clue-api 1.7.0.dev459__tar.gz → 1.7.0.dev464__tar.gz

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: clue-api
-Version: 1.7.0.dev459
+Version: 1.7.0.dev464
 Summary: Clue distributed enrichment service
 License: MIT
 License-File: LICENSE
@@ -36,7 +36,7 @@ Requires-Dist: gevent (>=24.2.1,<25.0.0)
 Requires-Dist: gunicorn (>=22,<24)
 Requires-Dist: imgkit (>=1.2.3,<2.0.0)
 Requires-Dist: passlib (>=1.7.4,<2.0.0) ; extra == "server"
-Requires-Dist: pillow (>=11.1,<13.0)
+Requires-Dist: pillow (>=11.1,<14.0)
 Requires-Dist: prometheus-client (>=0.20.0,<0.21.0) ; extra == "server"
 Requires-Dist: pydantic (>=2.7.1,<3.0.0)
 Requires-Dist: pydantic-settings[yaml] (>=2.3.4,<3.0.0)

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/clue/api/__init__.py

@@ -2,7 +2,7 @@ from sys import exc_info
 from traceback import format_tb
 from typing import Any, Union, cast
 
-from flask import Blueprint, Response, make_response, request
+from flask import Blueprint, Response, current_app, make_response, request
 from prometheus_client import Counter
 from pydantic import BaseModel
 
@@ -21,13 +21,19 @@ RAW_API_COUNTER = Counter(
 logger = get_logger(__file__)
 
 
-def make_subapi_blueprint(name, api_version=1):
+def make_subapi_blueprint(name: str, api_version: int = 1, *, blueprint_name: str | None = None):
     """Create a flask Blueprint for a subapi in a standard way."""
-    return Blueprint(name, name, url_prefix="/".join([API_PREFIX, f"v{api_version}", name]))
+    return Blueprint(blueprint_name or name, name, url_prefix="/".join([API_PREFIX, f"v{api_version}", name]))
 
 
 def _make_api_response(
-    data: Any, err: Union[str, Exception] = "", warnings: list[str] = [], status_code: int = 200, cookies: Any = None
+    data: Any,
+    err: Union[str, Exception] = "",
+    warnings: list[str] = [],
+    status_code: int = 200,
+    cookies: Any = None,
+    *,
+    sort_keys: bool | None = None,
 ) -> Response:
     if isinstance(err, Exception):  # pragma: no cover
         trace = exc_info()[2]
@@ -41,11 +47,12 @@ def _make_api_response(
             entry.model_dump(mode="json", by_alias=True, exclude_none=True) for entry in cast(list[BaseModel], data)
         ]
 
+    payload = ClueResponse(response=data, error_message=err, warning=warnings, status_code=status_code).model_dump(
+        mode="json", by_alias=True, exclude_none=True
+    )
+    # Keep existing endpoint serialization unchanged unless ordering is explicitly requested.
     resp = make_response(
-        ClueResponse(response=data, error_message=err, warning=warnings, status_code=status_code).model_dump(
-            mode="json", by_alias=True, exclude_none=True
-        ),
-        status_code,
+        payload if sort_keys is None else current_app.json.dumps(payload, sort_keys=sort_keys), status_code
     )
 
     resp.headers["Content-Type"] = "application/json"
@@ -65,9 +72,9 @@ def _make_api_response(
 DEFAULT_DATA = {True: {"success": True}, False: {"success": False}}
 
 
-def ok(data=DEFAULT_DATA[True], cookies=None):
+def ok(data: Any = DEFAULT_DATA[True], cookies: Any = None, *, sort_keys: bool | None = None):
     """Returns response with status code 200"""
-    return _make_api_response(data, status_code=200, cookies=cookies)
+    return _make_api_response(data, status_code=200, cookies=cookies, sort_keys=sort_keys)
 
 
 def created(data=DEFAULT_DATA[True], warnings=[], cookies=None):

clue_api-1.7.0.dev459/clue/api/v1/__init__.py → clue_api-1.7.0.dev464/clue/api/documentation.py

@@ -1,19 +1,14 @@
 from textwrap import dedent
 
-from flask import Blueprint, current_app, request
+from flask import current_app, request
 
 from clue.api import ok
-from clue.api.base import api_login
-
-API_PREFIX = "/api/v1"
-apiv1 = Blueprint("apiv1", __name__, url_prefix=API_PREFIX)
-apiv1._doc = "Api Documentation - Verison 1"  # type: ignore[attr-defined]
+from clue.security import api_login
 
 
 #####################################
 # API DOCUMENTATION
 # noinspection PyProtectedMember,PyBroadException
-@apiv1.route("/")
 @api_login(audit=False)
 def get_api_documentation(**_):
     """Full API doc. Loop through all registered API paths and display their documentation.
@@ -38,17 +33,19 @@ def get_api_documentation(**_):
       'complete' : True},               # Is the API stable?
       ...]
     """
+    api_prefix = f"{request.path.rstrip('/')}/"
+    api_version = api_prefix.strip("/").split("/")[-1]
     api_blueprints = {}
     api_list = []
     for rule in current_app.url_map.iter_rules():
-        if rule.rule.startswith(request.path):
+        if rule.rule.startswith(api_prefix):
             methods = [item for item in (rule.methods or []) if item != "OPTIONS" and item != "HEAD"]
 
             func = current_app.view_functions[rule.endpoint]
             doc_string = func.__doc__
             func_title = " ".join([x.capitalize() for x in rule.endpoint[rule.endpoint.rindex(".") + 1 :].split("_")])
             blueprint = rule.endpoint[: rule.endpoint.rindex(".")]
-            if blueprint == "apiv1":
+            if blueprint == request.blueprint:
                 blueprint = "documentation"
 
             if blueprint not in api_blueprints:
@@ -64,14 +61,14 @@ def get_api_documentation(**_):
             else:
                 description = "[INCOMPLETE]\n\nTHIS API HAS NOT BEEN DOCUMENTED YET!"
 
-            api_id = rule.endpoint.replace("apiv1.", "").replace(".", "_")
+            api_id = rule.endpoint.replace(f"{request.blueprint}.", "").replace(".", "_")
 
             api_list.append(
                 {
                     "protected": func.__dict__.get("protected", False),
                     "name": func_title,
                     "id": api_id,
-                    "function": f"api.v1.{rule.endpoint}",
+                    "function": f"api.{api_version}.{rule.endpoint}",
                     "path": rule.rule,
                     "methods": methods,
                     "description": description,

clue_api-1.7.0.dev464/clue/api/v1/__init__.py

@@ -0,0 +1,8 @@
+from flask import Blueprint
+
+from clue.api.documentation import get_api_documentation
+
+API_PREFIX = "/api/v1"
+apiv1 = Blueprint("apiv1", __name__, url_prefix=API_PREFIX)
+apiv1._doc = "Api Documentation - Version 1"  # type: ignore[attr-defined]
+apiv1.add_url_rule("/", view_func=get_api_documentation)

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/clue/api/v1/lookup.py

@@ -61,7 +61,7 @@ def get_types(**kwargs) -> dict[str, list[str]]:
 @generate_swagger_docs(responses={200: "A list of types and their regex detectors"})
 @lookup_api.route("/types_detection/", methods=["GET"])
 @api_login()
-def get_types_detection(**kwargs) -> dict[str, str]:
+def get_types_detection(**kwargs) -> dict[str, str | None]:
     """Return the regular expression to detect the different types
 
     Variables:

clue_api-1.7.0.dev464/clue/api/v2/__init__.py

@@ -0,0 +1,8 @@
+from flask import Blueprint
+
+from clue.api.documentation import get_api_documentation
+
+API_PREFIX = "/api/v2"
+apiv2 = Blueprint("apiv2", __name__, url_prefix=API_PREFIX)
+apiv2._doc = "Api Documentation - Version 2"  # type: ignore[attr-defined]
+apiv2.add_url_rule("/", view_func=get_api_documentation)

clue_api-1.7.0.dev464/clue/api/v2/lookup.py

@@ -0,0 +1,41 @@
+"""Version 2 type detection metadata for enrichment lookups."""
+
+from flask_cors import CORS
+
+from clue.api import make_subapi_blueprint, ok
+from clue.common.swagger import generate_swagger_docs
+from clue.config import config
+from clue.constants.supported_types import SupportedType
+from clue.security import api_login
+from clue.services import type_service
+
+lookup_api = make_subapi_blueprint("lookup", api_version=2, blueprint_name="lookup_v2")
+lookup_api._doc = "Type detection metadata with case sensitivity and priority."
+
+CORS(lookup_api, origins=config.ui.cors_origins, supports_credentials=True)
+
+
+@generate_swagger_docs(responses={200: "Supported types and their detection metadata"})
+@lookup_api.route("/types_detection/", methods=["GET"])
+@api_login()
+def get_types_detection(**kwargs) -> dict[str, SupportedType]:
+    """Return detection metadata for types exposed by accessible plugins.
+
+    Variables:
+    None
+
+    Arguments:
+    None
+
+    Result Example:
+    {
+        "ipv4": {"regex": "<ipv4 regex>", "case_sensitive": True, "priority": 10},
+        "domain": {"regex": "<domain regex>", "case_sensitive": False},
+        "ip": {"regex": None, "case_sensitive": False}
+    }
+
+    Higher priorities win. Omitted priorities default to zero; equal priorities
+    use the registry insertion order preserved in this response. Null regexes
+    indicate types that must be specified explicitly rather than auto-detected.
+    """
+    return ok(type_service.get_types_detection(kwargs["user"]), sort_keys=False)

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/clue/app.py

@@ -60,6 +60,8 @@ from clue.api.v1.lookup import lookup_api
 from clue.api.v1.registration import registration_api
 from clue.api.v1.static import static_api
 from clue.api.v1.sync import sync_api
+from clue.api.v2 import apiv2
+from clue.api.v2.lookup import lookup_api as lookup_v2_api
 from clue.common.logging import get_logger
 from clue.cronjobs import setup_jobs as setup_cron_jobs
 from clue.error import errors
@@ -125,12 +127,14 @@ if SESSION_COOKIE_SAMESITE:
 app.register_blueprint(healthz)
 app.register_blueprint(api)
 app.register_blueprint(apiv1)
+app.register_blueprint(apiv2)
 app.register_blueprint(errors)
 app.register_blueprint(auth_api)
 app.register_blueprint(actions_api)
 app.register_blueprint(configs_api)
 app.register_blueprint(fetchers_api)
 app.register_blueprint(lookup_api)
+app.register_blueprint(lookup_v2_api)
 app.register_blueprint(registration_api)
 app.register_blueprint(static_api)
 app.register_blueprint(sync_api)

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/clue/common/regex.py

@@ -5,15 +5,23 @@ DOMAIN_REGEX = (
 )
 DOMAIN_ONLY_REGEX = f"^{DOMAIN_REGEX}$"
 DOMAIN_EXCLUDED_NORM_CHARS = "./?@#"
-EMAIL_REGEX = f"^[a-zA-Z0-9!#$%&'*+/=?^_‘{{|}}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_‘{{|}}~-]+)*@({DOMAIN_REGEX})$"
+# Accept either case in hosts without lowercasing email local parts or URI paths.
+CASE_INSENSITIVE_DOMAIN_REGEX = (
+    r"(?:(?=[a-zA-Z0-9-]{1,63}\.)"
+    r"(?:xn--[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)"
+    r"\.)+[a-zA-Z]{2,63}"
+)
+EMAIL_REGEX = (
+    f"^[a-zA-Z0-9!#$%&'*+/=?^_‘{{|}}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_‘{{|}}~-]+)*@({CASE_INSENSITIVE_DOMAIN_REGEX})$"
+)
 IPV4_REGEX = r"(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
 IPV6_REGEX = (
     r"(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|"
     r"(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|"
     r"(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|"
     r"(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|"
-    r":(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|"
-    r"::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|"
+    r":(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|[fF][eE]80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|"
+    r"::(?:[fF]{4}(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|"
     r"(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|"
     r"(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))"
 )
@@ -26,12 +34,7 @@ MD5_REGEX = r"^[a-fA-F0-9]{32}$"
 SHA1_REGEX = r"^[a-fA-F0-9]{40}$"
 SHA256_REGEX = r"^[a-fA-F0-9]{64}$"
 URI_PATH = r"([/?#]\S*)"
-# Case-insensitive version of DOMAIN_REGEX for URIs
-URI_DOMAIN_REGEX = (
-    r"(?:(?=[a-zA-Z0-9-]{1,63}\.)"
-    r"(?:xn--[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)"
-    r"\.)+[a-zA-Z]{2,63}"
-)
+URI_DOMAIN_REGEX = CASE_INSENSITIVE_DOMAIN_REGEX
 URI_REGEX = (
     f"((?:(?:[A-Za-z][A-Za-z0-9+.-]*:)//(?:[^/?#\\s]+@)?)?({IPV4_REGEX}|\\[{IPV6_REGEX}\\]|{URI_DOMAIN_REGEX})"
     f"(?::\\d{{1,5}})?{URI_PATH}?)"

clue_api-1.7.0.dev464/clue/constants/supported_types.py

@@ -0,0 +1,108 @@
+from typing import NotRequired, TypedDict
+
+from clue.common.logging import get_logger
+from clue.common.regex import (
+    COMMUNITY_ID_REGEX,
+    DOMAIN_ONLY_REGEX,
+    EMAIL_PATH_REGEX,
+    EMAIL_REGEX,
+    IPV4_ONLY_REGEX,
+    IPV6_ONLY_REGEX,
+    JA3_REGEX,
+    JA4_REGEX,
+    MAC_ADDRESS_REGEX,
+    MD5_REGEX,
+    PORT_REGEX,
+    SHA1_REGEX,
+    SHA256_REGEX,
+    URI_ONLY,
+    UUID4_REGEX,
+    ZEEK_ID_REGEX,
+)
+
+logger = get_logger(__file__)
+
+
+class SupportedType(TypedDict):
+    """Type detection metadata; an omitted priority is equivalent to zero."""
+
+    regex: str | None
+    case_sensitive: bool
+    priority: NotRequired[int]
+
+
+SUPPORTED_TYPES: dict[str, SupportedType] = {
+    "ipv4": {"regex": IPV4_ONLY_REGEX, "case_sensitive": True, "priority": 10},
+    "ipv6": {"regex": IPV6_ONLY_REGEX, "case_sensitive": True, "priority": 10},
+    # We don't auto-detect ip types, as it's redundant with ipv4/v6. This is just a convenience/backwards compat thing
+    "ip": {"regex": None, "case_sensitive": False},
+    "asn": {"regex": None, "case_sensitive": True},
+    "domain": {"regex": DOMAIN_ONLY_REGEX, "case_sensitive": False},
+    "port": {"regex": PORT_REGEX, "case_sensitive": False},
+    "url": {"regex": URI_ONLY, "case_sensitive": True},
+    "userid": {"regex": None, "case_sensitive": True},
+    "user_agent": {"regex": None, "case_sensitive": True},
+    "email_address": {"regex": EMAIL_REGEX, "case_sensitive": True},
+    "email_id": {"regex": None, "case_sensitive": True},
+    "email_path": {"regex": EMAIL_PATH_REGEX, "case_sensitive": True},
+    "md5": {"regex": MD5_REGEX, "case_sensitive": True},
+    "sha1": {"regex": SHA1_REGEX, "case_sensitive": True},
+    "sha256": {"regex": SHA256_REGEX, "case_sensitive": True},
+    "telemetry": {"regex": None, "case_sensitive": True},
+    "hostname": {"regex": None, "case_sensitive": True},
+    "tenant_id": {"regex": UUID4_REGEX, "case_sensitive": False},
+    "mac_address": {"regex": MAC_ADDRESS_REGEX, "case_sensitive": False},
+    "command_line": {"regex": None, "case_sensitive": True},
+    "community_id": {"regex": COMMUNITY_ID_REGEX, "case_sensitive": True},
+    "ja3": {"regex": JA3_REGEX, "case_sensitive": True},
+    "ja4": {"regex": JA4_REGEX, "case_sensitive": True},
+    "zeek_id": {"regex": ZEEK_ID_REGEX, "case_sensitive": True},
+}
+
+
+# Retained for selector normalization and extensions importing the legacy list.
+CASE_INSENSITIVE_TYPES = [
+    type_name for type_name, metadata in SUPPORTED_TYPES.items() if not metadata["case_sensitive"]
+]
+
+
+def add_supported_type(
+    type: str,
+    regex: str | None = None,
+    namespace: str | None = None,
+    case_insensitive: bool = False,
+    priority: int = 0,
+) -> None:
+    r"""Add a supported type to the SUPPORTED_TYPES registry.
+
+    This function registers a new type with an optional regex pattern for validation.
+    The type can be added to either the default namespace or a custom namespace.
+
+    Args:
+        type (str): The name of the type to be added.
+        regex (str | None, optional): A regex pattern for validating the type. Defaults to None.
+        namespace (str | None, optional): The namespace for the type. If None, adds to default namespace.
+            Defaults to None.
+        case_insensitive (bool, optional): Whether matching and selector normalization ignore case. Defaults to False.
+        priority (int, optional): Detection priority; higher values win, with registry insertion order breaking ties.
+            Defaults to 0. Negative values are allowed.
+
+    Returns:
+        None
+
+    Examples:
+        >>> add_supported_type("email", r"^[\w\.-]+@[\w\.-]+\.\w+$")
+        >>> add_supported_type("custom_id", r"^\d{5}$", namespace="myapp")
+    """
+    if not namespace:
+        logger.info("Adding new type %s to the default namespace with regex %s", type, regex)
+        new_entry = type
+    else:
+        logger.info("Adding type %s to namespace %s with regex %s", type, namespace, regex)
+        new_entry = f"{namespace}_{type}"
+
+    SUPPORTED_TYPES[new_entry] = {"regex": regex, "case_sensitive": not case_insensitive, "priority": priority}
+    if case_insensitive and new_entry not in CASE_INSENSITIVE_TYPES:
+        CASE_INSENSITIVE_TYPES.append(new_entry)
+    elif not case_insensitive and new_entry in CASE_INSENSITIVE_TYPES:
+        CASE_INSENSITIVE_TYPES.remove(new_entry)

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/clue/services/type_service.py

@@ -2,14 +2,13 @@ from typing import Any
 
 import requests
 from elasticapm.traces import capture_span
-from flask import request
 from requests import exceptions
 
 from clue.common.exceptions import AuthenticationException
 from clue.common.logging import get_logger
 from clue.config import CLASSIFICATION, DEBUG, cache, config
 from clue.constants.env import DISABLE_CACHE
-from clue.constants.supported_types import SUPPORTED_TYPES
+from clue.constants.supported_types import SUPPORTED_TYPES, SupportedType
 from clue.helper.headers import generate_headers
 from clue.helper.obo import get_obo_access_token
 from clue.helper.plugin_requests import request_with_safe_redirects
@@ -23,12 +22,13 @@ CACHE_TIMEOUT: int = 1 if DEBUG else 5 * 60
 CACHE = RedisCache(prefix="clue_types", ttl=CACHE_TIMEOUT)
 
 
-def get_types_regular_expressions(user: dict[str, Any]):
-    """Return the regular expression to detect the different types"""
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
+def get_types_regular_expressions(user: dict[str, Any]) -> dict[str, str | None]:
+    """Return the legacy V1 regex mapping in plugin discovery order."""
+    return {type_name: metadata["regex"] for type_name, metadata in _get_accessible_type_definitions(user).items()}
 
+
+def _get_accessible_type_definitions(user: dict[str, Any]) -> dict[str, SupportedType]:
+    """Collect definitions for types exposed by plugins accessible to the user."""
     all_types = all_supported_types(user)
 
     type_detection = {}
@@ -44,6 +44,14 @@ def get_types_regular_expressions(user: dict[str, Any]):
     return type_detection
 
 
+def get_types_detection(user: dict[str, Any]) -> dict[str, SupportedType]:
+    """Return V2 detection metadata in registry order for deterministic priority ties."""
+    accessible_types = _get_accessible_type_definitions(user)
+    return {
+        type_name: metadata.copy() for type_name, metadata in SUPPORTED_TYPES.items() if type_name in accessible_types
+    }
+
+
 @cache.memoize(timeout=CACHE_TIMEOUT)
 def get_supported_types(
     source_url: str, access_token: str | None = None, obo_access_token: str | None = None

{clue_api-1.7.0.dev459 → clue_api-1.7.0.dev464}/pyproject.toml

@@ -141,7 +141,7 @@ log_cli_level = "WARN"
 [tool.poetry]
 package-mode = true
 name = "clue-api"
-version = "1.7.0.dev459"
+version = "1.7.0.dev464"
 description = "Clue distributed enrichment service"
 authors = ["Canadian Centre for Cyber Security <contact@cyber.gc.ca>"]
 license = "MIT"
@@ -184,7 +184,7 @@ pydantic-settings = { extras = ["yaml"], version = "^2.3.4" }
 redis = { version = "^5.0.3" }
 beautifulsoup4 = "^4.13.3"
 imgkit = "^1.2.3"
-pillow = ">=11.1,<13.0"
+pillow = ">=11.1,<14.0"
 cart = "^1.2.3"
 setuptools = "<84.0.0"
 requests = "^2.32.5"

clue_api-1.7.0.dev459/clue/constants/supported_types.py

@@ -1,85 +0,0 @@
-from clue.common.logging import get_logger
-from clue.common.regex import (
-    COMMUNITY_ID_REGEX,
-    DOMAIN_ONLY_REGEX,
-    EMAIL_PATH_REGEX,
-    EMAIL_REGEX,
-    IPV4_ONLY_REGEX,
-    IPV6_ONLY_REGEX,
-    JA3_REGEX,
-    JA4_REGEX,
-    MAC_ADDRESS_REGEX,
-    MD5_REGEX,
-    PORT_REGEX,
-    SHA1_REGEX,
-    SHA256_REGEX,
-    URI_ONLY,
-    UUID4_REGEX,
-    ZEEK_ID_REGEX,
-)
-
-logger = get_logger(__file__)
-
-SUPPORTED_TYPES = {
-    "ipv4": IPV4_ONLY_REGEX,
-    "ipv6": IPV6_ONLY_REGEX,
-    # We don't auto-detect ip types, as it's redundant with ipv4/v6. This is just a convenience/backwards compat thing
-    "ip": None,
-    "asn": None,
-    "domain": DOMAIN_ONLY_REGEX,
-    "port": PORT_REGEX,
-    "url": URI_ONLY,
-    "userid": None,
-    "user_agent": None,
-    "email_address": EMAIL_REGEX,
-    "email_id": None,
-    "email_path": EMAIL_PATH_REGEX,
-    "md5": MD5_REGEX,
-    "sha1": SHA1_REGEX,
-    "sha256": SHA256_REGEX,
-    "telemetry": None,
-    "hostname": None,
-    "tenant_id": UUID4_REGEX,
-    "mac_address": MAC_ADDRESS_REGEX,
-    "command_line": None,
-    "community_id": COMMUNITY_ID_REGEX,
-    "ja3": JA3_REGEX,
-    "ja4": JA4_REGEX,
-    "zeek_id": ZEEK_ID_REGEX,
-}
-
-
-CASE_INSENSITIVE_TYPES = ["ip", "domain", "port", "tenant_id", "mac_address"]
-
-
-def add_supported_type(
-    type: str, regex: str | None = None, namespace: str | None = None, case_insensitive: bool = False
-):
-    r"""Add a supported type to the SUPPORTED_TYPES registry.
-
-    This function registers a new type with an optional regex pattern for validation.
-    The type can be added to either the default namespace or a custom namespace.
-
-    Args:
-        type (str): The name of the type to be added.
-        regex (str | None, optional): A regex pattern for validating the type. Defaults to None.
-        namespace (str | None, optional): The namespace for the type. If None, adds to default namespace.
-            Defaults to None.
-
-    Returns:
-        None
-
-    Examples:
-        >>> add_supported_type("email", r"^[\w\.-]+@[\w\.-]+\.\w+$")
-        >>> add_supported_type("custom_id", r"^\d{5}$", namespace="myapp")
-    """
-    if not namespace:
-        logger.info("Adding new type %s to the default namespace with regex %s", type, regex)
-        new_entry = type
-    else:
-        logger.info("Adding type %s to namespace %s with regex %s", type, namespace, regex)
-        new_entry = f"{namespace}_{type}"
-
-    SUPPORTED_TYPES[new_entry] = regex
-    if case_insensitive:
-        CASE_INSENSITIVE_TYPES.append(new_entry)