Building a Threat Intel CLI Tool in Rust

Wed, 01 Apr 2026 00:00:00 +0000

Python is the default language for security tooling, but Rust offers compelling advantages for CLI tools that need to be fast, distributable as a single binary, and safe by default. Here’s how I built a threat intelligence lookup tool in Rust.

The goal

A single binary that:

Accepts an IP, domain, or hash as input
Queries VirusTotal, AbuseIPDB, and Shodan in parallel
Outputs a unified JSON report

Project setup

cargo init threat-lookup
cd threat-lookup
cargo add reqwest --features json,rustls-tls
cargo add tokio --features full
cargo add serde --features derive
cargo add serde_json
cargo add clap --features derive

CLI argument parsing with Clap

use clap::Parser;

#[derive(Parser, Debug)]
#[command(name = "threat-lookup")]
#[command(about = "Query threat intel APIs for IOCs")]
struct Args {
 /// The indicator to look up (IP, domain, or hash)
 indicator: String,

 /// Output format
 #[arg(short, long, default_value = "json")]
 format: String,

 /// Verbose output
 #[arg(short, long)]
 verbose: bool,
}

Parallel API queries with Tokio

The key advantage of Rust here is safe, zero-cost concurrency. All three API calls happen simultaneously:

Threat-Intel on Clean Tech

Building a Threat Intel CLI Tool in Rust

The goal

Project setup

CLI argument parsing with Clap

Parallel API queries with Tokio