From 94142f4739f441532db4a621dd183dfb60c373e3 Mon Sep 17 00:00:00 2001 From: Guillaume Bourgeois Date: Fri, 9 Oct 2026 22:53:04 +0000 Subject: [PATCH] docs(ioc-sources): suggest summary lines for Riposte context enrichment rules Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5 --- integrations/circl-hashlookup/manifest.yaml | 2 +- integrations/crtsh/manifest.yaml | 2 +- integrations/rdap/manifest.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/integrations/circl-hashlookup/manifest.yaml b/integrations/circl-hashlookup/manifest.yaml index 9487aad..75b134f 100644 --- a/integrations/circl-hashlookup/manifest.yaml +++ b/integrations/circl-hashlookup/manifest.yaml @@ -1,7 +1,7 @@ id: circl_hashlookup name: CIRCL hashlookup version: 1.0.0 -description: "CIRCL hashlookup — tells whether a file hash belongs to known software: NSRL, Linux distribution packages, Windows updates and other trusted sets (6.5 billion hashes). The fastest way to rule out a false positive on a file alert. Free public service, no API key; the server is open source and can be self-hosted (set base_url). Stdlib-only. As an enrichment rule: command lookup_hash, score field `score`, benign threshold 0 and malicious threshold 100 — a known file reads benign, a record CIRCL flags as KnownMalicious reads malicious, and an unknown hash is an answer (not found), never a failure." +description: "CIRCL hashlookup — tells whether a file hash belongs to known software: NSRL, Linux distribution packages, Windows updates and other trusted sets (6.5 billion hashes). The fastest way to rule out a false positive on a file alert. Free public service, no API key; the server is open source and can be self-hosted (set base_url). Stdlib-only. As an enrichment rule: command lookup_hash, score field `score`, benign threshold 0 and malicious threshold 100 — a known file reads benign, a record CIRCL flags as KnownMalicious reads malicious, and an unknown hash is an answer (not found), never a failure. Add the summary `Known file ${FileName} (${source})` (Riposte 0.299+) to see which file it is." changelog: "1.0.0 — Initial release: single lookup (MD5, SHA-1, SHA-256), bulk lookup (MD5, SHA-1), test connection." category: enrichment diff --git a/integrations/crtsh/manifest.yaml b/integrations/crtsh/manifest.yaml index e473e25..aa27bd0 100644 --- a/integrations/crtsh/manifest.yaml +++ b/integrations/crtsh/manifest.yaml @@ -1,7 +1,7 @@ id: crtsh name: crt.sh (Certificate Transparency) version: 1.0.0 -description: "crt.sh by Sectigo — searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Lists a domain's sub-domains and who issued their certificates, shows when a host first got a certificate (a phishing site usually gets one the day it goes live), and finds look-alike domains that start with a client's brand. Free, no API key; stdlib-only. crt.sh is a shared public service: it is slow on big domains and a starts_with search on a short word can time out — keep searches narrow." +description: "crt.sh by Sectigo — searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Lists a domain's sub-domains and who issued their certificates, shows when a host first got a certificate (a phishing site usually gets one the day it goes live), and finds look-alike domains that start with a client's brand. Free, no API key; stdlib-only. crt.sh is a shared public service: it is slow on big domains and a starts_with search on a short word can time out — keep searches narrow. As a context enrichment rule (Riposte 0.299+, no score field) on domains: search_certificates with summary `${name_count} names, newest certificate ${certificates.0.not_before}`." changelog: "1.0.0 — Initial release: certificate search (sub-domains, exact name, starts with), test connection." category: enrichment diff --git a/integrations/rdap/manifest.yaml b/integrations/rdap/manifest.yaml index efe232d..aafc2d8 100644 --- a/integrations/rdap/manifest.yaml +++ b/integrations/rdap/manifest.yaml @@ -1,7 +1,7 @@ id: rdap name: RDAP (WHOIS) version: 1.0.0 -description: "RDAP, the IETF successor to WHOIS — who registered a domain, an IP block or an AS number, and when. Answers the first phishing question (how old is this domain?) with `age_days`, plus registrar, status, name servers and the abuse contact. Queries the authoritative registry found through the IANA bootstrap files; free, no API key; stdlib-only. Personal data is usually redacted by registries (GDPR) — expect the registrant to be empty for most domains." +description: "RDAP, the IETF successor to WHOIS — who registered a domain, an IP block or an AS number, and when. Answers the first phishing question (how old is this domain?) with `age_days`, plus registrar, status, name servers and the abuse contact. Queries the authoritative registry found through the IANA bootstrap files; free, no API key; stdlib-only. Personal data is usually redacted by registries (GDPR) — expect the registrant to be empty for most domains. As a context enrichment rule (Riposte 0.299+, no score field): domain_lookup with summary `Registered ${age_days} days ago · ${registrar}`; ip_lookup with `${network_name} · ${holder} · ${country}`." changelog: "1.0.0 — Initial release: domain, IP and ASN lookups through the IANA bootstrap, test connection." category: enrichment