List IOC - FalconFeeds

Endpoint

GET https://api.falconfeeds.io/merlin/ioc/v2

Authentication

Authorization: Bearer <your-api-token>

Query Parameters

Parameter	Type	Required	Description
`type`	`string`	No	Filter by IOC type. See allowed values below.
`malwareUUID`	`string`	No	Filter by a specific Malware UUID.
`threatActorUUID`	`string`	No	Filter by a specific Threat Actor UUID.
`confidence`	`string`	No	Filter by confidence level. See allowed values below.
`next`	`string`	No	Cursor for pagination. Pass the `next` value from the previous response.
`keyword`	`string`	No	Filter results by keyword.
`sortBy`	`string`	No	Field to sort results by. If omitted, defaults to `lastSeen`. Allowed values: `lastSeen`, `createdAt`.
`sortOrder`	`string`	No	Sort direction. If omitted, defaults to `desc`. Allowed values: `asc`, `desc`.

Allowed Values - `type`

ipv4, ipv6, ip:port, domain, url, md5, sha1, sha256

Allowed Values - `confidence`

limited, moderate, elevated, high, other

Request

curl --location 'https://api.falconfeeds.io/merlin/ioc/v2' \
  --header 'Authorization: Bearer <your-api-token>'

Response

{
  "message": "string",
  "data": [
    {
      "uuid": "string",
      "type": "string",
      "ttp": ["string"],
      "indicator": "string",
      "threatType": "string",
      "threatActors": [
        {
          "uuid": "string",
          "name": "string"
        }
      ],
      "malware": [
        {
          "uuid": "string",
          "family": "string",
          "aliases": ["string"],
          "displayName": "string",
          "platformHint": "string"
        }
      ],
      "victims": [
        {
          "type": "string",
          "value": ["string"]
        }
      ],
      "createdAt": "number",
      "confidence": "string",
      "tags": ["string"]
    }
  ],
  "next": "string"
}

string

Status message from the API.

array

Array of IOC objects.

string

Unique identifier for the IOC.

string

IOC type (e.g., ipv4, domain, sha256).

array

MITRE ATT&CK TTPs (Tactics, Techniques, and Procedures) associated with this IOC.

string

The actual indicator value (e.g., an IP address, domain, or file hash).

string

The threat category this IOC belongs to.

array

Threat actors associated with this IOC, each with a UUID and name.

array

Malware families linked to this IOC, including aliases and platform hints.

array

Victim entities associated with this IOC.

number

Unix timestamp (in milliseconds) when the IOC was created. Defaults to 0 when unavailable.

string

Confidence level of the IOC (e.g., limited, high).

array

Tags associated with the IOC.

string

Cursor to pass as next for the next page, or null if no more results.

Looking for the older IOC endpoint? The previous version of this endpoint has been deprecated. You can still find its reference documentation on the List IOC (Deprecated) page.

​Endpoint

​Authentication

​Query Parameters

​Allowed Values - type

​Allowed Values - confidence

​Request

​Response

Endpoint

Authentication

Query Parameters

Allowed Values - `type`

Allowed Values - `confidence`

Request

Response