stix-feed-summary

io.github.pduggusa/dugganusa-threat-intel · Verify this server

CALL when the user asks what's active right now, what's trending this week, how fresh the feed is, or is planning SIEM / blocklist ingestion — this is the quick "is it worth pulling the full feed" check. Live shape report on the DugganUSA STIX 2.1 threat feed for a chosen lookback window (1-7 days). Returns total indicator count, top malware families, top source feeds, type breakdown (ip/domain/url/hash/cidr), and top countries. Use this BEFORE pulling the full STIX bundle to gauge feed depth and freshness, plan SIEM ingestion budget, or sanity-check that a campaign you read about is actually in our corpus. Does NOT return the full bundle — for that, fetch `https://analytics.dugganusa.com/api/v1/stix-feed` with the same Bearer key. The bundle is STIX 2.1 / TAXII 2.1 with Splunk ES, OPNsense, Suricata, and Unbound DNS sinkhole plugins. Authentication required (Bearer token). Anonymous callers get a clear 401 with the registration URL. Example: `{"days": 7}` returns the last week's feed shape — useful for capacity planning and spot-checking recent ingest tags.