lookyloo/config/modules.json.sample

101 lines
3.1 KiB
Plaintext

{
"VirusTotal": {
"apikey": null,
"autosubmit": false,
"allow_auto_trigger": false
},
"PhishingInitiative": {
"apikey": null,
"autosubmit": false,
"allow_auto_trigger": false
},
"FOX": {
"apikey": null,
"autosubmit": false,
"allow_auto_trigger": false
},
"Pandora": {
"url": "http://127.0.0.1:6100",
"autosubmit": false,
"allow_auto_trigger": false
},
"SaneJS": {
"enabled": true,
"allow_auto_trigger": true
},
"MultipleMISPs": {
"default": "MISP",
"instances": {
"MISP": {
"apikey": null,
"url": "https://misp.url",
"verify_tls_cert": true,
"timeout": 10,
"enable_lookup": false,
"enable_push": false,
"default_tags": [
"source:lookyloo"
],
"auto_publish": false,
"allow_auto_trigger": false
}
}
},
"UniversalWhois": {
"enabled": false,
"ipaddress": "127.0.0.1",
"port": 4243,
"allow_auto_trigger": true
},
"UrlScan": {
"apikey": null,
"autosubmit": false,
"allow_auto_trigger": false,
"force_visibility": false
},
"Phishtank": {
"enabled": false,
"url": "https://phishtankapi.circl.lu/",
"allow_auto_trigger": true
},
"URLhaus": {
"enabled": false,
"url": "https://urlhaus-api.abuse.ch/v1/",
"allow_auto_trigger": true
},
"Hashlookup": {
"enabled": false,
"url": "https://hashlookup.circl.lu/",
"allow_auto_trigger": true
},
"RiskIQ": {
"user": null,
"apikey": null,
"allow_auto_trigger": false,
"default_first_seen_in_days": 5
},
"CIRCLPDNS": {
"user": null,
"password": null,
"allow_auto_trigger": false
},
"_notes": {
"apikey": "null disables the module. Pass a string otherwise.",
"autosubmit": "Automatically submits the URL to the 3rd party service.",
"allow_auto_trigger": "Allow auto trigger per module: some (i.e. VT) can be very expensive",
"VirusTotal": "Module to query Virustotal: https://www.virustotal.com/",
"PhishingInitiative": "Module to query phishing initiative: https://phishing-initiative.fr/contrib/",
"SaneJS": "Module to query SaneJS: https://github.com/Lookyloo/sanejs",
"MultipleMISPs": "Module to query one or more MISP(s): https://www.misp-project.org/",
"UniversalWhois": "Module to query a local instance of uWhoisd: https://github.com/Lookyloo/uwhoisd",
"UrlScan": "Module to query urlscan.io",
"Phishtank": "Module to query Phishtank Lookup (https://github.com/Lookyloo/phishtank-lookup). URL set to none means querying the public instance.",
"URLhaus": "Module to query URL Haus.",
"Hashlookup": "Module to query Hashlookup (https://github.com/adulau/hashlookup-server). URL set to none means querying the public instance.",
"FOX": "Submission only interface by and for CCCS",
"Pandora": "Submission only interface for https://github.com/pandora-analysis/",
"RiskIQ": "Module to query RiskIQ (https://community.riskiq.com/)",
"CIRCLPDNS": "Module to query CIRCL Passive DNS (https://www.circl.lu/services/passive-dns/)"
}
}