> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search Indicators

> Search threat indicators with filters for protocol, confidence, sensor type, and time range.

Search enriched and verified indicators stored in ClickHouse.

## Filters

| Field            | Type      | Description                           |
| ---------------- | --------- | ------------------------------------- |
| `protocols`      | string\[] | e.g. `PROTOCOL_MODBUS`, `PROTOCOL_S7` |
| `sensor_types`   | string\[] | e.g. `SENSOR_TYPE_ICS`                |
| `min_confidence` | integer   | Minimum confidence score (0–100)      |
| `created_after`  | datetime  | ISO 8601 lower bound                  |
| `created_before` | datetime  | ISO 8601 upper bound                  |

## Example request

```json theme={null}
{
  "filter": {
    "protocols": ["PROTOCOL_MODBUS"],
    "min_confidence": 70,
    "created_after": "2026-07-01T00:00:00Z"
  },
  "page_size": 50
}
```

## Authentication

Requires WorkOS JWT or API key with `indicators:read` scope.

## Metering

This endpoint is metered for billing (Stripe). See your plan at [app.reyhford.com](https://app.reyhford.com).


## OpenAPI

````yaml POST /v1/indicators/search
openapi: 3.0.0
info:
  title: Reyhford Threat Intelligence API
  description: >-
    REST endpoints for threat indicator search and retrieval. Generated from
    Protobuf; do not edit by hand.
  version: 1.0.0
  contact:
    name: Reyhford API
    email: api@reyhford.com
  license:
    name: Proprietary
servers: []
security:
  - BearerAuth: []
tags:
  - name: QueryService
paths:
  /v1/indicators/search:
    post:
      tags:
        - Indicators
      summary: Search Indicators
      description: >-
        Search threat indicators with filters. Supports filtering by protocol,
        sensor type, confidence, and time range.
      operationId: searchIndicators
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/v1SearchIndicatorsRequest'
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/v1SearchIndicatorsResponse'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/rpcStatus'
components:
  schemas:
    v1SearchIndicatorsRequest:
      type: object
      properties:
        query:
          type: string
          description: Free-text query matched against value, tags and enrichment summary.
        filter:
          $ref: '#/components/schemas/v1IndicatorFilter'
        pagination:
          $ref: '#/components/schemas/v1Pagination'
    v1SearchIndicatorsResponse:
      type: object
      properties:
        indicators:
          type: array
          items:
            $ref: '#/components/schemas/v1ThreatIndicator'
        pageInfo:
          $ref: '#/components/schemas/v1PageInfo'
    rpcStatus:
      type: object
      properties:
        code:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/protobufAny'
    v1IndicatorFilter:
      type: object
      properties:
        types:
          type: array
          items:
            $ref: '#/components/schemas/v1IndicatorType'
        categories:
          type: array
          items:
            $ref: '#/components/schemas/v1ThreatCategory'
        minSeverity:
          $ref: '#/components/schemas/v1Severity'
        minConfidenceScore:
          type: integer
          format: int64
          description: Minimum confidence score in [0, 100].
        states:
          type: array
          items:
            $ref: '#/components/schemas/v1IndicatorState'
        tags:
          type: array
          items:
            type: string
        lastSeenWindow:
          $ref: '#/components/schemas/v1TimeWindow'
        sourceIds:
          type: array
          items:
            type: string
        protocols:
          type: array
          items:
            $ref: '#/components/schemas/v1Protocol'
          description: >-
            Restrict to indicators observed over these protocols; empty means
            all.
        sensorTypes:
          type: array
          items:
            $ref: '#/components/schemas/v1SensorType'
          description: >-
            Restrict to indicators observed by these sensor kinds; empty means
            all.
      description: Declarative filter; all set fields are ANDed together.
    v1Pagination:
      type: object
      properties:
        pageSize:
          type: integer
          format: int64
          description: Maximum number of items to return. Server may cap this value.
        pageToken:
          type: string
          description: Opaque cursor from a previous response; empty for the first page.
      description: Cursor-based pagination request parameters.
    v1ThreatIndicator:
      type: object
      properties:
        id:
          type: string
          description: UUID assigned by the platform.
        type:
          $ref: '#/components/schemas/v1IndicatorType'
        value:
          type: string
          description: >-
            Normalized observable value, e.g. "203.0.113.7" or a lowercase
            SHA-256.
        categories:
          type: array
          items:
            $ref: '#/components/schemas/v1ThreatCategory'
        severity:
          $ref: '#/components/schemas/v1Severity'
        confidenceScore:
          type: integer
          format: int64
          description: >-
            Confidence in [0, 100]; computed by domain rules, adjusted by
            enrichment.
        tlp:
          $ref: '#/components/schemas/v1TlpMarking'
        state:
          $ref: '#/components/schemas/v1IndicatorState'
        firstSeen:
          type: string
          format: date-time
        lastSeen:
          type: string
          format: date-time
        validUntil:
          type: string
          format: date-time
          description: After this instant the indicator is considered stale.
        sources:
          type: array
          items:
            $ref: '#/components/schemas/v1ThreatSource'
        sightings:
          type: array
          items:
            $ref: '#/components/schemas/v1Sighting'
        enrichment:
          $ref: '#/components/schemas/v1Enrichment'
        tags:
          type: array
          items:
            type: string
        labels:
          type: array
          items:
            $ref: '#/components/schemas/commonV1Label'
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        protocol:
          $ref: '#/components/schemas/v1Protocol'
        sensorType:
          $ref: '#/components/schemas/v1SensorType'
      description: A threat indicator (IOC) — the core entity of the platform.
    v1PageInfo:
      type: object
      properties:
        nextPageToken:
          type: string
          description: Cursor to fetch the next page; empty when there are no more results.
        totalCount:
          type: string
          format: uint64
          description: Total number of items matching the query, if cheaply computable.
      description: Pagination metadata returned with list responses.
    protobufAny:
      type: object
      properties:
        '@type':
          type: string
      additionalProperties: {}
    v1IndicatorType:
      type: string
      enum:
        - INDICATOR_TYPE_UNSPECIFIED
        - INDICATOR_TYPE_IPV4
        - INDICATOR_TYPE_IPV6
        - INDICATOR_TYPE_DOMAIN
        - INDICATOR_TYPE_URL
        - INDICATOR_TYPE_FILE_HASH_MD5
        - INDICATOR_TYPE_FILE_HASH_SHA1
        - INDICATOR_TYPE_FILE_HASH_SHA256
        - INDICATOR_TYPE_EMAIL
        - INDICATOR_TYPE_CIDR
        - INDICATOR_TYPE_JA3
        - INDICATOR_TYPE_SSL_CERT_FINGERPRINT
      default: INDICATOR_TYPE_UNSPECIFIED
      description: Kind of observable the indicator describes.
    v1ThreatCategory:
      type: string
      enum:
        - THREAT_CATEGORY_UNSPECIFIED
        - THREAT_CATEGORY_MALWARE
        - THREAT_CATEGORY_PHISHING
        - THREAT_CATEGORY_COMMAND_AND_CONTROL
        - THREAT_CATEGORY_BOTNET
        - THREAT_CATEGORY_SCANNER
        - THREAT_CATEGORY_SPAM
        - THREAT_CATEGORY_BRUTE_FORCE
        - THREAT_CATEGORY_EXPLOIT
        - THREAT_CATEGORY_TOR_EXIT_NODE
        - THREAT_CATEGORY_PROXY
      default: THREAT_CATEGORY_UNSPECIFIED
      description: Threat classification of the indicator.
    v1Severity:
      type: string
      enum:
        - SEVERITY_UNSPECIFIED
        - SEVERITY_INFO
        - SEVERITY_LOW
        - SEVERITY_MEDIUM
        - SEVERITY_HIGH
        - SEVERITY_CRITICAL
      default: SEVERITY_UNSPECIFIED
      description: Severity of the threat the indicator represents.
    v1IndicatorState:
      type: string
      enum:
        - INDICATOR_STATE_UNSPECIFIED
        - INDICATOR_STATE_RAW
        - INDICATOR_STATE_SCORED
        - INDICATOR_STATE_ENRICHED
        - INDICATOR_STATE_VERIFIED
      default: INDICATOR_STATE_UNSPECIFIED
      description: >-
        Pipeline lifecycle state of an indicator: Raw → Scored → Enriched →
        Verified.

         - INDICATOR_STATE_RAW: Sensor event received, nothing computed yet.
         - INDICATOR_STATE_SCORED: pipeline-worker computed the confidence score.
         - INDICATOR_STATE_ENRICHED: ai-enricher attached MITRE ATT&CK context.
         - INDICATOR_STATE_VERIFIED: Confirmed by a human analyst.
    v1TimeWindow:
      type: object
      properties:
        start:
          type: string
          format: date-time
        end:
          type: string
          format: date-time
      description: Half-open time interval [start, end).
    v1Protocol:
      type: string
      enum:
        - PROTOCOL_UNSPECIFIED
        - PROTOCOL_MODBUS
        - PROTOCOL_DNP3
        - PROTOCOL_BACNET
        - PROTOCOL_S7
        - PROTOCOL_OPC_UA
        - PROTOCOL_SSH
        - PROTOCOL_HTTP
        - PROTOCOL_FTP
        - PROTOCOL_TELNET
        - PROTOCOL_SNMP
      default: PROTOCOL_UNSPECIFIED
      description: Network protocol the observed activity used.
    v1SensorType:
      type: string
      enum:
        - SENSOR_TYPE_UNSPECIFIED
        - SENSOR_TYPE_ICS
        - SENSOR_TYPE_NETWORK
        - SENSOR_TYPE_ENDPOINT
      default: SENSOR_TYPE_UNSPECIFIED
      description: |-
        Kind of sensor that produced an event.

         - SENSOR_TYPE_ICS: Industrial control system honeypot (Conpot etc.).
         - SENSOR_TYPE_NETWORK: Generic network honeypot.
         - SENSOR_TYPE_ENDPOINT: Endpoint / host-based sensor.
    v1TlpMarking:
      type: string
      enum:
        - TLP_MARKING_UNSPECIFIED
        - TLP_MARKING_CLEAR
        - TLP_MARKING_GREEN
        - TLP_MARKING_AMBER
        - TLP_MARKING_AMBER_STRICT
        - TLP_MARKING_RED
      default: TLP_MARKING_UNSPECIFIED
      description: Traffic Light Protocol 2.0 sharing marking.
    v1ThreatSource:
      type: object
      properties:
        id:
          type: string
          description: >-
            Stable source identifier, e.g. "edge-honeypot-eu-1" or
            "abusech-urlhaus".
        name:
          type: string
          description: Human-readable source name.
        reliability:
          type: number
          format: double
          description: Reliability score of the source in [0.0, 1.0].
        reportedAt:
          type: string
          format: date-time
          description: When this source first reported the indicator.
      description: Origin feed or sensor that reported an indicator.
    v1Sighting:
      type: object
      properties:
        sourceId:
          type: string
          description: Source that observed the indicator.
        observedAt:
          type: string
          format: date-time
        count:
          type: string
          format: uint64
          description: Number of occurrences aggregated into this sighting.
      description: A single observation of the indicator in the wild.
    v1Enrichment:
      type: object
      properties:
        geo:
          $ref: '#/components/schemas/v1GeoLocation'
        asn:
          $ref: '#/components/schemas/v1AsnInfo'
        reverseDns:
          type: string
          description: Reverse DNS name, when resolvable.
        malwareFamilies:
          type: array
          items:
            type: string
          description: Related malware family names, if attributed.
        attackTechniques:
          type: array
          items:
            type: string
          description: MITRE ATT&CK technique IDs, e.g. "T1071.001".
        aiSummary:
          type: string
          description: AI-generated analyst summary of the threat context.
        riskScore:
          type: number
          format: double
          description: Model-assessed risk score in [0.0, 1.0].
        enrichedAt:
          type: string
          format: date-time
      description: Enrichment data attached to an indicator by the enrichment pipeline.
    commonV1Label:
      type: object
      properties:
        key:
          type: string
        value:
          type: string
      description: Free-form key/value label attached to an entity.
    v1GeoLocation:
      type: object
      properties:
        countryCode:
          type: string
        city:
          type: string
        latitude:
          type: number
          format: double
        longitude:
          type: number
          format: double
      description: Geolocation resolved for a network indicator.
    v1AsnInfo:
      type: object
      properties:
        number:
          type: integer
          format: int64
        organization:
          type: string
      description: Autonomous system information for a network indicator.
  securitySchemes:
    BearerAuth:
      type: apiKey
      description: 'WorkOS JWT or machine API key: Bearer <token>'
      name: Authorization
      in: header

````