{"title":"DugganUSA STIX Feed API","version":"2.1","description":"Enterprise threat intelligence feed. Behavioral scoring, precursor signals, supply chain detection.","authentication":{"required":"Grace period active — anonymous access serves degraded feed (48h stale, 1/day). Full auth enforced March 15, 2026.","methods":{"bearer_header":"Authorization: Bearer YOUR_API_KEY","query_param":"?api_key=YOUR_API_KEY (for SIEMs that cannot set custom headers — Splunk ES, QRadar, etc.)"},"register":"https://analytics.dugganusa.com/stix/register","pricing":"https://analytics.dugganusa.com/stix/pricing","grace_period":{"active":true,"expires":"2026-03-15T00:00:00Z","limitations":"Anonymous requests receive 48-hour stale data, limited to 1 request/day per IP","action":"Register for a free API key NOW to ensure uninterrupted access after March 15"}},"tiers":{"free":{"limit":"1/day","price":"$0","features":["STIX 2.1","CSV exports","7-day lookback"]},"pro":{"limit":"5,000/day","price":"$4,999/mo","features":["30-day lookback","Behavioral scoring","Precursor signals"]},"enterprise":{"limit":"50,000/day","price":"$19,999/mo","features":["90-day lookback","GitHub IOCs","Dedicated support"]},"custom":{"limit":"Unlimited","price":"$49,999+/mo","features":["SLA","White-label","Account manager"]}},"endpoints":{"stix_formats":{"/api/v1/stix-feed":{"method":"GET","description":"Full STIX 2.1 bundle with all indicators","auth":"Required (March 15, 2026)","params":["days","min_confidence","country","exclude_residential","since","minimal","limit","offset","format","api_key"],"formats":{"bundle":"Default — STIX 2.1 bundle with indicator objects (pattern syntax)","splunk":"Splunk ES compatible — uses observed-data objects instead of indicator.pattern","csv":"CSV export","simple":"Simplified JSON","indicators":"Raw indicators array"},"splunk_es_setup":{"url":"https://analytics.dugganusa.com/api/v1/stix-feed?format=splunk&api_key=YOUR_KEY","file_parser":"stix2","type":"stix","interval":86400,"note":"Use ?api_key= query param — Splunk ES cannot set custom Authorization headers"}},"/api/v1/stix-feed/v2":{"method":"GET","description":"STIX 2.1 with proper SCO→Indicator→Relationship hierarchy","auth":"Required (March 15, 2026)","params":["days","min_confidence","country","limit"]}},"csv_exports":{"/api/v1/stix-feed/ips.csv":{"method":"GET","description":"CSV of malicious IPs for firewall rules","auth":"Required (March 15, 2026)","params":["days","min_confidence"]},"/api/v1/stix-feed/domains.csv":{"method":"GET","description":"CSV of malicious domains for DNS blocklists","auth":"Required (March 15, 2026)","params":["days"]},"/api/v1/stix-feed/urls.csv":{"method":"GET","description":"CSV of malicious URLs for proxy rules","auth":"Required (March 15, 2026)","params":["days"]},"/api/v1/stix-feed/hashes.csv":{"method":"GET","description":"CSV of malware file hashes for EDR","auth":"Required (March 15, 2026)","params":["days"]}},"taxii":{"/api/v1/stix-feed/manifest.json":{"method":"GET","description":"TAXII 2.1 discovery manifest","auth":"None"},"/api/v1/stix-feed/collections":{"method":"GET","description":"TAXII 2.1 collections list","auth":"None"}},"metadata":{"/api/v1/stix-feed/info":{"method":"GET","description":"Feed information and statistics","auth":"None"},"/api/v1/stix-feed/analytics":{"method":"GET","description":"Feed usage analytics","auth":"None"},"/api/v1/stix-feed/schema":{"method":"GET","description":"STIX schema documentation","auth":"None"},"/api/v1/stix-feed/help":{"method":"GET","description":"This endpoint - API documentation","auth":"None"}}},"examples":{"With API key (recommended)":"curl -H \"Authorization: Bearer YOUR_KEY\" https://analytics.dugganusa.com/api/v1/stix-feed","Get last 7 days high-confidence IPs":"curl -H \"Authorization: Bearer YOUR_KEY\" https://analytics.dugganusa.com/api/v1/stix-feed/ips.csv?days=7&min_confidence=80","Get delta updates since timestamp":"curl -H \"Authorization: Bearer YOUR_KEY\" https://analytics.dugganusa.com/api/v1/stix-feed?since=2026-01-01T00:00:00Z","Get minimal bundle (smaller payload)":"curl -H \"Authorization: Bearer YOUR_KEY\" https://analytics.dugganusa.com/api/v1/stix-feed?minimal=true"},"trusted_by":["Microsoft","Google","Amazon AWS","SinoPac Holdings","PT Telkom Indonesia","BT UK"],"contact":"butterbot@dugganusa.com","documentation":"https://analytics.dugganusa.com/stix/pricing"}