ThreatMap documentation
ThreatMap aggregates configured cyber-intelligence providers through REST and MCP. The portal provides lookup, graphs, projects, monitors, and account settings.
New accounts see a dashboard checklist linking to their first lookup, API key, and monitor. Each step updates after the account saves that item.
Guides
- Quickstart: account, API key, and both MCP transports
- API reference
- Execution, providers, and scoring
- Credits and plan limits
- Security controls and workflow status
- Integration options and enterprise scope
Extract indicators from reports
In the portal, Extract indicators accepts pasted text, UTF-8 text/HTML files, selectable-text PDFs, DOCX main-body text and public HTTPS report URLs. Extraction is free and transient. Review highlighted text and deduplicated indicators, then click Enrich on a specific row to run one normal lookup. Documents are limited to 2 MiB and PDFs to 20 pages; OCR, encrypted PDFs, legacy DOC and private or authenticated URLs are not supported. DOCX includes main-body text only; headers, footers, comments and images are omitted.
Before calling the API
Verify your email, create a key, and submit one IOC per lookup. Successful IOC/CVE searches cost one base credit. BYOK removes source surcharges, not the base search charge. Providers need applicable configured credentials.
These guides describe implemented behavior. Integration availability and deployment health depend on configuration; planned capabilities are labeled separately.