# Threatline

> Source-linked vulnerability and patch intelligence for people and agents: CISA KEV exploitation, EPSS, affected and fixed versions, merged from five public sources.

Threatline is a static, public, read-only API on the Internet Computer. No credentials.
Query strings are ignored. Read source health before treating a snapshot as current.
Snapshot: 2026-10-24T00:31:04.721601Z. Records: 19522.

## Start here

- [Agent skill](https://threatline.ai/.well-known/skills/threatline-feed/SKILL.md): workflow, fields, evidence rules
- [Skill index](https://threatline.ai/.well-known/skills/index.json): name, description, hash
- [Documentation for people](https://threatline.ai/agents/): the same skill as a web page
- [API index](https://threatline.ai/api/v1/index.json): every endpoint and feed

## Data

- [Source health](https://threatline.ai/api/v1/health.json)
- [Catalog](https://threatline.ai/api/v1/catalog.json): compact index of every record
- [Record](https://threatline.ai/api/v1/cve/CVE-2024-4577.json): full record by ID, `/api/v1/cve/{id}.json`
- [Incidents](https://threatline.ai/api/v1/incidents.json): curated service disruption reports
- [Signals](https://threatline.ai/api/v1/signals.json): unconfirmed reports from security sources, grouped by CVE, each with its link
- [Daily brief](https://threatline.ai/api/v1/brief.json): per day, what changed that matters; also an Atom feed at /feeds/brief/atom.xml
- [Products](https://threatline.ai/api/v1/products.json): products people run, each with an Atom feed of new vulnerabilities, exploitation reports and fixes
- [Supply chain](https://threatline.ai/api/v1/compromises.json): hijacked package releases and compromised vendor services, with what to do
- [Campaigns](https://threatline.ai/api/v1/campaigns.json): which CVEs named operations used, per published research

## Feeds

- [Latest changes](https://threatline.ai/feeds/latest/atom.xml): Atom; also /feeds/latest/rss.xml and /feeds/latest/feed.json
- [Known exploited](https://threatline.ai/feeds/exploited/atom.xml): Atom; also /feeds/exploited/rss.xml and /feeds/exploited/feed.json
- [Ransomware use](https://threatline.ai/feeds/ransomware/atom.xml): Atom; also /feeds/ransomware/rss.xml and /feeds/ransomware/feed.json
- [Fix available](https://threatline.ai/feeds/fixes/atom.xml): Atom; also /feeds/fixes/rss.xml and /feeds/fixes/feed.json
- [Critical severity](https://threatline.ai/feeds/critical/atom.xml): Atom; also /feeds/critical/rss.xml and /feeds/critical/feed.json