Sales
Threat Intelligence Automation: A Practical Guide for MSPs
Threat intelligence automation stopped being a nice-to-have when security teams lost the ability to keep up manually. The market itself makes that clear.
Integrations
Webhooks, REST API and Threat Feeds
New findings from every module are sent to your SIEM, ticketing or chat tools as webhook events, a REST API gives your own tools access to your data, and daily blocklists send known threats to firewalls and intrusion detection systems.
Where new findings are sent
InsecureWeb- SIEMWebhook
- TicketingWebhook
- ChatWebhook
- Firewall and IDSDaily blocklist
- Webhook retries
- Up to 10
- Records per request
- 10,000
- Blocklists updated
- Daily
Webhooks with retries
Up to 10,000 records per request, and retries for up to 10 attempts when your endpoint is down.
REST API keys you control
Name each key, limit it to your IP addresses, set an expiry date and see every call it made.
Feeds for your defenses
Malicious IPs, domains, hostnames and malware hashes, updated daily.
Webhooks
Choose one endpoint, add custom headers (secrets are masked), and send a test. New results for dark web, company impersonation, threat intelligence, vulnerability monitoring and Reputation Shield arrive as events, and the delivery log shows each attempt with its status. Receiver examples are provided in Node.js, Go, Python and Java.
- One event ID shared by every page of a large delivery
- Automatic retries about every 10 minutes on timeouts and gateway errors
- Penetration test events are coming soon
REST API
Create keys from the developer page, limit each one to the IP addresses or ranges you trust, and give it an expiry date. The usage log shows every call — method, endpoint, status, time and address. The interactive documentation lists every endpoint.
Threat intelligence feeds
Download the cumulative lists once a day with the commands the app gives you in Bash, Python or PowerShell. Guides cover Suricata, Cisco, Fortinet and Wazuh, and the lists are plain text for anything else.
Questions about Webhooks, API and feeds
Is there a native Slack or Microsoft Teams integration?
Not yet. Send webhooks to an automation tool or a small receiver that posts to your chat.
Which plans include webhooks?
Webhooks are available on paid and pay-as-you-go accounts for companies and MSPs.
Where is the API documentation?
In the app, under For Developers, and at the interactive documentation linked from this page.
Works well with
-
Threat Intelligence
Map your subdomains, open services, certificates, technologies and exposed people, score each domain from 0 to 100, and feed known threats to your firewall.
Multi-client workspace
Manage hundreds of client organizations from one InsecureWeb account, with view-only client users, per-client reports and billing, and a fully white-labeled console.
-
Dark Web Monitoring
Monitor breach dumps, paste sites and criminal markets for your domains, emails, IPs, usernames and phones, and work every exposure to closed.
Further reading
Data Breach News
10 API Security Best Practices for 2026
A single integration can connect your security platform to threat intelligence, vulnerability findings, and monitoring workflows across multiple client environments.
Sales
24/7 Threat Monitoring: A Guide for MSPs and Businesses
It's 3:07 AM on a Saturday. A client's remote access account starts pulling data it never touches, then a server begins spawning processes nobody on the day team would approve. No one's at a desk. No one's watching the dashboard.
Find out what an attacker would find first
Create a free account, add your domain and see your leaked credentials, lookalike domains and exposed services. No card required.