BinaryEdge

Overview

BinaryEdge offers a suite of APIs designed to assist cybersecurity professionals, developers, and researchers in gathering comprehensive threat intelligence and conducting security assessments. Founded in 2017, the platform aggregates vast amounts of internet-wide scan data, dark web mentions, and vulnerability information to provide insights into potential risks and exposed assets. Its core products include real-time threat intelligence feeds, asset discovery tools, vulnerability scanning capabilities, and dark web monitoring services. This allows organizations to establish a detailed inventory of their internet-facing infrastructure and monitor for emerging threats.

The BinaryEdge API is particularly suited for use cases such as proactive threat hunting, where security teams analyze current and historical data to identify attack patterns and indicators of compromise. For instance, a security analyst might use the API to query for all devices exposing a specific vulnerable port across a given IP range, cross-referencing this with known CVEs. It also supports asset inventory management by helping organizations discover previously unknown or unmanaged internet-connected devices, which often represent significant security gaps. Developers can integrate BinaryEdge's data into existing security information and event management (SIEM) systems, security orchestration, automation, and response (SOAR) platforms, or custom security tools to automate parts of their vulnerability assessment and incident response workflows.

The platform collects and indexes data from various sources, including open ports, services, banners, and detected vulnerabilities across IPv4 and IPv6 space. This data is then made available through a RESTful API, allowing programmatic access to query and analyze information about hosts, services, and associated risks. For example, a developer could write a script to automatically check newly deployed servers against BinaryEdge's vulnerability database to ensure they are not exposing critical services without proper hardening. The availability of a Python SDK simplifies integration, making it accessible for rapid prototyping and deployment within existing security toolchains. BinaryEdge's commitment to compliance, including GDPR regulations, addresses data privacy concerns for users operating in different jurisdictions.

Key features

• Real-time Threat Intelligence: Access up-to-date data on internet-connected devices, services, and associated vulnerabilities, enabling informed security decisions.
• Asset Discovery: Identify and catalog internet-facing assets, including servers, IoT devices, and web applications, to maintain a comprehensive inventory.
• Vulnerability Scanning and Data: Query for known vulnerabilities (CVEs) associated with specific services or IP addresses, aiding in proactive patch management and risk assessment.
• Dark Web Monitoring: Monitor mentions and data leaks on the dark web related to specific keywords, domains, or IP addresses to detect potential compromises.
• Historical Data Access: Retrieve past scan results and threat intelligence to analyze trends, track changes in asset configurations, and investigate historical incidents.
• Network Scanning Data: Access a database of scanned ports, protocols, and banners for global IP ranges, useful for reconnaissance and attack surface analysis.
• API Key Management: Manage API keys securely through the user portal, with options for revocation and rotation to maintain access control.

Pricing

BinaryEdge offers a free tier with limited API queries for initial exploration and development. Paid plans are structured based on the number of API queries per month, with different tiers designed to accommodate varying usage levels. Custom enterprise solutions are available for organizations with specific requirements for query volume, data retention, or specialized support. All plans provide access to the core threat intelligence data and API endpoints.

Common integrations

• SIEM Systems: Integrate threat intelligence into Security Information and Event Management (SIEM) platforms to enrich logs and enhance correlation rules.
• SOAR Platforms: Automate incident response workflows by feeding BinaryEdge data into Security Orchestration, Automation, and Response (SOAR) systems.
• Vulnerability Management Tools: Enhance vulnerability scanners or asset management solutions with external threat context and dark web monitoring data.
• Custom Security Applications: Develop bespoke tools for threat hunting, compliance auditing, or security posture management using the BinaryEdge API and Python SDK.
• Network Security Devices: Feed IP reputation data or identified compromised hosts into firewalls and intrusion prevention systems for automated blocking.

Alternatives

• Shodan: Focuses on indexing internet-connected devices, offering broad visibility into exposed services and IoT devices globally.
• Censys: Provides continuous visibility into an organization's internet attack surface, identifying public assets and monitoring for vulnerabilities.
• RiskIQ (now Microsoft Defender TI): Offers comprehensive external attack surface management, digital risk protection, and threat intelligence for enterprise security.

Getting started

To begin using the BinaryEdge API, you typically need to obtain an API key from your BinaryEdge account dashboard. The API provides various endpoints to query different types of data, such as host information, vulnerability details, or dark web mentions. The following Python example demonstrates how to use the official BinaryEdge Python SDK to query information about a specific IP address. This example assumes you have the binaryedge library installed (pip install binaryedge) and your API key set as an environment variable or directly in the script.

import os
from binaryedge import API

# It's recommended to set your API key as an environment variable
# Example: export BINARYEDGE_API_KEY="YOUR_API_KEY_HERE"
api_key = os.environ.get('BINARYEDGE_API_KEY')

if not api_key:
    print("Error: BINARYEDGE_API_KEY environment variable not set.")
    print("Please set it or replace 'os.environ.get(...)' with your actual API key.")
else:
    # Initialize the API client
    api = API(api_key)

    # Define the IP address to query
    ip_address = "8.8.8.8"  # Example: Google Public DNS

    try:
        # Query host information for the IP address
        host_info = api.host_get(ip_address)

        if host_info and host_info.get('status') == 200:
            print(f"Host Information for {ip_address}:")
            print(f"  IP: {host_info.get('result', {}).get('ip')}")
            print(f"  Country: {host_info.get('result', {}).get('country_name')}")
            print(f"  Open Ports: {', '.join(map(str, host_info.get('result', {}).get('ports', [])))}")
            print(f"  Last Seen: {host_info.get('result', {}).get('last_seen')}")
            
            # Example of accessing exposed services
            if 'results' in host_info:
                for service in host_info['results']:
                    print(f"    - Service: {service.get('service', 'N/A')} on port {service.get('port', 'N/A')}")
                    print(f"      Product: {service.get('product', 'N/A')}")
                    print(f"      Operating System: {service.get('os', 'N/A')}")
        elif host_info and 'message' in host_info:
            print(f"Error querying {ip_address}: {host_info['message']}")
        else:
            print(f"No information found for {ip_address} or unknown error.")

    except Exception as e:
        print(f"An error occurred: {e}")

This Python script initializes the BinaryEdge API client with your API key. It then calls the host_get method to retrieve detailed information about a specified IP address, such as its country, open ports, and last seen timestamp. The output includes a summary of the host's attributes and details about any exposed services discovered during BinaryEdge's scans. This fundamental query can be expanded to integrate with other BinaryEdge endpoints for broader threat intelligence gathering, such as searching for dark web leaks or correlating vulnerabilities with specific software versions.