Introduction

Welcome to Cylist, the threat intelligence platform built for SOC analysts.

Cylist is a triage workbench that aggregates data from multiple threat intelligence feeds, applies automated scoring algorithms, and lets you generate AI-powered incident case reports from a single search. It's built to replace the workflow of juggling browser tabs across VirusTotal, AbuseIPDB, ThreatFox, and ipinfo.io.

Whether you're triaging a suspicious IP during an incident, building a collection of indicators for a campaign, or generating a case report for your team, Cylist brings everything into one interface.

Multi-feed search

Query an IOC once, get results from all connected threat intelligence providers.

Automated triage

Threat level, confidence score, and verdict computed automatically from feed data.

AI case reports

Generate structured incident reports with a single click, editable before export.

Collections

Group related IOCs for organized reference, sharing, and team collaboration.

Quick start

Get up and running in under a minute.

Create an account

Search an IOC

From the dashboard, enter any IP address, domain, URL, or file hash into the search bar and click Analyze.

Review results

Cylist queries all connected feeds and presents a unified analysis with threat level, verdict, and confidence score.

Generate a report

Switch to the Case tab on any result to generate an AI-powered incident report you can edit and copy.

Tip

You can search any indicator type without specifying it. Cylist automatically detects whether your input is an IP, domain, hash, or URL.

IOC search

How to search indicators of compromise and what to expect.

The search dashboard is the primary entry point. Type or paste any indicator into the search bar and Cylist will query all active feeds simultaneously. Results typically return within a few seconds.

Supported indicator types

IPv4 / IPv6

185.220.101.42

Public IP addresses are checked against all feeds.

Domain

malware-domain.xyz

Domains are resolved and checked for reputation and associations.

URL

http://evil.com/payload.exe

Full URLs are analyzed for hosting malicious content.

MD5 / SHA1 / SHA256

5d41402abc4b2a76b971...

File hashes are checked against malware databases.

Tip

If an IOC has been searched before, Cylist returns the cached result instantly. Fresh data is fetched on each new unique query.

Analysis results

Understanding the data Cylist presents after a search.

Every search result is organized into four tabs: Summary, Details, Case, and Comms. The top of the page always shows the threat summary bar with three key metrics.

Threat summary bar

Threat level

Computed from a weighted average of all feed scores. Ranges from Low to Critical. The raw score (0 to 100) is shown alongside.

Verdict

A human-readable judgment: Malicious, Likely Malicious, Suspicious, Not Malicious, or Unknown. Derived from the threat level and the binary malicious flag.

Recommendation

An actionable next step based on the verdict, from routine monitoring to immediate investigation.

Result tabs

Summary

High-level overview with key metrics from each feed, IOC metadata, tags, and per-source confidence scores.

Details

Deep dive into each feed's raw data: network info, WHOIS, malware families, abuse reports, geolocation, and timeline.

Case

AI-generated incident report with editable sections, section toggling, reordering, and one-click copy.

Comms

Team communication panel for discussing findings. Currently under development.

Intelligence sources

The threat intelligence sources Cylist queries, and which indicator types each one covers.

VirusTotal

IPs, domains and file hashes

The industry standard for multi-engine malware scanning. Cylist retrieves detection counts, community reputation scores, AS ownership, network ranges, and WHOIS data.

Data points collected

Malicious detections (out of ~95 engines)

Community reputation score

AS owner and network range

WHOIS registration data

AbuseIPDB

IPs

A community-driven IP abuse reporting database. Provides confidence scoring based on the volume and recency of reports filed against an address.

Data points collected

Abuse confidence score (0 to 100%)

Total report count

ISP and geolocation

TOR exit node detection

Public/private classification

ThreatFox

IPs, domains, URLs and file hashes

An open threat intelligence platform by abuse.ch focused on malware and botnet tracking. Identifies malware families, IOC types, and provides sample tracking.

Data points collected

Associated malware family

Confidence level

IOC and threat type classification

First/last seen timestamps

Related malware samples

ipinfo.io

IPs

IP address intelligence from ipinfo.io. Shows who operates an address and where it is registered, which helps separate cloud, hosting and residential infrastructure.

Data points collected

Autonomous system number (ASN)

Network operator name and domain

Country and country code

Continent

Tip

All feeds are queried simultaneously. If a feed has no data for a given indicator, that section is simply omitted from the results.

AI case reports

Automatically generate structured incident reports from IOC data.

The Case tab on any analysis result lets you generate a comprehensive incident report with a single click. The AI model analyzes all available feed data and produces a structured document covering the executive summary, detailed description, indicators, feed corroboration, threat actors, affected assets, recommendations, and timeline.

Every field in the generated report is editable. You can adjust the text, reorder sections, toggle sections on or off, and copy the final report as formatted text for pasting into your ticketing system, email, or documentation.

Report sections

Executive summary

A brief overview of the incident suitable for management or cross-team communication.

Detailed description

In-depth analysis of the indicator and its context across all intelligence sources.

Indicators

List of all associated indicators (the queried IOC, its hash, and any related values).

Feeds corroboration

Per-source breakdown of what VirusTotal, AbuseIPDB, ThreatFox and ipinfo.io reported.

Threat actors

Known or suspected threat actors associated with the indicator, if attributable.

Affected assets

Systems, networks, or services potentially impacted.

Recommendations

Actionable next steps for containment, investigation, and remediation.

Timeline

Chronological sequence of events related to the indicator.

Tip

Use the section toggle controls to customize which sections appear in the exported report. The order can be rearranged with the up/down arrows.

Collections

Organize IOCs into named groups for tracking and collaboration.

Collections let you group related IOCs together. You might create a collection for a specific incident, a threat campaign, or a category of indicators you want to monitor over time. Each collection can be set to public (visible to other analysts) or private.

Create a collection

From the Collections tab in your profile, click "New collection", name it, set visibility, and select IOCs to include.

Manage contents

Open a collection to view, search, and filter the IOCs inside it. Add or remove indicators as your investigation evolves.

Share or keep private

Toggle visibility between public and private at any time. Public collections can be discovered by other analysts.

Search within collections

Filter IOCs inside a collection by value, threat level, or country.

Bulk organization

Select multiple IOCs during creation to add them all at once.

Usage tracking

Your profile shows how many collections you've used out of your plan limit.

Public sharing

Make collections visible to the community to contribute to collective threat intelligence.

Profile & settings

Manage your account, preferences, and security configuration.

Your profile page provides an overview of your activity, collections, subscription status, and account settings. It's divided into five tabs: Overview, Activity, Collections, Subscription, and Settings.

Settings sections

Profile

Update your display name, bio, and location. Changes are reflected across the platform.

Notifications

Control which email and in-app notifications you receive (security alerts, threat updates, mentions, product news).

Security

Enable two-factor authentication and manage active login sessions.

Privacy

Toggle whether your profile and activity are visible to other analysts.

Integrations

Manage API access and third-party service connections (coming soon).

Data & export

Request an export of all your IOC data, collections, and analysis history (coming soon).

Account

Manage sessions, API keys, and account deletion.

Subscription & billing

Plans, usage limits, and payment management.

Cylist offers tiered plans to match different usage levels. All plans include access to the core search and analysis features. Higher tiers unlock more queries, AI reports, collections, team members, and API access.

Billing is handled through Stripe. You can upgrade, downgrade, or cancel at any time from the pricing page or through the Stripe Customer Portal accessible from your profile's Subscription tab.

Usage limits tracked

IOC queries per month

AI report generations per month

Collections

API requests per month

Teams

Team members per team

Tip

Usage counters reset at the start of each billing cycle. You can monitor your current usage in the Subscription tab of your profile.

API overview

Programmatic access to Cylist's threat intelligence capabilities.

Coming soon

The Cylist REST API is currently under development. It will provide programmatic access to IOC search, result retrieval, collection management, and report generation. API access will be available on paid plans.

The API will follow RESTful conventions with JSON request/response bodies, bearer token authentication, and rate limiting based on your subscription tier.

Planned base URL

https://api.cylist.io/v1

Authentication

How to authenticate with the Cylist API.

Coming soon

API key management is not yet available. This section will be updated when the API launches.

All API requests will require a bearer token passed in the Authorization header. API keys will be generated and managed from the Settings page in your profile.

Example request

curl -X GET https://api.cylist.io/v1/ioc/search?q=185.220.101.42 \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Endpoints

Available API endpoints and their functionality.

Coming soon

Endpoint documentation will be published alongside the API launch. The following is a preview of planned endpoints.

Planned endpoints

GET/v1/ioc/search?q={indicator}Search for an IOC across all feeds

GET/v1/ioc/{hash}Retrieve a previously analyzed IOC by its hash

POST/v1/ioc/reportGenerate an AI case report for an IOC

GET/v1/collectionsList all collections for the authenticated user

POST/v1/collectionsCreate a new collection

GET/v1/collections/{id}Get a collection with its IOCs

PUT/v1/collections/{id}Update a collection's name, visibility, or contents

DELETE/v1/collections/{id}Delete a collection

GET/v1/user/usageGet current usage stats and limits

Webhooks

Receive real-time notifications when events occur in Cylist.

Coming soon

Webhook support is planned for a future release. You will be able to configure endpoints that receive POST requests when IOCs are analyzed, collections are updated, or threat levels change.

Planned events

ioc.analyzed: Fired when a new IOC analysis completes

ioc.threat_level_changed: Fired when re-analysis changes the threat level

collection.updated: Fired when IOCs are added or removed from a collection

report.generated: Fired when an AI case report is created

Teams

Collaborate with your team on threat intelligence workflows.

Coming soon

Team workspaces are currently under development. Teams will allow you to share collections, assign IOC reviews, and collaborate on case reports with role-based access controls.

Shared collections

Team members will be able to access and contribute to shared IOC collections.

Role management

Assign roles (admin, analyst, viewer) to control what team members can do.

Activity feed

See what your team is investigating in a shared activity stream.

Invite by email

Add team members with a simple email invitation flow.

Integrations

Connect Cylist to your existing security stack.

Coming soon

Third-party integrations are on the roadmap. We plan to support SIEM, SOAR, ticketing, and communication platforms to embed Cylist into your existing workflows.

Planned integrations

Slack

Post IOC analysis results and alerts directly to Slack channels.

Jira / ServiceNow

Create tickets from case reports with pre-filled IOC data.

Splunk / Elastic

Enrich SIEM alerts with Cylist threat intelligence.

MISP

Sync IOC collections with MISP for community threat sharing.