00
| CrowdStrike API | TI | `apiKey` | Yes | [Link! ](https://www.crowdstrike.com/blog/tech-center/get-access-crowdstrike-apis/ ) |NO|
2018-01-09 20:49:07 +00:00
| Cymon.io | Open Threat Intel | `apiKey` | Yes | [Link! ](https://guard.certly.io/ ) |?|
2018-01-14 15:55:41 +00:00
| Cybergreen | How clean is a network | `apiKey` | Yes | [Link! ](http://stats.cybergreen.net/download/ ) |?|
| DDosMon | DDos Monitoring | `apiKey` | Yes | [Link! ](https://api.ddosmon.net/docs/ ) |?|
2018-01-14 15:59:41 +00:00
| Domaintools | Commercial Threat Intel | `apiKey` | Yes | [Link! ](https://www.domaintools.com/products/api-integration/ ) |Commercial|
2018-01-12 14:40:38 +00:00
| DShield | Internet Storm Center API | `apiKey` | Yes | [Link! ](https://www.dshield.org/api/ ) |Free|
| emergingthreats.net | Domain / IP intelligence and reputation | `apiKey` | Yes | [Link! ](http://apidocs.emergingthreats.net/ ) |?|
| Farsight DNSDB Passive DNS | Passive DNS and more | `apiKey` | Yes | [Link! ](https://api.dnsdb.info/ ) |?|
2018-01-14 15:59:41 +00:00
| Fireeye iSight | Commercial Threat Intel | `apiKey` | Yes | [Link! ](https://docs.fireeye.com/iSight/index.html#/ ) |Commercial|
2018-01-12 14:40:38 +00:00
| FIRST.org | Incident Response Teams API | `none` | Yes | [Link! ](https://api.first.org/ ) |?|
2018-01-14 15:55:41 +00:00
| Flashpoint Intel | Threat Intel | `apiKey` | Yes | [Link! ](https://www.flashpoint-intel.com/api/ ) |?|
| Flexera | Vuln Management | `apiKey` | Yes | [Link! ](http://helpnet.flexerasoftware.com/svm/api/Default.htm ) |?|
| HackerOne | Query HackerOne reports | `apiKey` | Yes | [Link! ](https://api.hackerone.com/docs/v1 ) |?|
2018-01-14 15:56:30 +00:00
| have i been pwned | - | `apiKey` | Yes | [Link! ](https://haveibeenpwned.com/API/v2 ) |?|
2018-01-13 17:32:08 +00:00
| Hybrid Analysis | Online Sandbox | `none` | Yes | [Link! ](https://www.hybrid-analysis.com/apikeys/info ) |Free|
2018-01-12 14:40:38 +00:00
| Malwr.com | Malware analysis | `apiKey` | Yes | [Link! ](https://malwr.com/ ) |?|
2018-01-09 20:49:07 +00:00
| MAlshare | Malware Sharing | `apiKey` | Yes | [Link! ](https://malshare.com/doc.php ) |?|
| Mac Vendor Lookup | Threat Intel | `apiKey` | Yes | [Link! ](https://macvendors.com/api ) |?|
| MaxMind | GeoIP and More | `apiKey` | Yes | [Link! ](https://dev.maxmind.com/ ) |?|
2018-01-14 15:55:41 +00:00
| NeutrinoAPI | IP Blocklist API | `apiKey` | Yes | [Link! ](https://www.neutrinoapi.com/api/ip-blocklist/ ) |?|
2018-01-09 20:54:24 +00:00
| Passive Total | Threat Intel | `apiKey` | Yes | [Link! ](https://api.passivetotal.org/api/docs/ ) |?|
2018-01-13 18:01:49 +00:00
| Pastebin | | `apiKey` | Yes | [Link! ](https://pastebin.com/api ) |?|
2018-01-12 14:40:38 +00:00
| Qualys SSLLabs | Test SSL and more | `apiKey` | Yes | [Link! ](https://www.ssllabs.com/projects/ssllabs-apis/ ) |?|
2018-01-09 21:11:49 +00:00
| Spamhaus | Domain / IP intelligence and reputation | `?` | Yes | [Link! ](https://www.spamhaus.org/zen/ ) |?|
2018-01-14 15:55:41 +00:00
| Tenable | ? | `?` | Yes | [Link! ](https://cloud.tenable.com/api#/overview ) |?|
2018-01-12 14:40:38 +00:00
| Team Cymru | Threat Intel | `apiKey` | Yes | [Link! ](http://www.team-cymru.org/services.html ) |Both|
| VirusTotal | VirusTotal File/URL Analysis | `apiKey` | Yes | [Link! ](https://www.virustotal.com/en/documentation/public-api/ ) |?|
2018-04-10 14:09:41 +00:00
| vulners | vulners Vuln Database | `apiKey` | Yes | [Link! ](https://vulners.com/docs ) |?|
2018-01-12 14:35:50 +00:00
| Zoomeye | CVE Search | `apiKey` | Yes | [Link! ](https://www.zoomeye.org/api ) |?|
2018-01-11 20:12:25 +00:00
2018-01-09 20:25:28 +00:00
## Tools
2018-01-09 20:49:07 +00:00
API | Description | Auth | HTTPS | Link | Free / Commercial|
|---|---|---|---|---|---|
2018-01-12 14:40:38 +00:00
| Carbon Black | Endpoint Security | `apiKey` | Yes | [Link! ](https://github.com/carbonblack/cbapi ) |Commercial|
2018-01-09 21:05:50 +00:00
| Cuckoo | Cuckoo Sandbox | `apiKey` | Yes | [Link! ](https://malwr.com/ ) |OpenSource|
2018-01-12 14:40:38 +00:00
| CRITS | TI System | `apiKey` | Yes | [Link! ](https://github.com/crits/crits/wiki/Authenticated-API ) |?|
2018-01-13 17:32:08 +00:00
| CrowdStrike falcon-orchestrator | Orchestrator | `apiKey` | Yes | [Link! ](https://github.com/CrowdStrike/falcon-orchestrator/wiki/Installation-&-Deployment ) |yes|
2018-01-09 20:49:07 +00:00
| Cymetria Maze Runner | - | `apiKey` | Yes | [Link! ](https://community.cymmetria.com/api/sdk.pdf ) |?|
2018-01-09 20:54:24 +00:00
| FireEye | Endpoint Security | `apiKey` | Yes | [Link! ](https://docs.fireeye.com/ ) |?|
2018-01-12 14:40:38 +00:00
| GRR | Endpoint Incident Response tool | `apiKey` | Yes | [Link! ](http://grr-doc.readthedocs.io/en/v3.2.0/investigating-with-grr/automation-with-api.html ) |OpenSource|
2018-02-18 18:47:53 +00:00
| Kolide Fleet | osQuery fleet management | `?` | Yes | [Link! ](https://github.com/kolide/fleet/blob/master/docs/api/README.md ) |OpenSource|
2018-01-09 21:05:50 +00:00
| MISP | Open Source Threat Intelligence Platform | `apiKey` | Yes | [Link! ](https://www.circl.lu/doc/misp/automation/ ) |OpenSource|
2018-01-13 17:34:32 +00:00
| Metadefender | MultiAV | `apiKey` | Yes | [Link! ](https://www.opswat.com/products/metadefender/developers/apis ) |Commercial|
2018-01-14 15:55:41 +00:00
| Metasploit | Exploiting | `apiKey` | Yes | [Link! ](http://rapid7.github.io/metasploit-framework/api/ ) |Commercial|
2018-01-09 20:51:24 +00:00
| OTRS | Open Ticket Relay System | `apiKey` | Yes | [Link! ](https://doc.otrs.com/doc/api/otrs/6.0/Perl/index.html ) |?|
2018-01-13 18:01:49 +00:00
| Plaso | Plaso Langar Að Safna Öllu | `apiKey` | Yes | [Link! ](https://readthedocs.org/projects/plaso-api/ ) |OpenSource|
2018-01-12 14:40:38 +00:00
| Recorded Future | Threat Intelligence Platform | `apiKey` | Yes | [Link! ](https://www.circl.lu/doc/misp/automation/ ) |?|
2018-01-13 17:50:55 +00:00
| Request Tracker | Ticketing System | `apiKey` | Yes | [Link! ](https://rt-wiki.bestpractical.com/wiki/REST ) |?|
| Scot | SCOT - Sandia Cyber Omni Tracker Ticketing System | `apiKey` | Yes | [Link! ](http://scot.readthedocs.io/en/latest/devguide.html#scot-rest-api ) |Free|
2018-01-15 10:52:15 +00:00
| TheHive | Security Incident Response Platform | `apiKey` | Yes | [Link! ](https://blog.thehive-project.org/tag/api/ ) |Free|
2018-01-12 14:40:38 +00:00
| Viper.li | Viper malware repository API | `None` | No | [Link! ](http://viper-framework.readthedocs.io/en/latest/usage/web.html ) |OpenSource|
| VMRay | VMRay Sandbox | `apiKey` | Yes | [Link! ](https://www.vmray.com/blog/v-1-9-api-now-restjson/ ) |?|
2018-01-09 21:05:50 +00:00
## SIEM
2018-01-09 20:59:08 +00:00
API | Description | Auth | HTTPS | Link | Free / Commercial|
|---|---|---|---|---|---|
| ArcSight | HP ArcSight API | `None` | No | [Link! ](https://h41382.www4.hpe.com/gfs-shared/downloads-273.pdf ) |Commercial|
2018-01-09 21:05:50 +00:00
| ELK | ELK Stack API | `None` | No | [Link! ](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs.html ) |OpenSource|
2018-01-12 14:40:38 +00:00
| QRadar | IBM QRadar API | `None` | No | [Link! ](https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc_cloud/c_rest_api_getting_started.html ) |Commercial|
| Splunk | Splunk API | `None` | No | [Link! ](http://dev.splunk.com/restapi ) |Commercial|
2018-01-09 20:59:08 +00:00
2018-01-09 20:05:48 +00:00
### Various
2018-01-09 20:49:07 +00:00
API | Description | Auth | HTTPS | Link |Free / Commercial|
|---|---|---|---|---|---|
| AlienVault Open Threat Exchange (OTX) | IP/domain/URL reputation | `apiKey` | Yes | [Link! ](https://otx.alienvault.com/api/ ) |?|
| Certly | Certly Link/Domain Flagging | `apiKey` | Yes | [Link! ](https://guard.certly.io/ ) |?|
2018-01-13 17:32:08 +00:00
| Cisco ISE | ISE is an identity and access control policy platform | `apiKey` | Yes | [Link! ](https://www.cisco.com/c/en/us/support/security/identity-services-engine/products-command-reference-list.html ) |?|
| Cisco PXGrid | Cisco Platform Exchange Grid | `apiKey` | Yes | [Link! ](https://developer.cisco.com/site/pxgrid/ ) |?|
| Cisco Security APIs | Cisco Developer Page | `` | ? | [Link! ](https://developer.cisco.com/site/security/ ) |?|
| Cisco Umbrella | Cisco Umbrella Enforcement API | `apiKey` | Yes | [Link! ](https://docs.umbrella.com/developer/enforcement-api/ ) |?|
2018-01-13 17:39:12 +00:00
| Cyphon | Open Source INcident Management tool | `apiKey` | Yes | [Link! ](http://cyphon.readthedocs.io/en/latest/api.html ) |?|
2018-01-09 20:49:07 +00:00
| Google Safe Browsing | Google Link/Domain Flagging | `apiKey` | Yes | [Link! ](https://developers.google.com/safe-browsing/ ) |?|
| Metacert | Metacert Link Flagging | `apiKey` | Yes | [Link! ](https://metacert.com/ ) |?|
2018-01-13 18:01:49 +00:00
| National Software Reference Library (NSRL) | - | `apiKey` | Yes | [Link! ](https://github.com/bsi-group/nsrls ) |?|
2018-01-13 17:32:08 +00:00
| RSA Secure ID | Metacert Link Flagging | `apiKey` | Yes | [Link! ]( https://community.rsa.com/docs/DOC-75741 ) |?|
2018-01-09 20:49:07 +00:00
| Web Of Trust (WOT) | Website reputation | `apiKey` | Yes | [Link! ](https://www.mywot.com/wiki/API ) |?|