@oomol-lab/open-connector 1.9.0 → 1.9.1

package/assets/open-connector/catalog/apps/urlhaus.json

@@ -0,0 +1,246 @@
+{
+  "service": "urlhaus",
+  "displayName": "URLhaus",
+  "description": "Look up URLs against the URLhaus malware URL database to check whether a URL is known to distribute malware. Requires a free abuse.ch Auth-Key, sent as the Auth-Key request header.",
+  "categories": [
+    "Security",
+    "Data"
+  ],
+  "authTypes": [
+    "api_key"
+  ],
+  "auth": [
+    {
+      "type": "api_key",
+      "label": "Auth-Key",
+      "placeholder": "URLHAUS_AUTH_KEY",
+      "description": "abuse.ch Auth-Key sent as the Auth-Key request header. Get a free key at the abuse.ch Authentication Portal (https://auth.abuse.ch).",
+      "extraFields": []
+    }
+  ],
+  "homepageUrl": "https://urlhaus.abuse.ch",
+  "actions": [
+    {
+      "id": "urlhaus.lookup_url",
+      "service": "urlhaus",
+      "name": "lookup_url",
+      "description": "Check whether a URL is known to URLhaus as a malware distribution site. Returns the database entry with threat, blacklist status, tags, and payload details when the URL is known, or a not-found result otherwise. Requires a free abuse.ch Auth-Key.",
+      "operationType": "read",
+      "requiredScopes": [],
+      "providerPermissions": [],
+      "inputSchema": {
+        "type": "object",
+        "properties": {
+          "url": {
+            "type": "string",
+            "description": "The absolute URL to look up, e.g. https://example.com/payload.exe.",
+            "format": "uri"
+          }
+        },
+        "additionalProperties": false,
+        "required": [
+          "url"
+        ],
+        "description": "URL lookup input."
+      },
+      "outputSchema": {
+        "type": "object",
+        "properties": {
+          "found": {
+            "type": "boolean",
+            "description": "Whether URLhaus knows this URL."
+          },
+          "query_status": {
+            "type": "string",
+            "description": "URLhaus query status: ok or no_results. Invalid URLs produce an invalid_input error."
+          },
+          "entry": {
+            "type": "object",
+            "properties": {
+              "id": {
+                "type": "string",
+                "description": "URLhaus database entry ID."
+              },
+              "urlhaus_reference": {
+                "type": "string",
+                "description": "Link to the URLhaus entry page."
+              },
+              "url": {
+                "type": "string",
+                "description": "The queried URL as recorded by URLhaus."
+              },
+              "url_status": {
+                "type": "string",
+                "description": "Whether the URL is currently online, offline, or unknown."
+              },
+              "host": {
+                "type": "string",
+                "description": "Host extracted from the URL."
+              },
+              "date_added": {
+                "type": "string",
+                "description": "When the URL was added to URLhaus, in UTC."
+              },
+              "last_online": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "description": "When an offline URL last served malware; null otherwise."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "When an offline URL last served malware; null otherwise."
+              },
+              "threat": {
+                "type": "string",
+                "description": "Threat type, e.g. malware_download."
+              },
+              "blacklists": {
+                "type": "object",
+                "properties": {
+                  "surbl": {
+                    "type": "string",
+                    "description": "SURBL blacklist status."
+                  },
+                  "spamhaus_dbl": {
+                    "type": "string",
+                    "description": "Spamhaus DBL blacklist status."
+                  }
+                },
+                "additionalProperties": true,
+                "required": [
+                  "surbl",
+                  "spamhaus_dbl"
+                ],
+                "description": "Blacklist status of the queried URL."
+              },
+              "reporter": {
+                "type": "string",
+                "description": "Handle of the reporter, or anonymous."
+              },
+              "larted": {
+                "type": "string",
+                "description": "Whether the URL was reported to its hosting provider."
+              },
+              "takedown_time_seconds": {
+                "anyOf": [
+                  {
+                    "type": "integer",
+                    "description": "Seconds until the site was taken down, if applicable."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Seconds until the site was taken down, if applicable."
+              },
+              "tags": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "description": "A tag."
+                },
+                "description": "Tags associated with the URL."
+              },
+              "payloads": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "firstseen": {
+                      "type": "string",
+                      "description": "Date the payload was first seen."
+                    },
+                    "filename": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "description": "Filename reported by the remote server, if any."
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Filename reported by the remote server, if any."
+                    },
+                    "file_type": {
+                      "type": "string",
+                      "description": "File type guessed by URLhaus, e.g. exe or doc."
+                    },
+                    "response_size": {
+                      "type": "string",
+                      "description": "Size of the HTTP response body in bytes, as reported by URLhaus."
+                    },
+                    "response_md5": {
+                      "type": "string",
+                      "description": "MD5 hash of the payload."
+                    },
+                    "response_sha256": {
+                      "type": "string",
+                      "description": "SHA256 hash of the payload."
+                    },
+                    "urlhaus_download": {
+                      "type": "string",
+                      "description": "Where to download a copy of the payload."
+                    },
+                    "signature": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "description": "Malware family, if URLhaus identified one."
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "Malware family, if URLhaus identified one."
+                    }
+                  },
+                  "additionalProperties": true,
+                  "required": [
+                    "firstseen",
+                    "filename",
+                    "file_type",
+                    "response_size",
+                    "response_md5",
+                    "response_sha256",
+                    "urlhaus_download",
+                    "signature"
+                  ],
+                  "description": "Malware payload served by the URL."
+                },
+                "description": "Payloads served by the URL."
+              }
+            },
+            "additionalProperties": true,
+            "required": [
+              "id",
+              "urlhaus_reference",
+              "url",
+              "url_status",
+              "host",
+              "date_added",
+              "last_online",
+              "threat",
+              "blacklists",
+              "reporter",
+              "larted",
+              "takedown_time_seconds",
+              "tags",
+              "payloads"
+            ],
+            "description": "The URLhaus database entry, present when the URL is known."
+          }
+        },
+        "additionalProperties": true,
+        "required": [
+          "found",
+          "query_status"
+        ],
+        "description": "URLhaus URL lookup result."
+      }
+    }
+  ]
+}