Ingest Threat Intel into Anomali ThreatStream

The anomali-feed endpoint emits a STIX 2.1 bundle designed as a direct replacement for the threat-feed → Tines → Anomali pipeline. For each verified threat in the time window, it returns one x-malicious-package Custom Object, one indicator SDO per IOC, and relationship SROs linking them.

Subscription Required: This is a paid endpoint available to Researcher Pro and Enterprise users.

This endpoint has been validated for Anomali ThreatStream and is not guaranteed to be compatible with other TIPs.

Use it to:

Replace your Anomali ingest pipeline: Import OSM threat intelligence directly into Anomali ThreatStream without intermediate tooling.
Stay current with a rolling window: Poll on a schedule using the hours parameter to ingest only threats verified within your chosen time window.
Ingest IOC-level indicators: Receive one STIX indicator SDO per IOC attached to each threat, ready for automated detection and blocking rules.

Endpoint

GET https://api.opensourcemalware.com/functions/v1/anomali-feed

Required header

Authorization: Bearer osm_your_token

Alternative: Pass API key as query parameter: ?apikey=osm_your_token

Pro Role Required Requires the ‘pro’ role (admin/editor also qualify). Contact an administrator if you receive a 403.

Query parameters

ecosystem is required. Package registry (npm, pypi, rubygems, etc.) or the special values repositories / domains. hours is optional. Rolling time window in hours. Integer 1–24, defaults to 1. Filters on verified_at = now() - hours.

Bundle shape

Content-Type: application/stix+json;version=2.1 Every bundle contains, in order:

One marking-definition SDO for TLP:WHITE (referenced via object_marking_refs).
For each verified threat in the window: one x-malicious-package Custom Object (STIX 2.1 §11.2). Threats with zero IOCs still appear as a Custom Object with no associated indicators.
For each IOC attached to a threat (mappable types only): one indicator SDO with the appropriate STIX pattern, plus one relationship SRO (related-to) linking the indicator to its Custom Object. The Custom Object also carries an x_object_refs array listing all of its indicator IDs as a redundant association hint for tools that don’t process the SROs.

Every object’s created_by_ref points to the stable OSM producer identity identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10. The identity SDO itself is not bundled — including it triggers UUID-conflict errors in Anomali ThreatStream on repeated polls. Consumers that want to resolve the reference can register that identity once in their environment. IOC types wallet_address, file_path, and other are skipped (no clean STIX SCO). All others are mapped as follows:

`ioc_type`	STIX pattern
`ip_address`	`[ipv4-addr:value = '…']`
`domain`	`[domain-name:value = '…']`
`url`	`[url:value = '…']`
`file_hash_md5`	`[file:hashes.'MD5' = '…']`
`file_hash_sha1`	`[file:hashes.'SHA-1' = '…']`
`file_hash_sha256`	`[file:hashes.'SHA-256' = '…']`
`email_address`	`[email-addr:value = '…']`
`c2_server`	inferred: `ipv4-addr` / `ipv6-addr` / `domain-name` / `url`
`registry_key`	`[windows-registry-key:key = '…']`
`github_user`	`[url:value = 'https://github.com/…']`
`github_repo`	`[url:value = 'https://github.com/…']`
`npm_user`	`[url:value = 'https://www.npmjs.com/~…']`
`npm_package`	`[url:value = 'https://registry.npmjs.org/…']`
`pypi_package`	`[url:value = 'https://pypi.org/project/…/']`
`wallet_address` / `file_path` / `other`	skipped

Response example

{
  "type": "bundle",
  "id": "bundle--550e8400-e29b-41d4-a716-446655440000",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": { "tlp": "white" }
    },
    {
      "type": "x-malicious-package",
      "spec_version": "2.1",
      "id": "x-malicious-package--<threat-id>",
      "created_by_ref": "identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10",
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"],
      "created": "2024-01-15T12:00:00.000Z",
      "modified": "2024-01-15T12:00:00.000Z",
      "name": "npm:evil-package@1.0.0",
      "description": "Contains cryptocurrency mining code",
      "x_registry": "npm",
      "x_package_name": "evil-package",
      "x_version_info": "1.0.0",
      "x_severity_level": "critical",
      "x_status": "verified",
      "x_object_refs": ["indicator--<uuid>"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--<uuid>",
      "created_by_ref": "identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10",
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"],
      "created": "2024-01-15T12:00:00.000Z",
      "modified": "2024-01-15T12:00:00.000Z",
      "name": "domain: evil-exfil.xyz",
      "description": "IOC extracted from malicious package 'evil-package' (npm)",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'evil-exfil.xyz']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2024-01-14T22:00:00.000Z",
      "valid_until": "2025-01-14T22:00:00.000Z",
      "confidence": 90,
      "x_ioc_type": "domain",
      "x_ioc_value": "evil-exfil.xyz"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--<uuid>",
      "created_by_ref": "identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10",
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"],
      "created": "2024-01-15T12:00:00.000Z",
      "modified": "2024-01-15T12:00:00.000Z",
      "relationship_type": "related-to",
      "source_ref": "indicator--<uuid>",
      "target_ref": "x-malicious-package--<threat-id>"
    }
  ]
}

cURL example

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/anomali-feed?ecosystem=npm&hours=1"

Rate limits

Pro users: 180 requests per minute
Admin / Editor: 360 requests per minute
Per-IP: 500 requests per 15 minutes

Overview

Free Endpoints

Paid Endpoints

Ingest Threat Intel into Anomali ThreatStream

Query parameters

Bundle shape

Response example

cURL example

Rate limits

​Query parameters

​Bundle shape

​Response example

​cURL example

​Rate limits

Query parameters

Bundle shape

Response example

cURL example

Rate limits