# Feeds for threat intelligence platforms

PromptIntel's reviewed records as a standard threat intelligence feed: a TAXII 2.1 server that
serves STIX 2.1, and two file exports (a STIX bundle and an indicator CSV). For a platform such as
Cyware Intel Exchange, OpenCTI, MISP or a SIEM that polls a feed.

**Access: Enterprise.** An API key of an account without Enterprise access gets `403`. The JSON
API (`/agent-feed`, `/artifacts/lookup`, `/check`) is unchanged and stays as it is.

Base URL: `https://api.promptintel.securitybreak.io/api/v1`

## What is in the feed

Three collections:

| Collection | Alias | What it holds |
|---|---|---|
| Agent files | `agent-files` | Malicious agent files seen in attacks (skills, `AGENTS.md` and `CLAUDE.md` instruction files, MCP configurations, session histories): each file by its SHA-256, named by its path, and where the files were found (URLs, domains, addresses). |
| Agent threats | `agent-threats` | Threats reported by AI agents and validated by reviewers: URLs, domains, addresses, hashes, packages, skills, MCP servers. |
| Prompt indicators | `prompts` | The indicators that go with reviewed adversarial prompts: the hashes of the malware a prompt belongs to, and the URLs, domains, packages and names reported with it. Only prompts that carry an indicator are listed. The prompt text is not in the feed: it is matched with its NOVA rule. |

Each record becomes:

- a `report`: title, description, a link to the record page, labels (`agent-file`,
  `agent-threat` or `adversarial-prompt`, the category, `severity:…`, `decision:…`);
- one `indicator` per value, with a STIX pattern, `valid_from`, and `valid_until` when the type
  ages (a URL 90 days, a domain 180, an address 30, then a period where it is only logged);
- one `attack-pattern` per IoPC technique, with the IoPC id, its page, and its MITRE ATLAS
  equivalent when a reviewed mapping exists;
- an `indicates` relationship from each indicator to each technique;
- the `identity` of PromptIntel, as `created_by_ref`.

Ids are stable: the same record gives the same objects on every poll, so a platform updates
what it has and never duplicates.

| Indicator | STIX pattern |
|---|---|
| URL | `[url:value = '…']` |
| Domain | `[domain-name:value = '…']` |
| IP address | `[ipv4-addr:value = '…']` or `[ipv6-addr:value = '…']` (a port is dropped) |
| SHA-256, MD5, SHA-1 | `[file:hashes.'SHA-256' = '…']`, `[file:hashes.MD5 = '…']`, `[file:hashes.'SHA-1' = '…']` |
| File path | `[file:name = '…']` (the file name) |
| Skill, MCP server, package, extension | `[software:name = '…']` |
| Repository | `[url:value = 'https://github.com/owner/name']` |
| Publisher account | `[user-account:account_login = '…']` |
| Email | `[email-addr:value = '…']` |

How PromptIntel treats each value is a label on the indicator: `enforced-as:block`,
`enforced-as:block-path`, `enforced-as:ask`, `enforced-as:warn`, `enforced-as:log`,
`enforced-as:lookup` or `enforced-as:expired`. An MD5 or a SHA-1 is offered for lookup only
(`indicator_types: ["anomalous-activity"]`); every other indicator is `malicious-activity`.

Left out on purpose:

- a credential that appeared in a report: it is never distributed;
- a domain that is a shared platform (a code host, a file host): flagging it would flag
  everyone's traffic. A URL on such a platform is exported, because it names one path;
- types STIX has no observable for: a crypto wallet, a messaging channel, a prompt. Prompts and
  their NOVA rules are in the JSON API and the rule pack.

There are no custom STIX properties, and no TLP marking.

## TAXII 2.1

| | |
|---|---|
| Discovery URL | `https://api.promptintel.securitybreak.io/api/v1/taxii2/` |
| API root | `https://api.promptintel.securitybreak.io/api/v1/taxii2/root/` |
| Version | TAXII 2.1, STIX 2.1 |
| Authentication | Basic. Username: anything (for example `promptintel`). Password: your API key (`ak_…`). |
| Collections | `agent-files`, `agent-threats`, `prompts` (by alias, or by the id the server lists) |

A Bearer token works too: `Authorization: Bearer ak_…`.

```bash
# Discovery, then the collections
curl -u "promptintel:$PROMPTINTEL_API_KEY" https://api.promptintel.securitybreak.io/api/v1/taxii2/
curl -u "promptintel:$PROMPTINTEL_API_KEY" https://api.promptintel.securitybreak.io/api/v1/taxii2/root/collections/

# Everything in a collection, then only what was added since the last poll
curl -u "promptintel:$PROMPTINTEL_API_KEY" \
  "https://api.promptintel.securitybreak.io/api/v1/taxii2/root/collections/agent-files/objects/"
curl -u "promptintel:$PROMPTINTEL_API_KEY" \
  "https://api.promptintel.securitybreak.io/api/v1/taxii2/root/collections/agent-files/objects/?added_after=2026-11-01T00:00:00Z"
```

Supported on `objects/` and `manifest/`: `added_after`, `limit` (default 500, at most 2,000),
`next`, `match[type]`, `match[id]`, `match[spec_version]`. Objects come oldest first. When
`more` is true, ask again with `next` set to the value returned. The headers
`X-TAXII-Date-Added-First` and `X-TAXII-Date-Added-Last` give the range of the page; keep the last
one as the next `added_after`.

The server is read-only: there is no `POST`, no status resource and no delete.

### Cyware Intel Exchange

1. Administration → Integration Management → Feed Sources → STIX → Add STIX Source.
2. STIX version 2.1. Discovery Service URL: the discovery URL above.
3. Authentication type: Basic. Username: `promptintel`. Password: your API key.
4. Save, then add the collections to poll: Agent files, Agent threats and Prompt indicators.
5. Poll hourly or daily: both are far inside the limits.

### Other platforms

Any TAXII 2.1 client works with the same four values (discovery URL, username, password,
collection). OpenCTI: the TAXII2 connector. MISP: add a TAXII server under Sync Actions, or import
the STIX bundle below. Splunk, Sentinel, Elastic, Sumo Logic: their TAXII 2 source.

## File exports

For a one-off import, or a platform that takes files.

```bash
# STIX 2.1 bundle (application/stix+json)
curl -H "Authorization: Bearer $PROMPTINTEL_API_KEY" -o promptintel.json \
  "https://api.promptintel.securitybreak.io/api/v1/export/stix.json?collection=agent-files"

# One row per indicator
curl -H "Authorization: Bearer $PROMPTINTEL_API_KEY" -o promptintel.csv \
  "https://api.promptintel.securitybreak.io/api/v1/export/indicators.csv?collection=agent-threats&since=2026-11-01"
```

| Parameter | |
|---|---|
| `collection` | `agent-files`, `agent-threats` or `prompts`. Left out: all three. |
| `since` | Only records added on or after this date or timestamp (ISO 8601). |

CSV columns: `collection`, `indicator_type`, `value`, `label`, `stix_pattern`, `severity`,
`decision`, `enforced_as`, `valid_from`, `valid_until`, `iopc_techniques` (separated by `;`),
`record_id`, `record_title`, `record_url`. Every cell is quoted. A cell that a spreadsheet would
run as a formula is prefixed with an apostrophe.

## Limits and errors

- An Enterprise account: 25,000 requests a day (50,000 by agreement) and 180 a minute, shared with
  the rest of the API. A full pull of the three collections is a handful of requests.
- `401`: no key, or a key that is not valid. On the TAXII paths the answer asks for Basic
  credentials.
- `403`: the account has no Enterprise access. See https://promptintel.securitybreak.io/plans
- `400`: a parameter is not valid (`added_after`, `limit`, `next`, `since`, `collection`).
- `404`: no such collection or object.

Using the feed inside your own product, or reselling it, needs a licence: contact@securitybreak.io