diff --git a/doc/README.md b/doc/README.md index af52175..54100c0 100644 --- a/doc/README.md +++ b/doc/README.md @@ -2,6 +2,26 @@ ## Expansion Modules +#### [apiosintds](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/apiosintds.py) + +On demand query API for OSINT.digitalside.it project. +- **features**: +>The module simply queries the API of OSINT.digitalside.it with a domain, ip, url or hash attribute. +> +>The result of the query is then parsed to extract additional hashes or urls. A module parameters also allows to parse the hashes related to the urls. +> +>Furthermore, it is possible to cache the urls and hashes collected over the last 7 days by OSINT.digitalside.it +- **input**: +>A domain, ip, url or hash attribute. +- **output**: +>Hashes and urls resulting from the query to OSINT.digitalside.it +- **references**: +>https://osint.digitalside.it/#About +- **requirements**: +>The apiosintDS python library to query the OSINT.digitalside.it API. + +----- + #### [backscatter_io](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/backscatter_io.py) @@ -306,6 +326,22 @@ DomainTools MISP expansion module. ----- +#### [eql](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/eql.py) + + + +Generates EQL queries from attributes +- **features**: +>The module simply generates EQL rules out of the input attribute. +- **input**: +>A filename or ip attribute. +- **output**: +>The EQL query generated from the input attribute. +- **references**: +>https://eql.readthedocs.io/en/latest/ + +----- + #### [eupi](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/eupi.py) diff --git a/doc/expansion/apiosintds.json b/doc/expansion/apiosintds.json new file mode 100644 index 0000000..81a1eec --- /dev/null +++ b/doc/expansion/apiosintds.json @@ -0,0 +1,8 @@ +{ + "description": "On demand query API for OSINT.digitalside.it project.", + "requirements": ["The apiosintDS python library to query the OSINT.digitalside.it API."], + "input": "A domain, ip, url or hash attribute.", + "output": "Hashes and urls resulting from the query to OSINT.digitalside.it", + "references": ["https://osint.digitalside.it/#About"], + "features": "The module simply queries the API of OSINT.digitalside.it with a domain, ip, url or hash attribute.\n\nThe result of the query is then parsed to extract additional hashes or urls. A module parameters also allows to parse the hashes related to the urls.\n\nFurthermore, it is possible to cache the urls and hashes collected over the last 7 days by OSINT.digitalside.it" +} diff --git a/doc/expansion/eql.json b/doc/expansion/eql.json new file mode 100644 index 0000000..d800ab6 --- /dev/null +++ b/doc/expansion/eql.json @@ -0,0 +1,9 @@ +{ + "description": "Generates EQL queries from attributes", + "logo": "logos/eql.png", + "requirements": [], + "input": "A filename or ip attribute.", + "output": "The EQL query generated from the input attribute.", + "references": ["https://eql.readthedocs.io/en/latest/"], + "features": "The module simply generates EQL rules out of the input attribute." +} diff --git a/doc/logos/eql.png b/doc/logos/eql.png new file mode 100644 index 0000000..4cddb91 Binary files /dev/null and b/doc/logos/eql.png differ