Malpedia Caad Fkie Fraunhofer De Malpedia REST API
Community OpenAPI document · agent-readySecurityThreat DetectionapiKey10 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Look up curated malware families, threat actors, samples, and YARA rules from the Fraunhofer FKIE Malpedia corpus by stable identifier or free-text search.
Use for: Look up the Malpedia record for the threat actor APT29, Find all malware families that match the search term emotet, Retrieve the YARA rules for the lockbit family from Malpedia, Check whether a SHA256 hash is catalogued as a known sample
Not supported: Does not handle live malware sandboxing, IP reputation, or domain takedown - use for curated malware family, actor, and YARA reference lookups only.
Malpedia is a curated malware corpus and threat actor knowledge base maintained by Fraunhofer FKIE, and the REST API exposes its catalogue of families, actors, samples, and YARA rules to security researchers and detection engineering teams. Lookups are organised around stable identifiers for malware families and APT groups, with endpoints to list, fetch, and search records, and to retrieve YARA rules associated with a given family. Authentication is via an API token passed in the Authorization header, granted to vetted researchers through the Malpedia portal. The dataset is continuously curated by analysts rather than crowd-sourced, which makes it useful as a normalisation layer for malware naming across other threat intel feeds.
Install Jentic One Beta
Connect the Malpedia REST API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Malpedia REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmalpedia.caad.fkie.fraunhofer.de%2Fmalpedia" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fmalpedia.caad.fkie.fraunhofer.de%2Fmalpedia" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Malpedia REST API.
Resolve a malware family identifier to its curated metadata, aliases, and references
List every threat actor tracked in Malpedia and pull a single actor record by id
Search across actors and families by free-text query to disambiguate naming
Retrieve sample metadata for a given hash to confirm a family attribution
Pull the YARA rules associated with a malware family for detection engineering
Use Cases
Patterns agents use Malpedia REST API for, with concrete tasks.
★ Malware family name normalisation
Security teams ingesting alerts from multiple vendors get conflicting family names for the same threat. Querying Malpedia by free-text search returns the canonical family record and its known aliases, so an analyst or pipeline can rewrite vendor-specific labels onto a single stable identifier before correlation. The corpus is curated by Fraunhofer FKIE analysts, which makes it a defensible source of truth in incident reports.
Search Malpedia for the family alias 'TrickBot' and return the canonical family_id and all known aliases.
YARA rule pull for detection engineering
Detection engineers building or tuning rules need vetted YARA signatures tied to specific malware families. The Malpedia API exposes the YARA rules attached to each family record at /get/yara/{family_id}, returning the rule text in a form that can be loaded into a scanning pipeline. This avoids scraping the Malpedia web UI and keeps the rule set in sync with the curated corpus.
Fetch the YARA rules for win.lockbit from Malpedia and write them to a rules directory for the EDR pipeline.
Threat actor profile enrichment
When triaging a suspected nation-state intrusion, analysts need quick access to a consolidated profile of the attributed actor. The Malpedia actor endpoints return descriptions, known aliases, and references for tracked groups, giving an analyst or agent a citable starting point during incident response. Combine with sample and family lookups to build out the attribution chain.
Retrieve the Malpedia actor record for apt29 and summarise the known aliases and associated families.
Agent-driven threat intel triage
An AI agent reviewing a SOC alert needs to enrich a flagged hash or family name without hand-coded API plumbing. Through Jentic, the agent searches for the right Malpedia operation by intent, loads the input schema, and executes the lookup with its scoped credential. The agent returns the canonical family, actor, and YARA rule references inline in the triage report, with no Malpedia API token in the agent's context.
Given a malware sample hash, call Malpedia via Jentic to identify the family, pull the actor profile, and return the YARA rule text.
Key Endpoints
10 endpoints — malpedia is a curated malware corpus and threat actor knowledge base maintained by fraunhofer fkie, and the rest api exposes its catalogue of families, actors, samples, and yara rules to security researchers and detection engineering teams.
METHOD
PATH
DESCRIPTION
GET
/list/actors
List all tracked threat actors
GET
/get/actor/{actor_id}
Get a single actor record
GET
/list/families
List all malware families
GET
/get/family/{family_id}
Get a family record by id
GET
/get/yara/{family_id}
Get YARA rules for a family
GET
/find/family/{search}
Search families by free text
GET
/find/actor/{search}
Search actors by free text
GET
/get/sample/{hash}
Look up a sample by hash
GET
/list/actors
List all tracked threat actors
GET
/get/actor/{actor_id}
Get a single actor record
GET
/list/families
List all malware families
GET
/get/family/{family_id}
Get a family record by id
GET
/get/yara/{family_id}
Get YARA rules for a family
GET
/find/family/{search}
Search families by free text
GET
/find/actor/{search}
Search actors by free text
GET
/get/sample/{hash}
Look up a sample by hash
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Malpedia by hand means handling its Authorization header API key, learning the /list, /get, and /find path conventions, and parsing each response yourself. Through Jentic you install once, import the Malpedia REST API from the API Directory, store the researcher token once, and your agent calls it.
Permission scoping
The Malpedia endpoints in this spec are read-only reference lookups, so scoping is by operation: you limit the agent to the operations it needs, such as looking up a malware family or actor and fetching YARA rules, and leave out anything you do not want it calling. Every operation you allow is one you have chosen, so the agent stays inside that set.
Credential isolation
Your Malpedia token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'look up a malware family' or 'find an actor by name', and Jentic returns the matching Malpedia operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Malpedia REST API through Jentic.
What authentication does the Malpedia REST API use?
Malpedia uses an API token passed in the Authorization header (apiKeyAuth). Tokens are issued by Fraunhofer FKIE to vetted researchers through the Malpedia portal. Through Jentic, the token is stored in the encrypted vault and scoped to the calling agent, so the raw key never enters the agent's context.
Can I pull YARA rules for a specific malware family with the Malpedia REST API?
Yes. The GET /get/yara/{family_id} endpoint returns the YARA rules attached to a curated family record. Resolve the family_id first via /find/family/{search} or /list/families, then call the YARA endpoint with that identifier to retrieve the rule text.
What are the rate limits for the Malpedia REST API?
Malpedia does not publish hard rate limits in the spec. Fraunhofer FKIE asks researchers to use the API responsibly and avoid scripted bulk scraping; sustained high-volume traffic can lead to token revocation. For corpus-wide pulls, prefer the official dump links offered to vetted accounts.
How do I search for a malware family by name through Jentic?
Run pip install jentic, then search Jentic with the query 'look up a malware family in malpedia'. Jentic returns the GET /find/family/{search} operation, you load its schema, and execute with the family alias as the search parameter to get the canonical record.
Is the Malpedia REST API free to use?
Malpedia access is free for vetted security researchers; there is no paid tier. Tokens are granted manually after a sign-up review, so it is not a self-service API. The corpus itself is curated by Fraunhofer FKIE and is not crowd-sourced.
Can the Malpedia REST API resolve a sample hash to a malware family?
Yes, when the sample is in the corpus. GET /get/sample/{hash} returns the sample record, which includes the family identifier. If the hash is not catalogued, the endpoint returns no match - Malpedia is curated rather than exhaustive, so unknown samples should be cross-checked against other feeds.
Can I limit what my agent is allowed to do with the Malpedia REST API?
Yes. Because you run Jentic One yourself, you decide which Malpedia operations your agent may call, and it can only use the ones you allow. Since every Malpedia endpoint is a read-only reference lookup, you scope by operation: you can permit family lookups (/get/family/{family_id}, /find/family/{search}), actor lookups (/get/actor/{actor_id}, /find/actor/{search}), YARA rule fetches (/get/yara/{family_id}), or sample-by-hash checks, and leave out anything you do not want it touching. Your researcher token is held by your own instance and injected only at execution time, so the agent never sees the raw credential.
GET STARTED