Public pull feeds#

All feeds require a HashWatch API key (X-API-Key: <key> header; any valid key works), are read-only, and cover the current verified hash set. Poll politely (hourly is plenty — responses are cache-friendly).

Format	URL
JSON	`https://api.hashwatch.us/public/feed.json`
RSS	`https://api.hashwatch.us/public/feed.rss`
STIX 2.1	`https://api.hashwatch.us/public/feed/stix`
TAXII 2.1 (discovery)	`https://api.hashwatch.us/taxii2/`

JSON#

{
  "feed": "hashwatch-verified",
  "date": "2026-06-28",
  "count": 420,
  "transparency": "https://api.hashwatch.us/public/transparency/2026-06-28",
  "records": [
    { "executable_name": "...", "vendor": "...", "version": "...",
      "platform": "windows", "arch": "amd64",
      "sha256": "…", "sha1": "…", "md5": "…", "signer": "…",
      "source_url": "…", "valid_from": "2026-06-28T10:00:00Z" }
  ]
}

Each JSON feed links the matching transparency root.

STIX / TAXII#

Records are emitted as STIX 2.1 indicator objects with indicator_types: ["benign"] and a [file:hashes.'SHA-256' = '…'] pattern — an allowlist of known-good software for suppressing false positives in EDR/SIEM. Object IDs are deterministic, so re-pulls are idempotent.

TAXII 2.1 collection: 5f8a1c3e-0b2d-4e6f-8a1b-2c3d4e5f6a7b (/taxii2/api/collections/{id}/objects/).

Custom HTTP clients must send an Accept header (most clients do by default).

SIEM / EDR connectors#

Any SIEM/EDR can poll these feeds on a schedule and use the hashes as a known-good allowlist (suppress false positives — a file whose SHA-256 is in the feed is a vendor-verified binary). Ready-to-use configs ship with your deployment under integrations/siem/:

Tool	Feed	How
Splunk	`feed.json`	`TA-hashwatch` add-on (scripted input → `sourcetype=hashwatch:knowngood` + a `hashwatch_knowngood` lookup)
Microsoft Sentinel	TAXII 2.1	Threat Intelligence – TAXII connector → API root `https://api.hashwatch.us/taxii2/`, collection `5f8a1c3e-…`, API key as the Basic password (ARM template included)
Elastic	`feed.json`	Filebeat `httpjson` input → `hashwatch-knowngood-*` index
IBM QRadar	`feed.json`	REST loader → a reference set of known-good SHA-256s

All use the same API key as the feeds. See integrations/siem/README.md for step-by-step setup.