DOCUMENTATION · {{ version }}
Build with threatDefendr.
Everything you need to integrate, extend, and operate the platform — REST APIs, native SDKs, deployment patterns, and battle-tested architecture references from teams already running it in production.
Where would you like to start?
Five rooms inside the docs — open whichever one your problem lives in.
Architecture
The single data fabric, the detection pipeline, the response engine, and how they fit together.
- → System overview
- → Data fabric
- → Deployment models
API reference
REST endpoints across events, detections, cases, containment, and adversary intelligence — with OpenAPI.
- → GET /v1/events
- → POST /v1/detections
- → PATCH /v1/cases/:id
SDKs
Native libraries for Python, TypeScript, Go, and Rust — plus the td CLI for everything else.
- → Python · stable
- → TypeScript · stable
- → Go · stable
Guides
How-to walkthroughs for the patterns we see most — written by the team running them in production.
- → Detection-as-code
- → SOAR playbook authoring
- → BYOC deployment