isMalicious - Threat Intelligence API

Outbound URL filtering for messaging platforms

Inspect URLs in user-submitted content before they reach recipients by calling GET /check/reputation. The agent blocks or warns on URLs whose reputation falls below a threshold, reducing phishing exposure on the platform. The 60 requests per minute Basic tier accommodates moderate-traffic messaging products without needing a custom contract.

Threat hunting via keyword search

Hunt across the isMalicious feed for indicators tied to a specific campaign by calling POST /search with a keyword. The endpoint returns matching domains, IPs, and URLs that the analyst can pivot from. Combines naturally with GET /check/whois to build out attribution chains during an active investigation.

Bulk reputation check for blocklist refresh

Refresh an internal blocklist nightly by sending a curated list of suspect indicators to POST /bulk/check. The endpoint returns reputation, recency, and confidence values that the agent uses to keep only currently active malicious indicators in the blocklist. Reduces false positives compared to time-decayed blocklists that never re-validate older entries.

AI security agent answering analyst chat queries

An AI agent embedded in the SOC chat tool answers analyst questions like 'is this domain malicious' by routing through Jentic to GET /check. Through Jentic the agent searches for 'check threat indicator' and the matching isMalicious operation is loaded with the API key already injected. Reduces context-switching between Slack and the threat intel portal.