THREAT GROUPS REFERENCE
Cybersecurity Threat Groups
Cybersecurity organizes detection into 6 threat groups covering 200 indicators across 15 languages.
All Threat Groups
Each threat group contains a set of specific indicators that the API can detect. Click a group to expand its signal list. Signal lists are available to customers - sign in to view them.
01
Phishing Delivery
phishing_delivery
20
20 signals - request access
for the complete list.
View 20 indicators
Phishing Delivery
phishing_delivery
The complete signal list is available to customers. Request access to view it.
02
Access Identity
access_identity
30
30 signals - request access
for the complete list.
View 30 indicators
Access Identity
access_identity
The complete signal list is available to customers. Request access to view it.
03
Endpoint Malware
endpoint_malware
50
50 signals - request access
for the complete list.
View 50 indicators
Endpoint Malware
endpoint_malware
The complete signal list is available to customers. Request access to view it.
04
Network Lateral
network_lateral
30
30 signals - request access
for the complete list.
View 30 indicators
Network Lateral
network_lateral
The complete signal list is available to customers. Request access to view it.
05
App Cloud Data
app_cloud_data
50
50 signals - request access
for the complete list.
View 50 indicators
App Cloud Data
app_cloud_data
The complete signal list is available to customers. Request access to view it.
06
Infra Intel
infra_intel
20
20 signals - request access
for the complete list.
View 20 indicators
Infra Intel
infra_intel
The complete signal list is available to customers. Request access to view it.
Reading Cybersecurity output
What you can safely infer from a result - and what you must not.
Intended task
Turn security-relevant text - reported phishing, incident notes, threat-intel prose - into structured threat indicators your SOC queue can route on.
Input requirements
text- the only field analyzed; up to 4,096 Unicode code points. Over the limit is rejected withinput_too_long, never truncated.language- must be a language this analyzer supports. Unsupported codes are rejected with400 unsupported_language, never analyzed as a different language.analyzers- include"cybersecurity"; up to 2 analyzers per request, one billed run each.- No context beyond
text- no user IDs, history, profiles, or attachments are read or inferred. - Analyzes message/report text only - headers, rendered URLs, attachments, and telemetry are out of scope.
Ordinary positive
“Your mailbox storage is full. Verify your password within 24 hours at the link below or your account will be suspended.”
Safe inference: The text matches documented phishing patterns. You can route it to a credential-threat lane and attach the receipt to the ticket.
Confusing negative · Quotation
“The lure read "verify your password within 24 hours" - the SOC confirmed the campaign on Tuesday.”
What happens: Phishing indicators can still fire on the quoted lure. The signal describes the language in the text - it is not evidence that an attack actually occurred, and not a verdict on the analyst's report.
Why it's tricky: The analyzer cannot distinguish a lure from someone quoting a lure. Signals on incident write-ups and forwarded phish are expected - triage by where the text came from, not just what it says.
What you can safely infer
- Which documented threat indicators the text matched, and at what signal-match strength.
- That the same input on the same pinned configuration replays identically for your incident record.
What you must not infer
- ✕That a flagged sender, domain, or account is actually malicious.
- ✕That a described incident actually happened - the signal describes the text, it does not verify events.
- ✕That unflagged text is benign - a missing signal means "not detected," never "safe."
- ✕Anything about your network state - the analyzer sees text, not logs or endpoints.
Boundary: Security-language signals are not proof of compromise. A phishing or credential-abuse signal means the submitted text matches documented attack language - it does not confirm that an attack occurred, that a credential leaked, or that a sender is malicious.
Access the taxonomy through the API
Check Cybersecurity availability and endpoint programmatically via the public catalog endpoint - no authentication required. Include your API key to also retrieve taxonomy size and supported languages.
curl -X GET https://sentiqra.tech/v1/meta/domains/cybersecurity \
-H "Authorization: Bearer sq_live_your_key_here"Example response (authenticated):
{
"catalog_version": "...",
"domain": {
"id": "cybersecurity",
"name": "Cybersecurity",
"status": "production",
"taxonomy": { "groups": 6, "detection_labels": 200 },
"languages": [ ... ]
}
}Signals returned by the analyzers use code for the category or label slug - these correspond to the categories and indicators documented on this page.