CrowdSec CTI - Cyber Threat Intelligence
CrowdSec's Cyber Threat Intelligence (CTI) exposes the threat data collected by the global CrowdSec network — millions of IPs enriched with behaviors, classifications, scores, MITRE techniques, and CVE associations — through a REST API designed for programmatic integration.
This section covers the API side of CTI: authentication, datasets, data format, taxonomy, and integrations with third-party security platforms.
What the API Gives You
For any queried IP, the CTI API returns:
| Field | Description |
|---|---|
| Reputation | Malicious, Suspicious, Known, Benign, Safe, or Unknown |
| Behaviors | Attack types observed (SSH Bruteforce, HTTP Scan, CVE exploitation, etc.) |
| Classifications | TOR exit node, VPN/Proxy, CDN, scanner, false positive, and more |
| Scores | Aggressiveness, threat, trust, and anomaly — computed over 1d / 7d / 30d windows |
| MITRE ATT&CK | Techniques mapped to the IP's observed behaviors |
| CVEs | Vulnerabilities the IP has been actively exploiting |
| History | First seen / last seen, activity age |
| Target countries | Geographic distribution of attacks from this IP |
Full field-level documentation: CTI Object format.
Taxonomy
Understanding the CTI data model is key to making good use of the API. The Taxonomy section documents:
- CTI Format — complete response structure and field reference
- Scores — how aggressiveness, threat, trust, and anomaly are computed
- Behaviors — defined attack behaviors and their labels
- Classifications — IP category tags (VPN, TOR, CDN, scanner, etc.)
- False Positives — categories excluded from malicious verdicts
- Scenarios — the detection scenarios that triggered reports for an IP
Getting Started
- Get an API key — create one in the Console. A free key is available to all registered users. See API Keys.
- Make your first request — see API Introduction for the base URL, authentication header, and an example response.
- Integrate — connect CrowdSec CTI to your SIEM, SOAR, or TIP using one of the supported integrations.
Integrations
CrowdSec CTI has native integrations with major security platforms:
| Category | Platforms |
|---|---|
| SIEM | Splunk Enterprise Security, QRadar, Microsoft Sentinel |
| SOAR | Splunk SOAR, Palo Alto XSOAR, TheHive |
| TIP | MISP, OpenCTI, Sekoia XDR |
| Investigation | Maltego, MSTICpy, IntelOwl |
| Other | Chrome extension, Gigasheet |
