Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New cont3xt integration : "Quad9" for domain/ip block / malicious reputation state #2769

WilliamSalusky opened this issue Apr 30, 2024 · 0 comments


Copy link

This integration should issue a query for each DOMAIN or IP value to the following endpoint.${indicator}

A Quad9 json response with a blocked status would contain detail similar to:

{'domain': '', 'blocked': True, 'blocked_by': ['threatconnect', 'duskrise.malware', 'ticura'], 'meta': [{'name': 'ThreatConnect'}, {'name': 'Cluster25 - Malware Domains', 'url': ' positive report for'}, {'name': 'Ticura'}]}

Non malicious or unknown status would return a simple response, like:

{'domain': '', 'blocked': False}

Only in the case of a { 'blocked': True } result, a red background UI badge should be displayed in the Indicator Result tree [node/box] with static text of "Quad9", and tooltip hover text for the badge would include the key/values of the 'blocked_by' response.

@awick awick added this to the 5.4 milestone May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Status: Todo

No branches or pull requests

3 participants