Direct Security Integrations
Connect isMalicious to your existing security stack
Native connectors for OpenCTI and Cortex, STIX/TAXII feeds for Sentinel and MISP, dashboard destinations for Splunk, Elastic, Slack, and Teams, plus firewall blocklists, a ChatGPT GPT, and an n8n community node.
TIP and incident response
Install isMalicious where analysts already enrich observables.
OpenCTI
Native enrichment connector for the OpenCTI threat intelligence platform
- IPv4, IPv6, and Domain enrichment
- Risk score with threat labels
- Listed on Filigran Hub
- Docker deployment ready
Cortex / TheHive
Official analyzer for Cortex SOAR and TheHive incident response
- IP, domain, and FQDN analysis
- Risk scoring with taxonomies
- TheHive case enrichment
- Official Cortex-Analyzers repo
IntelOwl
Observable analyzer that adds isMalicious scores to IntelOwl playbooks
- IPv4, IPv6, domain, and URL analysis
- Drop-in analyzer module
- Playbook compatible
- Same /check API as Cortex
Feeds
STIX/TAXII 2.1 collections. Sentinel and MISP consume the feed — they do not need a custom IsMalicious app.
STIX/TAXII 2.1
Standard TAXII collections for TIPs, SIEMs, and custom clients
- Discovery at api.ismalicious.com/taxii2/
- IPs, domains, URLs, hashes, C2
- Basic Auth or X-API-KEY
- Works with any TAXII 2.1 client
Microsoft Sentinel
Ingest isMalicious indicators through Sentinel’s built-in TAXII connector
- Content Hub Threat Intelligence solution
- TAXII 2.1 API root and collection IDs
- Score-filter before auto-block
- Optional Log Analytics destination
MISP
Pull TAXII collections into MISP now; native expansion module for live lookups
- TAXII 2.1 server ingest
- Expansion and hover module
- IP, domain, hostname, URL
- Score, categories, sources
SIEM and chat destinations
Configure from the dashboard. These are outbound destinations, not Splunkbase or Elastic Fleet apps.
Splunk HEC
Push IOCs and SOC events to Splunk through HTTP Event Collector
- Configure in the dashboard
- IOC sync plus event delivery
- Pro plan
- Not a Splunkbase app
Elastic
Index IOCs and SOC events with the Elastic Bulk API
- Configure in the dashboard
- NDJSON bulk ingest
- Pro plan
- Custom index and pipeline
Sentinel Log Analytics
Push normalized telemetry to a Log Analytics table for Sentinel hunts
- Configure in the dashboard
- Workspace ID and shared key
- Pro plan
- Use TAXII for indicator ingest
Slack
Post threat, monitor, and CVE alerts to a Slack channel
- Incoming webhook
- Event-only (no bulk IOC sync)
- Basic plan
- Configure in the dashboard
Microsoft Teams
Post SOC alerts as Adaptive Cards to a Teams channel
- Workflow webhook
- Event-only (no bulk IOC sync)
- Basic plan
- Configure in the dashboard
Firewall Integrations
Protect your network infrastructure by integrating our blocklists directly into your firewall.
iptables
Native Linux firewall integration using ipset for high-performance blocking.
- 1Download the blocklist using curl
- 2Load IPs into an ipset for efficiency
- 3Add iptables rule to drop traffic matching the set
- 4Persist rules using iptables-save
pfSense
Automated threat blocking via pfBlockerNG package integration.
- 1Install pfBlockerNG package
- 2Add new IPv4 Alias with Auto format
- 3Paste isMalicious blocklist URL
- 4Set Action to "Deny Both"
FortiGate
Enterprise firewall integration via External Threat Feed connector for FortiOS 7.x.
- 1Create External Resource in Security Fabric
- 2Select "IP Address" or "Domain Name" type
- 3Configure refresh rate (1440 min)
- 4Apply to firewall policy or DNS filter
Palo Alto
PAN-OS External Dynamic List (EDL) for IP and domain blocklists, refreshed on a daily schedule.
- 1Create an External Dynamic List of type IP List or Domain List
- 2Paste the isMalicious blocklist URL as the source
- 3Set recurring refresh to Daily at 04:00
- 4Attach the EDL to a security policy as source or destination
AI and automation
Lookups in ChatGPT, an n8n community node, and HTTPS webhooks.
ChatGPT GPT
Look up IPs, domains, hashes, and emails from ChatGPT without leaving chat
- Live /check lookups
- Free daily quota
- Optional API key for higher limits
- Ransomware search
n8n
Community node that looks up an IP, domain, or URL from an n8n workflow
- Check IOC node
- n8n-nodes-ismalicious
- No extra runtime deps
- Same /check API as Cortex
Webhooks
Receive eight platform events on an HTTPS endpoint you control
- threat.detected, monitor.alert, report.created
- CVE findings, cases, dataset freshness
- Signed deliveries (whsec_*)
- Pro plan
Build Your Own Integration
Use the REST API and the official TypeScript SDK (@ismalicious/sdk). Python, Go, and Rust clients are not published yet — call /check with X-API-KEY, or generate a client from OpenAPI.
Integration Use Cases
How security teams use isMalicious integrations
SOC Alert Enrichment
Automatically enrich security alerts with threat context and risk scores for faster triage.
Automated Threat Hunting
Integrate threat intelligence into hunting workflows for proactive threat detection.
Incident Response
Accelerate investigations with instant IOC enrichment during incident response.
Custom Integrations
Build custom integrations using the REST API and the TypeScript SDK.
Frequently Asked Questions
Do I need a paid plan to use integrations?
How do I get an API key?
Is the Cortex analyzer officially supported?
How do I deploy the OpenCTI connector?
Can I request a new integration?
What data types are supported?
How fresh is the threat intelligence data?
Ready to Integrate?
Get started with isMalicious integrations in minutes. Free tier available for development and testing.