CVE data from NVD/MITRE is public domain. ATT&CK is Apache 2.0. Sigma rules are DRL 1.1 (detection-use permitted). YARA rules are per-rule (Apache, MIT, or GPL). Atomic Red Team is MIT. CISA KEV, EPSS, and D3FEND are public domain or CC-BY. Vendor advisories (Cisco, Microsoft, Apple, Adobe, Red Hat) are reproduced as fair use. IDs and titles only. IOC feeds (abuse.ch, OTX, Spamhaus, Blocklist.de) are free for non-commercial or research use.

threatengine.sh does not redistribute raw bulk data dumps. We store transformed, indexed records for search and cross-linking. If you are a data provider and have a concern, contact us.