See new domains, routes and exposures early.

teleon.dev/docs/netintel watches certificate transparency logs, BGP routes and CVE exposure, and ties each signal to the company it belongs to.

v32.0teleon.dev/docs/netintelNetwork feedhttpsjson

Read the docs Copy the agent prompt

New signals for one company

Seen	Kind	Subject	Detail
06:12	Certificate	launch.example.com	New subdomain
06:20	BGP	AS64500	New origin for 203.0.113.0/24
07:01	CVE	CVE-2026-12345	3 exposed hosts

A new certificate hints at a launch, a route change shows new network space, and CVE matching counts the hosts that need a patch.

What it does

New certificates

Certificate transparency logs show each new domain and subdomain as its certificate issues.

Route changes

BGP announcements show when a network gains, moves or drops address space.

CVE exposure

Published CVEs are matched to the internet-facing hosts of each company.

The contract

A signal names its kind, subject and change, with the log, collector or CVE record behind it, its license and read time.

StoreS115, added in v32.0

SourcesCertificate transparency logs, BGP routes

ExposureCVE matching by host

RecordsEach record carries its source, license and read time

Identifiers

netintel.signal
netintel.cve_exposure

Execution contracts

Request and responseCopy

GET /v1/netintel/signals?entity=ent_4410&kinds=cert,bgp,cve&limit=3
Host: api.teleon.dev

# Response
{
  "signals": [
    {"id": "ni_90412", "kind": "cert", "name": "launch.example.com",
     "issued": "2026-10-25T06:12:00Z", "source": "CT log",
     "license": "terms:ct-log", "read_at": "2026-10-25T06:14:31Z"},
    {"id": "ni_90418", "kind": "bgp", "asn": "AS64500",
     "prefix": "203.0.113.0/24", "change": "new origin",
     "source": "BGP collector", "license": "terms:collector",
     "read_at": "2026-10-25T06:20:02Z"},
    {"id": "ni_90433", "kind": "cve", "cve": "CVE-2026-12345",
     "hosts": 3, "source": "CVE list", "license": "terms:cve",
     "read_at": "2026-10-25T07:01:45Z"}
  ],
  "next_cursor": "c_1c66"
}

Endpoints

Method	Path	Access	What it does
`GET`	`/v1/netintel/signals`	RING-3	List certificates, route changes and CVE matches by company
`GET`	`/v1/netintel/signals/{id}`	RING-3	Read one signal with its log or collector record
`GET`	`/v1/netintel/changes?since={cursor}`	RING-3	Stream new signals since a cursor
`POST`	`/v1/netintel/watches`	RING-2	Watch a domain or network for new certificates and routes

Listed paths appear in the service’s published files today. This surface comes from the Teleon Omnibus Codex v1.0 to v50.0, Oct 25, 2026. In the one-host plan every path here is served under api.teleon.dev/v1/netintel.

How it connects

Reads from

Entitiesteleon.dev/docs/entities Library adoptionteleon.dev/docs/packages

Feeds into

Signed feedsteleon.dev/docs/feeds Catalyst fusionteleon.dev/docs/catalysts

Queuesaq261-aq350

StoresS115 Certificate Logs, BGP Routes and CVE Exposure

For agents

Give your agent the read-only guide first. It reports back before any write.

Agent prompt

Read https://teleon.dev/docs/netintel.md and list new certificates and route changes for one company's domains. Read only.

Copy

llms.txt Agent card

Words on this page

Full glossary

Certificate transparency: Public, append-only logs of issued TLS certificates, so new domains and subdomains can be watched as their certificates appear.
BGP: Border Gateway Protocol: how networks announce the address ranges they can reach. Route changes reveal new networks, moves and hijacks.
CVE: Common Vulnerabilities and Exposures: the public list of known security flaws, each with an ID in the form CVE-year-number.
Change cursor: A position in a feed's change stream. A reader sends the last cursor it saw and gets every change after it, in order.