docs(ioc-sources): suggest summary lines for Riposte context enrichment rules

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5

integrations/circl-hashlookup/manifest.yaml

@@ -1,7 +1,7 @@
 id: circl_hashlookup
 name: CIRCL hashlookup
 version: 1.0.0
-description: "CIRCL hashlookup — tells whether a file hash belongs to known software: NSRL, Linux distribution packages, Windows updates and other trusted sets (6.5 billion hashes). The fastest way to rule out a false positive on a file alert. Free public service, no API key; the server is open source and can be self-hosted (set base_url). Stdlib-only. As an enrichment rule: command lookup_hash, score field `score`, benign threshold 0 and malicious threshold 100 — a known file reads benign, a record CIRCL flags as KnownMalicious reads malicious, and an unknown hash is an answer (not found), never a failure."
+description: "CIRCL hashlookup — tells whether a file hash belongs to known software: NSRL, Linux distribution packages, Windows updates and other trusted sets (6.5 billion hashes). The fastest way to rule out a false positive on a file alert. Free public service, no API key; the server is open source and can be self-hosted (set base_url). Stdlib-only. As an enrichment rule: command lookup_hash, score field `score`, benign threshold 0 and malicious threshold 100 — a known file reads benign, a record CIRCL flags as KnownMalicious reads malicious, and an unknown hash is an answer (not found), never a failure. Add the summary `Known file ${FileName} (${source})` (Riposte 0.299+) to see which file it is."
 changelog: "1.0.0 — Initial release: single lookup (MD5, SHA-1, SHA-256), bulk lookup (MD5, SHA-1), test connection."
 category: enrichment
 

integrations/crtsh/manifest.yaml

@@ -1,7 +1,7 @@
 id: crtsh
 name: crt.sh (Certificate Transparency)
 version: 1.0.0
-description: "crt.sh by Sectigo — searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Lists a domain's sub-domains and who issued their certificates, shows when a host first got a certificate (a phishing site usually gets one the day it goes live), and finds look-alike domains that start with a client's brand. Free, no API key; stdlib-only. crt.sh is a shared public service: it is slow on big domains and a starts_with search on a short word can time out — keep searches narrow."
+description: "crt.sh by Sectigo — searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Lists a domain's sub-domains and who issued their certificates, shows when a host first got a certificate (a phishing site usually gets one the day it goes live), and finds look-alike domains that start with a client's brand. Free, no API key; stdlib-only. crt.sh is a shared public service: it is slow on big domains and a starts_with search on a short word can time out — keep searches narrow. As a context enrichment rule (Riposte 0.299+, no score field) on domains: search_certificates with summary `${name_count} names, newest certificate ${certificates.0.not_before}`."
 changelog: "1.0.0 — Initial release: certificate search (sub-domains, exact name, starts with), test connection."
 category: enrichment
 

integrations/rdap/manifest.yaml

@@ -1,7 +1,7 @@
 id: rdap
 name: RDAP (WHOIS)
 version: 1.0.0
-description: "RDAP, the IETF successor to WHOIS — who registered a domain, an IP block or an AS number, and when. Answers the first phishing question (how old is this domain?) with `age_days`, plus registrar, status, name servers and the abuse contact. Queries the authoritative registry found through the IANA bootstrap files; free, no API key; stdlib-only. Personal data is usually redacted by registries (GDPR) — expect the registrant to be empty for most domains."
+description: "RDAP, the IETF successor to WHOIS — who registered a domain, an IP block or an AS number, and when. Answers the first phishing question (how old is this domain?) with `age_days`, plus registrar, status, name servers and the abuse contact. Queries the authoritative registry found through the IANA bootstrap files; free, no API key; stdlib-only. Personal data is usually redacted by registries (GDPR) — expect the registrant to be empty for most domains. As a context enrichment rule (Riposte 0.299+, no score field): domain_lookup with summary `Registered ${age_days} days ago · ${registrar}`; ip_lookup with `${network_name} · ${holder} · ${country}`."
 changelog: "1.0.0 — Initial release: domain, IP and ASN lookups through the IANA bootstrap, test connection."
 category: enrichment