feat(anomali-threatstream): new Anomali ThreatStream threat-intel integration

ThreatStream API, 9 commands: ip/domain/file/url reputation, indicator search, passive DNS, threat models, import indicator. apikey auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 00:15:11 +02:00
parent ecc301d95d
commit a5db725529
10 changed files with 606 additions and 0 deletions
@@ -0,0 +1,112 @@
+id: anomali_threatstream
+name: Anomali ThreatStream
+version: 1.0.0
+description: "Anomali ThreatStream (API v2/v1) — threat intelligence: reputation lookups for IPs, domains, file hashes and URLs, indicator search, passive DNS, threat-model listing, and indicator import (with or without approval). API-key authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: ip/domain/file/url reputation, indicator search, passive DNS, threat models, import indicator."
+category: threat_intel
+
+# Per-instance configuration. Auth header 'Authorization: apikey <username>:<api_key>'.
+config_schema:
+  properties:
+    url:
+      type: string
+      description: "ThreatStream API URL"
+      default: "https://api.threatstream.com"
+    username:
+      type: string
+      description: "ThreatStream username"
+    api_key:
+      type: string
+      description: "ThreatStream API key"
+      x-soar-sensitive: true
+  required:
+    - username
+    - api_key
+
+commands:
+  - id: ip_reputation
+    name: anomali-ip-reputation
+    description: "Look up threat intelligence for an IP address."
+    risk: read
+    inputs_schema:
+      properties:
+        ip: { type: string, description: "IP address" }
+      required: [ip]
+    outputs_schema: { properties: {} }
+  - id: domain_reputation
+    name: anomali-domain-reputation
+    description: "Look up threat intelligence for a domain."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+  - id: file_reputation
+    name: anomali-file-reputation
+    description: "Look up threat intelligence for a file hash."
+    risk: read
+    inputs_schema:
+      properties:
+        file_hash: { type: string, description: "MD5/SHA1/SHA256 hash" }
+      required: [file_hash]
+    outputs_schema: { properties: {} }
+  - id: url_reputation
+    name: anomali-url-reputation
+    description: "Look up threat intelligence for a URL."
+    risk: read
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL" }
+      required: [url]
+    outputs_schema: { properties: {} }
+  - id: get_indicators
+    name: anomali-get-indicators
+    description: "Search indicators with a free-text query."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "ThreatStream search query (q=)" }
+        limit: { type: number, description: "Max indicators (default 20)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: passive_dns
+    name: anomali-passive-dns
+    description: "Get passive DNS records for an IP or domain."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "IP or domain" }
+        type: { type: string, description: "ip or domain (default ip)" }
+      required: [value]
+    outputs_schema: { properties: {} }
+  - id: get_threat_models
+    name: anomali-get-threat-models
+    description: "List threat models (actors, campaigns, incidents, ...)."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Optional name search" }
+        limit: { type: number, description: "Max models (default 20)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: import_indicator
+    name: anomali-import-indicator
+    description: "Import an observable as an indicator (optionally requiring approval)."
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Observable value (IP, domain, hash, URL)" }
+        itype: { type: string, description: "Indicator type (e.g. mal_ip, mal_domain, apt_md5)" }
+        confidence: { type: number, description: "Confidence 0-100 (default 50)" }
+        approve: { type: boolean, description: "Import without approval (default false = requires approval)" }
+      required: [value, itype]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: anomali-test-connection
+    description: "Verify connectivity and the API key (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }