Managed SOC API

The Managed SOC API exposes cases, detections, and data-health so you can pull SOC activity into your own SIEM, SOAR, ticketing, or reporting. The cases it returns are the ones analysts work in intSignal's AI-assisted investigation and orchestrated response console, so what you pull is triaged work rather than raw alerts. It shares the platform's authentication and conventions — see the Developer platform for the full reference.

Base URL & authentication

https://api.intsignal.com/v1

Authenticate with a bearer token scoped to soc:read (and soc:write to update cases). Create tokens in Portal → Settings → API keys. See Authentication.

curl https://api.intsignal.com/v1/soc/cases \
  -H "Authorization: Bearer $INTSIGNAL_TOKEN" \
  -H "Accept: application/json"

List cases

GET /soc/cases — returns cases, newest first. Supports filtering and cursor pagination.

{
  "data": [
    {
      "id": "case_8f21c0",
      "title": "Impossible-travel sign-in for j.rivera",
      "severity": "high",
      "status": "investigating",
      "opened_at": "2026-07-28T14:03:11Z",
      "attack_techniques": ["T1078", "T1110"],
      "assets": ["user:j.rivera", "host:LT-4471"]
    }
  ],
  "next_cursor": "eyJvIjoxMDB9"
}

Get a case

GET /soc/cases/{id} returns the full case, including the investigation timeline and recommended actions.

Update a case

PATCH /soc/cases/{id} (scope soc:write) to acknowledge, add a note, or approve a recommended response.

curl -X PATCH https://api.intsignal.com/v1/soc/cases/case_8f21c0 \
  -H "Authorization: Bearer $INTSIGNAL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "status": "contained", "note": "Approved endpoint isolation." }'

Stream events

For near-real-time integration, subscribe to case events with webhooks rather than polling. The SOC posts case.opened, case.updated, and case.closed events to your endpoint.

Errors & limits

The API uses standard HTTP status codes and returns a JSON error body. See Rate limits for throttling behavior.