> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Ingest Threat Intel into Anomali ThreatStream
> Retrieve a rolling-window STIX 2.1 bundle purpose-built for Anomali ThreatStream.
The `anomali-feed` endpoint emits a STIX 2.1 bundle designed as a direct replacement for the threat-feed → Tines → Anomali pipeline. For each verified threat in the time window, it returns one `x-malicious-package` Custom Object, one indicator SDO per IOC, and relationship SROs linking them.
Subscription Required: This is a paid endpoint available to Researcher Pro and Enterprise users.
This endpoint has been validated for Anomali ThreatStream and is not guaranteed to be compatible with other TIPs.
Use it to:
* **Replace your Anomali ingest pipeline:** Import OSM threat intelligence directly into Anomali ThreatStream without intermediate tooling.
* **Stay current with a rolling window:** Poll on a schedule using the `hours` parameter to ingest only threats verified within your chosen time window.
* **Ingest IOC-level indicators:** Receive one STIX indicator SDO per IOC attached to each threat, ready for automated detection and blocking rules.
**Endpoint**
```
GET https://api.opensourcemalware.com/functions/v1/anomali-feed
```
**Required header**
```
Authorization: Bearer osm_your_token
```
Alternative: Pass API key as query parameter: `?apikey=osm_your_token`
> **Pro Role Required**
> Requires the 'pro' role (admin/editor also qualify). Contact an administrator if you receive a 403.
## Query parameters
`ecosystem` is required. Package registry (`npm`, `pypi`, `rubygems`, etc.) or the special values `repositories` / `domains`.
`hours` is optional. Rolling time window in hours. Integer 1–24, defaults to 1. Filters on `verified_at = now() - hours`.
## Bundle shape
`Content-Type: application/stix+json;version=2.1`
Every bundle contains, in order:
1. One `marking-definition` SDO for TLP:WHITE (referenced via `object_marking_refs`).
2. For each verified threat in the window: one `x-malicious-package` Custom Object (STIX 2.1 §11.2). Threats with zero IOCs still appear as a Custom Object with no associated indicators.
3. For each IOC attached to a threat (mappable types only): one indicator SDO with the appropriate STIX pattern, plus one relationship SRO (`related-to`) linking the indicator to its Custom Object. The Custom Object also carries an `x_object_refs` array listing all of its indicator IDs as a redundant association hint for tools that don't process the SROs.
Every object's `created_by_ref` points to the stable OSM producer identity `identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10`. The identity SDO itself is not bundled -- including it triggers UUID-conflict errors in Anomali ThreatStream on repeated polls. Consumers that want to resolve the reference can register that identity once in their environment.
IOC types `wallet_address`, `file_path`, and `other` are skipped (no clean STIX SCO). All others are mapped as follows:
| `ioc_type` | STIX pattern |
| ---------------------------------------- | ----------------------------------------------------------- |
| `ip_address` | `[ipv4-addr:value = '…']` |
| `domain` | `[domain-name:value = '…']` |
| `url` | `[url:value = '…']` |
| `file_hash_md5` | `[file:hashes.'MD5' = '…']` |
| `file_hash_sha1` | `[file:hashes.'SHA-1' = '…']` |
| `file_hash_sha256` | `[file:hashes.'SHA-256' = '…']` |
| `email_address` | `[email-addr:value = '…']` |
| `c2_server` | inferred: `ipv4-addr` / `ipv6-addr` / `domain-name` / `url` |
| `registry_key` | `[windows-registry-key:key = '…']` |
| `github_user` | `[url:value = 'https://github.com/…']` |
| `github_repo` | `[url:value = 'https://github.com/…']` |
| `npm_user` | `[url:value = 'https://www.npmjs.com/~…']` |
| `npm_package` | `[url:value = 'https://registry.npmjs.org/…']` |
| `pypi_package` | `[url:value = 'https://pypi.org/project/…/']` |
| `wallet_address` / `file_path` / `other` | skipped |
## Response example
```json theme={null}
{
"type": "bundle",
"id": "bundle--550e8400-e29b-41d4-a716-446655440000",
"objects": [
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": { "tlp": "white" }
},
{
"type": "x-malicious-package",
"spec_version": "2.1",
"id": "x-malicious-package--",
"created_by_ref": "identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10",
"object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"],
"created": "2024-01-15T12:00:00.000Z",
"modified": "2024-01-15T12:00:00.000Z",
"name": "npm:evil-package@1.0.0",
"description": "Contains cryptocurrency mining code",
"x_registry": "npm",
"x_package_name": "evil-package",
"x_version_info": "1.0.0",
"x_severity_level": "critical",
"x_status": "verified",
"x_object_refs": ["indicator--"]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--",
"created_by_ref": "identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10",
"object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"],
"created": "2024-01-15T12:00:00.000Z",
"modified": "2024-01-15T12:00:00.000Z",
"name": "domain: evil-exfil.xyz",
"description": "IOC extracted from malicious package 'evil-package' (npm)",
"indicator_types": ["malicious-activity"],
"pattern": "[domain-name:value = 'evil-exfil.xyz']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-01-14T22:00:00.000Z",
"valid_until": "2025-01-14T22:00:00.000Z",
"confidence": 90,
"x_ioc_type": "domain",
"x_ioc_value": "evil-exfil.xyz"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--",
"created_by_ref": "identity--b4a2a0a6-1f4e-4f2c-9c6a-7f1d2c5a0b10",
"object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"],
"created": "2024-01-15T12:00:00.000Z",
"modified": "2024-01-15T12:00:00.000Z",
"relationship_type": "related-to",
"source_ref": "indicator--",
"target_ref": "x-malicious-package--"
}
]
}
```
## cURL example
```
curl -H "Authorization: Bearer osm_your_token" \
"https://api.opensourcemalware.com/functions/v1/anomali-feed?ecosystem=npm&hours=1"
```
## Rate limits
* Pro users: 180 requests per minute
* Admin / Editor: 360 requests per minute
* Per-IP: 500 requests per 15 minutes