Build with threatDefendr.
Everything you need to integrate, extend, and operate the platform — REST APIs, native SDKs, deployment patterns, and battle-tested architecture references from teams already running it in production.
Where would you like to start?
Five rooms inside the docs — open whichever one your problem lives in.
The single data fabric, the detection pipeline, the response engine, and how they fit together.
- → System overview
- → Data fabric
- → Deployment models
REST endpoints across events, detections, cases, containment, and adversary intelligence — with OpenAPI.
- → GET /v1/events
- → POST /v1/detections
- → PATCH /v1/cases/:id
Native libraries for Python, TypeScript, Go, and Rust — plus the td CLI for everything else.
- → Python · stable
- → TypeScript · stable
- → Go · stable
How-to walkthroughs for the patterns we see most — written by the team running them in production.
- → Detection-as-code
- → SOAR playbook authoring
- → BYOC deployment
Our open reference framework for federal network defense — maneuver doctrine made assessable, and the studio that scores an estate against it.
- → 10 terrain layers
- → 11 forms · 154 techniques
- → 78 assessable controls