misp-modules icon indicating copy to clipboard operation
misp-modules copied to clipboard
verified publisher icon MISP

Module for querying URLhaus

Open abusech opened this issue 6 years ago • 3 comments

It would be cool to have a module that enriches certain information with data from the URLhaus API: https://urlhaus-api.abuse.ch/

I'm specially thinking about querying the URLhaus API for a malware sample (MD5 hash or SHA256 hash) or a URL: https://urlhaus-api.abuse.ch/#urlinfo https://urlhaus-api.abuse.ch/#payloadinfo

abusech avatar Feb 01 '19 09:02 abusech

Sure, I will work on it soon and poke you once it is done within the next few days ;-)

chrisr3d avatar Feb 01 '19 10:02 chrisr3d

Did you had any chance to look into this feature request yet?

abusech avatar Jul 04 '19 10:07 abusech

The module is available since the feature branch we created with other modules presenting the same new features (being able to return objects as well as attributes from modules) has been merged into the master branch.

It required some work on MISP core as well, which took me indeed some time, but it is merged as well, and available too. It will be released (new tagged version and so on) today hopefully, or during the week end.

By the way any comment, suggestion, idea to improve the module is very welcome

chrisr3d avatar Jul 05 '19 12:07 chrisr3d

The module is available and working.

adulau avatar Mar 19 '23 09:03 adulau