diff --git a/salt/sensoroni/files/analyzers/README.md b/salt/sensoroni/files/analyzers/README.md index a968fdc57..fa891ed7b 100644 --- a/salt/sensoroni/files/analyzers/README.md +++ b/salt/sensoroni/files/analyzers/README.md @@ -9,13 +9,17 @@ The built-in analyzers support the following observable types: | Name | Domain | EML | Hash | IP | Mail | Other | URI | URL | User Agent | | ------------------------|--------|-------|-------|-------|-------|-------|-------|-------|-------| | Alienvault OTX |✓ |✗|✓|✓|✗|✗|✗|✓|✗| +| EchoTrail |✗ |✗|✓|✗|✗|✓|✗|✗|✗| | EmailRep |✗ |✗|✗|✗|✓|✗|✗|✗|✗| +| Elasticsearch |✓ |✓|✓|✓|✓|✓|✓|✓|✓| | Greynoise |✗ |✗|✗|✓|✗|✗|✗|✗|✗| | LocalFile |✓ |✗|✓|✓|✗|✓|✗|✓|✗| | Malware Hash Registry |✗ |✗|✓|✗|✗|✗|✗|✓|✗| +| MalwareBazaar |✗ |✗|✓|✗|✗|✓|✗|✗|✗| | Pulsedive |✓ |✗|✓|✓|✗|✗|✓|✓|✓| | Spamhaus |✗ |✗|✗|✓|✗|✗|✗|✗|✗| | Sublime Platform |✗ |✓|✗|✗|✗|✗|✗|✗|✗| +| ThreatFox |✓ |✗|✓|✓|✗|✗|✗|✗|✗| | Urlhaus |✗ |✗|✗|✗|✗|✗|✗|✓|✗| | Urlscan |✗ |✗|✗|✗|✗|✗|✗|✓|✗| | Virustotal |✓ |✗|✓|✓|✗|✗|✗|✓|✗| @@ -28,13 +32,17 @@ Many analyzers require authentication, via an API key or similar. The table belo | Name | Authn Req'd| --------------------------|------------| [AlienVault OTX](https://otx.alienvault.com/api) |✓| +[EchoTrail](https://www.echotrail.io/docs/quickstart) |✓| [EmailRep](https://emailrep.io/key) |✓| +[Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/setting-up-authentication.html) |✓| [GreyNoise](https://www.greynoise.io/plans/community) |✓| [LocalFile](https://github.com/Security-Onion-Solutions/securityonion/tree/fix/sublime_analyzer_documentation/salt/sensoroni/files/analyzers/localfile) |✗| [Malware Hash Registry](https://hash.cymru.com/docs_whois) |✗| +[MalwareBazaar](https://bazaar.abuse.ch/) |✗| [Pulsedive](https://pulsedive.com/api/) |✓| [Spamhaus](https://www.spamhaus.org/dbl/) |✗| [Sublime Platform](https://sublime.security) |✓| +[ThreatFox](https://threatfox.abuse.ch/) |✗| [Urlhaus](https://urlhaus.abuse.ch/) |✗| [Urlscan](https://urlscan.io/docs/api/) |✓| [VirusTotal](https://developers.virustotal.com/reference/overview) |✓|