Feed documentation

What your plan includes

Plan	TAXII 2.1	HTTPS download	Reports (PDF)
Researcher	no	profiles, infrastructure	no
Executive brief	no	no	account page
Organization	profiles, infrastructure	same	account page, download, TAXII
Organization + Detection	+ detection content	same	account page, download, TAXII
MSSP	profiles, infrastructure, detection	same	account page, download, TAXII

Everything is STIX 2.1. Detection content means deployable rules and hunting queries (YARA, Sigma, Suricata and SIEM queries). Details and licenses are on the plans page.

Your account

Sign in at https://feeds.knownexploited.com/account/ (also the Sign in button on the plans page) with the email and password you signed up with. There you can:

• create an API token for each platform, with a label so you know which is which;
• revoke tokens, and rotate them: create a new one, switch your platform to it, revoke the old one;
• download the reports your plan includes;
• change your password, and find your customer ID (needed only for HTTP Basic auth).

A new token is shown once, in a popup, right after you create it. Copy it into your platform's secret store before closing the popup. Tokens are stored only as hashes, so a lost token can't be recovered: revoke it and create a new one. Forgot your password? Use Forgot your password? on the sign-in page.

Authentication

Platforms authenticate with an API token, never with your account password. Send it as a bearer token, or with HTTP Basic auth using your customer ID as the username and the token as the password. Use whichever your client supports.

Authorization: Bearer ke_…
Authorization: Basic base64(cus_…:ke_…)

401	Missing, unknown or revoked token, or your access has ended.
403	Not part of your plan. Unknown collection IDs also return 403.
429	More than 120 requests per minute with one token. Wait a minute and retry.

TAXII 2.1

Organization and MSSP plans. Read-only.

Discovery	https://feeds.knownexploited.com/taxii2/
API root	https://feeds.knownexploited.com/api/

Subscribe to Everything in your plan: one collection with every actor and every type of content your plan includes, plus one report per actor ("<Actor> pack") that groups all of it. Executive reports arrive in it too, each as a STIX report with the PDF attached. New actors and updates appear automatically; you never need to add a feed per actor.

If you'd rather route content types separately (for example detection content to a different platform), subscribe to the per-type collections instead. Each carries its own report per actor ("<Actor> – infrastructure"). Use one approach or the other, not both, or every object arrives twice. GET https://feeds.knownexploited.com/api/collections/ lists the collections your token can read.

Collection	ID	Plans
Everything in your plan (recommended)	d9d4ae20-3558-5dbf-be39-dfaf11351c78	Organization, MSSP
Actor profiles	0df57e83-b655-530a-8c90-cd9286a2dd27	Organization, MSSP
Live infrastructure	c365561e-89a9-514b-bb0b-4640c75c0d6e	Organization, MSSP
Detection content	6deccb09-74bf-5794-b807-683e1cfdafc1	Organization + Detection, MSSP

Endpoints

GET /api/collections/	Collections your token can read
GET /api/collections/{id}/objects/	Objects, oldest first
GET /api/collections/{id}/objects/{object-id}/	One object
GET /api/collections/{id}/manifest/	IDs, versions and date_added, without the objects

Objects are returned in the order they were added, 500 per page by default (limit up to 1000). Follow next while more is true. To fetch only what's new, poll with added_after set to the X-TAXII-Date-Added-Last header of your previous response. match[id] and match[type] filter by comma-separated values.

curl -H "Authorization: Bearer $KE_TOKEN" \
  "https://feeds.knownexploited.com/api/collections/d9d4ae20-3558-5dbf-be39-dfaf11351c78/objects/?added_after=2026-10-01T00:00:00Z"

OpenCTI

1. Go to Data → Ingestion → TAXII feeds and create a feed.
2. Server URL https://feeds.knownexploited.com/api/, version 2.1, collection d9d4ae20-3558-5dbf-be39-dfaf11351c78 (Everything in your plan).
3. Authentication: Bearer token with your API token, or Basic with your customer ID and API token.
4. Leave the start date empty to import everything, then start the feed. Each actor arrives as one report ("<Actor> pack") holding everything your plan includes for it, and the report updates when the actor does.

Field names differ slightly between OpenCTI versions. Any TAXII 2.1 client (MISP, Microsoft Sentinel's TAXII connector, taxii2-client) works with the same URL and credentials.

HTTPS downloads

Researcher, Organization and MSSP plans: the same content as TAXII, as plain files for tools without a TAXII client. Start with the index, which lists every actor, file and report your token can read:

curl -H "Authorization: Bearer $KE_TOKEN" https://feeds.knownexploited.com/download/

Then fetch an actor by the slug from the index, either everything your plan includes or one content type (profile, infra or detection):

curl -H "Authorization: Bearer $KE_TOKEN" -OJ https://feeds.knownexploited.com/download/$SLUG.json
curl -H "Authorization: Bearer $KE_TOKEN" -OJ https://feeds.knownexploited.com/download/infra/$SLUG.json

Files are STIX 2.1 bundles, ready to import into OpenCTI (Data → Import), MISP or any STIX tool. Reports are listed under reports in the index and are also on your account page.

Updates

Infrastructure is re-checked every day; profiles and detection content change when there's something new. Updated objects keep their STIX ID and get a newer modified date, so your platform updates them in place. Infrastructure indicators carry valid_until and a confidence score: treat expired ones as historical, not as something to block.

Questions and corrections

Something wrong or unclear? Write to feeds@knownexploited.com. Corrections to published infrastructure are handled first.