@oomol-lab/open-connector 1.9.0 → 1.9.1

package/assets/open-connector/catalog/apps/threatfox.json

@@ -0,0 +1,203 @@
+{
+  "service": "threatfox",
+  "displayName": "ThreatFox",
+  "description": "Look up indicators of compromise (IP address, domain, URL, or file hash) against the ThreatFox IOC database to check whether an IOC is associated with malware activity. Requires a free abuse.ch Auth-Key, sent as the Auth-Key request header.",
+  "categories": [
+    "Security",
+    "Data"
+  ],
+  "authTypes": [
+    "api_key"
+  ],
+  "auth": [
+    {
+      "type": "api_key",
+      "label": "Auth-Key",
+      "placeholder": "THREATFOX_AUTH_KEY",
+      "description": "abuse.ch Auth-Key sent as the Auth-Key request header. Get a free key at the abuse.ch Authentication Portal (https://auth.abuse.ch).",
+      "extraFields": []
+    }
+  ],
+  "homepageUrl": "https://threatfox.abuse.ch",
+  "actions": [
+    {
+      "id": "threatfox.lookup_ioc",
+      "service": "threatfox",
+      "name": "lookup_ioc",
+      "description": "Check whether an indicator of compromise (IP address, domain, URL, or MD5/SHA256 file hash) is known to ThreatFox. Uses an exact-match IOC search or a file-hash search and returns the matching IOC entries with threat type, malware family, and confidence level when known, or a not-found result otherwise. Requires a free abuse.ch Auth-Key.",
+      "operationType": "read",
+      "requiredScopes": [],
+      "providerPermissions": [],
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "ioc": {
+            "type": "string",
+            "description": "The indicator of compromise to look up: an IP address, domain, URL, or MD5/SHA256 file hash, e.g. 1.2.3.4 or 44d88612fea8a8f36de82e1278abb02f."
+          }
+        },
+        "additionalProperties": false,
+        "required": [
+          "ioc"
+        ],
+        "description": "IOC lookup input."
+      },
+      "outputSchema": {
+        "type": "object",
+        "properties": {
+          "found": {
+            "type": "boolean",
+            "description": "Whether ThreatFox knows this IOC."
+          },
+          "query_status": {
+            "type": "string",
+            "description": "ThreatFox query status: ok, or no_result when the IOC is unknown."
+          },
+          "entries": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "id": {
+                  "type": "string",
+                  "description": "ThreatFox database entry ID."
+                },
+                "ioc": {
+                  "type": "string",
+                  "description": "The indicator of compromise as recorded by ThreatFox."
+                },
+                "threat_type": {
+                  "type": "string",
+                  "description": "Threat type, e.g. botnet_cc or payload."
+                },
+                "threat_type_desc": {
+                  "type": "string",
+                  "description": "Human-readable threat type description."
+                },
+                "ioc_type": {
+                  "type": "string",
+                  "description": "IOC type, e.g. ip:port, domain, url, or sha256_hash."
+                },
+                "ioc_type_desc": {
+                  "type": "string",
+                  "description": "Human-readable IOC type description."
+                },
+                "malware": {
+                  "type": "string",
+                  "description": "Malware family identifier, e.g. win.vidar."
+                },
+                "malware_printable": {
+                  "type": "string",
+                  "description": "Printable malware family name, e.g. Vidar."
+                },
+                "confidence_level": {
+                  "type": "integer",
+                  "description": "ThreatFox confidence level, 0-100."
+                },
+                "first_seen": {
+                  "type": "string",
+                  "description": "When the IOC was first seen, in UTC."
+                },
+                "last_seen": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "description": "When the IOC was last seen, in UTC; null if unknown."
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "description": "When the IOC was last seen, in UTC; null if unknown."
+                },
+                "reporter": {
+                  "type": "string",
+                  "description": "Handle of the reporter."
+                },
+                "reference": {
+                  "anyOf": [
+                    {
+                      "type": "string",
+                      "description": "Reference URL for the IOC, if any."
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "description": "Reference URL for the IOC, if any."
+                },
+                "tags": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "description": "A tag."
+                  },
+                  "description": "Tags associated with the IOC."
+                },
+                "malware_samples": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "time_stamp": {
+                        "type": "string",
+                        "description": "When the sample was associated with the IOC, in UTC."
+                      },
+                      "md5_hash": {
+                        "type": "string",
+                        "description": "MD5 hash of the sample."
+                      },
+                      "sha256_hash": {
+                        "type": "string",
+                        "description": "SHA256 hash of the sample."
+                      },
+                      "malware_bazaar": {
+                        "type": "string",
+                        "description": "MalwareBazaar link for the sample."
+                      }
+                    },
+                    "additionalProperties": true,
+                    "required": [
+                      "time_stamp",
+                      "md5_hash",
+                      "sha256_hash",
+                      "malware_bazaar"
+                    ],
+                    "description": "Malware sample associated with the IOC."
+                  },
+                  "description": "Malware samples associated with the IOC."
+                }
+              },
+              "additionalProperties": true,
+              "required": [
+                "id",
+                "ioc",
+                "threat_type",
+                "threat_type_desc",
+                "ioc_type",
+                "ioc_type_desc",
+                "malware",
+                "malware_printable",
+                "confidence_level",
+                "first_seen",
+                "last_seen",
+                "reporter",
+                "reference",
+                "tags",
+                "malware_samples"
+              ],
+              "description": "ThreatFox database entry for the queried IOC."
+            },
+            "description": "Matching IOC entries, present when the IOC is known."
+          }
+        },
+        "additionalProperties": true,
+        "required": [
+          "found",
+          "query_status"
+        ],
+        "description": "ThreatFox IOC lookup result."
+      }
+    }
+  ]
+}