# TeleSint Cross-Category Threat Intelligence Search > TeleSint Cross-Category Threat Intelligence Search is a paid API for AI agents from telesint-api.onrender.com, paid per call via x402, $0.04/call, status unknown (last checked 2026-09-15). Searches across all Telegram-sourced CTI categories (IOCs, actors, breaches, vulnerabilities, malware, etc.) using keywords, tags, MITRE ATT&CK techniques, and filters to return AI-enriched threat intelligence records ## Facts - Endpoint: GET https://telesint-api.onrender.com/search - Price: $0.04/call - Payment: x402 - Status: unknown - Last checked: 2026-09-15 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/telesint-cross-category-threat-intelligence-search-746ff158 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_VMv9Md3roFz3DeBv1vpl4 Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability telesint-cross-category-threat-intelligence-search-746ff158 ``` Example prompt: Search TeleSint for recent critical-severity threat intelligence about LockBit ransomware targeting the finance sector — show me the top 20 results with at least 70 confidence, from the last 30 days. ## When to prefer this Use this endpoint when you need a broad, cross-category search across all CTI data types at once — ideal when you don't know which specific category (IOC, actor, breach, vulnerability) a threat falls into, or when you want to correlate signals across multiple categories. Prefer the specialized sibling endpoints (ioc, actor, breach, etc.) when you know the exact category for more targeted results. ## Known failure modes - Payment not received — 402 response if USDC micropayment on Base is not completed - Invalid query parameters — 400 if enum values like category or severity are not from allowed set - No results found — empty items array with total=0 when no records match the filters - Rate limiting or server overload — 429 or 503 from Render.com hosting - since parameter malformed — 400 if ISO 8601 timestamp is not correctly formatted - min_confidence out of range — 400 if value is not between 0 and 100 ## How this service works Cross-category pivot across all TeleSint intel. Use ?q= for broad keyword or combine filters: category, severity, sector, country, tag, ttp, name, organization, min_confidence, since. Returns items[] across any category. ## Output A paginated JSON array of threat intelligence records, each containing: unique ID, timestamp, TLP classification, IOCs with context, MITRE ATT&CK TTP tags, source Telegram channel, AI-generated summary, category, severity, and confidence score (0-100). Also includes total count, limit, and offset for pagination. ## Example request ```json { "input": { "type": "http", "method": "GET", "queryParams": { "q": "lockbit", "tag": "ransomware", "limit": 20, "offset": 0, "category": "actor", "severity": "high", "min_confidence": 70 } } } ``` ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "q": { "type": "string", "description": "Broad keyword search across tags and summaries, e.g. lockbit, lazarus, cve-2026" }, "tag": { "type": "string", "description": "Tag keyword filter, e.g. ransomware, apt, cobalt-strike" }, "ttp": { "type": "string", "description": "MITRE ATT&CK technique ID prefix, e.g. T1059" }, "name": { "type": "string", "description": "Actor name partial match, e.g. lazarus, sandworm" }, "limit": { "type": "number", "description": "Page size, default 20, max 100" }, "since": { "type": "string", "description": "ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z" }, "offset": { "type": "number", "description": "Pagination offset, default 0" }, "sector": { "type": "string", "description": "Target sector: finance | healthcare | government | energy | retail" }, "country": { "type": "string", "description": "Target country keyword, e.g. us | uk | de | fr" }, "category": { "type": "string", "description": "Narrow to one category: ioc | c2 | actor | breach | intent | vulnerability" }, "severity": { "type": "string", "description": "Minimum severity: critical | high | medium | low | info" }, "organization": { "type": "string", "description": "Target organization name partial match" }, "min_confidence": { "type": "number", "description": "Minimum AI confidence score 0-100" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object" } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "items": [ { "id": "s1e2a3r4-c5h6-7890-abcd-search789012", "ts": "2026-05-27T12:00:00Z", "tlp": "WHITE", "iocs": [ { "type": "url", "value": "https://lockbit3[.]onion/leak/fin-data", "context": "Ransomware leak site" } ], "tags": [ "lockbit", "ransomware", "finance", "data-leak" ], "ttps": [ { "id": "T1486", "name": "Data Encrypted for Impact", "tactic": "Impact" } ], "channel": "https://t[.]me/cyberinsider", "summary": "LockBit claims breach of US financial institution — 2.4M records including SSNs and account numbers", "category": "breach", "severity": "critical", "confidence": 82 } ], "limit": 20, "total": 12, "offset": 0, "source": "TeleSint", "endpoint": "search" } } ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/telesint-cross-category-threat-intelligence-search-746ff158/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from telesint-api.onrender.com](https://www.zero.xyz/host/telesint-api.onrender.com/llms.txt)