feat(maltiverse): new Maltiverse enrichment integration

5 commands: IP/domain/URL/file threat-intel reputation. Bearer-token auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 22:39:29 +02:00
parent 79d870a4e8
commit 1294e3b330
6 changed files with 252 additions and 0 deletions
@@ -0,0 +1,62 @@
+id: maltiverse
+name: Maltiverse
+version: 1.0.0
+description: "Maltiverse (API) — threat-intelligence reputation for IPs, hostnames/domains, URLs and file samples (classification, blacklist sources, tags, first/last seen). Bearer-token authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: IP, hostname/domain, URL and file-sample reputation."
+category: enrichment
+
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "Maltiverse API key (Bearer token, from your Maltiverse account)"
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+commands:
+  - id: ip_reputation
+    name: maltiverse-ip
+    description: "Threat-intelligence reputation for an IP address."
+    risk: read
+    inputs_schema:
+      properties:
+        ip: { type: string, description: "IP address" }
+      required: [ip]
+    outputs_schema: { properties: {} }
+  - id: domain_reputation
+    name: maltiverse-domain
+    description: "Threat-intelligence reputation for a hostname/domain."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Hostname or domain" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: url_reputation
+    name: maltiverse-url
+    description: "Threat-intelligence reputation for a URL."
+    risk: read
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL" }
+      required: [url]
+    outputs_schema: { properties: {} }
+  - id: file_reputation
+    name: maltiverse-file
+    description: "Threat-intelligence reputation for a file sample by hash (MD5, SHA1 or SHA256)."
+    risk: read
+    inputs_schema:
+      properties:
+        file: { type: string, description: "File hash" }
+      required: [file]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: maltiverse-test-connection
+    description: "Verify the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }