Rösti Threat Intel

Rösti (rosti.dev) collects public threat-intelligence reports from security vendors, researchers and CERTs, and extracts their indicators of compromise (IOCs), YARA rules, MITRE ATT&CK techniques and CVEs. This connector brings that data into Claude.

Ask Claude whether IPs, domains, URLs, hashes or email addresses appear in any report, paste up to 1,000 indicators at once, or have it read a report's IOCs and YARA rules. Claude can find reports by keyword, source, CVE, ATT&CK technique or date, show which reports share infrastructure, and give you a download link for a report export in formats such as STIX or MISP. Defanged values like hxxps://evil[.]com are accepted.

Every IOC comes with its type, tags, the report it was found in and a link to the original publication, plus Rösti's false-positive risk, which flags values such as popular domains that also carry benign traffic.

The connector is free and read-only. It works without an account on a shared quota; signing in with a free Rösti account gives you your own quota.