Loading
Every data point in SikkerAPI comes from one of two places: our honeypot sensor network recording real attacker behavior, or community reports from security teams using the platform. No third-party list aggregation. No recycled data. Every confidence score is backed by observable events you can verify in the session database and detection catalog.
Most threat feeds tell you an IP connected to a honeypot. SikkerAPI tells you what the attacker did after connecting. Our sensors accept every credential and record everything that follows — commands typed, files downloaded, payloads deployed, queries executed. This behavioral depth is what enables meaningful classification instead of simple IP lists.
Confidence scores are calculated from session frequency, protocol diversity, behavior severity, and community reports. The scoring methodology is documented. Every behavior classification in the detection catalog has a name, severity, and description. No black box. No “trust us.”
A threat database is only useful if it feeds into your actual security stack. SikkerAPI delivers intelligence through REST API, TAXII 2.1, plaintext blacklists, CLI tools, and automated firewall rules — whatever your infrastructure needs.
SikkerGuard is a self-contained Linux firewall manager. It pulls from SikkerAPI, AbuseIPDB, and blocklist.de, merges and deduplicates IPs, applies iptables/ipset rules with atomic swap, monitors blocked connections in real time, and provides a web dashboard. No configuration required beyond an API key.
Sikker-CLI is a Go binary with 7 commands. Every command supports --json. Errors go to stderr, data to stdout. --fail-above enables shell gating. Environment variable auth for CI/CD. Cross-platform: Linux, macOS, Windows (x64 + ARM64).