We are currently building something exciting and will be launching soon. Registration is temporarily closed. Launching soon — registration temporarily closed.

INDICATORS REFERENCE

Cybersecurity Indicators

Cybersecurity covers 200 indicators across 6 threat groups. Each signal has a stable slug and code for programmatic access. Representative signals are shown publicly; the complete reference is available to customers.

View Threat Groups Features

200

Indicators

6

Threat Groups

15

Languages

33

Avg / Group

Overview Threat Groups Indicators Features

6 results

Showing 6 representative indicators of 200. The complete taxonomy is available to customers.

Request access

#	Indicator	Slug	code	Threat Group
001	phishing	`phishing`	`phishing_delivery.phishing`	Phishing Delivery
002	credential theft	`credential_theft`	`access_identity.credential_theft`	Access Identity
003	persistence	`persistence`	`endpoint_malware.persistence`	Endpoint Malware
004	lateral movement	`lateral_movement`	`network_lateral.lateral_movement`	Network Lateral
005	sql injection	`sql_injection`	`app_cloud_data.sql_injection`	App Cloud Data
006	denial of service	`denial_of_service`	`infra_intel.denial_of_service`	Infra Intel

Browse by Threat Group

Alternatively, explore indicators grouped by their parent threat group:

1

Phishing Delivery

phishing_delivery

20 Indicators

The complete signal list for this threat group is available to customers. Request access to view it.

2

Access Identity

access_identity

30 Indicators

The complete signal list for this threat group is available to customers. Request access to view it.

3

Endpoint Malware

endpoint_malware

50 Indicators

The complete signal list for this threat group is available to customers. Request access to view it.

4

Network Lateral

network_lateral

30 Indicators

The complete signal list for this threat group is available to customers. Request access to view it.

5

App Cloud Data

app_cloud_data

50 Indicators

The complete signal list for this threat group is available to customers. Request access to view it.

6

Infra Intel

infra_intel

20 Indicators

The complete signal list for this threat group is available to customers. Request access to view it.

Reading Cybersecurity output

What you can safely infer from a result - and what you must not.

Intended task

Turn security-relevant text - reported phishing, incident notes, threat-intel prose - into structured threat indicators your SOC queue can route on.

Input requirements

text - the only field analyzed; up to 4,096 Unicode code points. Over the limit is rejected with input_too_long, never truncated.
language - must be a language this analyzer supports. Unsupported codes are rejected with 400 unsupported_language, never analyzed as a different language.
analyzers - include "cybersecurity"; up to 2 analyzers per request, one billed run each.
No context beyond text - no user IDs, history, profiles, or attachments are read or inferred.
Analyzes message/report text only - headers, rendered URLs, attachments, and telemetry are out of scope.

Ordinary positive

“Your mailbox storage is full. Verify your password within 24 hours at the link below or your account will be suspended.”

phishing_delivery very high

credential_lure high

urgency_lure high

Safe inference: The text matches documented phishing patterns. You can route it to a credential-threat lane and attach the receipt to the ticket.

Confusing negative · Quotation

“The lure read "verify your password within 24 hours" - the SOC confirmed the campaign on Tuesday.”

What happens: Phishing indicators can still fire on the quoted lure. The signal describes the language in the text - it is not evidence that an attack actually occurred, and not a verdict on the analyst's report.

Why it's tricky: The analyzer cannot distinguish a lure from someone quoting a lure. Signals on incident write-ups and forwarded phish are expected - triage by where the text came from, not just what it says.

What you can safely infer

Which documented threat indicators the text matched, and at what signal-match strength.
That the same input on the same pinned configuration replays identically for your incident record.

What you must not infer

✕That a flagged sender, domain, or account is actually malicious.
✕That a described incident actually happened - the signal describes the text, it does not verify events.
✕That unflagged text is benign - a missing signal means "not detected," never "safe."
✕Anything about your network state - the analyzer sees text, not logs or endpoints.

Boundary: Security-language signals are not proof of compromise. A phishing or credential-abuse signal means the submitted text matches documented attack language - it does not confirm that an attack occurred, that a credential leaked, or that a sender is malicious.

Signal reference Evaluation evidence Understanding signals API reference Evaluate on your data

Using Indicators in API Responses

When you call /v1/analyze, the response includes matched indicators with signal-match scores. Each signal is identified by its code and includes a level field (“category” or “label”). A score expresses signal-match strength under a particular analyzer configuration. It is not a probability that the signal or a downstream action is correct. Validate action thresholds on representative labeled data.

{
    "language": "en",
    "language_source": "declared",
    "signals": [
        {
            "analyzer": "cybersecurity",
            "code": "phishing_delivery",
            "label": "Phishing Delivery",
            "score": 0.94,
            "level": "category"
        },
        {
            "analyzer": "cybersecurity",
            "code": "credential_lure",
            "label": "Credential Lure",
            "score": 0.93,
            "level": "label",
            "parent": "phishing_delivery"
        },
        {
            "analyzer": "cybersecurity",
            "code": "urgency_lure",
            "label": "Urgency Lure",
            "score": 0.89,
            "level": "label",
            "parent": "phishing_delivery"
        }
    ],
    "meta": {
        "analyzers": [
            {
                "name": "cybersecurity",
                "status": "completed",
                "applicability": "analyzable",
                "assessment": "signals_detected",
                "signal_count": 3,
                "billed": true
            }
        ]
    },
    "usage": {
        "analyzer_runs": 1
    },
    "verification": {
        "configuration": "sqcfg_6X29ABXM",
        "fingerprint": "fp_8a72...19f",
        "input_commitment": "ic_31bd...a42",
        "signature": "sig_ed25519_4c1f...e2a",
        "key_id": "edk_af4f218e"
    }
}

Back to Cybersecurity Docs View Threat Groups

Quickstart Guide

First API call in under 5 minutes

API Reference

Full endpoint documentation

Benchmark Results

Per-language Top-3 Hit Rate

Pricing

From Free to Enterprise

Playground

Test detection live - no API key

Indicator Dictionary

Browse all 200 indicators

Benchmark Methodology

How we measure Top-3 Hit Rate

Request access5,000 analyzer runs/month · No card required