# NuLL — Security API Source Catalog

This is a curated reference of real security-related APIs and platforms you can
wire into the connector framework (`/connectors/manifests/`). **25 of these are
already built as working manifests** (see `connectors/manifests/*.json` and run
`connectors` in the terminal to see their status).

For every other entry: search "`<name>` API docs" to find current signup and
documentation pages — vendors change URLs often enough that hardcoding all 200+
here would go stale. Where a manifest already exists, the exact docs/signup URL
is in that JSON file and visible via the `connectors` command.

To wire up a new one yourself: copy `connectors/manifests/virustotal.json`,
change the `base_url`, `auth_type`, and `endpoints`, save it with the service's
key as the filename, then run `admin api setkey <key> <your_api_key>` in the
terminal.

## Threat Intelligence
VirusTotal✅, AlienVault OTX✅, GreyNoise✅, ThreatFox✅, Pulsedive✅, MITRE ATT&CK✅,
IBM X-Force Exchange, Recorded Future, ThreatConnect, Anomali, MISP (self-hosted,
open source), CIRCL MISP feeds, abuse.ch Feodo Tracker, abuse.ch SSL Blacklist,
Cisco Talos Intelligence, Team Cymru, Shadowserver, Spamhaus, Team CYRU IP Rep,
CINS Score, Blocklist.de, FireHOL IP Lists, Emerging Threats (Proofpoint ET),
Google Safe Browsing, Microsoft Defender Threat Intelligence, Mandiant Advantage,
CrowdStrike Falcon Intelligence, Group-IB Threat Intelligence, Intezer, Hybrid
Analysis, Any.Run, Joe Sandbox, Cuckoo Sandbox (self-hosted), ReversingLabs.

## Malware & File Analysis
VirusTotal✅, URLhaus✅, MalwareBazaar✅, urlscan.io✅, Hybrid Analysis, Any.Run,
Joe Sandbox Cloud, Triage (recorded future/hatching), Cuckoo Sandbox, ClamAV
(local scan engine, no API needed), MetaDefender Cloud (OPSWAT), Yara rules
repos (Yara-Rules Project, GitHub), Malshare, VxCube, Cape Sandbox.

## IP / Network Intelligence
AbuseIPDB✅, GreyNoise✅, ipinfo.io✅, IPQualityScore✅, Shodan✅, Censys✅,
BGPView, Team Cymru IP-ASN mapping, MaxMind GeoIP2, IP2Location, DB-IP,
ProxyCheck.io, IPHub, ipapi.co, ipgeolocation.io, FraudGuard, X-Force Exchange
IP Reputation, Talos IP Reputation Center, Norse Intel (legacy), Onyphe.

## DNS, SSL & Domain
crt.sh✅, SSL Labs✅, Google DNS-over-HTTPS✅, WhoisXML API✅, SecurityTrails,
DNSDB (Farsight), PassiveTotal (RiskIQ/Microsoft), DomainTools, Cloudflare DNS
over HTTPS, Quad9 DoH, Mnemonic PassiveDNS, RiskIQ Community, BuiltWith,
Wappalyzer API, Netcraft Site Report, Censys Certificates, DNSlytics,
DNSChecker.org, ViewDNS.info, DNSdumpster (web tool), SSLShopper, Qualys SSL
Labs Community.

## Data Breach & Leak Checking
Have I Been Pwned✅, EmailRep.io✅, BreachDirectory✅, DeHashed, LeakCheck,
Breach-Parse (self-hosted tools), Firefox Monitor (Mozilla, powered by HIBP),
IntelligenceX, SpyCloud, Snusbase.

## Email Security
EmailRep.io✅, Hunter.io (email finder/verifier), MailboxLayer, Abstract Email
Validation, ZeroBounce, Kickbox, Proofpoint Email Protection API, Mimecast API,
DMARC Analyzer, DMARCian, MXToolbox, Sender Score (Return Path).

## Vulnerability & CVE Databases
NVD / NIST✅, MITRE CVE, CVE Details (web), Vulners.com, OSV.dev (Open Source
Vulnerabilities), GitHub Security Advisories API, Snyk Vulnerability DB,
Exploit-DB (Offensive Security), Rapid7 AttackerKB, VulDB, CISA Known
Exploited Vulnerabilities (KEV) catalog, EPSS (Exploit Prediction Scoring
System), Tenable.io, Qualys VMDR API, Nessus (self-hosted).

## OSINT & Recon
Shodan✅, Censys✅, GitHub Code Search✅, Numverify✅, theHarvester (self-hosted
tool), SpiderFoot (self-hosted / SaaS), Maltego Transform Hub, Pipl, FullContact,
Clearbit, Hunter.io, Social Searcher, WhatsMyName, Sherlock (self-hosted
username search), Have I Been Pwned domain search, LinkedIn Sales Navigator API
(restricted), Twitter/X API v2, Reddit API, Pastebin scraping tools (PasteHunter),
Google Custom Search JSON API, Bing Web Search API.

## SIEM, Logging & Monitoring
Elastic Security / ELK Stack (self-hosted), Splunk REST API, Graylog API,
Wazuh (open-source SIEM/XDR), Microsoft Sentinel API, IBM QRadar API, Sumo
Logic, Datadog Security Monitoring, Grafana Loki, Panther Labs.

## Vulnerability / Web Scanners
OWASP ZAP (self-hosted, has REST API), Nikto (self-hosted CLI), Nuclei
(ProjectDiscovery, self-hosted + templates), Burp Suite REST API (Pro),
Acunetix API, Netsparker/Invicti API, Qualys WAS, Detectify API, probely.com
API, WPScan API (WordPress vulnerability DB), Sucuri SiteCheck.

## API Security Specific Tools
Salt Security, Noname Security, 42Crunch API Security Audit, APIsec, Wallarm,
Traceable AI, Cequence Security, StackHawk (DAST for APIs), Postman API
Security testing.

## Enterprise / Commercial Vendor Platforms
*(require paid contracts — connectors are optional and admin-configured)*
CrowdStrike Falcon API, Fortinet FortiGate/FortiAnalyzer API, Sophos Central
API, Trellix (formerly McAfee/FireEye) API, Darktrace Threat Visualizer API,
Vanta (compliance automation) API, Palo Alto Cortex XSOAR/XDR API, SentinelOne
API, Check Point Infinity Portal API, Zscaler API, Rapid7 InsightVM/InsightIDR,
Tenable.io, Cisco SecureX, Microsoft Defender for Endpoint API, Okta API
(identity security), Ping Identity API, Cloudflare API (WAF/DDoS), Akamai
Security API, Imperva API, F5 BIG-IP API.

## General API Marketplaces (browse for more)
RapidAPI.com (hundreds of security-tagged APIs), Postman Public API Network,
ProgrammableWeb (directory/archive), APIs.guru (OpenAPI directory).

## Security Tool Directories (browse, filter by category)
AlternativeTo (security tools), G2 Security Software category, SecTools.org
Top 125 Network Security Tools, OWASP Tools list, GitHub "awesome-security"
curated lists (e.g. awesome-osint, awesome-threat-intelligence, awesome-pentest).

---
### Notes on adding a connector
1. Confirm the API has a free tier or trial key.
2. Read its docs for auth style: header key, bearer token, or query param —
   the manifest's `auth_type` field must match.
3. Copy an existing manifest, adjust `base_url` and `endpoints`.
4. Insert a row in `api_connectors` (or use the admin panel once built) with
   `conn_key` matching the manifest filename.
5. `admin api setkey <key> <value>` in the terminal — the key is AES-256-GCM
   encrypted at rest, never stored in plaintext or logged.