Native libraries for every runtime your team writes.

SHELLinstall
$ pip install threatdefendr

PYTHONtail high-severity events
from threatdefendr import Client

td = Client(token=os.environ["TD_TOKEN"], workspace="acme-prod")

for ev in td.events.tail(severity="HIGH"):
    print(ev.ts, ev.id, ev.actor.name, ev.enrichments.get("intel.adversary"))

SHELLinstall
$ pnpm add @threatdefendr/sdk

TYPESCRIPTcreate a case
import { Client } from "@threatdefendr/sdk";

const td = new Client({ token: process.env.TD_TOKEN!, workspace: "acme-prod" });

const { id } = await td.cases.create({
  severity:   "HIGH",
  title:      "Service account from corp egress",
  detections: ["det_2vK4nT"],
  owner:      "alex@acme.io",
});

console.log(`opened ` + id);

SHELLinstall
$ go get github.com/threatdefendr/go-sdk/v2

GOisolate a host
import td "github.com/threatdefendr/go-sdk/v2"

c := td.NewClient(td.Config{ Token: os.Getenv("TD_TOKEN"), Workspace: "acme-prod" })

resp, err := c.Contain.IsolateHost(ctx, td.IsolateHostInput{
    HostID:           "h_47193",
    Reason:           "IRONVEIL signed-driver match",
    RequiresApproval: false,
})

SHELLadd dep
$ cargo add threatdefendr

RUSTverify a webhook
use threatdefendr::webhooks::verify;

fn handle(req: Request) -> Result<(), Error> {
    verify(&WH_SECRET, req.body(), req.header("X-TD-Signature")?, req.header("X-TD-Timestamp")?)?;
    Ok(())
}

SHELLinstall
$ brew install threatdefendr/tap/td      # macOS · Linuxbrew
$ curl -fsSL https://td.sh/install | sh   # everywhere else

SHELLcommon commands
$ td events tail --severity=high
$ td detect deploy ./detections/
$ td case open --severity=HIGH --title="oncall handoff"
$ td contain isolate-host --id=h_47193
$ td adversary show IRONVEIL --iocs