PAGES
← all tools
◆ Threat Intelligence

Hudson Rock

snapshot-20260917 commercial

Hudson Rock is a cybersecurity threat intelligence platform that detects compromised credentials and leaked data across the internet.

Summary

Hudson Rock is a commercial threat-intel platform that indexes data harvested by infostealer malware and exposes it through an API for programmatic lookup, run as a hosted service rather than installed locally. Queries can be run by company, by PC name to flag infected machines, or by arbitrary search term, with subdomain filtering to scope results and a directory-tree field that surfaces the file and folder structure captured from compromised devices. This fits SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts and threat-intelligence teams tracking credential exposure and infostealer infections tied to their organization or third parties, sitting in the compromised-credentials and infostealer-intelligence space rather than general dark-web monitoring. Ten releases in the window we track show steady, active development of the API's search surface.

Hudson Rock is a cybersecurity threat intelligence platform that detects compromised credentials and leaked data across the internet.

Hudson Rock publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.

How Hudson Rock helps

Which of our employees or users have credentials exposed by infostealer malware?

runs a company-scoped search against the compromised-credentials database and returns the exposed records tied to that organization

Is this specific machine on our network infected with an infostealer?

looks up the PC name in the compromised-credentials database and reports whether that hostname appears in harvested infostealer data

Which of our vendors or partners have infostealer exposure that could reach us?

surfaces compromised-credential records tied to third-party companies so exposure can be tracked across supply-chain relationships rather than only inside our own domain

Can we narrow a compromised-credentials search to one part of our web presence?

filters results by subdomain so a query scopes to a specific subdomain instead of returning every match across the whole domain

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities

Built from Hudson Rock's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • Hudson Rock covers 1 of the 8 investigation and response capabilities we track.

What Hudson Rock offers you

  • REST API3
  • Scripting API1
All capabilities 8 capabilities
Company intelligence lookup shipped Enables programmatic search for companies within the Hudson Rock platform to retrieve associated intelligence. 8 releases · 2 other sources · first seen Sep 2025

Also counts toward: REST API, Scripting API

release 8 total

  • Adds a Company Search endpoint for querying companies within the Cavalier dataset. updated · seen Sep 2026 · source · release history
  • New Company Search endpoint enables programmatic lookup of companies within the Hudson Rock platform. { New } - Company Search Endpoint · seen Jul 2026 · source · release history
  • Adds GET /json/v3/my-account endpoint to retrieve user name, email, companies, domains, alert_emails, date_created, and categorized permissions. { New } - Account Management Endpoint · Jan 2026 · source · release history
  • Added POST /json/v3/search-by-company endpoint for targeted compromise searches across corporate domains, mobile apps (APKs), and third-party services { New } - Company Search Endpoint · Jan 2026 · source · release history
  • New company_id prerequisite via GET /my-account to scope search results to specific enterprise portfolios { New } - Company Search Endpoint · Jan 2026 · source · release history
  • Provides new API surface for permission auditing, account verification, company ID discovery, and integration planning. { New } - Account Management Endpoint · Jan 2026 · source · release history

example

  • Retrieve your current API permissions and associated companies to plan integrations or audit access levels. curl --request GET --url https://api.hudsonrock.com/json/v3/my-account --header 'accept: application/json' --header 'api-key: <API_KEY>' { New } - Account Management Endpoint · Jan 2026 · source
  • Retrieve the company ID required to scope future search-by-company queries. curl --request GET \ --url https://api.hudsonrock.com/json/v3/my-account \ --header 'accept: application/json' \ --header 'api-key: <API_KEY>' { New } - Company Search Endpoint · Jan 2026 · source
Compromised-credentials search shipped suggested Lets users query Hudson Rock's compromised-credentials database by machine name, arbitrary search terms, or other identifiers to find infected machines and related data. 5 releases · 2 other sources · first seen Dec 2025

Suggested capability: Threat indicator matching. This is our guess, not confirmed.

release

  • Adds a Search by PC Name endpoint to look up infostealer-compromised machines by hostname. updated · seen Sep 2026 · source · release history
  • Adds a Search by Term endpoint for free-text querying across infostealer records. updated · seen Sep 2026 · source · release history
  • New API endpoint enables searching the compromised-credentials database by PC name to identify infected machines. { New } - Search by PC Name Endpoint · seen Jul 2026 · source · release history
  • New Search by Term API endpoint enables querying Hudson Rock data by arbitrary search terms. { New } - Search by Term Endpoint · seen Jul 2026 · source · release history
  • Adds POST /search-by-term endpoint (at /json/v3/search-by-term) to search by term with request body fields search_terms, start_date, sort_by, and sort_direction. Response includes search_query, search_engine, timestamp, stealer, ip, and computer_name. { New } - Search by Term Endpoint · Dec 2025 · source · release history

example

  • Query Hudson Rock's API to check whether a specific machine name appears in compromised-credentials data. curl "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-computer-name?computer_name=DESKTOP-ABC123" -H "api-key: <your-api-key>" { New } - Search by PC Name Endpoint · seen Jul 2026 · source
  • Scan a specific company's digital assets for keywords indicating potential compromise in third-party services. curl --request POST \ --url https://api.hudsonrock.com/json/v3/search-by-company \ --header 'accept: application/json' \ --header 'api-key: <API_KEY>' \ --header 'content-type: application/json' \… { New } - Company Search Endpoint · Jan 2026 · source
Advanced compromise intelligence filtering shipped Allows users to filter intelligence queries using multiple specific criteria including employee counts, date ranges, company size, industry, and country. 5 releases · first seen Sep 2025

Also counts toward: REST API

release

  • POST /json/v3/search-by-domain/supply-chain-risks allows paginated discovery of third-party partner services exposed via compromised credentials for a given domain. { New } - Supply Chain Risks · Jun 2026 · source · release history
  • Supports domain, page, limit, and sort_by request fields to filter and rank partners by size, occurrence, or name. { New } - Supply Chain Risks · Jun 2026 · source · release history
  • Adds POST /advanced-search endpoint for advanced compromise intelligence queries using multiple filters. { New } - Advanced Search Endpoint · Sep 2025 · source · release history
  • Supports domain, employee/user count, and date range filters (min_employees_compromised, max_users_compromised, etc.). { New } - Advanced Search Endpoint · Sep 2025 · source · release history
  • Enables enrichment filtering by company size, industry (147+), and country (247). { New } - Advanced Search Endpoint · Sep 2025 · source · release history
Infostealer file-system data shipped Surfaces the directory tree — file and folder structure — captured from machines compromised by infostealers. 3 releases · first seen Aug 2025

Shared capability: Disk and filesystem forensics

release

  • Adds a Directory Tree field exposing filesystem path data from infostealer-collected machine telemetry. updated · seen Sep 2026 · source · release history
  • Adds a new Directory Tree field surfacing the file/folder structure captured from compromised machines in infostealer data. { New} - Directory Tree Field · seen Jul 2026 · source · release history
  • Adds dir_tree field to the additional_fields array in Hudson Rock's POST /json/v3/search-by-domain API call { New} - Directory Tree Field · Aug 2025 · source · release history
Multi-machine asset-based threat hunting shipped Enables searching for compromises across multiple computer names with case-insensitive matching and credential type filtering. 2 releases · first seen Dec 2025

Also counts toward: REST API

release

  • New endpoint /json/v3/search-by-pc enables asset-based threat hunting and infrastructure security monitoring by searching for compromises via computer/machine names. { New } - Search by PC Name Endpoint · Dec 2025 · source · release history
  • The endpoint supports up to 50 computer names per request, accepts case-insensitive matching, and allows filtering by credential types (employees, users, third_parties) and domains. { New } - Search by PC Name Endpoint · Dec 2025 · source · release history
Subdomain-scoped intelligence queries shipped Allows users to filter intelligence queries to specific subdomains to narrow the scope of results. 2 releases

release

  • Adds a Subdomain Filtering feature to scope company and domain searches to specific subdomains. updated · seen Sep 2026 · source · release history
  • Adds subdomain filtering capability to scope intelligence queries to specific subdomains. { New } - Subdomain Filtering Feature · seen Jul 2026 · source · release history
Infostealer search query data access shipped Exposes raw search queries, engines, and timestamps from compromised devices captured by infostealers. 1 release · first seen Dec 2025

release

  • Added search_data field (string) to the additional_fields array in the /json/v3/search-by-domain API response, exposing search queries, engines, and timestamps from compromised devices. { New } - Search Data Field · Dec 2025 · source · release history
Supply chain risk discovery shipped Surfaces third-party partner services exposed via compromised credentials for a given domain. 1 release

release

  • Adds Supply Chain Risks capability to surface infostealer exposure across third-party vendor relationships.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ updated · seen Sep 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Command line

2 commands for Hudson Rock, each with where it came from. This tool has no source analysis yet, so there is no option reference and no captured run beside them.

Source

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for Hudson Rock, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail Hudson Rock puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

16 entries

  1. September 20261
  2. July 20265
  3. June 20261
  4. May 20261
  5. January 20262
  6. December 20253
  7. November 20251
  8. September 20251
  9. August 20251

    16 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →