Developers
Threat Intel API
The data behind the threat dashboard is free to consume as JSON — no key, no registration, CORS enabled. Licensed CC BY 4.0: use it in dashboards, SIEM enrichment, or bots, with attribution to runtimerebel.com.
// Endpoint
GET https://runtimerebel.com/api/threat-intel.json
Regenerated every ingestion run; cache it for up to 5 minutes (the endpoint sends
s-maxage=300, stale-while-revalidate=600).
// Example
curl -s https://runtimerebel.com/api/threat-intel.json | jq '.globalThreatLevel, .topCves[0]'
// Fields
- globalThreatLevel
- Overall threat level string (e.g. "High"), derived from the 30-day severity distribution
- globalThreatLevelSubtext
- One-line human-readable rationale for the level
- lastUpdated
- ISO-8601 timestamp of the last ingestion run
- severityCounts
- Article counts by severity over the 30-day window (critical/high/medium/low/info)
- topCves
- Highest-scored CVEs from recent coverage: id, description, CVSS score
- threatCategories
- Relative activity levels for Ransomware / Phishing / Supply Chain / Zero-Days
- activeCampaigns
- Threat actors active in recent reporting (mention-derived — see naming note below)
- topThreatActors
- Most-mentioned known actors with attribution and mention counts
- hotVendors
- Vendors most frequently affected in the last 90 days of coverage
// Honesty notes
-
activeCampaignsentries are derived from mention frequency in coverage — "LockBit activity" means LockBit is active in recent reporting, not that we track a named operation. - Severity counts reflect our own evidence-calibrated classifications of AI-drafted coverage — see the editorial policy before treating them as ground truth.
- Feeds: prefer RSS for article-level
consumption; every tag archive also serves its own feed at
/blog/tag/<tag>/rss.xml.