SophosLabs Intelix: Threat intelligence APIs for everyone

HTTP/2  200  OK

Each and every Sophos product leverages a broad line-up of SophosLabs technologies – from machine learning models to URL categorization – all to augment themselves with the latest in threat intelligence and threat analysis.

Historically, these technologies were only available to our internal product teams and our OEM partners. There are few services that offer programmatic access to threat intelligence and threat analysis and, of the services that exist, they often have low efficacy, poor quality data, or require a large up-front investment.

Not any more.

Today, we are launching SophosLabs Intelix on the AWS Marketplace.

SophosLabs Intelix is our new, cloud-based threat intelligence and threat analysis platform, accessible via a suite of RESTful APIs. It enables developers of all skill levels to tap into SophosLabs systems and add threat intelligence to anything you can write code for.

Best of all, every user receives a free, monthly usage allowance of all the APIs, meaning every software developer can test the service and even make regular use of it without having to make a purchase.

Powered by machine learning, decades of threat research and petabytes of intelligence, SophosLabs Intelix gives your app superpowers to identify, classify and prevent threats. Quickly answer the hardest to answer questions. “Is this file safe? What happens if I open or execute it?” or “Is this link safe? What happens if I click this URL?”

Three Easy to Use Services

Through SophosLabs Intelix’s APIs, take advantage of industry-leading analysis techniques and data science research into predictive detection through deep learning artificial neural networks and advanced learning and modelling techniques.

The new platform is built upon petabytes of curated, aggregated and consolidated threat intelligence sourced from disparate and complementary data sources with global visibility including intelligence derived from Sophos product telemetry from networks and endpoints.

Sophos Labs Intelix initially offers three key services:

Cloud Threat Lookups 
Rapid classification of artifacts with direct access to the latest SophosLabs intelligence by querying file hashes (SHA256), URLs, IPv4 addresses or Android application (APK) thumbprints. Reputation scores identify known bad and known good files, as well as those in the grey area.

Static File Analysis
Conduct advanced analysis by submitting files to be analyzed by multiple machine learning models, deep file scanning and more without having to execute the file in real-time.

Dynamic File Analysis
Reveal an executable’s intent by submitting a file and detonating it in a sandbox. System activity, artifact classification, screenshots and even an activity tree as an SVG or node and data.

You get to pick the response type for static and dynamic file analysis. JSON, for easy decomposition by programming languages or HTML, for sharing info on threats with others, and learning what is available in the JSON results.

RESTful APIs

Representational state transfer is a modern paradigm for how web applications communicate between each other. RESTful APIs are among the simplest and easiest to implement APIs around, meaning that even the most novice of scripters will be able to harness the entire range of intelligence and analysis APIs that SophosLabs Intelix has to offer.

Augmenting the cybersecurity of any app, tool, system, or service is only an HTTP request away.

Building a Global Community

Our goal is to build a global community around our APIs and to spark innovation among developers. By exposing a variety of intelligence from SophosLabs directly through RESTful APIs, we’re making it simpler than ever before to quickly and easily integrate threat intelligence into new and existing applications and operations. With SophosLabs Intelix, we’re lowering the barrier to realize analysis for anyone developing an application or platform. The information breadth and depth are also valuable for IT admins, researchers, security analysts or students in need of top-tier threat intelligence.

Free Usage and Predictable Pricing

Sophos Labs Intelix is available via the AWS Marketplace. All users receive a monthly free usage allowance, with Pay As You Go (PAYG) pricing if you go over. The monthly free tier will allow each user a set number of API calls to each service for free, paying only for the requests that exceed the monthly free allowance.

Head on over to the AWS Marketplace and signup to start using the service today.

Support
Our APIs adhere to the OAS3 standard fully documented on our website. Our developers and user community will support SophosLabs Intelix on the popular coding Q&A site, StackOverflow, via the ‘sophoslabs-intelix’ tag.