> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Reyhford global ICS/OT threat intelligence — TAXII 2.1 feed and REST indicators API.

Reyhford delivers **real-time threat intelligence** from a distributed honeypot network across Southeast Asia and beyond. Indicators are enriched with MITRE ATT\&CK for ICS mappings, CVE context, and IP reputation before delivery.

## What you get

<CardGroup cols={2}>
  <Card title="TAXII 2.1 feed" icon="rss" href="/api-reference/taxii/discovery">
    STIX 2.1 bundles via standard TAXII 2.1 endpoints — compatible with any TAXII client.
  </Card>

  <Card title="Indicators REST API" icon="magnifying-glass" href="/api-reference/indicators/search">
    Search and retrieve enriched indicators with filters for protocol, confidence, sensor type, and time range.
  </Card>
</CardGroup>

## Architecture

```
Honeypot sensors → Pub/Sub → Pipeline → Enrichment → ClickHouse → API Gateway → You
```

| Layer       | Technology                                                |
| ----------- | --------------------------------------------------------- |
| Ingest      | GCP Pub/Sub from edge honeypots (Conpot, Cowrie, Dionaea) |
| Enrichment  | Deterministic MITRE/CVE mapping + IP reputation           |
| Storage     | ClickHouse                                                |
| Gateway     | Zuplo (`api.reyhford.com`) with API keys and WorkOS JWT   |
| Feed format | STIX 2.1 over TAXII 2.1                                   |

## Base URL

All API requests use:

```
https://api.reyhford.com
```

## Support

* Email: [api@reyhford.com](mailto:api@reyhford.com)
* Status: [status.reyhford.com](https://status.reyhford.com)
* Get access: [app.reyhford.com](https://app.reyhford.com)