Global-Intel API Docs

The Global-Intel API allows developers access to a public, read-only instance of CTIA, which an organization can use to store and share data, including ongoing investigations and threat intelligence. Public objects, like judgements and verdicts, are also stored in the Global Intelligence store.

Note: Please be mindful that there is also a read-write instance of CTIA, named Private-Intel, which allows you to create and manage your own threat intelligence information.

Use Cases

• Sharing actionable threat intel.
• Simple, pragmatic data model.
• Ease of integration and exploration.
• Extremely fast Verdict lookups.
• Hypertextual integration with other services.

How to use the API Docs

Use the interactive documentation to explore the Global-Intel API endpoints. Each request will have a complete description of all the required parameters and it also allow you to instantly try it out in the online console. Code templates are also provided for you to quickly build scripts.

In the interactive explorer, the Client ID and Client Secret has been pre-filled and will allow you to make read-only API requests. These credentials will allow you to get an Access Token, which will be stored for subsequent API requests and regenerated when it expires.

Note: The interactive documentation uses read-only credentials and the try it out feature will only work with GET and selected POSTrequests.

To try other Global-Intel API requests, go to https://intel.amp.cisco.com/index.html

Generate an Access Token

In the interactive API explorer, the Access Token is automatically generated using the pre-filled Client ID and Client Secret so you do not need to generate it yourself.

If you want to understand how the Access Token is generated from the Client ID and Client Secret credentials, take a look at the Authentication page.

For detailed instructions on how to use the interactive API documentation (or your own Python script), see the Getting Started page.

Download the Global-Intel OpenAPI Specification

Download the Global-Intel OpenAPI specification (OAS) file here.

Sample Code

Below is an example of how to use the Global-Intel API.

import json
import requests

# create headers for API request (See the OAuth2 overview page for sample code to generate an access token)
access_token = 'eyJhbGciO....bPito5n5Q' # truncated example, generate JWT token separately
bearer_token = 'Bearer ' + access_token

# searches for a judgement for an observable
observable_type = 'domain'
observable_value = 'internetbadguys.com'
url = f'https://intel.amp.cisco.com/ctia/{observable_type}/{observable_value}/judgements'

headers = {
            'Authorization': bearer_token,
            'Content-Type':'application/json',
            'Accept':'application/json'
}

response = requests.get(url, headers=headers)
print(response.text)

if response.status_code == 200:
    # convert the response to a dict object
    response_json = json.loads(response.text)

    # iterate through the judgements 
    for judgement in response_json:
        # get the values from the judgement (remainder values are accessed in the same way)
        id = judgement['id']
        reason = judgement['reason']
        source_uri = judgement['source_uri']