Tools (6)

investigate_domain
search_vulnerabilities
get_outage_overview
full_cyber_investigation
list_cyber_intelligence_sources
report_feedback

investigate_domain

Investigate a domain by querying WHOIS and DNS records in parallel.

Returns registrar, registration/expiration dates, nameservers, DNSSEC status,
and DNS records (A, AAAA, MX, NS, TXT) for a unified domain intelligence view.

Examples:
investigate_domain(domain="google.com")
investigate_domain(domain="suspicious-site.xyz")

Parameter	Type	Required	Description
`domain`	`string`	required	Domain name to investigate (e.g. example.com).

Request Body

{
  "domain": "example"
}

search_vulnerabilities

Search the NVD for CVE vulnerabilities matching a keyword.

Returns CVE records with CVSS scores, severity ratings, and affected products
from the NIST National Vulnerability Database.

Examples:
search_vulnerabilities(keyword="log4j")
search_vulnerabilities(keyword="Apache HTTP Server", limit=5)

Parameter	Type	Required	Description
`keyword`	`string`	required	Search keyword for CVE vulnerabilities (e.g. 'Apache', 'log4j').
`limit`	`integer`	optional	Max results. (default: 10)

Request Body

{
  "keyword": "example"
}

get_outage_overview

Get internet outage alerts from IODA (Internet Outage Detection and Analysis).

Monitors BGP routing, active probing, and traffic data to detect outages
affecting countries and autonomous systems.

Examples:
get_outage_overview()
get_outage_overview(country_code="RU", hours=48)

Parameter	Type	Required	Description
`country_code`	`any`	optional	ISO country code to filter (e.g. 'US', 'NO').
`hours`	`number`	optional	Lookback window in hours. (default: 24)
`limit`	`integer`	optional	Max alerts. (default: 20)

Request Body

{
  "query": "example"
}

full_cyber_investigation

Run a full cyber intelligence investigation across all four sources in parallel.

Combines NVD vulnerability search, domain WHOIS/RDAP lookup, DNS record queries,
and IODA internet outage monitoring into a single unified response.

Each source runs concurrently for fast results. Sources that fail return
gracefully with error details while other results are still returned.

Examples:
full_cyber_investigation(query="Apache exposure", domain="apache.org", vulnerability_keyword="Apache")
full_cyber_investigation(query="Russia internet health", country_code="RU")
full_cyber_investigation(query="suspicious domain", domain="sketchy-site.xyz")

Parameter	Type	Required	Description
`query`	`string`	required	Investigation label or summary term.
`domain`	`any`	optional	Domain to investigate (WHOIS + DNS).
`vulnerability_keyword`	`any`	optional	CVE vulnerability search keyword.
`country_code`	`any`	optional	ISO country code for outage alerts.
`outage_hours`	`number`	optional	Outage lookback window in hours. (default: 24)
`limit`	`integer`	optional	Max results per source. (default: 10)

Request Body

{
  "query": "example"
}

list_cyber_intelligence_sources

List all cyber intelligence data sources, their coverage, and data types.

Shows which vulnerability databases, domain registries, DNS resolvers,
and outage monitoring systems are queried during investigation.

Examples:
list_cyber_intelligence_sources()

Request Body

{
  "query": "example"
}

report_feedback

Report a bug, feature request, or general feedback for this data source.

Use this when something doesn't work as expected, when you'd like
a new feature, or when you have suggestions for improvement.

Args:
feedback: Describe the issue or suggestion.
feedback_type: One of 'bug', 'feature_request', or 'general'.

Parameter	Type	Required	Description
`feedback`	`string`	required
`feedback_type`	`string`	optional	(default: "general")

Request Body

{
  "feedback": "example"
}

Quick Start

Shell

curl -X POST "https://context.gnist.ai/rest/cyber-intelligence/investigate_domain" \
  -H "Content-Type: application/json" \
  -H "Gnist-API-Key: YOUR_API_KEY" \
  -d '{"domain": "example"}'

Python

import httpx

resp = httpx.post(
    "https://context.gnist.ai/rest/cyber-intelligence/investigate_domain",
    headers={"Gnist-API-Key": "YOUR_API_KEY"},
    json={
  "domain": "example"
},
)
print(resp.json())