feat: CIRCL hashlookup, RDAP and crt.sh — free IOC lookups, no API key

Three keyless sources for the questions an analyst asks first:

- circl-hashlookup 1.0.0: is this hash known software (NSRL, distro
  packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL
  flags it KnownMalicious, so an enrichment rule with benign 0 marks it
  benign; an unknown hash is an HTTP 404, read as "no record". Single and
  bulk lookups; base_url for a self-hosted instance.
- rdap 1.0.0: who registered a domain, IP block or AS, and when — with
  age_days for the phishing question. Authoritative server from the IANA
  bootstrap, rdap.org as fallback; a host name walks up to its registered
  domain; GDPR placeholders are not reported as registrants; a TLD with no
  RDAP (.ch) is an error, not a fake "unregistered".
- crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen,
  issuers, recent certificates, and a starts_with mode for look-alikes of a
  brand (crt.sh no longer searches with a leading wildcard). Retries the
  502/503/504 its shared front throws under load.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5

integrations/circl-hashlookup/scripts/lookup_hash.py

@@ -0,0 +1,73 @@
+import json, os, re, ssl, sys, urllib.error, urllib.request
+
+DEFAULT_BASE = "https://hashlookup.circl.lu"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "").strip() or DEFAULT_BASE).rstrip("/")
+
+
+def _ctx(cfg):
+    if cfg.get("insecure") in (True, "true", "True", 1, "1"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+def call(cfg, path, body=None):
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "User-Agent": "riposte-soar"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(_base(cfg) + path, data=data, headers=headers, method="POST" if data is not None else "GET")
+    with urllib.request.urlopen(req, timeout=60, context=_ctx(cfg)) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+KINDS = {32: "md5", 40: "sha1", 64: "sha256"}
+
+
+def kind_of(h):
+    h = h.strip().lower()
+    if not re.fullmatch(r"[0-9a-f]+", h) or len(h) not in KINDS:
+        raise Exception("not an MD5, SHA-1 or SHA-256 hash: " + h)
+    return KINDS[len(h)], h
+
+
+def annotate(rec):
+    # score: 0 for a known file, 100 when CIRCL itself flags the record as
+    # malicious — what an enrichment rule maps with benign 0 / malicious 100.
+    rec = dict(rec)
+    rec["known"] = True
+    rec["score"] = 100 if rec.get("KnownMalicious") else 0
+    return rec
+
+
+def main(cfg, inputs):
+    kind, h = kind_of(str(inputs.get("hash", "")))
+    return annotate(call(cfg, "/lookup/%s/%s" % (kind, h)))
+
+
+_run(main)