Security Intel,
Delivered as API

Add ClawGuru enrichment to every Splunk, Elastic, or Sentinel alert containing an IP or domain. One lookup. Full context.

# Splunk SOAR Playbook (Python)
import requests

def enrich_indicator(indicator, indicator_type):
    resp = requests.post(
        "https://clawguru.org/api/v1/check-indicator",
        headers={"X-Api-Key": os.environ["CLAWGURU_API_KEY"]},
        json={"indicator": indicator, "type": indicator_type},
        timeout=5,
    )
    data = resp.json()
    return {
        "risk": data["risk"],
        "score": data["score"],
        "tags": data["tags"],
        "actions": data["actions"],
    }

When your SOAR creates an incident ticket, automatically fetch and attach the relevant ClawGuru runbook as a remediation guide.

// SOAR Automation (TypeScript / Tines)
const runbook = await fetch(
  `https://clawguru.org/api/v1/runbook/${incidentType}`,
  { headers: { "X-Api-Key": process.env.CLAWGURU_API_KEY } }
).then(r => r.json())

await jira.createComment(ticketId, `
## Remediation Runbook: ${runbook.title}
${runbook.steps.map((s, i) => `${i+1}. ${s}`).join("\n")}
`)

Integrate ClawGuru into your GitHub Actions pipeline to check domain/hash indicators from npm audit or trivy scans before deploying.

# GitHub Actions – Indicator Check Step
- name: Check suspicious domain
  run: |
    RESULT=$(curl -s -X POST \
      -H "X-Api-Key: ${{ secrets.CLAWGURU_API_KEY }}" \
      -H "Content-Type: application/json" \
      -d '{"indicator":"'$DOMAIN'","type":"domain"}' \
      https://clawguru.org/api/v1/check-indicator)
    RISK=$(echo $RESULT | jq -r '.risk')
    if [ "$RISK" = "high" ]; then
      echo "High-risk indicator detected. Blocking deploy."
      exit 1
    fi