Skip to main content
Reyhford delivers ICS/OT threat intelligence collected from internet-facing honeypot sensors, enriched into STIX 2.1, and published via TAXII 2.1 and REST. Owned observation capacity today is in Southeast Asia (Singapore). The network grows as customers enroll optional sensors under contribution terms.

​
What you get

Install a Sensor

Optional: portal → install.sh → contribute + private org TAXII collection.

ICS/OT Threat Intelligence

Threat landscape, industrial protocols, MITRE ATT&CK for ICS context, STIX/TAXII.

TAXII 2.1 feed

STIX 2.1 bundles via TAXII 2.1 — use with any TAXII client.

Indicators REST API

Search indicators with filters for protocol, confidence, and time range.

​
Base URL

Authenticate with Authorization: Bearer <api-key> from portal.reyhford.com.

​
Retention

Raw events and STIX bundles are retained for 90 days.

​
Support