CTIF

CTIF documentation

Everything the CTIF feed exposes is reachable over HTTPS with a single personal key. This page covers authentication, the endpoints, daily quotas, the firewall blocklist and the host agent.

Authentication

Every programmatic call carries your personal key in the X-CTIF-Key header. You generate and rotate the key on the Settings page of the dashboard. The key identifies your account, so it also carries your plan, quota and expiry.

curl -H "X-CTIF-Key: $CTIF_KEY" \
  https://ctif.orvteam.com/api/ioc/185.220.101.4

Firewalls that can only template a URL and cannot set a header may pass the key as a query parameter on the blocklist endpoint instead: ?key=…. Treat that URL as a secret.

Which plans include API access

Programmatic access (REST API, STIX export and the blocklist) is part of the SMB and SOC plans. Base and Free accounts use the dashboard. A key on a plan without API access gets a 403 api_not_in_plan.

Endpoints

IP enrichment

Returns everything CTIF knows about a single IPv4 address: geolocation, ASN and ISP, reverse DNS, RDAP and WHOIS, Tor exit status, the MITRE ATT&CK techniques observed, first and last sighting, and the hostility score from 0 to 100.

GET /api/ioc/{ip}
GET /api/whois/{ip}
GET /api/domain/{domain}

STIX 2.1 export

Returns a STIX 2.1 bundle for the indicator, ready to import into a TIP or a SIEM that speaks STIX. Available on SMB and SOC.

curl -H "X-CTIF-Key: $CTIF_KEY" \
  https://ctif.orvteam.com/api/stix/185.220.101.4 -o stix.json

Blocklist

Returns the scored blocklist as JSON, or as one IP per line with format=txt. Two parameters shape it: min_score (0-100, default 50) and limit (1-100000, default 10000).

GET /api/blocklist?format=txt&min_score=60&limit=10000

Quotas and errors

Each metered call counts against your plan’s daily cap, which resets at 00:00 UTC: Base 800, SMB 2,000, SOC 10,000 requests per day.

  • 401 api_key_required — no key was sent.
  • 403 invalid_api_key — the key does not match an account.
  • 403 api_not_in_plan — the plan has no programmatic access.
  • 403 subscription_expired — the subscription lapsed.
  • 429 daily_limit — the daily cap is spent; retry after 00:00 UTC.

Firewall blocklist (EDL)

Point an External Dynamic List on a Palo Alto, FortiGate or any firewall that can fetch a plain-text URL at the blocklist endpoint. No agent is involved: the firewall pulls the list on its own schedule and drops the traffic upstream of your network.

https://ctif.orvteam.com/api/blocklist?format=txt&min_score=60&key=YOUR_KEY

A daily pull is the right cadence. The list is rebuilt continuously from the live feed, and the hostility score decays as an address stops being seen, so stale entries fall out on their own.

Host agent

For Linux servers without a managed firewall, the CTIF agent pulls the same blocklist and applies it to a dedicated nftables table. There is no daemon: a systemd timer runs it daily with a randomized delay, and each run atomically replaces the ruleset, so a failed fetch keeps the previous one.

curl -fsSL https://ctif.orvteam.com/agent/install.sh | sudo sh
sudo vi /etc/ctif-agent/agent.conf     # CTIF_API_KEY, MIN_SCORE, MODE
sudo systemctl enable --now ctif-agent.timer

Set MODE=list-only to maintain the set without dropping anything while you evaluate the list, and MODE=enforce once you trust it. Start there: it is the honest way to see what the feed would have blocked before it blocks anything.

Read it before you run it

Piping a script into a root shell deserves scrutiny. Every file the installer writes is published with a SHA-256 checksum and verified before it lands on disk, so a truncated or swapped download aborts instead of installing. To audit first, download and check by hand:

curl -fsSL -O https://ctif.orvteam.com/agent/install.sh
curl -fsSL -O https://ctif.orvteam.com/agent/SHA256SUMS
curl -fsSL https://ctif.orvteam.com/agent/VERSION      # agent version
less install.sh                                        # read it
sha256sum -c SHA256SUMS --ignore-missing               # check what you downloaded
sudo sh install.sh

If you keep your own copy of a SHA256SUMS you have audited, point the installer at it with CTIF_AGENT_SUMS=/path/to/SHA256SUMS and the check no longer depends on what our server hands out that day. The agent is a plain POSIX shell script, around a hundred lines, with no daemon and no telemetry: one curl to our blocklist endpoint and one nft set replacement per run.

Splunk

The feed lands in Splunk as a lookup you join against your own events: schedule a pull of the scored CSV into a lookup table, then correlate it with firewall, VPN and authentication sources to surface hits with the CTIF hostility score attached. The Splunk guide has the cron entry, the transforms.conf stanza and a working search. Palo Alto, FortiGate, MISP, OpenCTI and the Linux agent each have their own guide.

Need help wiring it into your environment? Write to support@orvteam.com.