CH_INT · Integrations

Your feed, inside your stack.

CS::Chronicles curates CVEs, KEV, ransomware activity, and regulatory enforcement into clean, tagged streams. Pipe them into your SIEM, TIP, SOAR, or Slack — no signup, no token, no dashboard to babysit.

RSS / Atom / JSON Feed

Drop the URL into any RSS reader, Slack RSS app, feedly, Zapier, n8n, Tines.

STIX 2.1 over TAXII 2.1

Consumed natively by MISP, OpenCTI, Anomali, ThreatQuotient, EclecticIQ.

MISP Feed

Add as a MISP feed in one URL. Auto-pulled on your MISP instance schedule.

Public feeds

CISA KEV Mirror

/kev

Known Exploited Vulnerabilities, enriched with sector/region tags.

Critical CVEs

/critical-cves

CVSS ≥ 8.0 published in the last 7 days.

Curated Threat Signals

/signals

Editor-curated cyber news, deduplicated and severity-tagged.

Ransomware Leak Activity

/ransomware-leaks

Ransomware group leak-site posts and extortion incidents.

Regulatory Enforcement

/enforcement

GRC fines, enforcement actions, and regulatory announcements.

Firehose

/all

Everything, one stream.

Quickstart recipes

Add to MISP (60 seconds)

MISP → Sync Actions → List Feeds → Add Feed.
Source Format: MISP Feed
URL:
Enable, then Fetch and store all feed data.

Add to OpenCTI / Anomali via TAXII 2.1

Add a TAXII 2.1 collector.
Discovery URL:
No authentication required for public collections.

Send new KEV entries to Slack

Slack → Add Apps → RSS.
/feed subscribe https://www.cschronicles.com/api/public/feeds/kev.rss

Pull into a script (curl / jq)

# Get today's critical CVEs as JSON, extract IDs
curl -s https://www.cschronicles.com/api/public/feeds/critical-cves.json \
  | jq -r '.items[] | ._csc.metadata.vendor + " " + ._csc.metadata.product + " " + .title'

Splunk (RSS modular input)

Install the RSS/Atom modular input add-on from Splunkbase.
Feed URL:
Interval: 300 (5 min).

REST API live · v1

Try it in the browser

Query CS::Chronicles curated intelligence programmatically with a per-user API key. Bearer-auth, JSON, cursor pagination, deterministic sort — designed to slot behind SIEM/TIP/SOAR pipelines or a custom console. Same data that powers the desks; nothing client-side-only.

GET /api/v1/cves

GET /api/v1/kev

GET /api/v1/signals

GET /api/v1/ransomware/leaks

GET /api/v1/enforcement

GET /api/v1/infra/indicators

GET /api/v1/risk/composite

GET /api/v1/risk/history

GET /api/v1/risk/sectors

GET /api/v1/cves/{id}

curl -H "Authorization: Bearer $CSC_API_KEY" \
  "https://www.cschronicles.com/api/v1/cves?severity=critical&limit=100"

Tier limits

Tier	Req / min	Req / day	Req / month	Rows / day
Free	10	500	5,000	2,000
Pro / Founder	60	20,000	300,000	50,000
Team	300	100,000	2,000,000	250,000
Enterprise	1,000	1,000,000	20,000,000	2,000,000

Every response ships X-RateLimit-Remaining, X-CSC-Quota-Day, and X-CSC-Rows-Remaining-Day so integrators can back off cleanly. Hard limit ≤ 200 per page. Cursor-based pagination.

Get an API key →Postman collection API terms

Terms

Public feeds are provided as-is with a shared 5-minute edge cache. Please cache responsibly and attribute CS::Chronicles when redistributing. High-volume, branded, or SLA-backed usage requires a paid plan. Bulk redistribution and rebuilding derivative datasets require an Enterprise agreement — see API terms.