| description | Threat intelligence enrichment for IPs, domains, file hashes — combines AbuseIPDB, Maltiverse (classification + tags), DNS, WHOIS, ipapi.co (HTTPS geolocation + proxy/VPN/TOR detection), Shodan (ports, CVEs, OS), and VirusTotal (community votes, tags, network) into a unified 0-100 reputation score. Trigger when user asks IOC, reputation, מוניטין, האם IP זדוני, blacklist, threat intel, lookup, whois, dns, domain age, virustotal, abuseipdb, maltiverse, shodan, ip reputation, network osint. |
| metadata | {"clawdbot":{"emoji":"🛰️","commands":["ip","domain","hash","dns","whois","sweep","cluster","israeli","cert","attack","feeds"],"commands_schema":{"ip":{"properties":{"target":{"type":"string","description":"IP address to lookup (IPv4 or IPv6)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"domain":{"properties":{"target":{"type":"string","description":"Domain name (FQDN) to lookup"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"hash":{"properties":{"target":{"type":"string","description":"File hash to check (md5, sha1, or sha256)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"dns":{"properties":{"target":{"type":"string","description":"Domain name for DNS lookup (A/AAAA/MX/TXT/NS)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"whois":{"properties":{"target":{"type":"string","description":"Domain or IP for WHOIS/RDAP lookup"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"sweep":{"properties":{"threshold":{"type":"integer","default":10,"description":"Minimum threat score to flag connections (0-100)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":[]},"cluster":{"properties":{"targets":{"type":"string","description":"Comma-separated IOCs (IPs, domains, hashes) to cluster"},"threshold":{"type":"number","default":0.8,"description":"Cosine similarity threshold for clustering (0.0-1.0)"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["targets"]},"israeli":{"properties":{"target":{"type":"string","description":"IP address or domain for Israeli-specific monitoring"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["target"]},"cert":{"properties":{"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":[]},"attack":{"properties":{"technique":{"type":"string","description":"MITRE ATT&CK technique ID (e.g. T1059, T1071, T1090)"},"format":{"type":"string","enum":["markdown","json"],"default":"json"}},"required":["technique"]},"feeds":{"properties":{"source":{"type":"string","enum":["urlhaus","threatfox","all"],"description":"Threat feed source (URLhaus malicious URLs, ThreatFox botnet C2 IOCs)"},"limit":{"type":"integer","default":50,"description":"Max IOCs to display"},"format":{"type":"string","enum":["markdown","json"],"default":"markdown"}},"required":["source"]}},"arg_template":"scripts/intel.py {command} {args}","requires":{"bins":["python"]},"install":[]}} |
