diff --git a/doc/README.md b/doc/README.md
index 0ca9b3e..5656105 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -253,6 +253,22 @@ A simple DNS expansion service to resolve IP address from domain MISP attributes
-----
+#### [docx-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/docx-enrich.py)
+
+
+
+Module to extract freetext from a .docx document.
+- **features**:
+>The module reads the text contained in a .docx document. The result is passed to the freetext import parser so IoCs can be extracted out of it.
+- **input**:
+>Attachment attribute containing a .docx document.
+- **output**:
+>Text and freetext parsed from the document.
+- **requirements**:
+>docx python library
+
+-----
+
#### [domaintools](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/domaintools.py)
@@ -348,6 +364,22 @@ Module to query a local copy of Maxmind's Geolite database.
-----
+#### [greynoise](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/greynoise.py)
+
+
+
+Module to access GreyNoise.io API
+- **features**:
+>The module takes an IP address as input and queries Greynoise for some additional information about it. The result is returned as text.
+- **input**:
+>An IP address.
+- **output**:
+>Additional information about the IP fetched from Greynoise API.
+- **references**:
+>https://greynoise.io/, https://github.com/GreyNoise-Intelligence/api.greynoise.io
+
+-----
+
#### [hashdd](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/hashdd.py)
A hover module to check hashes against hashdd.com including NSLR dataset.
@@ -362,6 +394,22 @@ A hover module to check hashes against hashdd.com including NSLR dataset.
-----
+#### [hibp](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/hibp.py)
+
+
+
+Module to access haveibeenpwned.com API.
+- **features**:
+>The module takes an email address as input and queries haveibeenpwned.com API to find additional information about it. This additional information actually tells if any account using the email address has already been compromised in a data breach.
+- **input**:
+>An email address
+- **output**:
+>Additional information about the email address.
+- **references**:
+>https://haveibeenpwned.com/
+
+-----
+
#### [intelmq_eventdb](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/intelmq_eventdb.py)
@@ -483,6 +531,68 @@ MISP hover module for macaddress.io
-----
+#### [macvendors](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/macvendors.py)
+
+
+
+Module to access Macvendors API.
+- **features**:
+>The module takes a MAC address as input and queries macvendors.com for some information about it. The API returns the name of the vendor related to the address.
+- **input**:
+>A MAC address.
+- **output**:
+>Additional information about the MAC address.
+- **references**:
+>https://macvendors.com/, https://macvendors.com/api
+
+-----
+
+#### [ocr-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/ocr-enrich.py)
+
+Module to process some optical character recognition on pictures.
+- **features**:
+>The module takes an attachment attributes as input and process some optical character recognition on it. The text found is then passed to the Freetext importer to extract potential IoCs.
+- **input**:
+>A picture attachment.
+- **output**:
+>Text and freetext fetched from the input picture.
+- **requirements**:
+>cv2: The OpenCV python library.
+
+-----
+
+#### [ods-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/ods-enrich.py)
+
+
+
+Module to extract freetext from a .ods document.
+- **features**:
+>The module reads the text contained in a .ods document. The result is passed to the freetext import parser so IoCs can be extracted out of it.
+- **input**:
+>Attachment attribute containing a .ods document.
+- **output**:
+>Text and freetext parsed from the document.
+- **requirements**:
+>ezodf: Python package to create/manipulate OpenDocumentFormat files., pandas_ods_reader: Python library to read in ODS files.
+
+-----
+
+#### [odt-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/odt-enrich.py)
+
+
+
+Module to extract freetext from a .odt document.
+- **features**:
+>The module reads the text contained in a .odt document. The result is passed to the freetext import parser so IoCs can be extracted out of it.
+- **input**:
+>Attachment attribute containing a .odt document.
+- **output**:
+>Text and freetext parsed from the document.
+- **requirements**:
+>ODT reader python library.
+
+-----
+
#### [onyphe](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/onyphe.py)
@@ -606,6 +716,52 @@ Module to get information from AlienVault OTX.
-----
+#### [pdf-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/pdf-enrich.py)
+
+
+
+Module to extract freetext from a PDF document.
+- **features**:
+>The module reads the text contained in a PDF document. The result is passed to the freetext import parser so IoCs can be extracted out of it.
+- **input**:
+>Attachment attribute containing a PDF document.
+- **output**:
+>Text and freetext parsed from the document.
+- **requirements**:
+>pdftotext: Python library to extract text from PDF.
+
+-----
+
+#### [pptx-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/pptx-enrich.py)
+
+
+
+Module to extract freetext from a .pptx document.
+- **features**:
+>The module reads the text contained in a .pptx document. The result is passed to the freetext import parser so IoCs can be extracted out of it.
+- **input**:
+>Attachment attribute containing a .pptx document.
+- **output**:
+>Text and freetext parsed from the document.
+- **requirements**:
+>pptx: Python library to read PowerPoint files.
+
+-----
+
+#### [qrcode](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/qrcode.py)
+
+Module to decode QR codes.
+- **features**:
+>The module reads the QR code and returns the related address, which can be an URL or a bitcoin address.
+- **input**:
+>A QR code stored as attachment attribute.
+- **output**:
+>The URL or bitcoin address the QR code is pointing to.
+- **requirements**:
+>cv2: The OpenCV python library., pyzbar: Python library to read QR codes.
+
+-----
+
#### [rbl](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/rbl.py)
Module to check an IPv4 address against known RBLs.
@@ -1029,6 +1185,22 @@ An expansion module for IBM X-Force Exchange.
-----
+#### [xlsx-enrich](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/xlsx-enrich.py)
+
+
+
+Module to extract freetext from a .xlsx document.
+- **features**:
+>The module reads the text contained in a .xlsx document. The result is passed to the freetext import parser so IoCs can be extracted out of it.
+- **input**:
+>Attachment attribute containing a .xlsx document.
+- **output**:
+>Text and freetext parsed from the document.
+- **requirements**:
+>pandas: Python library to perform data analysis, time series and statistics.
+
+-----
+
#### [yara_query](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/expansion/yara_query.py)
@@ -1083,6 +1255,22 @@ Module to export a MISP event in CEF format.
-----
+#### [cisco_firesight_manager_ACL_rule_export](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/cisco_firesight_manager_ACL_rule_export.py)
+
+
+
+Module to export malicious network activity attributes to Cisco fireSIGHT manager block rules.
+- **features**:
+>The module goes through the attributes to find all the network activity ones in order to create block rules for the Cisco fireSIGHT manager.
+- **input**:
+>Network activity attributes (IPs, URLs).
+- **output**:
+>Cisco fireSIGHT manager block rules.
+- **requirements**:
+>Firesight manager console credentials
+
+-----
+
#### [goamlexport](https://github.com/MISP/misp-modules/tree/master/misp_modules/modules/export_mod/goamlexport.py)
diff --git a/doc/expansion/docx-enrich.json b/doc/expansion/docx-enrich.json
new file mode 100644
index 0000000..361f63a
--- /dev/null
+++ b/doc/expansion/docx-enrich.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to extract freetext from a .docx document.",
+ "logo": "logos/docx.png",
+ "requirements": ["docx python library"],
+ "input": "Attachment attribute containing a .docx document.",
+ "output": "Freetext parsed from the document.",
+ "references": [],
+ "features": "The module reads the text contained in a .docx document. The result is passed to the freetext import parser so IoCs can be extracted out of it."
+}
diff --git a/doc/expansion/greynoise.json b/doc/expansion/greynoise.json
new file mode 100644
index 0000000..effb027
--- /dev/null
+++ b/doc/expansion/greynoise.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to access GreyNoise.io API",
+ "logo": "greynoise.png",
+ "requirements": [],
+ "input": "An IP address.",
+ "output": "Additional information about the IP fetched from Greynoise API.",
+ "references": ["https://greynoise.io/", "https://github.com/GreyNoise-Intelligence/api.greynoise.io"],
+ "features": "The module takes an IP address as input and queries Greynoise for some additional information about it. The result is returned as text."
+}
diff --git a/doc/expansion/hibp.json b/doc/expansion/hibp.json
new file mode 100644
index 0000000..3c3ee54
--- /dev/null
+++ b/doc/expansion/hibp.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to access haveibeenpwned.com API.",
+ "logo": "logos/hibp.png",
+ "requirements": [],
+ "input": "An email address",
+ "output": "Additional information about the email address.",
+ "references": ["https://haveibeenpwned.com/"],
+ "features": "The module takes an email address as input and queries haveibeenpwned.com API to find additional information about it. This additional information actually tells if any account using the email address has already been compromised in a data breach."
+}
diff --git a/doc/expansion/macvendors.json b/doc/expansion/macvendors.json
new file mode 100644
index 0000000..cc10475
--- /dev/null
+++ b/doc/expansion/macvendors.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to access Macvendors API.",
+ "logo": "logos/macvendors.png",
+ "requirements": [],
+ "input": "A MAC address.",
+ "output": "Additional information about the MAC address.",
+ "references": ["https://macvendors.com/", "https://macvendors.com/api"],
+ "features": "The module takes a MAC address as input and queries macvendors.com for some information about it. The API returns the name of the vendor related to the address."
+}
diff --git a/doc/expansion/ocr-enrich.json b/doc/expansion/ocr-enrich.json
new file mode 100644
index 0000000..fb222f4
--- /dev/null
+++ b/doc/expansion/ocr-enrich.json
@@ -0,0 +1,8 @@
+{
+ "description": "Module to process some optical character recognition on pictures.",
+ "requirements": ["The OpenCV python library."],
+ "input": "A picture attachment.",
+ "output": "Text and freetext fetched from the input picture.",
+ "references": [],
+ "features": "The module takes an attachment attributes as input and process some optical character recognition on it. The text found is then passed to the Freetext importer to extract potential IoCs."
+}
diff --git a/doc/expansion/ods-enrich.json b/doc/expansion/ods-enrich.json
new file mode 100644
index 0000000..dda4281
--- /dev/null
+++ b/doc/expansion/ods-enrich.json
@@ -0,0 +1,10 @@
+{
+ "description": "Module to extract freetext from a .ods document.",
+ "logo": "logos/ods.png",
+ "requirements": ["ezodf: Python package to create/manipulate OpenDocumentFormat files.",
+ "pandas_ods_reader: Python library to read in ODS files."],
+ "input": "Attachment attribute containing a .ods document.",
+ "output": "Text and freetext parsed from the document.",
+ "references": [],
+ "features": "The module reads the text contained in a .ods document. The result is passed to the freetext import parser so IoCs can be extracted out of it."
+}
diff --git a/doc/expansion/odt-enrich.json b/doc/expansion/odt-enrich.json
new file mode 100644
index 0000000..e201c77
--- /dev/null
+++ b/doc/expansion/odt-enrich.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to extract freetext from a .odt document.",
+ "logo": "logos/odt.png",
+ "requirements": ["ODT reader python library."],
+ "input": "Attachment attribute containing a .odt document.",
+ "output": "Text and freetext parsed from the document.",
+ "references": [],
+ "features": "The module reads the text contained in a .odt document. The result is passed to the freetext import parser so IoCs can be extracted out of it."
+}
diff --git a/doc/expansion/pdf-enrich.json b/doc/expansion/pdf-enrich.json
new file mode 100644
index 0000000..5b3f0a8
--- /dev/null
+++ b/doc/expansion/pdf-enrich.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to extract freetext from a PDF document.",
+ "logo": "logos/pdf.jpg",
+ "requirements": ["pdftotext: Python library to extract text from PDF."],
+ "input": "Attachment attribute containing a PDF document.",
+ "output": "Text and freetext parsed from the document.",
+ "references": [],
+ "features": "The module reads the text contained in a PDF document. The result is passed to the freetext import parser so IoCs can be extracted out of it."
+}
diff --git a/doc/expansion/pptx-enrich.json b/doc/expansion/pptx-enrich.json
new file mode 100644
index 0000000..aff0d8d
--- /dev/null
+++ b/doc/expansion/pptx-enrich.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to extract freetext from a .pptx document.",
+ "logo": "logos/pptx.png",
+ "requirements": ["pptx: Python library to read PowerPoint files."],
+ "input": "Attachment attribute containing a .pptx document.",
+ "output": "Text and freetext parsed from the document.",
+ "references": [],
+ "features": "The module reads the text contained in a .pptx document. The result is passed to the freetext import parser so IoCs can be extracted out of it."
+}
diff --git a/doc/expansion/qrcode.json b/doc/expansion/qrcode.json
new file mode 100644
index 0000000..38ed77c
--- /dev/null
+++ b/doc/expansion/qrcode.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to decode QR codes.",
+ "requirements": ["cv2: The OpenCV python library.",
+ "pyzbar: Python library to read QR codes."],
+ "input": "A QR code stored as attachment attribute.",
+ "output": "The URL or bitcoin address the QR code is pointing to.",
+ "references": [],
+ "features": "The module reads the QR code and returns the related address, which can be an URL or a bitcoin address."
+}
diff --git a/doc/expansion/xlsx-enrich.json b/doc/expansion/xlsx-enrich.json
new file mode 100644
index 0000000..c41f17c
--- /dev/null
+++ b/doc/expansion/xlsx-enrich.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to extract freetext from a .xlsx document.",
+ "logo": "logos/xlsx.png",
+ "requirements": ["pandas: Python library to perform data analysis, time series and statistics."],
+ "input": "Attachment attribute containing a .xlsx document.",
+ "output": "Text and freetext parsed from the document.",
+ "references": [],
+ "features": "The module reads the text contained in a .xlsx document. The result is passed to the freetext import parser so IoCs can be extracted out of it."
+}
diff --git a/doc/export_mod/cisco_firesight_manager_ACL_rule_export.json b/doc/export_mod/cisco_firesight_manager_ACL_rule_export.json
new file mode 100644
index 0000000..6d1d0dd
--- /dev/null
+++ b/doc/export_mod/cisco_firesight_manager_ACL_rule_export.json
@@ -0,0 +1,9 @@
+{
+ "description": "Module to export malicious network activity attributes to Cisco fireSIGHT manager block rules.",
+ "logo": "logos/cisco.png",
+ "requirements": ["Firesight manager console credentials"],
+ "input": "Network activity attributes (IPs, URLs).",
+ "output": "Cisco fireSIGHT manager block rules.",
+ "references": [],
+ "features": "The module goes through the attributes to find all the network activity ones in order to create block rules for the Cisco fireSIGHT manager."
+}
diff --git a/doc/logos/cisco.png b/doc/logos/cisco.png
new file mode 100644
index 0000000..87b863b
Binary files /dev/null and b/doc/logos/cisco.png differ
diff --git a/doc/logos/docx.png b/doc/logos/docx.png
new file mode 100644
index 0000000..018d2c1
Binary files /dev/null and b/doc/logos/docx.png differ
diff --git a/doc/logos/greynoise.png b/doc/logos/greynoise.png
new file mode 100644
index 0000000..b4d4f91
Binary files /dev/null and b/doc/logos/greynoise.png differ
diff --git a/doc/logos/hibp.png b/doc/logos/hibp.png
new file mode 100644
index 0000000..849ccf2
Binary files /dev/null and b/doc/logos/hibp.png differ
diff --git a/doc/logos/macvendors.png b/doc/logos/macvendors.png
new file mode 100644
index 0000000..3316ea3
Binary files /dev/null and b/doc/logos/macvendors.png differ
diff --git a/doc/logos/ods.png b/doc/logos/ods.png
new file mode 100644
index 0000000..19b42f1
Binary files /dev/null and b/doc/logos/ods.png differ
diff --git a/doc/logos/odt.png b/doc/logos/odt.png
new file mode 100644
index 0000000..d177a21
Binary files /dev/null and b/doc/logos/odt.png differ
diff --git a/doc/logos/pdf.jpg b/doc/logos/pdf.jpg
new file mode 100644
index 0000000..74f4297
Binary files /dev/null and b/doc/logos/pdf.jpg differ
diff --git a/doc/logos/pptx.png b/doc/logos/pptx.png
new file mode 100644
index 0000000..11b2133
Binary files /dev/null and b/doc/logos/pptx.png differ
diff --git a/doc/logos/xlsx.png b/doc/logos/xlsx.png
new file mode 100644
index 0000000..fbe6e13
Binary files /dev/null and b/doc/logos/xlsx.png differ