Malpedia Caad Fkie Fraunhofer De Malpedia REST API

Name: Malpedia REST API
Brand: Malpedia REST API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey10 EndpointsREST

For Agents

Look up curated malware families, threat actors, samples, and YARA rules from the Fraunhofer FKIE Malpedia corpus by stable identifier or free-text search.

Install Jentic One Beta

Connect the Malpedia REST API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Malpedia REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Malpedia REST API.

Resolve a malware family identifier to its curated metadata, aliases, and references

List every threat actor tracked in Malpedia and pull a single actor record by id

Search across actors and families by free-text query to disambiguate naming

GET STARTED

Start building with Malpedia REST API

Explore with Jentic

View OpenAPI Document

Malpedia is a curated malware corpus and threat actor knowledge base maintained by Fraunhofer FKIE, and the REST API exposes its catalogue of families, actors, samples, and YARA rules to security researchers and detection engineering teams. Lookups are organised around stable identifiers for malware families and APT groups, with endpoints to list, fetch, and search records, and to retrieve YARA rules associated with a given family. Authentication is via an API token passed in the Authorization header, granted to vetted researchers through the Malpedia portal. The dataset is continuously curated by analysts rather than crowd-sourced, which makes it useful as a normalisation layer for malware naming across other threat intel feeds.

Use Cases

Patterns agents use Malpedia REST API for, with concrete tasks.

★ Malware family name normalisation

Security teams ingesting alerts from multiple vendors get conflicting family names for the same threat. Querying Malpedia by free-text search returns the canonical family record and its known aliases, so an analyst or pipeline can rewrite vendor-specific labels onto a single stable identifier before correlation. The corpus is curated by Fraunhofer FKIE analysts, which makes it a defensible source of truth in incident reports.

Search Malpedia for the family alias 'TrickBot' and return the canonical family_id and all known aliases.

YARA rule pull for detection engineering

Detection engineers building or tuning rules need vetted YARA signatures tied to specific malware families. The Malpedia API exposes the YARA rules attached to each family record at /get/yara/{family_id}, returning the rule text in a form that can be loaded into a scanning pipeline. This avoids scraping the Malpedia web UI and keeps the rule set in sync with the curated corpus.

Fetch the YARA rules for win.lockbit from Malpedia and write them to a rules directory for the EDR pipeline.

Threat actor profile enrichment

When triaging a suspected nation-state intrusion, analysts need quick access to a consolidated profile of the attributed actor. The Malpedia actor endpoints return descriptions, known aliases, and references for tracked groups, giving an analyst or agent a citable starting point during incident response. Combine with sample and family lookups to build out the attribution chain.

Retrieve the Malpedia actor record for apt29 and summarise the known aliases and associated families.

Agent-driven threat intel triage

An AI agent reviewing a SOC alert needs to enrich a flagged hash or family name without hand-coded API plumbing. Through Jentic, the agent searches for the right Malpedia operation by intent, loads the input schema, and executes the lookup with its scoped credential. The agent returns the canonical family, actor, and YARA rule references inline in the triage report, with no Malpedia API token in the agent's context.

Given a malware sample hash, call Malpedia via Jentic to identify the family, pull the actor profile, and return the YARA rule text.

Key Endpoints

10 endpoints — malpedia is a curated malware corpus and threat actor knowledge base maintained by fraunhofer fkie, and the rest api exposes its catalogue of families, actors, samples, and yara rules to security researchers and detection engineering teams.

METHOD

PATH

DESCRIPTION

GET

/list/actors

List all tracked threat actors

GET

/get/actor/{actor_id}

Get a single actor record

GET

/list/families

List all malware families

GET

/get/family/{family_id}

Get a family record by id

GET

/get/yara/{family_id}

Get YARA rules for a family

GET

/find/family/{search}

Search families by free text

GET

/find/actor/{search}

Search actors by free text

GET

/get/sample/{hash}

Look up a sample by hash

GET

/list/actors

List all tracked threat actors

GET

/get/actor/{actor_id}

Get a single actor record

GET

/list/families

List all malware families

GET

/get/family/{family_id}

Get a family record by id

GET

/get/yara/{family_id}

Get YARA rules for a family

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Malpedia API tokens are stored encrypted in the Jentic vault. The agent receives a scoped session, never the raw Authorization header value, so the researcher token cannot be exfiltrated through prompt content.

Intent-based discovery

Agents search Jentic by intent (e.g. 'look up a malware family') and Jentic returns the matching Malpedia operation with its input schema, removing the need to read the Malpedia docs to find the right endpoint.

Time to first call

Direct Malpedia integration: half a day for token handling, retry logic, and response normalisation. Through Jentic: under 30 minutes — search, load schema, execute.

FAQs

Specific to using Malpedia REST API through Jentic.

What authentication does the Malpedia REST API use?

Malpedia uses an API token passed in the Authorization header (apiKeyAuth). Tokens are issued by Fraunhofer FKIE to vetted researchers through the Malpedia portal. Through Jentic, the token is stored in the encrypted vault and scoped to the calling agent, so the raw key never enters the agent's context.

Can I pull YARA rules for a specific malware family with the Malpedia REST API?

Yes. The GET /get/yara/{family_id} endpoint returns the YARA rules attached to a curated family record. Resolve the family_id first via /find/family/{search} or /list/families, then call the YARA endpoint with that identifier to retrieve the rule text.

What are the rate limits for the Malpedia REST API?

Malpedia does not publish hard rate limits in the spec. Fraunhofer FKIE asks researchers to use the API responsibly and avoid scripted bulk scraping; sustained high-volume traffic can lead to token revocation. For corpus-wide pulls, prefer the official dump links offered to vetted accounts.

How do I search for a malware family by name through Jentic?

Run pip install jentic, then search Jentic with the query 'look up a malware family in malpedia'. Jentic returns the GET /find/family/{search} operation, you load its schema, and execute with the family alias as the search parameter to get the canonical record.

Is the Malpedia REST API free to use?

Malpedia access is free for vetted security researchers; there is no paid tier. Tokens are granted manually after a sign-up review, so it is not a self-service API. The corpus itself is curated by Fraunhofer FKIE and is not crowd-sourced.

Can the Malpedia REST API resolve a sample hash to a malware family?

Yes, when the sample is in the corpus. GET /get/sample/{hash} returns the sample record, which includes the family identifier. If the hash is not catalogued, the endpoint returns no match — Malpedia is curated rather than exhaustive, so unknown samples should be cross-checked against other feeds.