From 5ee7352652def3d9072ed70992c11273f4ba657f Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Wed, 15 Jul 2026 19:18:49 +0200 Subject: [PATCH] =?UTF-8?q?fix(ransomware-live):=20keyless=20=E2=80=94=20d?= =?UTF-8?q?rop=20optional=20API=20key,=20no=20auth=20required?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ransomware.live's v2 API is free and needs no authentication. Remove the optional api_key config field and the X-API-KEY header logic from all commands so instance creation requires no credentials. Only an optional base_url override remains. Co-Authored-By: Claude Opus 4.8 (1M context) --- integrations/ransomware-live/manifest.yaml | 11 +++-------- .../ransomware-live/scripts/country_victims.py | 3 --- integrations/ransomware-live/scripts/get_group.py | 3 --- integrations/ransomware-live/scripts/group_victims.py | 3 --- integrations/ransomware-live/scripts/list_groups.py | 3 --- .../ransomware-live/scripts/recent_cyberattacks.py | 3 --- .../ransomware-live/scripts/recent_victims.py | 3 --- .../ransomware-live/scripts/search_victims.py | 3 --- .../ransomware-live/scripts/test_connection.py | 3 --- .../ransomware-live/scripts/victims_by_date.py | 3 --- 10 files changed, 3 insertions(+), 35 deletions(-) diff --git a/integrations/ransomware-live/manifest.yaml b/integrations/ransomware-live/manifest.yaml index 077ce33..e72ce14 100644 --- a/integrations/ransomware-live/manifest.yaml +++ b/integrations/ransomware-live/manifest.yaml @@ -1,19 +1,14 @@ id: ransomware_live name: Ransomware.live version: 1.0.0 -description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). An API key is optional — set it if your ransomware.live plan requires one; it is sent as the X-API-KEY header. Stdlib-only, no extra Python dependencies." +description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). Free and keyless — no authentication required. Stdlib-only, no extra Python dependencies." changelog: "1.0.0 — Initial release: recent victims, groups, group profile, group victims, search victims (keyword/country/date), recent cyberattacks." category: threat_intel -# Per-instance configuration. Ransomware.live's v2 API may require a free API key -# depending on your plan; leave it blank to call keyless endpoints. When set, it -# is sent as the X-API-KEY header. +# Ransomware.live's v2 API is free and requires no authentication. The only +# configuration is an optional base URL override. config_schema: properties: - api_key: - type: string - description: "Ransomware.live API key (optional — sent as X-API-KEY when set)" - x-soar-sensitive: true base_url: type: string description: "API base URL" diff --git a/integrations/ransomware-live/scripts/country_victims.py b/integrations/ransomware-live/scripts/country_victims.py index 1fd8650..912e755 100644 --- a/integrations/ransomware-live/scripts/country_victims.py +++ b/integrations/ransomware-live/scripts/country_victims.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/get_group.py b/integrations/ransomware-live/scripts/get_group.py index 6735b30..9708879 100644 --- a/integrations/ransomware-live/scripts/get_group.py +++ b/integrations/ransomware-live/scripts/get_group.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/group_victims.py b/integrations/ransomware-live/scripts/group_victims.py index 964384b..4b79f30 100644 --- a/integrations/ransomware-live/scripts/group_victims.py +++ b/integrations/ransomware-live/scripts/group_victims.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/list_groups.py b/integrations/ransomware-live/scripts/list_groups.py index 4e49840..7c79803 100644 --- a/integrations/ransomware-live/scripts/list_groups.py +++ b/integrations/ransomware-live/scripts/list_groups.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/recent_cyberattacks.py b/integrations/ransomware-live/scripts/recent_cyberattacks.py index a7e1931..bd4f15c 100644 --- a/integrations/ransomware-live/scripts/recent_cyberattacks.py +++ b/integrations/ransomware-live/scripts/recent_cyberattacks.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/recent_victims.py b/integrations/ransomware-live/scripts/recent_victims.py index 02ce739..4e90805 100644 --- a/integrations/ransomware-live/scripts/recent_victims.py +++ b/integrations/ransomware-live/scripts/recent_victims.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/search_victims.py b/integrations/ransomware-live/scripts/search_victims.py index 4b3dad3..7c437ad 100644 --- a/integrations/ransomware-live/scripts/search_victims.py +++ b/integrations/ransomware-live/scripts/search_victims.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/test_connection.py b/integrations/ransomware-live/scripts/test_connection.py index ccf3abd..9a66549 100644 --- a/integrations/ransomware-live/scripts/test_connection.py +++ b/integrations/ransomware-live/scripts/test_connection.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read() diff --git a/integrations/ransomware-live/scripts/victims_by_date.py b/integrations/ransomware-live/scripts/victims_by_date.py index f7ea659..1fb1c8e 100644 --- a/integrations/ransomware-live/scripts/victims_by_date.py +++ b/integrations/ransomware-live/scripts/victims_by_date.py @@ -14,9 +14,6 @@ def _inputs(): def _get(cfg, path): base = (cfg.get("base_url") or DEFAULT_BASE).rstrip("/") headers = {"User-Agent": "Riposte-SOAR", "Accept": "application/json"} - key = str(cfg.get("api_key") or "").strip() - if key: - headers["X-API-KEY"] = key req = urllib.request.Request(base + path, headers=headers) with urllib.request.urlopen(req, timeout=60) as r: raw = r.read()