API & SIEM Integrations

api REST Ingestion Endpoint

Send custom intelligence, threat feeds, or suspected phishing targets detected in your network to the Tetik Threat Processor.

POST /daemon/threat POST

curl -X POST "https://app.tetik.net/api/daemon/threat" \
  -H "Content-Type: application/json" \
  -H "X-Daemon-Secret: YOUR_DAEMON_SECRET" \
  -d '{
    "company_id": 3,
    "domain": "secure-verify-paypal.xyz",
    "keyword_matched": "paypal",
    "risk_score": 92
  }'

Request Body Parameters

Parameter	Type	Required	Description
company_id	integer	Yes	Identifies your company account.
domain	string	Yes	The malicious or suspicious target domain name.
keyword_matched	string	Yes	Your registered brand keyword that triggered the hit.
risk_score	integer	No	Custom classification risk score (50 to 100). Defaults to 75.

webhook Outbound Webhooks

Receive instant JSON payloads sent to your endpoints (e.g. Teams, Discord, or custom REST orchestrators) the second a high-risk typosquatting or brand-spoof domain is recorded.

Webhook Payload Example JSON

{
  "event": "threat_detected",
  "timestamp": "2026-05-27T12:00:00Z",
  "companyId": 3,
  "data": {
    "domain": "logın-secure-tetik.xyz",
    "keyword_matched": "tetik",
    "risk_score": 95,
    "source": "certstream",
    "seen_at": "2026-05-27T12:00:00Z"
  }
}

dns Splunk HEC Integration

Forward logs using Splunk's HTTP Event Collector (HEC). Tetik posts threat events natively as json objects, ready to build dashboard views.

Event Schema Forwarded to Splunk HEC

{
  "time": 1779951600,
  "host": "tetik-cti-gateway",
  "source": "tetik-cti-threat-intelligence",
  "sourcetype": "_json",
  "event": {
    "alert_type": "suspicious_domain",
    "timestamp": "2026-05-27T12:00:00.000Z",
    "company_id": 3,
    "domain": "tetik-net-login-portal.com",
    "keyword_matched": "tetik",
    "risk_score": 95,
    "source": "certstream"
  }
}

To enable, go to settings -> API Key Integrations, and input your Splunk HEC Endpoint URL and HEC Authorization Token.

security Microsoft Sentinel Connector

Push logs to Log Analytics Workspace in Azure. Security data is signed using an HMAC-SHA256 signature calculated from the payload size and request date.

Ingestion Details

Property	Value / Value Type	Description
Target Table	Tetik_CTI_Alerts_CL	Custom log table created inside your Sentinel Log Analytics workspace.
Authorization Header	SharedKey {WorkspaceId}:{Signature}	HMAC-SHA256 signature base64 encoded.
Content Type	application/json	Plain JSON payload of the threat.

Sentinel Signature Calculation Pattern (Javascript)

async function buildSentinelSignature(workspaceId, sharedKey, dateStr, contentLength) {
  const stringToSign = `POST\n${contentLength}\napplication/json\nx-ms-date:${dateStr}\n/api/logs`;
  const binaryKey = Uint8Array.from(atob(sharedKey), c => c.charCodeAt(0));
  const encoder = new TextEncoder();
  const dataToSign = encoder.encode(stringToSign);
  
  const cryptoKey = await crypto.subtle.importKey(
    "raw", binaryKey, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]
  );
  const signatureBuffer = await crypto.subtle.sign("HMAC", cryptoKey, dataToSign);
  const signatureBase64 = btoa(String.fromCharCode(...new Uint8Array(signatureBuffer)));
  
  return `SharedKey ${workspaceId}:${signatureBase64}`;
}

gavel Automated Registrar Takedowns

Tetik.NET CTI automates complaints using provider APIs rather than simple emails. When a takedown notice is dispatched, Tetik queries the domain registrar and fires parallel API integration payloads:

Cloudflare Abuse API: Submits direct API reports to CF's trust and safety portal if the phishing site is proxied.
GoDaddy developer Abuse API: Automatically opens support tickets and provides JSON-formatted evidence to GoDaddy's registry department.
USOM Threat Ingestion API: Dispatches indicators to the National Computer Emergency Response Center (TR-CERT) for immediate national DNS filtering.
Google Safe Browsing / Web Risk: Instantly requests inclusion in Chrome/Safari security block lists.

Unified Automated Dispatch payload (Backend Internal) API Trigger

{
  "takedown_id": "TK-1082",
  "domain": "phish-bank-login.net",
  "evidence_url": "https://app.tetik.net/api/takedowns/proxy-image?url=...",
  "dispatchStatus": {
    "email": "SUCCESS",
    "googleWebRisk": "SUBMITTED (LIVE)",
    "cloudflare": "SUBMITTED (LIVE)",
    "godaddy": "NOT CONFIG (SKIPPED)",
    "usom": "SUBMITTED (LIVE)"
  }
}

Integrations & API Reference