diff --git a/documentation/README.md b/documentation/README.md
index ec9366f..0016f25 100644
--- a/documentation/README.md
+++ b/documentation/README.md
@@ -58,7 +58,7 @@ A module tu query the AssemblyLine API with a submission ID to get the submissio
- **output**:
>MISP attributes & objects parsed from the AssemblyLine submission.
- **references**:
->https://www.cyber.cg.ca/en/assemblyline
+>https://www.cyber.gc.ca/en/assemblyline
- **requirements**:
>assemblyline_client: Python library to query the AssemblyLine rest API.
@@ -207,6 +207,39 @@ Modules to access CIRCL Passive SSL.
-----
+#### [cluster25_expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/cluster25_expand.py)
+
+
+
+Module to query Cluster25 CTI.
+- **features**:
+>This module takes a MISP attribute value as input to query the Cluster25CTI API. The result is then mapped into compatible MISP Objects and relative attributes.
+>
+- **input**:
+>An Indicator value of type included in the following list:
+>- domain
+>- email-src
+>- email-dst
+>- filename
+>- md5
+>- sha1
+>- sha256
+>- ip-src
+>- ip-dst
+>- url
+>- vulnerability
+>- btc
+>- xmr
+> ja3-fingerprint-md5
+- **output**:
+>A series of c25 MISP Objects with colletion of attributes mapped from Cluster25 CTI query result.
+- **references**:
+>
+- **requirements**:
+>A Cluster25 API access (API id & key)
+
+-----
+
#### [countrycode](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/countrycode.py)
Module to expand country codes.
@@ -780,6 +813,28 @@ Module to access intelmqs eventdb.
-----
+#### [ip2locationio](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ip2locationio.py)
+
+
+
+An expansion module to query IP2Location.io to gather more information on a given IP address.
+- **features**:
+>The module takes an IP address attribute as input and queries the IP2Location.io API.
+>Free plan user will get the basic geolocation informaiton, and different subsription plan will get more information on the IP address.
+> Refer to [pricing page](https://www.ip2location.io/pricing) for more information on data available for each plan.
+>
+>More information on the responses content is available in the [documentation](https://www.ip2location.io/ip2location-documentation).
+- **input**:
+>IP address attribute.
+- **output**:
+>Additional information on the IP address, such as geolocation, proxy and so on. Refer to the Response Format section in https://www.ip2location.io/ip2location-documentation to find out the full format of the data returned.
+- **references**:
+>https://www.ip2location.io/ip2location-documentation
+- **requirements**:
+>An IP2Location.io token
+
+-----
+
#### [ipasn](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ipasn.py)
Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).
@@ -1459,6 +1514,24 @@ An expansion hover module to perform a syntax check on sigma rules.
-----
+#### [sigmf-expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/sigmf-expand.py)
+
+Enrichs a SigMF Recording or extracts a SigMF Archive into a SigMF Recording.
+- **features**:
+>This module can be used to expand a SigMF Recording object into a SigMF Expanded Recording object with a waterfall plot or to extract a SigMF Archive object into a SigMF Recording objet.
+- **input**:
+>Object of sigmf-archive or sigmf-recording template.
+- **output**:
+>Object of sigmf-expanded-recording or sigmf-recording template.
+- **references**:
+>https://github.com/sigmf/SigMF
+- **requirements**:
+> - matplotlib: For plotting the waterfall plot of the recording.
+> - numpy: For the waterfall plot of the recording.
+> - sigmf: For validating SigMF files.
+
+-----
+
#### [socialscan](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/socialscan.py)
A hover module to get information on the availability of an email address or username on some online platforms.
diff --git a/documentation/mkdocs/expansion.md b/documentation/mkdocs/expansion.md
index 701c79d..5379c82 100644
--- a/documentation/mkdocs/expansion.md
+++ b/documentation/mkdocs/expansion.md
@@ -55,7 +55,7 @@ A module tu query the AssemblyLine API with a submission ID to get the submissio
- **output**:
>MISP attributes & objects parsed from the AssemblyLine submission.
- **references**:
->https://www.cyber.cg.ca/en/assemblyline
+>https://www.cyber.gc.ca/en/assemblyline
- **requirements**:
>assemblyline_client: Python library to query the AssemblyLine rest API.
@@ -204,6 +204,39 @@ Modules to access CIRCL Passive SSL.
-----
+#### [cluster25_expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/cluster25_expand.py)
+
+
+
+Module to query Cluster25 CTI.
+- **features**:
+>This module takes a MISP attribute value as input to query the Cluster25CTI API. The result is then mapped into compatible MISP Objects and relative attributes.
+>
+- **input**:
+>An Indicator value of type included in the following list:
+>- domain
+>- email-src
+>- email-dst
+>- filename
+>- md5
+>- sha1
+>- sha256
+>- ip-src
+>- ip-dst
+>- url
+>- vulnerability
+>- btc
+>- xmr
+> ja3-fingerprint-md5
+- **output**:
+>A series of c25 MISP Objects with colletion of attributes mapped from Cluster25 CTI query result.
+- **references**:
+>
+- **requirements**:
+>A Cluster25 API access (API id & key)
+
+-----
+
#### [countrycode](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/countrycode.py)
Module to expand country codes.
@@ -777,6 +810,28 @@ Module to access intelmqs eventdb.
-----
+#### [ip2locationio](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ip2locationio.py)
+
+
+
+An expansion module to query IP2Location.io to gather more information on a given IP address.
+- **features**:
+>The module takes an IP address attribute as input and queries the IP2Location.io API.
+>Free plan user will get the basic geolocation informaiton, and different subsription plan will get more information on the IP address.
+> Refer to [pricing page](https://www.ip2location.io/pricing) for more information on data available for each plan.
+>
+>More information on the responses content is available in the [documentation](https://www.ip2location.io/ip2location-documentation).
+- **input**:
+>IP address attribute.
+- **output**:
+>Additional information on the IP address, such as geolocation, proxy and so on. Refer to the Response Format section in https://www.ip2location.io/ip2location-documentation to find out the full format of the data returned.
+- **references**:
+>https://www.ip2location.io/ip2location-documentation
+- **requirements**:
+>An IP2Location.io token
+
+-----
+
#### [ipasn](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/ipasn.py)
Module to query an IP ASN history service (https://github.com/D4-project/IPASN-History).
@@ -1456,6 +1511,24 @@ An expansion hover module to perform a syntax check on sigma rules.
-----
+#### [sigmf-expand](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/sigmf-expand.py)
+
+Enrichs a SigMF Recording or extracts a SigMF Archive into a SigMF Recording.
+- **features**:
+>This module can be used to expand a SigMF Recording object into a SigMF Expanded Recording object with a waterfall plot or to extract a SigMF Archive object into a SigMF Recording objet.
+- **input**:
+>Object of sigmf-archive or sigmf-recording template.
+- **output**:
+>Object of sigmf-expanded-recording or sigmf-recording template.
+- **references**:
+>https://github.com/sigmf/SigMF
+- **requirements**:
+> - matplotlib: For plotting the waterfall plot of the recording.
+> - numpy: For the waterfall plot of the recording.
+> - sigmf: For validating SigMF files.
+
+-----
+
#### [socialscan](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/expansion/socialscan.py)
A hover module to get information on the availability of an email address or username on some online platforms.