AbuseIPDB MISP expansion module

AL

Expansion

AlienVault OTX Lookup

otx

Module to get information from AlienVault OTX.

alphaMountain threat intelligence lookup for IPs, domains, hostnames, and URLs - adds risk score tags

A module designed to retrieve an analysis report from the ANY.RUN Sandbox by its unique ID and extract results (such as verdict, malware tags, and IOCs), converting them into MISP attributes within your event.

A module designed to submit URLs or files to the ANY.RUN Sandbox for analysis and return the unique analysis link and ID.

An expansion module for https://apifreaks.com/ that provides an enriched analysis of a domain, hostname, IP address, ASN or email address, including WHOIS, DNS, subdomains and domain-availability information.

AP

Expansion

APIVoid

apivoid

Query APIVoid v2 for DNS records, SSL certificates and email verification.

AS

Expansion

AssemblyLine Query

assemblyline_query

A module tu query the AssemblyLine API with a submission ID to get the submission report and parse it.

AS

Expansion

AssemblyLine Submit

assemblyline_submit

A module to submit samples and URLs to AssemblyLine for advanced analysis, and return the link of the submission.

BA

Expansion

Backscatter.io

backscatter_io

Backscatter.io module to bring mass-scanning observations into MISP.

BT

Expansion

BTC Scam Check

btc_scam_check

An expansion hover module to query a special dns blacklist to check if a bitcoin address has been abused.

BT

Expansion

BTC Steroids

btc_steroids

An expansion hover module to get a blockchain balance from a BTC address in MISP.

Module to export a MISP event in CEF format.

An expansion module to enrich attributes in MISP by quering the censys.io API

CI

Expansion

CIRCL Hashlookup Lookup

hashlookup

An expansion module to query the CIRCL hashlookup services to find it if a hash is part of a known set such as NSRL.

CI

Expansion

CIRCL Passive DNS

circl_passivedns

Module to access CIRCL Passive DNS.

CI

Expansion

CIRCL Passive SSL

circl_passivessl

Modules to access CIRCL Passive SSL.

Export IDS-marked network attributes as Cisco ASA 9.x IPv4/IPv6 extended ACL entries.

CI

Export

Cisco fireSIGHT blockrule Export

cisco_firesight_manager_ACL_rule_export

Module to export malicious network activity attributes to Cisco fireSIGHT manager block rules.

CI

Export

Cisco IOS ACL Export

cisco_acl_export

Export IDS-marked network attributes as Cisco IOS/IOS-XE IPv4 and IPv6 ACL fragments.

Submit file to ClamAV

CL

Expansion

Cluster25 Expand

cluster25_expand

Module to query Cluster25 CTI.

Module to expand country codes.

CP

Expansion

CPE Lookup

cpe

An expansion module to query the CVE search API with a cpe code to get its related vulnerabilities.

CR

Expansion

CrowdSec CTI

crowdsec

Module to access CrowdSec CTI API.

CR

Expansion

CrowdStrike Falcon

crowdstrike_falcon

Module to query CrowdStrike Falcon.

CR

Action

CrowdStrike IOC Publish

crowdstrike_ioc_publish

Create and renew module-owned Falcon custom IOCs from MISP event and object attributes.

Module to import MISP attributes from a csv file.

Simple CSV import tool with mapable columns

CU

Import

Cuckoo Sandbox Import

cuckooimport

Module to import Cuckoo JSON.

CU

Expansion

Cuckoo Submit

cuckoo_submit

Submit files and URLs to Cuckoo Sandbox

CV

Expansion

CVE Advanced Lookup

cve_advanced

An expansion module to query the CIRCL CVE search API for more information about a vulnerability (CVE).

CV

Expansion

CVE Lookup

cve

An expansion hover module to expand information about CVE id.

CY

Expansion

Cytomic Orion Lookup

cytomic_orion

An expansion module to enrich attributes in MISP by quering the Cytomic Orion API

Module to import the JSON findings of the Darkmoon autonomous AI penetration testing platform.

DB

Expansion

DBL Spamhaus Lookup

dbl_spamhaus

Checks Spamhaus DBL for a domain name.

Enumerate DNS record types and extract domain, IP, email and URL pivots.

Simple DNS expansion service to resolve IP address from MISP attributes

DO

Expansion

DOCX Enrich

docx_enrich

Module to extract freetext from a .docx document.

DO

Expansion

DomainTools Lookup

domaintools

DomainTools MISP expansion module.

Export event and object indicators as ECS threat indicators in Elasticsearch Bulk NDJSON.

Email import module for MISP

Check email security posture (SPF, DKIM, DMARC, MTA-STS) for a domain.

EQ

Export

EQL Query Export

mass_eql_export

Export MISP event in Event Query Language

EQ

Expansion

EQL Query Generator

eql

EQL query generation for a MISP attribute.

EU

Expansion

EUPI Lookup

eupi

A module to query the Phishing Initiative service (https://phishing-initiative.lu).

Simple export of a MISP event to PDF.

Export indicators to Microsoft Sentinel or Microsoft Defender. Requires an existing installation of MISP2Sentinel or MISP2Defender.

EX

Expansion

Extuno Lookup

extuno

Query Extuno for the reputation of a browser extension, an IDE extension or a package, identified by its store id or its listing URL.

FA

Expansion

Farsight DNSDB Lookup

farsight_passivedns

Module to access Farsight DNSDB Passive DNS.

FL

Expansion

Flowtriq DDoS Intelligence

flowtriq

Query Flowtriq for DDoS attack intelligence on IP addresses

Export IDS-marked network attributes as FortiOS 7.4+ address objects, services and firewall policies.

Expand CPE attributes with GCVE CPE catalog metadata, package mappings and vulnerability references.

GE

Expansion

GeoIP ASN Lookup

geoip_asn

Query a local copy of the Maxmind Geolite ASN database (MMDB format)

GE

Expansion

GeoIP City Lookup

geoip_city

An expansion module to query a local copy of Maxmind's Geolite database with an IP address, in order to get information about the city where it is located.

GE

Expansion

GeoIP Country Lookup

geoip_country

Query a local copy of Maxminds Geolite database, updated for MMDB format

GE

Expansion

GeoIP Enrichment

mmdb_lookup

A hover and expansion module to enrich an ip with geolocation and ASN information from an mmdb server instance, such as CIRCL's ip.circl.lu.

GO

Export

GoAML Export

goamlexport

This module is used to export MISP events containing transaction objects into GoAML format.

GO

Import

GoAML Import

goamlimport

Module to import MISP objects about financial transactions from GoAML files.

Google safe browsing expansion module

GO

Expansion

Google Threat Intelligence Lookup

google_threat_intelligence

An expansion module to have the observable's threat score assessed by Google Threat Intelligence.

GR

Expansion

GreyNoise Lookup

greynoise

Module to query IP and CVE information from GreyNoise

A hover module to check hashes against hashdd.com including NSLR dataset.

HA

Expansion

Have I Been Pwned Lookup

hibp

Module to access haveibeenpwned.com API.

Retrieve Host.io DNS, website and co-hosted domain observations.

Expansion module to fetch the html content from an url and convert it into markdown.

HY

Expansion

HYAS Insight Lookup

hyasinsight

HYAS Insight integration to MISP provides direct, high volume access to HYAS Insight data. It enables investigators and analysts to understand and defend against cyber adversaries and their infrastructure.

Look up Hybrid Analysis reports or submit a file or URL for sandbox analysis.

Check an observable against local MISP warninglists and record the matching lists.

IB

Expansion

IBM X-Force Exchange Lookup

xforceexchange

An expansion module for IBM X-Force Exchange.

Generic blueprint to be copy-pasted to quickly boostrap creation of import module.

Capture a public web reference as Markdown or a PDF attachment.

Retrieve Intel 471 Hunter hunt packages, Sigma rules and analyst guidance.

IN

Expansion

Intel471 Lookup

intel471

Module to access Intel 471

Retrieve Intezer Analyze file reports or submit an attachment for analysis.

IP

Expansion

IP2Location.io Lookup

ip2locationio

An expansion module to query IP2Location.io to gather more information on a given IP address.

IP

Expansion

ipapi.is Lookup

ipapi_is

An expansion and hover module to enrich an IP address with geolocation, ASN, company and abuse contact data, and VPN (with the provider), proxy, Tor and datacenter detection from ipapi.is.

Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).

IP

Expansion

IPGeolocation.io Lookup

ipgeolocation

An expansion and hover module to enrich an IP address with geolocation, ASN, company, threat intelligence (threat score, VPN, proxy, Tor, bot and spam signals) and abuse contact information from IPGeolocation.io, either through the API or from local IPGeolocation.io MMDB databases.

IP

Expansion

IPInfo.io Lookup

ipinfo

An expansion module to query ipinfo.io to gather more information on a given IP address.

IP

Expansion

IPQualityScore Lookup

ipqs_fraud_and_risk_scoring

IPQualityScore MISP Expansion Module for IP reputation, Email Validation, Phone Number Validation, Malicious Domain,Malicious URL Scanner,Malicious File Scanner & Compromised username, Password, Email

Module to query IPRep data for IP addresses.

IS

Expansion

isMalicious Lookup

ismalicious

Query isMalicious for IP, domain, hostname, and URL reputation.

Retrieve active scan observations from an IVRE web API.

JO

Expansion

Joe Sandbox Import

joesandbox_query

Query Joe Sandbox API with a submission url to get the json report and extract its data that is parsed and converted into MISP attributes and objects.

JO

Import

Joe Sandbox Import

joe_import

A module to import data from a Joe Sandbox analysis json report.

JO

Expansion

Joe Sandbox Submit

joesandbox_submit

A module to submit files or URLs to Joe Sandbox for an advanced analysis, and return the link of the submission.

Export IDS-marked network attributes as Junos inet/inet6 stateless firewall filter set commands.

Retrieve Kaspersky commercial Threat Intelligence Portal reports.

Lamis Network IP Intelligence and Risk Scoring expansion module.

Retrieve LastInfoSec STIX 2.1 intelligence and convert it to MISP.

LA

Import

Lastline Import

lastline_import

Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module. Module to import and parse reports from Lastline analysis links.

LA

Expansion

Lastline Lookup

lastline_query

Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module. Query Lastline with an analysis link and parse the report into MISP attributes and objects.

LA

Expansion

Lastline Submit

lastline_submit

Deprecation notice: this module will be deprecated by December 2021, please use vmware_nsx module. Module to submit a file or URL to Lastline.

Lite export of a MISP event.

Enrich a Lookyloo capture link or UUID with observed resources and analysis context.

Find Lookyloo captures containing an IP, hostname, URL, resource hash or favicon hash.

MA

Expansion

Macaddress.io Lookup

macaddress_io

MISP hover module for macaddress.io

MA

Expansion

macadress.com Lookup

macadress_com

Module to access macadress.com API.

MA

Expansion

Macvendors Lookup

macvendors

Module to access Macvendors API.

Retrieve MalBeacon C2 and actor infrastructure observations.

Search Malpedia families and actors, or expand a sample hash or Malpedia record URL.

Module to push malware samples to MalShare

Look up a SHA256 digest in the Malwagon sandbox and return the scans it already has for it.

Detonate a sample or a URL in the Malwagon sandbox and return the analysis.

Query Malware Bazaar to get additional information about the input hash.

Render the markdown (under GFM) into PDF. Requires pandoc (https://pandoc.org/), wkhtmltopdf (https://wkhtmltopdf.org/) and mermaid dependencies.

Send a message to an unencrypted Matrix room.

Simplistic module to send message to a Mattermost channel.

Lookup McAfee MVISION Insights Details

Enrich file hashes and IP addresses with Metras EDR inventory and fleet context.

Defender for Endpoint KQL hunting query export module

Export IDS-marked network attributes as RouterOS IPv4/IPv6 firewall filter commands.

Module to import MISP JSON format for merging MISP events.

Enrich internet infrastructure using MODAT Magnify host, service and DNS observations.

Module to push malware samples to a MWDB instance

Export IDS-marked event and object network attributes as nftables block or logging rules.

Simplistic module to send a message to a Nextcloud talk conversation.

NE

Export

Nexthink NXQL Export

nexthinkexport

Nexthink NXQL query export module

Render the template with the data passed

Module to process some optical character recognition on pictures.

Optical Character Recognition (OCR) module for MISP.

OD

Expansion

ODS Enrich

ods_enrich

Module to extract freetext from a .ods document.

OD

Expansion

ODT Enrich

odt_enrich

Module to extract freetext from a .odt document.

ON

Expansion

Onion Lookup

onion_lookup

MISP module using the MISP standard. Uses the onion-lookup service to get information about an onion.

ON

Expansion

Onyphe Full Lookup

onyphe_full

Module to process a full query on Onyphe.

ON

Expansion

Onyphe Lookup

onyphe

Module to process a query on Onyphe.

Export IDS-marked event and object network attributes as OpenBSD PF block or logging rules.

Query an OpenCTI instance for exact observable matches and their context and source references.

Module to import OpenIOC packages.

Look up indicators in the Orange Cyberdefense Datalake API.

Retrieve existing Orion Malware reports by file hash.

On demand query API for OSINT.digitalside.it project.

Find OSINT Industries account and identity context for an email, phone, username or wallet.

OS

Export

OSQuery Export

osqueryexport

Export MISP event and object indicators as an osquery query pack.

OS

Action

OSQuery Pack Publish

osquery_pack_publish

Publish a MISP query pack to a configured local osquery pack directory.

An expansion module for the OTI Labs Domain Intelligence API (https://oti-labs.com/domain-intelligence-api). One request returns WHOIS/RDAP registration, DNS records, the certificate the domain serves, live subdomains with their IP addresses and the SPF, DMARC and DKIM records.

Export IDS-marked proxy and HTTP indicators as custom ModSecurity rules alongside OWASP CRS.

Export IDS-marked network attributes as PAN-OS local security policy set commands.

Retrieve WildFire verdicts and XML reports, or submit an attachment for analysis.

An expansion module to enrich, SSH key fingerprints and IP addresses with information collected by passive-ssh

PA

Expansion

PassiveTotal Lookup

passivetotal

The PassiveTotal MISP expansion module brings the datasets derived from Internet scanning directly into your MISP instance. This module supports passive DNS, historic SSL, WHOIS, and host attributes. In order to use the module, you must have a valid PassiveTotal account username and API key. Registration is free and can be done by visiting https://www.passivetotal.org/register

PD

Expansion

PDF Enrich

pdf_enrich

Module to extract freetext from a PDF document.

Passive DNS Common Output Format (COF) MISP importer

Pivot on OpenPGP key IDs, fingerprints, email addresses and UIDs using an HKP keyserver.

Look up a host in phishunt (phishunt.io), the free CC0 feed of live phishing domains: the phishing URLs detected on that exact host, the brand they target, when they were first seen, where they are hosted and which other feeds flag them.

Retrieve PolySwarm sample reputation, engine verdicts and file metadata.

Retrieve PolySwarm sandbox tasks or submit an existing PolySwarm sample for sandbox analysis.

PP

Expansion

PPTX Enrich

pptx_enrich

Module to extract freetext from a .pptx document.

Enrich domains, IPv4 addresses and MD5 hashes using Proofpoint ET Intelligence.

Classify PTR hostnames and tag queried attributes with the ptrclassify taxonomy.

QI

Expansion

Qintel QSentry Lookup

qintel_qsentry

A hover and expansion module which queries Qintel QSentry for ip reputation data

Decode QR codes from attachments OR remote URLs (Anti-Quishing).

Export deduplicated, typed MISP indicators as QRadar reference-set CSV or JSON values.

Publish typed MISP indicators to an existing QRadar reference set and explicit domain.

Retrieve Qualys KnowledgeBase vulnerability details for a CVE identifier.

Module to access the ransomcoinDB (see https://ransomcoindb.concinnity-risks.com)

Query the RansomLook API and return matching ransomware leak-site posts as MISP objects.

RA

Expansion

Rapid7 AttackerKB lookup

rapid7_attackerkb

Module to lookup CVE attributes in Rapid7 AttackerKB.

An expansion module to query the public RDAP bootstrap (rdap.org) for registration data of a domain, hostname, IP address or URL. RDAP (Registration Data Access Protocol, RFC 9082/9083) is the free, unauthenticated and structured successor to WHOIS.

Module to check an IPv4 address against known RBLs.

RE

Expansion

Recorded Future Enrich

recordedfuture

Module to enrich attributes with threat intelligence from Recorded Future.

Simple Reverse DNS expansion service to resolve reverse DNS from MISP attributes.

Retrieve ReversingLabs file reputation and malware presence.

RE

Expansion

ReversingLabs Spectra Analyze

reversinglabs_spectra_analyze

Module to enrich file hashes, domains, IPs and URLs with ReversingLabs Spectra Analyze threat intelligence.

Submit a file hash, URL or attachment to ReversingLabs Spectra Intelligence dynamic analysis.

Scan a target IP[:port] for a Cobalt Strike beacon configuration via RST Scan API.

Fetch a target's favicon (image + all hashes for Shodan/Netlas/Censys pivoting) via RST Scan API.

Fetch rendered HTML body or extracted JavaScript for a URL/IP target via RST Scan API.

Enrich indicators with RST Cloud threat intelligence. Returns an rst-ioc object (score, attribution, geo/ASN for IPs, DNS/WHOIS for domains, parsed components for URLs, related hashes for file hashes) linked back to the enriched attribute.

Check whether a value (IP, domain, URL or hash) is known-good / noise via RST Noise Control. Returns an rst-noise object (verdict, category) linked back to the enriched attribute.

Capture a page screenshot (first/full/last frame) of a URL/IP target via RST Scan API.

Fetch the SSL certificate for an IP[:port] as an x509 object via RST Scan API.

Retrieve parsed WHOIS information for a domain via RST Cloud.

RU

Expansion

Rulezet Rule Validator

rulezet_validator

Validate the syntax of detection rules (YARA, Sigma, Suricata, Zeek, NOVA, Wazuh, Kunai, NSE, CRS, Splunk, Elastic, KQL, ATR, PLUM, Sagan) with the Rulezet API.

SC

Expansion

ScanMalware Lookup

scanmalware

Query ScanMalware for subdomains, browser-observed hosts and sandbox scan results.

SE

Expansion

SecurityTrails Lookup

securitytrails

An expansion modules for SecurityTrails.

Publish MISP event and object indicators to SentinelOne Threat Intelligence with explicit scope.

Enrich IP addresses with ShadowTrackr false-positive and infrastructure context.

Find social media accounts by username with Sherlock.

Look up exposed services, hostnames, CPEs and vulnerabilities in the free Shodan InternetDB API.

SH

Expansion

Shodan Lookup

shodan

Module to query on Shodan.

SI

Expansion

Sigma Rule Converter

sigma_queries

An expansion hover module to display the result of sigma queries.

SI

Expansion

Sigma Syntax Validator

sigma_syntax_validator

An expansion hover module to perform a syntax check on sigma rules.

Expands a SigMF Recording object into a SigMF Expanded Recording object, extracts a SigMF archive into a SigMF Recording object.

Retrieve domain and IP risk and infrastructure context from Silent Push.

Simplistic module to send messages to a Slack channel.

Get the balance, activity, counterparties and address poisoning findings of a BTC, LTC, DOGE or ZEC address from SoChain.

A hover module to get information on the availability of an email address or username on some online platforms.

SO

Import

SOCRadar TAXII Feed Import

socradar_taxii_feed

Import threat indicators from SOCRadar TAXII 2.1 feed with MITRE ATT&CK, malware family, confidence, and geo tagging. Leave collection_id empty and type 'list' to discover available collections.

SO

Expansion

SOCRadar Threat Intelligence

socradar_lookup

Enrich MISP attributes with SOCRadar threat intelligence. Queries SOCRadar IoC Enrichment API for categorization, malware families, threat actors, confidence scores, feed source history, and geographic attribution.

SO

Expansion

SophosLabs Intelix Lookup

sophoslabs_intelix

An expansion module to query the Sophoslabs intelix API to get additional information about an ip address, url, domain or sha256 attribute.

Check an IPv4 address against the SpamCop Blocking List (SCBL).

Export event and object indicators as a Splunk CSV lookup with CIM field mapping hints.

Export IDS-marked event and object attributes as Squid proxy ACLs and deny rules.

Grab SSH server fingerprint from an IP and return as passive-ssh MISP object.

ST

Expansion

Stairwell Lookup

stairwell

Module to query the Stairwell API to get additional information about the input hash attribute

ST

Expansion

STIX2 Pattern Syntax Validator

stix2_pattern_syntax_validator

An expansion hover module to perform a syntax check on stix2 patterns.

Import content from a TAXII 2.1 server

Retrieve Scout foundation intelligence for an IP address or search for a domain.

Run an explicit Scout search query and import the returned intelligence.

This module is merely a test, always returning true. Triggers on event publishing.

Skeleton export module.

Module to import ThreatAnalyzer archive.zip / analysis.json files.

TH

Export

ThreadConnect Export

threat_connect_export

Module to export a structured CSV file for uploading to ThreatConnect.

Module to search for an IOC on ThreatFox by abuse.ch.

TH

Expansion

ThreatCrowd Lookup

threatcrowd

Module to get information from ThreatCrowd.

TH

Expansion

ThreatMiner Lookup

threatminer

Module to get information from ThreatMiner.

TH

Export

ThreatStream Export

threatStream_misp_export

Module to export a structured CSV file for uploading to threatStream.

Extract TLS certificate details from a domain and return as x509 MISP object.

Module to submit samples to tria.ge

TR

Expansion

TruSTAR Enrich

trustar_enrich

Module to get enrich indicators with TruSTAR.

Look up an IOC in TweetFeed (tweetfeed.live), the free CC0 feed of URLs, domains, IPs and hashes shared by the infosec community on X/Twitter: who reported it and when, the source tweets and hashtags, cross-feed corroboration, AI-generated context and campaign membership.

Find existing UnpacMe unpacking results for a SHA-256 hash.

Module to cache web pages of analysis reports, OSINT sources. The module returns a page-capture object holding the cached page.

Extract URL components

Resolve URL hosts into IPv4/IPv6 IP-port objects and IPv4 ASN objects.

Simple URL import tool with Faup

UR

Expansion

URLhaus Lookup

urlhaus

Query of the URLhaus API to get additional information about the input attribute.

UR

Expansion

URLScan Lookup

urlscan

An expansion module to query urlscan.io.

VA

Expansion

Validin DNS History

validin

Validin internet dataset expansion. Returns dns-records, web crawls, registration (WHOIS) records, and certificates from Validin's historic internet intelligence dataset.

VA

Expansion

VARIoT db Lookup

variotdbs

An expansion module to query the VARIoT db API for more information about a vulnerability.

VI

Export

VirusTotal Collections Export

virustotal_collections

Creates a VT Collection from an event iocs.

VI

Export

VirusTotal Graph Export

vt_graph

This module is used to create a VirusTotal Graph from a MISP event.

VI

Expansion

VirusTotal Public API Lookup

virustotal_public

Enrich observables with the VirusTotal v3 public API

Download an existing file from VirusTotal by hash.

VI

Expansion

VirusTotal Upload

virustotal_upload

Module to push malware samples to VirusTotal

VI

Expansion

VirusTotal v3 Lookup

virustotal

Enrich observables with the VirusTotal v3 API

Retrieve existing VMRay sample and analysis context by file hash.

VM

Import

VMRay API Import

vmray_import

Module to import VMRay (VTI) results.

VM

Expansion

VMRay Submit

vmray_submit

Module to submit a sample to VMRay.

Import a VMRay Summary JSON report.

VM

Expansion

VMware NSX Defender Enrich

vmware_nsx

Module to enrich a file or URL with VMware NSX Defender.

VU

Expansion

VulnDB Lookup

vulndb

Module to query VulnDB (RiskBasedSecurity.com).

VU

Expansion

Vulnerability Lookup

vulnerability_lookup

Expand vulnerabilities and CPEs with Vulnerability Lookup advisories and enrichment

VU

Expansion

Vulners Lookup

vulners

An expansion hover module to expand information about CVE id using Vulners API.

VY

Expansion

Vysion Enrich

vysion

Module to enrich the information by making use of the Vysion API.

Export MISP event and object indicators as a typed Wazuh CDB source list.

Upload MISP event and object indicators to an explicitly named Wazuh CDB source list.

Query the Internet Archive Wayback Machine for an existing web page snapshot.

WH

Expansion

Whisper

whisper

Enrich IPs, domains, and ASNs with threat intelligence and infrastructure context from the Whisper graph.

Module to query a local instance of uwhois (https://github.com/rafiot/uwhoisd). It returns the registration record as raw text; the rdap module answers the same question as a structured whois object, over an unauthenticated protocol and without a local server, and is the better choice wherever RDAP covers the registry.

WH

Expansion

WhoisFreaks Lookup

whoisfreaks

An expansion module for https://whoisfreaks.com/ that enriches a domain or an IP address. For a domain it queries the WHOIS, DNS and Domain Reputation APIs; for an IP address it queries the IP WHOIS, Geolocation and IP Security APIs. All lookups for a given attribute are executed in parallel.

WI

Expansion

Wikidata Lookup

wiki

An expansion hover module to extract information from Wikidata to have additional information about particular term for analysis.

XL

Expansion

XLXS Enrich

xlsx_enrich

Module to extract freetext from a .xlsx document.

XP

Expansion

XposedOrNot Lookup

xposedornot

Query the XposedOrNot API to check whether an email address appears in known data breaches.

YA

Export

YARA Rule Export

yara_export

This module is used to export MISP events to YARA.

YA

Expansion

YARA Rule Generator

yara_query

The module takes a hash attribute (md5, sha1, sha256, imphash) as input, and is returning a YARA rule from it.

YA

Expansion

YARA Syntax Validator

yara_syntax_validator

An expansion hover module to perform a syntax check on if yara rules are valid or not.

YE

Expansion

Yeti Lookup

yeti

Module to process a query on Yeti.

Export validated MISP event and object indicators as a Zeek Intel Framework feed.

Look up passive DNS records in Zetalytics.