API Access

MetaDefender InSights is accessible via a RESTful web API that presents threat intelligence indicators in a simple JSON data format.

Authentication and authorization

API access is available using an API key. The API key is passed to the server in the request body as a parameter named api_key. Customer API keys are granted access to individual API endpoints and must be authorized to retrieve InSights threat intel data.

How to query the API

API access details:

• API host: https://eyelet.inquest.net
• API authentication: API queries must be authenticated, and require an API key to identify the requestor.

To query the APIs documented on this page:

1. Send an HTTPS request to the URL of the desired API endpoint.
2. Send requests using the POST method.
3. Include the API key in a form-encoded request body.

For example, to download the MetaDefender InSights C2 domain feed in Python using Requests, assuming that a valid API key is in the INSIGHTS_API_KEY environment variable:

import os

import requests

​

API_HOST = "https://eyelet.inquest.net"

API_KEY = os.environ["INSIGHTS_API_KEY"]

​

r = requests.post(

    f"{API_HOST}/api/insights/insights-c2-domain", data={"api_key": API_KEY}

)

​

with open("inquest-insights-c2-ip.json.gz", "wb") as f:

    f.write(r.content)

Lookup query interface

Supported InSights data feeds

Data from the following MetaDefender InSights feeds are available through the lookup query interface:

• MetaDefender InSights C2
• MetaDefender InSights TI

Supported API endpoints

The following API endpoints are supported through the query interface:

InSights C2 DNS lookup

InSights C2 IP lookup

InSights TI reputation lookup

Download interface

Our threat intelligence feeds may be downloaded in a packaged bulk format to support raw data use cases. The feed collections consist of the subset of our active threat indicators that have not yet aged out due to expiration, and help ensure that our customers receive actionable, relevant insights. We refer to these bulk intel data collections as snapshots.

Supported InSights data feeds

The following MetaDefender InSights data feeds are available through the snapshot download interface:

• MetaDefender InSights C2
• MetaDefender InSights TI
• MetaDefender InSights OSINT

Supported API endpoints

The following API endpoints can be accessed through the snapshot download interface:

InSights C2 snapshots

InSights TI snapshots

InSights OSINT snapshots