{"domain":"telesint-api.onrender.com","count":3,"changes":[{"captured_at":"2026-10-20T20:30:52.341913","card_hash":"68652e943c4b50d9ddde6ee649b40d728745f8563f24395ded8682ac73df5fbe","previous_card_hash":"b100fc53fd8d96a44f06aa3c03b90da768da014b27f08cee3af987f2946a4a84","diff":{"skills_added":[],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":true,"is_empty":false,"human_summary":"internal fields changed"}},{"captured_at":"2026-10-11T11:41:39.770336","card_hash":"b100fc53fd8d96a44f06aa3c03b90da768da014b27f08cee3af987f2946a4a84","previous_card_hash":"a0743702f3173bdd8df8c6010aca7010ebf89f9fbe9b38c2c1349495a522af58","diff":{"skills_added":[{"id":"adversary-preparation","name":"Adversary Preparation Assessment","description":"Call before an escalation decision: is someone preparing to attack this organisation, sector or country? Returns a deterministic verdict (escalate | watch | none), five-stage ladder with gaps, Dempster-Shafer belief/plausibility/conflict, EWMA velocity and evidence record IDs.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"claim-check","name":"Claim Recycling Check","description":"Call before acting on a breach, ransomware or hacktivist claim: tests it for recycling against earlier Telegram posts and returns recycled | reused_template | previously_claimed | repost | no_prior_match.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"target-mentions","name":"Organisation Mentions","description":"Call when you need to know whether an organisation is being named on Telegram: access sales, credential leaks, targeting announcements and compromise claims, deduplicated with first/last seen.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"threat-velocity","name":"Threat Activity Velocity","description":"Call on a schedule to detect tempo changes: acceleration of Telegram threat activity per preparation stage and category, globally or for a scope.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"watchlist","name":"Wallet-Bound Watchlists","description":"Register requirements once with /watch/create ($0.02); each /watch/pull ($0.10) returns only what changed since the last pull plus preparation verdict transitions. The paying wallet is the account — REST only, not available via /a2a.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[],"other_changed":true,"is_empty":false,"human_summary":"added 5 skills"}},{"captured_at":"2026-07-06T18:38:22","card_hash":"a0743702f3173bdd8df8c6010aca7010ebf89f9fbe9b38c2c1349495a522af58","previous_card_hash":null,"diff":{"skills_added":[{"id":"asn-intel","name":"ASN Threat Intelligence","description":"Profiles an ASN using Telegram CTI channel observations. Returns C2 framework associations, phishing kit links, threat actor mentions, bulletproof hosting indicators, and blocking recommendation. Surfaces what cybercriminals discuss about a given ASN on Telegram.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"attack-intent-signals","name":"Attack Intent Signals","description":"Query pre-attack signals: initial access sales, 0day disclosures, ransomware group targeting announcements. These signals appear BEFORE attacks land. Filter by sector, country, or intent type. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"breach-disclosures","name":"Breach Disclosures","description":"Query breach announcements and data leak disclosures from Telegram by sector, country, or organization. Returns breach target details, data types exposed, and source channel. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"c2-infrastructure","name":"C2 Infrastructure","description":"Query Command-and-Control infrastructure by framework (cobalt_strike, sliver, havoc, brute_ratel). Returns panels, listeners, beacons with MITRE C2 technique tags. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"cross-category-search","name":"Cross-Category Search","description":"Keyword pivot across all intel categories in one call. Use ?q= for broad keyword search or combine any filter params (category, sector, country, tag, ttp, severity). Ideal for ad-hoc threat pivoting. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"cti-artifact-export","name":"CTI Artifact Export","description":"Export any TeleSint intel record as a Sigma detection rule (YAML), STIX 2.1 bundle (JSON), or structured analyst report (text). Requires items[].id from any prior TeleSint call and a format choice. Output is derived from real enriched data — iocs[], ttps[], actor{}, target{}.","tags":null,"inputModes":["application/json"],"outputModes":["application/json","text/plain"]},{"id":"darkweb-intel","name":"Dark Web Intelligence","description":"Dark web marketplace listings, underground forum chatter, access broker posts, credential shops, Tor site activity. Filter by sector, country, organization, tag. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ioc-lookup","name":"IOC Lookup","description":"Query Indicators of Compromise by type (ip, domain, url, hash, cve), severity, confidence, TLP, and time range. Returns defanged indicators with MITRE ATT&CK context. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"malware-intel","name":"Malware Intelligence","description":"Malware family analysis: new sample drops, behavior descriptions, packer/loader details, malware-as-a-service offerings. Covers stealers, RATs, loaders, backdoors. Filter by tag, severity, since. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"ransomware-intel","name":"Ransomware Intelligence","description":"Ransomware group victim posts, leak site announcements, extortion demands, and group activity (LockBit, BlackCat, Cl0p, RansomHub, Play, Akira, etc.). Filter by severity, sector, country, tag. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"source-verification","name":"Raw Source Verification","description":"Returns the original defanged Telegram message for a given record UUID alongside its AI-generated English summary. Use for provenance checks, translation validation, and Tier-2/3 SOC forensics. Requires items[].id from any prior TeleSint call.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"threat-actor-profiles","name":"Threat Actor Profiles","description":"Query threat actor profiles by name, nation-state attribution, motivation, and MITRE technique. Returns actor aliases, TTPs, targets, and country of origin. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"threat-intel-feed","name":"Full Threat Intel Feed","description":"Unified paginated feed across all intelligence categories. Filter by category, severity, confidence, TLP, tag, or time range. Ideal for SIEM ingestion and agents that process all intel types. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]},{"id":"vulnerability-intel","name":"Vulnerability Intelligence","description":"CVEs and exploitation-in-the-wild signals from Telegram CTI channels. Filter by severity, min_confidence, since, tag, ttp. Returns CVE IDs, affected products, MITRE techniques, and exploit availability. Input: query params. Output: paginated JSON array.","tags":null,"inputModes":["application/json"],"outputModes":["application/json"]}],"skills_removed":[],"skills_changed":[],"fields_changed":[{"field":"name","before":null,"after":"TeleSint"},{"field":"description","before":null,"after":"Real-time Telegram threat intelligence API. Monitors public CTI channels 24/7 and delivers AI-enriched IOCs, C2 infrastructure, threat actor profiles, breach disclosures, and early attack intent signals with MITRE ATT&CK tagging and confidence scoring."},{"field":"version","before":null,"after":"1.0.0"},{"field":"url","before":null,"after":"https://telesint-api.onrender.com"},{"field":"documentationUrl","before":null,"after":"https://telesint-api.onrender.com/SKILL.md"}],"other_changed":true,"is_empty":false,"human_summary":"added 14 skills · name ∅ → TeleSint · description ∅ → Real-time Telegram threat intelligence A · version ∅ → 1.0.0 · url ∅ → https://telesint-api.onrender.com · documentationUrl ∅ → https://telesint-api.onrender.com/SKILL."}}]}