mirror of https://github.com/CIRCL/lookyloo
102 lines
3.1 KiB
Plaintext
102 lines
3.1 KiB
Plaintext
{
|
|
"VirusTotal": {
|
|
"apikey": null,
|
|
"trustenv": false,
|
|
"autosubmit": false,
|
|
"allow_auto_trigger": false
|
|
},
|
|
"PhishingInitiative": {
|
|
"apikey": null,
|
|
"autosubmit": false,
|
|
"allow_auto_trigger": false
|
|
},
|
|
"FOX": {
|
|
"apikey": null,
|
|
"autosubmit": false,
|
|
"allow_auto_trigger": false
|
|
},
|
|
"Pandora": {
|
|
"url": "http://127.0.0.1:6100",
|
|
"autosubmit": false,
|
|
"allow_auto_trigger": false
|
|
},
|
|
"SaneJS": {
|
|
"enabled": true,
|
|
"allow_auto_trigger": true
|
|
},
|
|
"MultipleMISPs": {
|
|
"default": "MISP",
|
|
"instances": {
|
|
"MISP": {
|
|
"apikey": null,
|
|
"url": "https://misp.url",
|
|
"verify_tls_cert": true,
|
|
"timeout": 10,
|
|
"enable_lookup": false,
|
|
"enable_push": false,
|
|
"default_tags": [
|
|
"source:lookyloo"
|
|
],
|
|
"auto_publish": false,
|
|
"allow_auto_trigger": false
|
|
}
|
|
}
|
|
},
|
|
"UniversalWhois": {
|
|
"enabled": false,
|
|
"ipaddress": "127.0.0.1",
|
|
"port": 4243,
|
|
"allow_auto_trigger": true
|
|
},
|
|
"UrlScan": {
|
|
"apikey": null,
|
|
"autosubmit": false,
|
|
"allow_auto_trigger": false,
|
|
"force_visibility": false
|
|
},
|
|
"Phishtank": {
|
|
"enabled": false,
|
|
"url": "https://phishtankapi.circl.lu/",
|
|
"allow_auto_trigger": true
|
|
},
|
|
"URLhaus": {
|
|
"enabled": false,
|
|
"url": "https://urlhaus-api.abuse.ch/v1/",
|
|
"allow_auto_trigger": true
|
|
},
|
|
"Hashlookup": {
|
|
"enabled": false,
|
|
"url": "https://hashlookup.circl.lu/",
|
|
"allow_auto_trigger": true
|
|
},
|
|
"RiskIQ": {
|
|
"user": null,
|
|
"apikey": null,
|
|
"allow_auto_trigger": false,
|
|
"default_first_seen_in_days": 5
|
|
},
|
|
"CIRCLPDNS": {
|
|
"user": null,
|
|
"password": null,
|
|
"allow_auto_trigger": false
|
|
},
|
|
"_notes": {
|
|
"apikey": "null disables the module. Pass a string otherwise.",
|
|
"autosubmit": "Automatically submits the URL to the 3rd party service.",
|
|
"allow_auto_trigger": "Allow auto trigger per module: some (i.e. VT) can be very expensive",
|
|
"VirusTotal": "Module to query Virustotal: https://www.virustotal.com/",
|
|
"PhishingInitiative": "Module to query phishing initiative: https://phishing-initiative.fr/contrib/",
|
|
"SaneJS": "Module to query SaneJS: https://github.com/Lookyloo/sanejs",
|
|
"MultipleMISPs": "Module to query one or more MISP(s): https://www.misp-project.org/",
|
|
"UniversalWhois": "Module to query a local instance of uWhoisd: https://github.com/Lookyloo/uwhoisd",
|
|
"UrlScan": "Module to query urlscan.io",
|
|
"Phishtank": "Module to query Phishtank Lookup (https://github.com/Lookyloo/phishtank-lookup). URL set to none means querying the public instance.",
|
|
"URLhaus": "Module to query URL Haus.",
|
|
"Hashlookup": "Module to query Hashlookup (https://github.com/adulau/hashlookup-server). URL set to none means querying the public instance.",
|
|
"FOX": "Submission only interface by and for CCCS",
|
|
"Pandora": "Submission only interface for https://github.com/pandora-analysis/",
|
|
"RiskIQ": "Module to query RiskIQ (https://community.riskiq.com/)",
|
|
"CIRCLPDNS": "Module to query CIRCL Passive DNS (https://www.circl.lu/services/passive-dns/)"
|
|
}
|
|
}
|