[ Blue ]
Analyst
10 creds a day
Free
- Detection rules: 5 creds to unlock a threat
- Asks before each unlock
- API and MCP: up to 30 creds a day
Last reviewed:
// tl_creds
What TL Creds cost
TL Creds unlock detection rules, indicator (IOC) values and some analysis tools. Personal plans include daily creds, you can earn more or top up, and team plans are metered, not limited. One complete detection per threat, in Splunk SPL, Microsoft KQL and Sigma, is free for everyone.
// daily_creds
Daily creds by plan
Blue, Red and Purple include daily creds. They reset at midnight Toronto time (America/Toronto), and unused daily creds do not carry over. Team plans are metered, not limited.
[ Red ]
Professional
25 creds a day
$4.99/month
- Rules + indicators: 5 creds to unlock a threat
- Opens threats automatically from your daily creds
- API and MCP: up to 75 creds a day
[ Purple ]
SME
150 creds a day
$11.99/month
- Full intelligence: 5 creds to unlock a threat
- Opens threats automatically from your daily creds
- API and MCP: up to 450 creds a day
[ Gold ]
Team
Metered, not limited
Contact us
- Every action that costs creds on a personal plan is recorded for your team at its usual price
- Nothing is charged, and nobody on the team is refused for lack of creds
- Team plans do not use top-ups
- Daily creds are spent first, then earned creds, then purchased creds.
- A threat you unlock stays unlocked. A day pass lasts until the next midnight in Toronto.
- If a tool call or a Research Lab prompt fails, the creds are refunded.
- One complete detection per threat, in Splunk SPL, Microsoft KQL and Sigma, is free for everyone and costs nothing.
// unlock_a_threat
Unlock a threat
An unlock opens one threat for good. Your plan’s own level is the cheapest; each level above it costs 5 creds more.
| Level | What it opens | Blue | Red | Purple |
|---|---|---|---|---|
| Detection rules | Every remaining SPL, KQL and Sigma rule for this threat (one detection, in SPL, KQL and Sigma, is free for everyone). | 5 | included | included |
| Rules + indicators | Adds IOC values, similar threats, attack flow and OSINT depth. | 10 | 5 | included |
| Full intelligence | Adds STIX export, simulations and infrastructure pivots. | 15 | 10 | 5 |
- Moving up a level later costs the difference: the new level’s price minus what you already paid for that threat.
- Export one threat on its own: 10 creds. The export carries that threat’s rules and indicator values and does not change what you have unlocked.
- With an API key or through MCP, an unlock costs 3 creds per threat at your plan’s level (see API keys and MCP).
- Gold teams are not charged: each unlock is recorded for the team at the same prices.
// tools_and_passes
Tools: day passes and per-call prices
A day pass opens every view of one tool until midnight Toronto time. A per-call price is charged each time you use the tool.
| Tool | What it opens | How it is charged | Creds |
|---|---|---|---|
| DNS enrichment | DNS lookups for an indicator and the DNS enrichment pages: records, inventory, graph and timeline. | Day pass | 2 |
| IOC intelligence | Indicator intelligence, blast radius and reach, and indicator browsing. Bulk indicator enrichment through the API is charged per call. | Day pass, and per call for bulk enrichment | 2 |
| Actor intelligence | Actor profiles and their evidence, actor relationships and campaigns. | Day pass | 2 |
| Correlation | Correlation overviews, the intel graph, indicator reuse and ATT&CK transitions. | Day pass | 2 |
| OSINT feeds | The community OSINT feed, its indicators and campaigns. | Day pass | 2 |
| Simulations | The simulations list and its archive. | Day pass | 2 |
| AI semantic search | Semantic search across the corpus. | Per call | 1 |
| AI answers | AI answers with their sources. | Per call | 2 |
| TLQL assistant | The TLQL assistant: translate, explain, name and diagnose a query. Costs no creds on your own AI key. | Per call; 0 on your own AI key | 1 |
- On a paid plan, a day pass for a tool at or below your plan is taken from your daily creds without a click. On Blue, you confirm each pass.
More about day passes
- Most passes for a page above your plan open it with result lists capped to a preview. The actor pass opens the actor pages without that cap; rule bodies and indicator values there stay limited to the threats you hold.
- Wild C2 data, the MISP and TAXII feeds and the MCP server belong to a plan. Creds do not unlock them.
// research_lab
Research Lab: creds per prompt
Each Research Lab prompt costs creds by the model you pick. Your first answer is free when you ask it on Haiku 5.5.
| Model | Good for | Creds per prompt |
|---|---|---|
| Haiku 5.5 | Quick answers. The default model, and the one the free first answer runs on. | 1 |
| Sonnet 5.5 | Balanced depth and speed. | 5 |
| Opus 5.5 | The deepest analysis. | 10 |
| Your own AI key | An Anthropic or OpenAI key set in your profile (BYOK). Prompts on your own key cost no creds. | 0 |
- The Research Lab is open to Blue, Red and Purple accounts, and every prompt is priced by model. The models are Anthropic’s Claude Haiku, Sonnet and Opus.
- If the model declines, fails or returns no answer, the creds for that prompt are refunded.
- The free first answer is for personal accounts. Gold teams are recorded at the model price and never refused.
// add_up_your_day
Add up your day
Pick a plan and what a typical day looks like. The sum runs in your browser and shows how far your daily creds go.
// auto_unlock
Automatic unlocks
On a paid plan, threats you open and tool day passes use your daily creds automatically. Earned and purchased creds are spent only when you confirm.
| Plan | Opening a threat | Tool day passes |
|---|---|---|
| Blue | Asks first. You confirm each unlock. | Asks first. You confirm each pass. |
| Red and Purple | Unlocks from your daily creds, without a click. Trials and granted plans included. | Taken from your daily creds, without a click, for tools at or below your plan. |
| Gold | Unlocks without a click and is recorded for your team. | Opened without a click and recorded for your team. |
- Once the day’s daily creds are used up, Threadlinqs asks before it spends earned or purchased creds.
Auto day passes and team plans
- Auto day passes: on a personal plan you can let one tool’s day pass be charged without asking, up to a daily maximum you set, from daily and earned creds (purchased creds only if you allow it). Turn it off at any time in your profile.
- On a team plan, threats you open and tool day passes are unlocked automatically and recorded for your team. Nothing is charged. Team plans do not use auto day pass settings.
// earn_creds
Earn creds
Earned creds are spent after your daily creds. Only Hunt Weekend creds expire.
| Way | You get | How it works |
|---|---|---|
| Hunt Weekend | +20 creds | The first time you open a threat on the website each Saturday and Sunday (Toronto time), for accounts at least a day old. They expire 30 days after they are granted. |
| Referrals | 25 creds each | Share your link. Friends must sign up with email, not Google or GitHub. You each get 25 creds about 7 days after they unlock their first threat with creds, once they have also spent 5 or more purchased creds, or creds earned from contributions or referrals, on unlocks or tool passes. Up to 20 rewards a year. You also need to have unlocked a threat with creds yourself. |
| Welcome grants | 25 + 10 creds | You get 25 creds when you verify your email and 10 more when you finish onboarding. New accounts only. |
| Contributions | See the awards below | Every contribution is reviewed by our team. Creds are posted when a contribution is accepted. |
Contribution awards
| Type | Creds | Who can send it |
|---|---|---|
| Indicator (IOC) | 2 per indicator, up to 20 indicators per submission | Open to every signed-in account. |
| Additional intel | Up to 10 creds | Open to every signed-in account. |
| Enrichment | Up to 5 creds | Needs Red or Purple and the IOC unlock (level 2) on the threat. |
| Correction | Up to 10 creds | Needs Red or Purple and the IOC unlock (level 2) on the threat. |
| Detection | Up to 25 creds | Needs Red or Purple and the IOC unlock (level 2) on the threat. |
- You can earn up to 50 creds a day and 200 a week from contributions, separate from your daily creds.
- Accepted work that is later found to be wrong or copied is reversed, and the creds with it.
// top_up
Top up
Top up when daily and earned creds are not enough. Purchased creds (top-ups) do not expire while your account exists and are forfeited if you delete your account.
| Pack | Blue | Red | Purple |
|---|---|---|---|
| 15 creds | $4.99 33.3¢ a cred | $4.99 33.3¢ a cred | not offered |
| 40 creds | $9.99 25.0¢ a cred | $7.49 18.7¢ a cred | $4.99 12.5¢ a cred |
| 100 creds | $19.99 20.0¢ a cred | $14.99 15.0¢ a cred | $9.99 10.0¢ a cred |
| 250 creds | $39.99 16.0¢ a cred | $29.99 12.0¢ a cred | $19.99 8.0¢ a cred |
- Prices are in USD and do not include tax. Link, the merchant of record, adds any sales tax, VAT or GST at checkout.
- Red subscribers pay 25% less per pack. On Red the 15-cred pack is sold at its list price, because a discount would take it under the $4.99 minimum.
- Purple subscribers pay 50% less per pack. The 15-cred pack is not offered on Purple because the 40-cred pack costs the same.
- A discount applies while your Red or Purple subscription is active. It does not apply during a trial or on a plan granted by access code.
- No pack is priced below $4.99.
- Team plans do not use top-ups.
- Purchases are final except where the law requires a refund. See the Terms.
Open TL Creds in your profile to top up.
// api_and_mcp
API keys and MCP
Requests made with an API key or through the MCP server spend creds automatically, 3 creds per threat at your plan’s level.
| Plan | Daily cap | Spent from |
|---|---|---|
| Blue | 30 creds a day | Daily creds, then earned creds |
| Red | 75 creds a day | Daily creds, then earned creds |
| Purple | 450 creds a day | Daily creds, then earned creds |
| Gold | Metered, not limited | Recorded for your team |
- Purchased creds are used only after you turn on API and MCP spending in your profile.
- When a request needs more creds than it may use, a threat read returns the locked version of the threat. A single detection, export or tool call answers HTTP 402 with the code
credits_required. At the daily cap the API answers 429 withapi_cap_reached. - Gold teams get no creds 402 or 429: usage is recorded and nobody is refused.
- Agent keys are pinned to Blue and hold no creds.
- The MISP and TAXII feeds are not metered with creds.
Response details
- A
credits_requiredbody carriescostand yourbalance. When only purchased creds could pay, it also carriespurchased_available,opt_inand ahint. - A threat list sends
X-TL-Locked: how many threats on the page are locked at your plan’s level. - How a program authenticates: auth.md.
// frequently_asked
Questions about TL Creds
What are TL Creds?
TL Creds (“creds”) unlock detection rules, indicator (IOC) values and some analysis tools on Threadlinqs. They are a limited, revocable license to use the Service, not money: they have no cash value, cannot be redeemed for cash, and cannot be transferred, gifted, sold or traded. This page lists the current prices, allowances and earning rules. The full terms are in section 8 of the Terms.
What stays free?
The whole corpus is readable without an account, and every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone. Creds are for the rest: the other detection rules, indicator values and some analysis tools.
Do creds expire?
Daily creds reset at midnight Toronto time, and unused daily creds do not carry over. Purchased creds (top-ups) do not expire while your account exists. Earned creds from welcome grants, contributions, referrals and the launch bonus do not expire. Hunt Weekend creds expire 30 days after they are granted.
What does a day pass cover?
One tool, every view of it, until midnight Toronto time. It is charged once per tool per day: from your daily creds without a click on a paid plan, or when you confirm on Blue.
What happens when I run out?
Threadlinqs asks before it spends earned or purchased creds, and shows how to earn creds or top up. Anything free stays free. Your daily creds come back at midnight Toronto time.
Can I get a refund on a top-up?
Purchases are final except where the law requires a refund. Where the law gives you a right to cancel a purchase of digital content (for example, in the EU or UK), you ask for immediate delivery and accept that you lose that right once the creds are delivered. If a top-up is refunded or charged back, including a refund issued by Link as merchant of record, we remove the creds from that purchase (or the refunded share of them), even if this takes your purchased balance below zero.
What happens to my creds if I delete my account?
Purchased creds (top-ups) do not expire while your account exists and are forfeited if you delete your account.
Do team (Gold) plans use TL Creds?
On a Gold team plan, creds are not limited: each action that costs creds on a personal plan is recorded for your team at its usual price, nothing is charged to anyone, and no request is refused for lack of creds. Team plans do not use top-ups or auto day pass settings.
Do top-up prices include tax?
No. Prices are in USD and exclude tax. Link processes your payment, sends your receipts, and calculates and collects any sales tax, VAT or GST that applies.
I received a launch bonus. Does it expire?
No. It was added to your earned balance, it does not expire, and it is spent after your daily creds.
Do agent keys use creds?
No. Agent keys are pinned to Blue and cannot hold creds or top up. Anything behind creds comes back to them locked.
Does the Chrome extension use creds?
Yes. The Threadlinqs extension follows the same creds rules as the website. Version 1.1.1 shows a threat that needs creds as an “Unlock on Threadlinqs” card. Until your browser installs that update, the extension may show such a threat without its detection rules or indicators; open it on Threadlinqs to unlock it.
Does a trial include daily creds?
Yes. A trial of a paid plan includes that plan’s daily creds. The 7-day Purple trial needs a payment method, as the pricing page explains.
Your balance and your top-ups
Open TL Creds in your profile to see today's balance, your spend log and the packs for your plan. Plans and subscription prices are on the pricing page.
[ open_tl_creds ]Prices are in USD and exclude tax. Top-ups are sold through Link, the merchant of record.
See the Terms, the Privacy Policy and the Cookie Policy.