add: Added documentation for the socialscan new module

- Also quick fix of the message for an invalid
  result or response concerning the queried email
  address or username

README.md

@@ -75,7 +75,8 @@ For more information: [Extending MISP with Python modules](https://www.misp-proj
 * [shodan](misp_modules/modules/expansion/shodan.py) - a minimal [shodan](https://www.shodan.io/) expansion module.
 * [Sigma queries](misp_modules/modules/expansion/sigma_queries.py) - Experimental expansion module querying a sigma rule to convert it into all the available SIEM signatures.
 * [Sigma syntax validator](misp_modules/modules/expansion/sigma_syntax_validator.py) - Sigma syntax validator.
-* [SophosLabs Intelix](misp_modules/modules/expansion/sophoslabs_intelix.py) - SophosLabs Intelix is an API for Threat Intelligence and Analysis (free tier availible). [SophosLabs](https://aws.amazon.com/marketplace/pp/B07SLZPMCS)
+* [Socialscan](misp_modules/modules/expansion/socialscan.py) - a hover module to check if an email address or a username is used on different online platforms, using the [socialscan](https://github.com/iojw/socialscan) python library
+* [SophosLabs Intelix](misp_modules/modules/expansion/sophoslabs_intelix.py) - SophosLabs Intelix is an API for Threat Intelligence and Analysis (free tier available). [SophosLabs](https://aws.amazon.com/marketplace/pp/B07SLZPMCS)
 * [sourcecache](misp_modules/modules/expansion/sourcecache.py) - a module to cache a specific link from a MISP instance.
 * [STIX2 pattern syntax validator](misp_modules/modules/expansion/stix2_pattern_syntax_validator.py) - a module to check a STIX2 pattern syntax.
 * [ThreatCrowd](misp_modules/modules/expansion/threatcrowd.py) - an expansion module for [ThreatCrowd](https://www.threatcrowd.org/).

doc/README.md

@@ -1214,6 +1214,22 @@ An expansion hover module to perform a syntax check on sigma rules.
 
 -----
 
+#### [socialscan](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/socialscan.py)
+
+A hover module to get information on the availability of an email address or username on some online platforms.
+- **features**:
+>The module takes an email address or username as input and check its availability on some online platforms. The results for each platform are then returned to see if the email address or the username is used, available or if there is an issue with it.
+- **input**:
+>An email address or usename attribute.
+- **output**:
+>Text containing information about the availability of an email address or a username in some online platforms.
+- **references**:
+>https://github.com/iojw/socialscan
+- **requirements**:
+>The socialscan python library
+
+-----
+
 #### [sophoslabs_intelix](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/sophoslabs_intelix.py)
 
 <img src=logos/sophoslabs_intelix.svg height=60>

doc/expansion/socialscan.json

@@ -0,0 +1,8 @@
+{
+    "description": "A hover module to get information on the availability of an email address or username on some online platforms.",
+    "requirements": ["The socialscan python library"],
+    "input": "An email address or usename attribute.",
+    "output": "Text containing information about the availability of an email address or a username in some online platforms.",
+    "references": ["https://github.com/iojw/socialscan"],
+    "features": "The module takes an email address or username as input and check its availability on some online platforms. The results for each platform are then returned to see if the email address or the username is used, available or if there is an issue with it."
+}

misp_modules/modules/expansion/socialscan.py

@@ -51,7 +51,7 @@ def parse_results(query_results, feature):
             results.append(f'Unable to retrieve the {feature} on {result.platform}.')
             continue
         if not result.valid:
-            results.append(f'Invalid response from {result.platform}.')
+            results.append(f'Invalid response from {result.platform}, or invalid {feature}.')
             continue
         statement = 'No account' if result.available else 'There is an account'
         results.append(f'{statement} linked to the {feature} on {result.platform}.')