Use cases

import os, time, httpx
from datetime import datetime, timezone

BASE = "https://intel-v1.exorde.io"
HEADERS = {"X-API-Key": os.environ["EXORDE_API_KEY"]}
SEEN: set[str] = set()


def poll(topic: str = "global", hours: int = 168) -> list[dict]:
    r = httpx.get(
        f"{BASE}/v1/topics/{topic}/alerts",
        params={"hours": hours, "limit": 50, "llm_validated": True},
        headers=HEADERS,
        timeout=10,
    )
    if r.status_code == 429:
        time.sleep(int(r.headers.get("Retry-After", 5)))
        return []
    r.raise_for_status()
    fresh = [a for a in r.json()["alerts"] if a["alert_id"] not in SEEN]
    SEEN.update(a["alert_id"] for a in fresh)
    return fresh


def slack_card(a: dict) -> dict:
    sev = a["severity"]
    spread = a["spread"]
    text = (
        f"*🚨 Volume spike on `{a['topic']}` — keyword `{a['keyword']}`*\n"
        f"σ={sev['deviation_sigma']:.2f}  "
        f"current={sev['current_value']:.0f}  "
        f"baseline={sev['baseline_value']:.1f}\n"
        f"Spread: {spread['domain_count']} domains, "
        f"{spread['language_count']} languages\n\n"
        f"_{a['description']}_"
    )
    return {
        "text": f"*{a['keyword']}* — {a['description']}",
        "blocks": [
            {"type": "section", "text": {"type": "mrkdwn", "text": text}}
        ],
    }


while True:
    for a in poll("global"):
        ts = datetime.now(timezone.utc).strftime("%H:%M:%S")
        print(f"[{ts}] {a['keyword']:<25} σ={a['severity']['deviation_sigma']:.2f}")
        # httpx.post(SLACK_WEBHOOK_URL, json=slack_card(a))
    time.sleep(60)

import os, httpx

BASE = "https://intel-v1.exorde.io"
KEY = os.environ["EXORDE_API_KEY"]
HEADERS_JSON = {"X-API-Key": KEY, "Content-Type": "application/json"}
HEADERS_GET = {"X-API-Key": KEY}


# 1. Create the watchlist (one-time)
r = httpx.post(
    f"{BASE}/v1/watchlists",
    headers=HEADERS_JSON,
    json={
        "name": "acme-brand",
        "base_topic": "global",
        "terms": [
            {"type": "keyword", "value": "acme"},
            {"type": "keyword", "value": "acme corp"},
            {"type": "domain",  "value": "acme.com"},
            {"type": "entity",  "value": "jane doe"},   # CEO
            {"type": "entity",  "value": "john roe"},   # CFO
        ],
    },
    timeout=10,
)
r.raise_for_status()
wl_id = r.json()["id"]
print("created:", wl_id)


# 2. Daily snapshot — what's spiking, who's mentioned, where
def daily_snapshot(wl_id: str) -> None:
    def g(path: str) -> dict:
        return httpx.get(
            f"{BASE}/v1/watchlists/{wl_id}{path}",
            headers=HEADERS_GET,
            timeout=10,
        ).json()

    print("Top terms:    ", [t["term"] for t in g("/trending")["terms"][:5]])
    print("Top entities: ", [e["entity"] for e in g("/entities")["entities"][:5]])
    print("Top platforms:", [p["platform"] for p in g("/platforms")["platforms"][:5]])

    alerts = g("/alerts?hours=24")["alerts"]
    if alerts:
        print(f"!! {len(alerts)} brand alerts in last 24h")


daily_snapshot(wl_id)

import os, httpx
from datetime import datetime, timezone

BASE = "https://intel-v1.exorde.io"
H = {"X-API-Key": os.environ["EXORDE_API_KEY"]}


def cyber_morning_digest() -> None:
    r = httpx.get(
        f"{BASE}/v1/topics/cyber/alerts",
        params={"hours": 24, "limit": 50, "llm_validated": True},
        headers=H,
        timeout=10,
    ).json()

    if not r["alerts"]:
        print("no qualifying cyber alerts in last 24h")
        return

    today = datetime.now(timezone.utc).strftime("%Y-%m-%d")
    print(f"=== Cyber digest, {today} ===")

    for a in sorted(r["alerts"], key=lambda x: -x["severity"]["deviation_sigma"]):
        sev = a["severity"]
        iocs = a["iocs"]

        ioc_summary: list[str] = []
        for k in ("cves", "domains", "ips", "urls", "crypto_wallets"):
            if iocs.get(k):
                ioc_summary.append(f"{len(iocs[k])} {k}")
        for h_alg in ("md5", "sha1", "sha256"):
            if iocs["hashes"].get(h_alg):
                ioc_summary.append(f"{len(iocs['hashes'][h_alg])} {h_alg}")

        print(f"\n[{a['detected_at']}]  σ={sev['deviation_sigma']:.2f}  '{a['keyword']}'")
        print(f"  {a['description']}")
        if a.get("matched_cluster"):
            print(f"  cluster: {a['matched_cluster']['cluster_title']}")
        if ioc_summary:
            print(f"  IOCs: {', '.join(ioc_summary)}")
        for cve in iocs.get("cves", [])[:3]:
            print(f"    - {cve}")


cyber_morning_digest()

import os, httpx

BASE = "https://intel-v1.exorde.io"
H = {"X-API-Key": os.environ["EXORDE_API_KEY"]}


# 1. High-confidence disinfo alerts — LLM-validated, multi-language, multi-domain
r = httpx.get(
    f"{BASE}/v1/topics/disinfo/alerts",
    params={"hours": 168, "limit": 25},
    headers=H,
    timeout=10,
).json()

suspicious = [
    a for a in r["alerts"]
    if a.get("llm_validated")
    and a["spread"]["language_count"] >= 3
    and a["spread"]["domain_count"] >= 5
    and a["confidence"] >= 0.7
]
print(f"{len(suspicious)} high-confidence multi-platform disinfo signals")


# 2. Cross-reference with cluster context where available
for a in suspicious[:5]:
    sev = a["severity"]
    spread = a["spread"]
    print(f"\n-  {a['keyword']}  σ={sev['deviation_sigma']:.1f}")
    print(f"  spread: {spread['domain_count']} domains × {spread['language_count']} langs")
    print(f"  context: {a['description'][:200]}")
    if a.get("matched_cluster"):
        print(f"  cluster: {a['matched_cluster']['cluster_title']}")

import os, asyncio, httpx
from datetime import datetime, timezone

BASE = "https://intel-v1.exorde.io"
H = {"X-API-Key": os.environ["EXORDE_API_KEY"]}
TOPICS = ["global", "cyber", "finance", "disinfo"]


async def fetch(client: httpx.AsyncClient, topic: str) -> dict:
    n, t, a = await asyncio.gather(
        client.get(f"{BASE}/v1/topics/{topic}/narrative"),
        client.get(f"{BASE}/v1/topics/{topic}/trending"),
        client.get(f"{BASE}/v1/topics/{topic}/alerts?hours=24&limit=50"),
    )
    n_data, t_data, a_data = n.json(), t.json(), a.json()
    return {
        "topic": topic,
        "narrative": n_data.get("summary", ""),
        "top_terms": [x["term"] for x in t_data.get("terms", [])[:3]],
        "alert_count": a_data.get("count", len(a_data.get("alerts", []))),
        "freshness_seconds": n_data.get("data_freshness", {}).get("snapshot_age_seconds"),
    }


async def main() -> None:
    async with httpx.AsyncClient(headers=H, timeout=10) as client:
        rows = await asyncio.gather(*[fetch(client, t) for t in TOPICS])

    now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
    print(f"\n=== Exorde Intel — {now} ===\n")
    for row in rows:
        age_min = (row["freshness_seconds"] or 0) // 60
        print(f"## {row['topic'].upper()}  "
              f"(snapshot {age_min}min ago, {row['alert_count']} alerts/24h)")
        print(f"   trending: {', '.join(row['top_terms'])}")
        print(f"   {row['narrative'][:240]}\n")


asyncio.run(main())