canonical: https://jentic.com/apis/malpedia.caad.fkie.fraunhofer.de/malpedia # Malpedia Caad Fkie Fraunhofer De Malpedia REST API Malpedia is a curated malware corpus and threat actor knowledge base maintained by Fraunhofer FKIE, and the REST API exposes its catalogue of families, actors, samples, and YARA rules to security researchers and detection engineering teams. Lookups are organised around stable identifiers for malware families and APT groups, with endpoints to list, fetch, and search records, and to retrieve YARA rules associated with a given family. Authentication is via an API token passed in the Authorization header, granted to vetted researchers through the Malpedia portal. The dataset is continuously curated by analysts rather than crowd-sourced, which makes it useful as a normalisation layer for malware naming across other threat intel feeds. ## For AI agents Look up curated malware families, threat actors, samples, and YARA rules from the Fraunhofer FKIE Malpedia corpus by stable identifier or free-text search. ## Scope Does not handle live malware sandboxing, IP reputation, or domain takedown - use for curated malware family, actor, and YARA reference lookups only. ## Capabilities - Resolve a malware family identifier to its curated metadata, aliases, and references - List every threat actor tracked in Malpedia and pull a single actor record by id - Search across actors and families by free-text query to disambiguate naming - Retrieve sample metadata for a given hash to confirm a family attribution - Pull the YARA rules associated with a malware family for detection engineering ## Use cases ### Malware family name normalisation Security teams ingesting alerts from multiple vendors get conflicting family names for the same threat. Querying Malpedia by free-text search returns the canonical family record and its known aliases, so an analyst or pipeline can rewrite vendor-specific labels onto a single stable identifier before correlation. The corpus is curated by Fraunhofer FKIE analysts, which makes it a defensible source of truth in incident reports. Example prompt: Search Malpedia for the family alias 'TrickBot' and return the canonical family_id and all known aliases. ### YARA rule pull for detection engineering Detection engineers building or tuning rules need vetted YARA signatures tied to specific malware families. The Malpedia API exposes the YARA rules attached to each family record at `/get/yara/{family_id}`, returning the rule text in a form that can be loaded into a scanning pipeline. This avoids scraping the Malpedia web UI and keeps the rule set in sync with the curated corpus. Example prompt: Fetch the YARA rules for win.lockbit from Malpedia and write them to a rules directory for the EDR pipeline. ### Threat actor profile enrichment When triaging a suspected nation-state intrusion, analysts need quick access to a consolidated profile of the attributed actor. The Malpedia actor endpoints return descriptions, known aliases, and references for tracked groups, giving an analyst or agent a citable starting point during incident response. Combine with sample and family lookups to build out the attribution chain. Example prompt: Retrieve the Malpedia actor record for apt29 and summarise the known aliases and associated families. ### Agent-driven threat intel triage An AI agent reviewing a SOC alert needs to enrich a flagged hash or family name without hand-coded API plumbing. Through Jentic, the agent searches for the right Malpedia operation by intent, loads the input schema, and executes the lookup with its scoped credential. The agent returns the canonical family, actor, and YARA rule references inline in the triage report, with no Malpedia API token in the agent's context. Example prompt: Given a malware sample hash, call Malpedia via Jentic to identify the family, pull the actor profile, and return the YARA rule text. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/list/actors` | List all tracked threat actors | | GET | `/get/actor/{actor_id}` | Get a single actor record | | GET | `/list/families` | List all malware families | | GET | `/get/family/{family_id}` | Get a family record by id | | GET | `/get/yara/{family_id}` | Get YARA rules for a family | | GET | `/find/family/{search}` | Search families by free text | | GET | `/find/actor/{search}` | Search actors by free text | | GET | `/get/sample/{hash}` | Look up a sample by hash | ## Key resources - **Actors** — Tracked threat actors and APT groups with descriptions, aliases, and references - **Families** — Curated malware families with canonical identifiers and metadata - **Samples** — Sample records keyed by hash, linked to families - **YARA** — YARA detection rules attached to malware families - **System** — Service version and health endpoints ## Why Jentic - **Setup:** Wiring Malpedia by hand means handling its Authorization header API key, learning the /list, /get, and /find path conventions, and parsing each response yourself. Through Jentic you install once, import the Malpedia REST API from the API Directory, store the researcher token once, and your agent calls it. - **Permission scoping:** The Malpedia endpoints in this spec are read-only reference lookups, so scoping is by operation: you limit the agent to the operations it needs, such as looking up a malware family or actor and fetching YARA rules, and leave out anything you do not want it calling. Every operation you allow is one you have chosen, so the agent stays inside that set. - **Credential handling:** Your Malpedia token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'look up a malware family' or 'find an actor by name', and Jentic returns the matching Malpedia operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **MISP** — Open-source threat intelligence platform that ingests Malpedia identifiers alongside other feeds. - **AbuseIPDB** — Reputation lookups for IP addresses, useful alongside Malpedia family attribution during triage. - **abuse.ch** — Community-driven malware intelligence (MalwareBazaar, ThreatFox) covering similar territory to Malpedia. - **Threat Intelligence Platform** — Domain and host-level threat intelligence to pair with Malpedia's family-level data. ## FAQ ### What authentication does the Malpedia REST API use? Malpedia uses an API token passed in the Authorization header (apiKeyAuth). Tokens are issued by Fraunhofer FKIE to vetted researchers through the Malpedia portal. Through Jentic, the token is stored in the encrypted vault and scoped to the calling agent, so the raw key never enters the agent's context. ### Can I pull YARA rules for a specific malware family with the Malpedia REST API? Yes. The GET `/get/yara/{family_id}` endpoint returns the YARA rules attached to a curated family record. Resolve the family_id first via `/find/family/{search}` or `/list/families`, then call the YARA endpoint with that identifier to retrieve the rule text. ### What are the rate limits for the Malpedia REST API? Malpedia does not publish hard rate limits in the spec. Fraunhofer FKIE asks researchers to use the API responsibly and avoid scripted bulk scraping; sustained high-volume traffic can lead to token revocation. For corpus-wide pulls, prefer the official dump links offered to vetted accounts. ### How do I search for a malware family by name through Jentic? Run pip install jentic, then search Jentic with the query 'look up a malware family in malpedia'. Jentic returns the GET `/find/family/{search}` operation, you load its schema, and execute with the family alias as the search parameter to get the canonical record. ### Is the Malpedia REST API free to use? Malpedia access is free for vetted security researchers; there is no paid tier. Tokens are granted manually after a sign-up review, so it is not a self-service API. The corpus itself is curated by Fraunhofer FKIE and is not crowd-sourced. ### Can the Malpedia REST API resolve a sample hash to a malware family? Yes, when the sample is in the corpus. GET `/get/sample/{hash}` returns the sample record, which includes the family identifier. If the hash is not catalogued, the endpoint returns no match - Malpedia is curated rather than exhaustive, so unknown samples should be cross-checked against other feeds. ### Can I limit what my agent is allowed to do with the Malpedia REST API? Yes. Because you run Jentic One yourself, you decide which Malpedia operations your agent may call, and it can only use the ones you allow. Since every Malpedia endpoint is a read-only reference lookup, you scope by operation: you can permit family lookups (`/get/family/{family_id}`, `/find/family/{search}`), actor lookups (`/get/actor/{actor_id}`, `/find/actor/{search}`), YARA rule fetches (`/get/yara/{family_id}`), or sample-by-hash checks, and leave out anything you do not want it touching. Your researcher token is held by your own instance and injected only at execution time, so the agent never sees the raw credential.