# TheBotWire Threat Intelligence Feed

> TheBotWire Threat Intelligence Feed is a paid API for AI agents from thebotwire.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-13).

Returns latest vendor-published cybersecurity threat intelligence from sources like Talos, Unit 42, Check Point, SentinelOne, and MSRC, with optional keyword search and source filtering

## Facts

- Endpoint: GET https://thebotwire.com/threatintel/latest
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/thebotwire-threat-intelligence-feed-2d4e8ea8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_GDFkSp0u_A3TBouK_XSGM

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability thebotwire-threat-intelligence-feed-2d4e8ea8
```

Example prompt: Pull the latest threat intelligence from Unit 42 and SentinelOne from the past 24 hours — up to 20 results — and flag anything mentioning ransomware or new IOCs.

## When to prefer this

Choose this endpoint when you need curated, vendor-published threat intelligence (Talos, Unit 42, Check Point, SentinelOne, MSRC) rather than raw government CVE feeds or unfiltered news. It is ideal for SOC automation, IOC enrichment pipelines, and security research agents that need high-signal, practitioner-grade content rather than NVD/NIST firehose data. Prefer it over general news search endpoints when the user specifically needs cybersecurity vendor research or threat actor analysis.

## Known failure modes

- No results found for narrow query terms or very short freshness windows
- Invalid 'since' format (e.g. '1week' instead of '7d') may return an error or empty results
- Source enum mismatch if an unsupported source name is passed
- Rate limiting or payment failure at $0.005 per call via x402
- Stale content if vendor sources have not published recently

## How this service works

Vendor threat-intelligence research , Talos, Unit 42, Check Point, SentinelOne, MSRC. SOC automation vendors and MSSPs; IOC-enrichment agents. Unlike cve, this is vendor-published trade content, not a government firehose , nearer the co

## Output

A list of threat intelligence items from vendor sources (Talos, Unit 42, Check Point, SentinelOne, MSRC, etc.), each including title, source, publication timestamp, summary or excerpt, and relevant tags or IOC references. Results are filtered by source, keyword, and freshness window as requested.

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/thebotwire-threat-intelligence-feed-2d4e8ea8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from thebotwire.com](https://www.zero.xyz/host/thebotwire.com/llms.txt)