Summarize the STIX feed
stix-feed-summarySummarizes what is in the feed right now: useful for "what's active this week", feed freshness, or planning SIEM / blocklist ingestion.
Shape report on the most recent 5,000 indicators in the DugganUSA STIX 2.1 feed, bounded to a 1-7 day window. Returns how many of those fall in the window (capped at 5,000), the top malware families or list labels (feeds such as Spamhaus DROP label by list, not family), top source feeds, a breakdown by indicator type, and top countries when the records carry one.
Useful before pulling the full STIX bundle, to gauge feed depth and freshness, plan a SIEM ingestion budget, or check that a campaign is in the corpus.
Does not return the full bundle (STIX 2.1 / TAXII 2.1), which is at bundle_url in the response and needs an API key.
Public read (no auth), cached for 10 minutes. The full bundle needs a free API key.
Example: {"days": 7} returns the last week's feed shape — useful for capacity planning and spot-checking recent ingest tags.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Lookback window in days (1–7). Default 1. |