Guillaume BOURGEOIS
3a4d06441c
CrowdSec CTI API v2, 4 commands: IP reputation, multi-IP search, fire list. API-key auth, stdlib-only. py_compile clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
1.8 KiB
YAML
55 lines
1.8 KiB
YAML
id: crowdsec
|
|
name: CrowdSec CTI
|
|
version: 1.0.0
|
|
description: "CrowdSec CTI (Cyber Threat Intelligence API v2) — IP reputation from CrowdSec's collaborative community: look up an IP's reputation and behaviors, search several IPs at once, and pull the currently-firing malicious IPs. API-key authentication; stdlib-only, no extra Python dependencies. (French vendor.)"
|
|
changelog: "1.0.0 — Initial release: IP reputation, multi-IP search, fire list."
|
|
category: enrichment
|
|
|
|
# Per-instance configuration. The CTI API key is sent as the 'x-api-key' header.
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "CrowdSec CTI API key"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_key
|
|
|
|
commands:
|
|
- id: ip_reputation
|
|
name: crowdsec-ip-reputation
|
|
description: "Get an IP's CrowdSec reputation, behaviors and background noise score."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ip: { type: string, description: "IP address" }
|
|
required: [ip]
|
|
outputs_schema: { properties: {} }
|
|
- id: search_ips
|
|
name: crowdsec-search-ips
|
|
description: "Look up several IPs in one request."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ips: { type: string, description: "Comma-separated IP addresses" }
|
|
required: [ips]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_fire
|
|
name: crowdsec-get-fire
|
|
description: "List IPs currently flagged as actively malicious (the fire list)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
page: { type: number, description: "Page number (default 1)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: crowdsec-test-connection
|
|
description: "Verify the API key (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|