{
  "VirusTotal": {
    "apikey": null,
    "autosubmit": false,
    "allow_auto_trigger": false
  },
  "PhishingInitiative": {
    "apikey": null,
    "autosubmit": false,
    "allow_auto_trigger": false
  },
  "FOX": {
    "apikey": null,
    "autosubmit": false,
    "allow_auto_trigger": false
  },
  "Pandora": {
    "url": "http://127.0.0.1:6100",
    "autosubmit": false,
    "allow_auto_trigger": false
  },
  "SaneJS": {
    "enabled": true,
    "allow_auto_trigger": true
  },
  "MultipleMISPs": {
    "default": "MISP",
    "instances": {
      "MISP": {
        "apikey": null,
        "url": "https://misp.url",
        "verify_tls_cert": true,
        "timeout": 10,
        "enable_lookup": false,
        "enable_push": false,
        "default_tags": [
          "source:lookyloo"
        ],
        "auto_publish": false,
        "allow_auto_trigger": false
      }
    }
  },
  "UniversalWhois": {
    "enabled": false,
    "ipaddress": "127.0.0.1",
    "port": 4243,
    "allow_auto_trigger": true
  },
  "UrlScan": {
    "apikey": null,
    "autosubmit": false,
    "allow_auto_trigger": false,
    "force_visibility": false
  },
  "Phishtank": {
    "enabled": false,
    "url": "https://phishtankapi.circl.lu/",
    "allow_auto_trigger": true
  },
  "URLhaus": {
    "enabled": false,
    "url": "https://urlhaus-api.abuse.ch/v1/",
    "allow_auto_trigger": true
  },
  "Hashlookup": {
    "enabled": false,
    "url": "https://hashlookup.circl.lu/",
    "allow_auto_trigger": true
  },
  "RiskIQ": {
    "user": null,
    "apikey": null,
    "allow_auto_trigger": false,
    "default_first_seen_in_days": 5
  },
  "CIRCLPDNS": {
    "user": null,
    "password": null,
    "allow_auto_trigger": false
  },
  "_notes": {
    "apikey": "null disables the module. Pass a string otherwise.",
    "autosubmit": "Automatically submits the URL to the 3rd party service.",
    "allow_auto_trigger": "Allow auto trigger per module: some (i.e. VT) can be very expensive",
    "VirusTotal": "Module to query Virustotal: https://www.virustotal.com/",
    "PhishingInitiative": "Module to query phishing initiative: https://phishing-initiative.fr/contrib/",
    "SaneJS": "Module to query SaneJS: https://github.com/Lookyloo/sanejs",
    "MultipleMISPs": "Module to query one or more MISP(s): https://www.misp-project.org/",
    "UniversalWhois": "Module to query a local instance of uWhoisd: https://github.com/Lookyloo/uwhoisd",
    "UrlScan": "Module to query urlscan.io",
    "Phishtank": "Module to query Phishtank Lookup (https://github.com/Lookyloo/phishtank-lookup). URL set to none means querying the public instance.",
    "URLhaus": "Module to query URL Haus.",
    "Hashlookup": "Module to query Hashlookup (https://github.com/adulau/hashlookup-server). URL set to none means querying the public instance.",
    "FOX": "Submission only interface by and for CCCS",
    "Pandora": "Submission only interface for https://github.com/pandora-analysis/",
    "RiskIQ": "Module to query RiskIQ (https://community.riskiq.com/)",
    "CIRCLPDNS": "Module to query CIRCL Passive DNS (https://www.circl.lu/services/passive-dns/)"
  }
}