f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
d2742ec6fb29b53c026d6e4ed021a1c8a1f7bc23
riposte-marketplace/integrations
T
History
f3nris d2742ec6fb feat: CIRCL hashlookup, RDAP and crt.sh — free IOC lookups, no API key 
Three keyless sources for the questions an analyst asks first:

- circl-hashlookup 1.0.0: is this hash known software (NSRL, distro
  packages, Windows updates)? `score` 0 for a known file, 100 when CIRCL
  flags it KnownMalicious, so an enrichment rule with benign 0 marks it
  benign; an unknown hash is an HTTP 404, read as "no record". Single and
  bulk lookups; base_url for a self-hosted instance.
- rdap 1.0.0: who registered a domain, IP block or AS, and when — with
  age_days for the phishing question. Authoritative server from the IANA
  bootstrap, rdap.org as fallback; a host name walks up to its registered
  domain; GDPR placeholders are not reported as registrants; a TLD with no
  RDAP (.ch) is an error, not a fake "unregistered".
- crtsh 1.0.0: Certificate Transparency — sub-domains with first/last seen,
  issuers, recent certificates, and a starts_with mode for look-alikes of a
  brand (crt.sh no longer searches with a leading wildcard). Retries the
  502/503/504 its shared front throws under load.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AmWT9wtWHGtZpMS64Hp4q5
2026-10-09 22:33:42 +00:00
..
abuseipdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
active-directory
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
alienvault-otx
feat(alienvault-otx): new AlienVault OTX enrichment integration
2026-07-11 22:33:10 +02:00
anomali-threatstream
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
anyrun
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
armis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
automox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
aws
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
axonius
feat(axonius): new Axonius asset-management integration
2026-07-12 14:41:43 +02:00
azure-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
beyondtrust-password-safe
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
binaryedge
feat(binaryedge): new BinaryEdge exposure-intel integration
2026-07-12 14:15:54 +02:00
box
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cape
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
carbon-black-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
censys
feat(censys): new Censys enrichment integration
2026-07-11 22:39:29 +02:00
checkpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
chronicle
feat(chronicle): new Google Chronicle SIEM integration
2026-07-12 00:25:51 +02:00
circl-hashlookup
feat: CIRCL hashlookup, RDAP and crt.sh — free IOC lookups, no API key
2026-10-09 22:33:42 +00:00
cisco-fmc
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-ise
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-secure-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-umbrella-enforcement
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cloudflare
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
confluence
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cortex-xdr
docs(mappers): MTTD is not retired, only re-anchored
2026-10-07 09:58:20 +00:00
crowdsec
feat(crowdsec): new CrowdSec CTI integration (French vendor)
2026-07-12 16:07:37 +02:00
crowdstrike
docs(mappers): MTTD is not retired, only re-anchored
2026-10-07 09:58:20 +00:00
crtsh
feat: CIRCL hashlookup, RDAP and crt.sh — free IOC lookups, no API key
2026-10-09 22:33:42 +00:00
cuckoo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybelangel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cyberark-pas
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybereason
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
darktrace
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
datadog
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
delinea-secret-server
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
discord
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
domaintools
feat(domaintools): new DomainTools DNS-intel integration
2026-07-12 21:59:05 +02:00
dropbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
duo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
eclecticiq
feat(eclecticiq): new EclecticIQ threat-intel integration
2026-07-12 15:49:16 +02:00
efficientip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
elasticsearch
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
emailrep
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
extrahop
feat(extrahop): new ExtraHop Reveal(x) NDR integration
2026-07-12 00:48:03 +02:00
f5-bigip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
feed-aws-ipranges
feat(feed): add AWS IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:48 +02:00
feed-blocklist-de
feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)
2026-07-12 22:59:19 +02:00
feed-botvrij
feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)
2026-07-13 12:15:50 +02:00
feed-cins-army
feat(feed): add CINS Army feed connector (CI Army bad-guys list)
2026-07-12 22:59:20 +02:00
feed-cisa-kev
feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)
2026-07-13 12:12:34 +02:00
feed-cloudflare-ips
feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-csv
feat(feed-csv): new generic CSV threat-intel feed connector
2026-07-12 22:43:16 +02:00
feed-dshield
feat(feed): add DShield block list feed connector (SANS ISC)
2026-07-12 22:59:18 +02:00
feed-emergingthreats
feat(feed): add Emerging Threats feed connector (ET Open reputation lists)
2026-07-12 23:02:11 +02:00
feed-feodotracker
feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)
2026-07-12 22:49:28 +02:00
feed-first-epss
feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)
2026-07-13 12:12:35 +02:00
feed-gcp-ipranges
feat(feed): add GCP IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-json
feat(feed): add generic JSON feed connector (configurable field mapping)
2026-07-12 23:02:10 +02:00
feed-nvd
feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)
2026-07-13 12:12:34 +02:00
feed-office365
feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)
2026-07-13 12:15:50 +02:00
feed-openphish
feat(feed): add OpenPhish feed connector (community phishing URLs)
2026-07-12 23:02:11 +02:00
feed-plaintext
feat(feed-plaintext): new generic plain-text threat-intel feed connector
2026-07-12 22:43:17 +02:00
feed-rss
feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)
2026-07-13 12:15:49 +02:00
feed-spamhaus-drop
feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)
2026-07-12 22:49:30 +02:00
feed-sslbl
feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)
2026-07-12 22:56:36 +02:00
feed-taxii2
feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector
2026-07-12 22:43:17 +02:00
feed-threatfox
feat(feed): add ThreatFox feed connector (abuse.ch IOC export)
2026-07-12 22:56:36 +02:00
feed-tor-exit
feat(feed): add Tor exit nodes feed connector
2026-07-12 22:49:29 +02:00
feed-urlhaus
feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)
2026-07-12 22:56:35 +02:00
forcepoint-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
fortigate
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
freshservice
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gatewatcher
feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)
2026-07-12 16:12:38 +02:00
gcp-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
github
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gitlab
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
glimps
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail-single-user
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-calendar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-drive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
graylog
feat(graylog): new Graylog log-search integration
2026-07-12 15:08:50 +02:00
greynoise
feat(greynoise): new GreyNoise enrichment integration
2026-07-11 22:33:09 +02:00
harfanglab
feat(harfanglab): describe an incident with the rule's message (1.7.1)
2026-10-07 19:11:35 +00:00
hibp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
hunter
feat(hunter): new Hunter.io email-OSINT integration
2026-07-12 14:15:53 +02:00
hybrid-analysis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
imperva
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
infoblox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intel471
feat(intel471): new Intel 471 threat-intel integration
2026-07-12 15:49:17 +02:00
intezer
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intune
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ipinfo
feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)
2026-08-05 21:01:43 +02:00
ipqualityscore
feat(ipqualityscore): new IPQualityScore enrichment integration
2026-07-11 22:58:17 +02:00
jira
feat(jira): pick the project, issue type and priority from the site (1.3.0)
2026-10-02 10:16:41 +00:00
joe-sandbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
jumpcloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mail-sender
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mailinblack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
maltiverse
feat(maltiverse): new Maltiverse enrichment integration
2026-07-11 22:39:29 +02:00
malwarebazaar
feat(malwarebazaar): new MalwareBazaar sample-intel integration
2026-07-12 14:58:07 +02:00
mandiant
feat(mandiant): new Mandiant Advantage threat-intel integration
2026-07-12 00:15:12 +02:00
mattermost
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
meraki
feat(meraki): new Cisco Meraki network integration
2026-07-12 21:53:58 +02:00
microsoft-defender-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-defender-o365
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-entra-id
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-graph-files
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-purview
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-sentinel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-teams
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mimecast
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
misp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mock-edr-s1
fix(mock-edr-s1): map the OCSF-shaped incident payload
2026-06-27 16:20:53 +02:00
netskope
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
okta
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
onelogin
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
opencti
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
openldap
feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)
2026-06-26 17:44:54 +02:00
opsgenie
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ovhcloud
fix(ovhcloud): treat the billing-account list as advice, never as a verdict (1.2.6)
2026-09-19 19:29:09 +00:00
pagerduty
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
panos
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
pingone
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
prisma-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
proofpoint-tap
feat(proofpoint-tap): new Proofpoint TAP email-threat integration
2026-07-11 23:46:35 +02:00
pulsedive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qradar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qualys
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ransomware-live
fix(ransomware-live): keyless — drop optional API key, no auth required
2026-07-15 19:18:49 +02:00
rapid7-insightidr
docs(mappers): MTTD is not retired, only re-anchored
2026-10-07 09:58:20 +00:00
rapid7-insightvm
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
rdap
feat: CIRCL hashlookup, RDAP and crt.sh — free IOC lookups, no API key
2026-10-09 22:33:42 +00:00
recorded-future
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
recorded-future-asi
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
rocketchat
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
runzero
feat(runzero): new runZero asset-inventory integration
2026-07-12 14:41:42 +02:00
sailpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
scaleway
feat(scaleway): new Scaleway cloud integration (French vendor)
2026-07-12 21:37:31 +02:00
securitytrails
feat(securitytrails): new SecurityTrails enrichment integration
2026-07-11 22:48:48 +02:00
sekoia-intelligence-center
feat(sekoia): Sekoia XDR + SEKOIA Intelligence Center integrations
2026-06-27 15:04:22 +02:00
sekoia-xdr
fix(sekoia-xdr): mapper reviewed on a real alert (1.2.0)
2026-10-07 09:13:03 +00:00
sentinelone
feat(sentinelone): list the UAM alert statuses as an enum (1.18.0)
2026-10-01 20:26:45 +00:00
sentinelone-sdl
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
servicenow
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-cmdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-iam
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
shodan
chore: bump ipinfo/shodan/virustotal to regenerate form-based scripts
2026-06-26 00:18:06 +02:00
signalsciences
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
slack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
snyk
feat(snyk): new Snyk appsec-posture integration
2026-07-12 15:18:48 +02:00
sophos-central
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
splunk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
stormshield
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
sumologic
feat(sumologic): new Sumo Logic log-search integration
2026-07-12 15:08:51 +02:00
symantec-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tehtris
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
telegram
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tenable-io
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thehive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thinkst-canary
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatconnect
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatfox
feat(threatfox): new ThreatFox IOC-intel integration
2026-07-12 14:58:07 +02:00
threatq
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
trend-vision-one
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
triage
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
twilio
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
urlhaus
feat(urlhaus): new URLhaus malicious-URL intel integration
2026-07-12 14:15:54 +02:00
urlscan
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vade
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vault
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vectra
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
virustotal
feat(virustotal): complete v3 command coverage (script-based)
2026-06-27 15:53:22 +02:00
virustotal-hunting
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
vmray
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wallix-bastion
feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)
2026-07-12 16:07:38 +02:00
webhook
feat(webhook): outbound webhooks to any third-party solution (v1.0.0)
2026-09-18 08:25:34 +00:00
withsecure
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wiz
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
yaraify
feat(yaraify): new YARAify file/YARA-intel integration
2026-07-12 14:58:08 +02:00
zendesk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler-zpa
feat(zscaler-zpa): new Zscaler Private Access integration
2026-07-12 00:37:11 +02:00