Package: rstapi
rstapi-pythonPython 3 library for using the various threat intelligence RST Cloud APIs:RST Threat FeedRST Report HubRST Noise ControlRST IoC LookupRST Whois APIInstallationTo install with pip runpip install rstapiUsageSee GitHub sourcehttps://github.com/rstcloud/rstapi-pythonfor further details and example usage. The filetest.pyincludes examples.See RST Cloud API docs here:https://www.rstcloud.com/api-docs/An API token is required to use the RST Cloud API. You can request a RST Cloud API token by contactingtrial@rstcloud.net, generating it onlinehttps://www.rstcloud.com/#free-trial, or reaching out your account representative.The better way is to setup an environment variable RST_API_KEY and call it without specifing the key in the code.import rstapi
c = rstapi.ioclookup()
c.GetIndicator("1.1.1.1")However, you can explicitly pass a token in the api client constructor:import rstapi
c = rstapi.ioclookup(APIKEY="YOU_API_KEY")
c.GetIndicator("1.1.1.1")ProductsRST Threat FeedA comprehensive threat intel feed of indicators (IP, Domain, URL, Hash) with their relationships to malware, TTPs, tools, threat groups, sectors, CVE, and other objects.Compiled from over 260 sources, including Twitter, Telegram, online sandboxes (Any.Run, Hybrid Analysis, VMRay, etc.), threat reports, CERTs, malware research sites, GitHub, pastebin, closed sources and our global RST Honeypot network.Read more:https://www.rstcloud.com/rst-threat-feed/RST Report HubAn electronic library of threat reports from hundreds of security companies, individual researchers and cyber communities.These reports undergo transformation from human-readable formats to machine-readable ones, including STIX 2.1. Extensive multilingual translation, archiving as PDFs, and summarization are conducted. Key data, encompassing threat actors, names, software, CVEs, geolocation, industry, etc., is automatically extracted, with due credit to the original report author.Read more:https://www.rstcloud.com/rst-report-hub/RST Noise ControlA service that can be used with TIP, SOAR, or SIEM solutions to minimise the noise coming from False Positive indicators. Make sure that CDN IPs, known domains, common URLs, or hashes of calc.exe don’t trigger alerts.This API employs over 110 rulesets and incorporates 12 GB of individual exceptions, to check if indicators are “known-good” and to be considered noise.Read more:https://www.rstcloud.com/rst-noise-control/RST IoC LookupAn API to check individual values if they are a suspicious or malicious indicator (IP, Domain, URL, Hash). Offering dynamic scoring and automatic decay of outdated indicators, the service ensures fair request rate with low cost.Ideal for real-time checks in SOAR or be integration into custom applications for online user connection scrutiny.Read more:https://www.rstcloud.com/rst-ioc-lookup/RST Whois APIA service to get actual registration info in JSON format for a given domain without limitations on speed and no ban from WHOIS servers. The results include whenever possible:Data in a unified JSON formatRegistrar and registrant infoAge of the domainDates (registered, updated, expires)Raw response from WHOIS serversRead more:https://www.rstcloud.com/rst-whois-api/