diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 3e2b2cc..d1f2440 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,4 +6,12 @@ Just do one or more of the following: - Open an issue - Send a pull request +If you send a pull request, please run the test suite first. It is stdlib-only (no +third-party dependencies needed) and also runs in CI on every PR: + +``` +python3 -m unittest discover -s tests -v +python3 feed_audit.py --check # static load-contract check for feed modules +``` + TIA! -- A. Eijkhoudt diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md index af1b216..b237fb1 100644 --- a/docs/COMMANDS.md +++ b/docs/COMMANDS.md @@ -36,7 +36,6 @@ The currently supported commands are listed below: | FileSec | Threat Intel | Look up a file extension on filesec.io for attack-relevance metadata: weaponisation status, execution behaviour, common use cases and references | No | No | | Fofa | Threat Intel | Fofa surface search; plain IP/domain input is auto-wrapped, anything else is passed verbatim as a Fofa query (e.g. `port="22" && country="CN"`). Requires a free Fofa account | Yes | No | | FullHunt | Threat Intel | FullHunt attack-surface lookup: bare query returns asset details (host count, tech fingerprints, countries, tags); `subdomains ` enumerates subdomains. Requires a free FullHunt account | Yes | No | -| GeoLocation | Threat Intel | Convert latitude/longitude  values into an address | No | No | | GeoLookup | Threat Intel | Reverse-geocode a ` ` pair via OpenStreetMap Nominatim and return the geolocation, if available | No | No | | GHunt | OSINT | Look up a Google account via the GHunt CLI - surfaces Gaia ID, profile picture, public reviews/maps activity and linked services. Wraps the `ghunt` binary (operator must run `ghunt login` first) | No | No | | Grayhat Warfare | Threat Intel | Query the Grayhat API for for public (eg. AWS, AZ, GCP) buckets and their contents. | Yes | No: Search in limited amount of buckets
Yes: all available buckets, regex searching, sorting on size/last modified date; see the GrayhatWarfare website for more information | @@ -53,6 +52,7 @@ The currently supported commands are listed below: | IPinfo | Threat Intel | Look up IP address information, such as geolocation and ownership | Yes | No: basic functionality, Yes: increased query limits | | IPLocation | Threat Intel | Look up general location information (country, ISP) for an IPv4 of IPv6 address | No | No | | IPWHOIS | Threat Intel | Look up IP address information: ownership, ASN, geolocation information | No | No | +| Kaspersky OpenTIP | Threat Intel | Kaspersky OpenTIP community reputation lookup; auto-detects IPs, domains, URLs and MD5/SHA1/SHA256 hashes and returns the verdict zone (Green/Yellow/Red/Grey) plus key metadata. Intentionally not bound to `@ioc` by default — enabling Kaspersky in a SOC tool is a compliance call the operator should make explicitly | Yes | No | | KoboldCPP | AI | Query a KoboldCPP instance with a question | Yes | Yes: either a paid subscription with an existing provider, or requires your own resource | | LeakIX | Threat Intel | Find subdomains and look up possible information/data leaks for hosts and domains | Yes: API key strongly recommended to prevent hitting API limits | No: basic functionality, Yes: additional data | | LOLBAS | Threat Intel | Query the 'Living Off The Land Binaries, Scripts and Libraries' project for file information. Returns detailed information and detection rules | No | No | @@ -79,6 +79,7 @@ The currently supported commands are listed below: | PeeringDB | Threat Intel | Look up network info on PeeringDB for an autonomous system: organisation, network type, IRR AS-set, traffic estimate, IXPs and facilities | No | No | | PhishStats | Threat Intel | Query PhishStats for recent phishing reports matching a domain or hostname substring; returns date, URL, score and page title per hit | No | No | | ProxyCheck | Threat Intel | Query the ProxyCheck.io API for information about IP and email addresses and | No | No, but a free registration or paid subscription will substantially increase daily allowance and rate limits | +| Pulsedive | Threat Intel | Look up an IP, domain, URL or MD5/SHA1/SHA256 hash on Pulsedive; returns risk level, associated threats and feed memberships. Requires a free Pulsedive account | Yes | No: the read endpoints used here
Yes: the higher-volume scan/analyze flow | | Qualys | Vulnerability Management | Query the Qualys CSAM API for software/libraries present on systems. Extremely useful for Attack Surface Management / Vulnerability Management. Returns a collated dataset of found software and versions, as well as a CSV list of systems found | Yes | Yes: Qualys subscription required, as well as CSAM subscription and agent-based scans on hosts | | RansomLook | Threat Intel | Search and view ransomware groups, markets, posts and telegram channels | No | No | | ReversingsLabs A1000 / TitaniumCloud | Threat Intel | Look up IPv4, IPv6, hosts/domains, URLs and MD5/SHA1/SHA256/SHA512 hashes | Yes | Yes | @@ -96,11 +97,14 @@ The currently supported commands are listed below: | Unprotect.it | Threat Intel | Search the Unprotect.it project for information on TTPs, code snippets and detection rules. Returns code snippets and detection rules as a download, if available | No | No | | URLhaus | Threat Intel | Look up reputation info on URLhaus for URLs and MD5 / SHA1 / SHA256 URL hashes | Yes | No | | Urlscan | Threat Intel | Query the Urlscan API for information on URLs/hostnames | Yes | Yes: Pro version has higher query and rate limits | +| Validin | Threat Intel | Validin DNS history lookup for a domain or IP. Requires a free Validin account | Yes | No | | VARIoT | Vulnerability Management | Search the VARIoT IoT vulnerability/exploit database by text, or look up a specific VAR vulnerability/exploit identifier (`VAR-YEARMONTH-ENUMERATOR`) | No | No, but signing up raises the 100-queries/day limit | | VirusTotal | Threat Intel | Search VirusTotal for IP addresses, MD5/SHA1/SHA256 hashes, URLs and domains. Returned results will include maliciousness, TTP sets, malware family names, etc., if available | Yes | No: basic functionality
Yes: paid VT features, throttling limit removal, etc. | | VulnCheck | Vulnerability Management | Query VulnCheck for CVE detail (description, CVSS, CWE, references) and known exploit count. Requires a free VulnCheck account | Yes | No | +| Watch | Utility | Watch channel messages for keywords and get DM'd when they match — like Mattermost's built-in keyword notifications, but with per-keyword expiry (`@watch add ransomware 7d`). Subcommands: `list`, `add`, `del`, `clear` | No | No | | Wayback Machine | Information Retrieval | Search Archive.org's Internet Wayback Machine for a given URL, and display the availability and links to the oldest and newest snapshots. | No | No | | WaybackLister | Information Retrieval | Enumerate paths the Wayback Machine has archived for a domain and filter for directory-shaped URLs (paths ending in `/`), as a first-pass open-directory hunt without touching the live domain | No | No | +| Welcome | Utility | Per-channel welcome messages for joining users, delivered via DM, channel post or both. Managed by Mattermost system/channel admins or a per-channel allowlist; `{user}` in the message expands to the joining user's mention | No | No | | WiGLE | OSINT | WiGLE wireless-network lookup; `ssid ` searches by network name, `bssid ` by access-point MAC, bare query auto-routes MAC-shaped input to bssid. Requires a free WiGLE account | Yes | No | | WikiJS | Information Retrieval | Search through WikiJS pages' contents for the given search terms. Returns links to the pages where the contents were found | Yes | Yes: currently requires a Microsoft Azure Search instance that indexes the WikiJS instance (*Note: this is a WikiJS limitation!*) | | YARAify | Threat Intel | Query abuse.ch YARAify by MD5/SHA1/SHA256 hash for matched YARA rules, signature/family, tags and first-seen timestamp | No | No: anonymous tier; optional auth-key for higher limits | diff --git a/docs/FEEDS.md b/docs/FEEDS.md index a856f03..c46e7bd 100644 --- a/docs/FEEDS.md +++ b/docs/FEEDS.md @@ -142,6 +142,7 @@ The currently supported sources are listed below: | Palo Alto/Unit 42 Advisories | RSS | No | No | | Patchstack Wordpress Security | RSS | No | No | | Persistent Security News | RSS | No | No | +| PhishingCatcher (suspicious-domains log watcher, scores hits against your configured domains) | Log file | No | No | | Portswigger Threat Research | RSS | No | No | | Prodaft Threat Intelligence | RSS | No | No | | Pulsedive Threat Intelligence | RSS | No | No | @@ -149,6 +150,7 @@ The currently supported sources are listed below: | Quesma LLM Blog | RSS | No | No | | R136a1 Malware Analysis | RSS | No | No | | RansomLook (with support for detection of keywords/regex) | JSON | No | No | +| Ransomware Data Leak (self-hosted JSON source, e.g. ransomleak output) | JSON | No | No | | Ransomwatch | JSON | No | No | | Recorded Future Threat Research | RSS | No | No | | Red Asgard Threat Intelligence | RSS | No | No | @@ -202,6 +204,7 @@ The currently supported sources are listed below: | Tweakers.net Nieuws | RSS | No | No | | US-CERT National Cyber Awareness System (Advisories, Alerts, Analysis Reports, Current Activity) | RSS | No | No | | Validin Threat Intelligence | RSS | No | No | +| VARIoT IoT Vulnerabilities | JSON | Yes | No | | Varonis Threat Research | RSS | No | No | | Veeam Advisories | RSS | No | No | | Velociraptor News/Updates | RSS | No | No |