Know what each site is before your endpoint agent connects.
Your agent already sees each domain and IP a device reaches. The question is what kind of site it is, and how risky it is, before the connection opens. License our category and threat data, keep a local copy, and look up the rest.
Endpoint threat intelligence is content categories for domains, URLs and millions of IPs, plus risk scores for domains, URLs and IPs, that endpoint security products check when a device connects. alphaMountain licenses it to endpoint vendors as URL Classification (92 content categories), Threat Feed (a 1.0 to 10.0 risk score) and Domain/IP reputation factors. Available as OEM, white label or co-branded. See how OEM licensing works.
Endpoints see IPs, not just URLs.
Web filtering starts from URLs. An endpoint agent also sees programs that connect straight to an IP address. Our data covers both:
- Domains and URLs: a risk score plus one of 92 content categories.
- IP addresses: a risk score, plus a content category for a subset of IPs, so a connection with no domain name still gets checked.
- Reputation factors: registration records, popularity and DNS history that show why a score is high.
A score of 1.0 is very safe and 10.0 is known malicious. Your product decides what to block, warn on or log.
Keep the data where your agents can reach it.
The Batch API sends batch updates to your local database (DB) copy every hour, delivered as Category Batch or Threat Batch. Run the copy as a database that your agents query. We don't recommend running it on an endpoint machine. You choose how your agents cache results. Everyday lookups don't wait on our cloud.
Anything your copy hasn't seen goes to the Query API, one lookup at a time. If you only want new findings, Threat Feed sends them in the score range you pick, 7.0 and up by default.
The number of endpoints decides API or batch.
Every device makes lookups, so the numbers add up fast.
- Up to about 100,000 lookups a day: the Query API alone fits.
- Above that: we recommend batch. The Query API handles up to 300,000 a day, but your local DB copy keeps response time under your control.
Pick the licensing model that matches your sales.
Choose royalty or consumption pricing. License the threat database, the category database, or both as a bundle.
Test it on your own devices first.
Start with a free trial, and we'll help you run a proof of value. For a quick check today, search a domain in threatYeti. We score domains, URLs and IPs. We don't analyze files, so file verdicts stay with your own engine.
FAQ
Can we score IP addresses, not just domains?
Yes. Risk scores cover domains, URLs and IPs. Content categories cover domains and URLs, plus a subset of IPs.
What if a domain isn't in our local DB copy?
Your product looks it up with the Query API, one lookup at a time.
Where should the local DB copy run?
Run it as a database that your agents query, not on an endpoint machine. Your agents check that database first, so everyday lookups stay fast and under your control, and anything it hasn't seen goes to the Query API.
How fresh is our local DB copy?
It gets batch updates every hour.
Bring your endpoint count.
Tell us how many endpoints run your agent and how many lookups they make a day. We'll match the products, delivery and licensing to it.