Get OSINT Corroboration
get_osintRead-onlyIdempotent
Corroborate a threat ID or IOC against community OSINT data. Returns tags, indicator sightings, reporters, and linked threats, including whether the community saw the indicator before your report.
Instructions
Community corroboration for a threat or an indicator from the TL_OSINT_Scan layer (tweetfeed.live, CC0). Given threat_id, returns the matched community tags, the corroborated indicator count, and whether the community saw an indicator BEFORE our report. Given ioc_value, returns sightings, reporters, tags and every linked threat. Community-sourced and heavily concentrated (~73% of recent submissions come from a single reporter) — treat as corroborating evidence, never as authoritative attribution.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ioc_value | No | Exact indicator (IP, domain, URL, MD5 or SHA256). Returns the community lookup + our linked threats. | |
| threat_id | No | Threat ID (e.g. TL-2026-1531). Returns the per-threat corroboration block. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| value | No | Present on the per-IOC shape (ioc_value input). | |
| scanned | No | ||
| lead_days | No | Days the community saw an indicator before our report. | |
| reporters | No | ||
| threat_id | No | Present on the per-threat shape. | |
| threat_ids | No | ||
| corroborated | No | ||
| matched_tags | No | ||
| indicator_count | No | ||
| community_seen_before_report | No |