SANS Internet Storm Center (DShield) API

SANS Internet Storm Center (DShield) API

The SANS Internet Storm Center's DShield API serves sensor-derived attack data — top attacking IPs and ports, threat level, IP/ASN lookups and threat feeds — as a keyless REST API. The page says: "We are using a simple REST API."

Coverage

Endpoints for infocon (threat level), handler of the day, port and IP summaries, ASN lookups, daily summaries, recent/aged domains, threat feeds and web-honeypot data, in XML (default), JSON, text, php, csv or tab depending on the endpoint. Bulk daily-summary files are also offered. Update cadence: Not stated as one figure; most endpoints describe themselves as daily or current.

Verdict

DShield sensor data from the SANS Internet Storm Center: top attacking IPs and ports, threat level, IP/ASN lookups, as JSON/XML. WARNING: the formal licence is CC BY-NC-SA 4.0, but the page separately says defensive commercial use is allowed; quoting both rather than summarising as "commercial use allowed": "If your lawyers ask, the data is provided using a Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) License ." and "It is ok to use this data for commercial purposes, for example to protect your own company's network. But again: do not resell, do not complain if it doesn't work sometimes, don't blame us if patients start dying in your hospital because the anti-ransomware script you built around our data turned off the IV pumps after it saw some badly formatted data." No authentication is required, but add a contact User-Agent: "Currently, we do not require authentication (we may in the future). But please add contact information ,for example an email address, as a User-Agent, to allow us to reach out if there is a problem." Rate limits: "We do not have strict rate limits, but at times of high load, you may get \"429\" responses." Signal Lab links only.