feat(whoisfreaks)#7083
Conversation
This README provides detailed information about the OpenCTI WhoisFreaks enrichment connector, including its features, configuration variables, and deployment instructions via Docker Compose.
This file is a compiled Python bytecode file for the config_variables module, which contains configuration settings for the WhoisFreaks OpenCTI Connector.
Contributor License Agreement✅ CLA signed 💚 Thank you @Usama015 for signing the Contributor License Agreement! Your pull request can now be reviewed and merged. We appreciate your contribution to Filigran's open source projects! ❤️ This is an automated message from the Filigran CLA Bot. |
There was a problem hiding this comment.
Pull request overview
Adds a new internal-enrichment connector (whoisfreaks) to the OpenCTI connectors monorepo, intended to enrich Domain-Name, IPv4-Addr, and IPv6-Addr observables using the WhoisFreaks API and emit STIX 2.1 bundles back into OpenCTI.
Changes:
- Introduces the connector runtime (listener + message processing), config loader, API client, and STIX bundle builder.
- Adds packaging/runtime assets (Dockerfile, entrypoint, docker-compose) to run the connector.
- Adds connector metadata (manifest) and end-user documentation (README).
Reviewed changes
Copilot reviewed 11 out of 18 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| internal-enrichment/whoisfreaks/src/main.py | Implements the connector worker lifecycle and enrichment dispatch based on observable type. |
| internal-enrichment/whoisfreaks/src/configVariables.py | Loads connector configuration from config.yml and environment variables with basic validation. |
| internal-enrichment/whoisfreaks/src/client.py | Adds a requests-based client wrapping WhoisFreaks REST API endpoints. |
| internal-enrichment/whoisfreaks/src/builder.py | Builds STIX 2.1 bundles (observables/relationships/notes/location) from API responses. |
| internal-enrichment/whoisfreaks/src/init.py | Initializes the Python package/module for the connector source directory. |
| internal-enrichment/whoisfreaks/requirements.txt | Declares Python dependencies for the connector image/runtime. |
| internal-enrichment/whoisfreaks/README.md | Documents features, configuration variables, and docker-compose deployment example. |
| internal-enrichment/whoisfreaks/entrypoint.sh | Container entrypoint to start the connector. |
| internal-enrichment/whoisfreaks/Dockerfile | Defines the container build for the connector. |
| internal-enrichment/whoisfreaks/docker-compose.yml | Provides a local stack example including OpenCTI + the connector. |
| internal-enrichment/whoisfreaks/config.yml | Provides a sample connector configuration file. |
| internal-enrichment/whoisfreaks/metadata/connector_manifest.json | Registers the connector in the repo’s metadata/manifest system. |
| whoisfreaks: | ||
| api_key: "9c0189f5a7a8457d88fdf22c91b4d9f1" |
| id: "ChangeMe" # Must be a valid UUIDv4 (e.g. generated via `uuidgen`) | ||
| type: "INTERNAL_ENRICHMENT" | ||
| name: "WhoisFreaks" | ||
| scope: "Domain-Name,IPv4-Addr" |
| environment: | ||
| - MINIO_ROOT_USER=opencti | ||
| - MINIO_ROOT_PASSWORD=opencti_minio_password |
| else: | ||
| target_stix = stix2.DomainName(value=clean_target) | ||
| ssl_certificates = ssl_data.get("sslCertificates") or [ssl_data] |
| location_stix = stix2.Location( | ||
| country=country, | ||
| city=city, | ||
| latitude=( | ||
| float(loc_data["latitude"]) if loc_data.get("latitude") else None | ||
| ), | ||
| longitude=( | ||
| float(loc_data["longitude"]) if loc_data.get("longitude") else None | ||
| ), | ||
| created_by_ref=self.author.id, | ||
| ) |
| ## Features | ||
|
|
||
| - **WHOIS Registration Intelligence**: Fetches live WHOIS records and converts Registrars and Registrants into STIX 2.1 `Identity` SDOs linked via `registered-by` and `owned-by` relationships. | ||
| - **DNS Record Mapping**: Parses live DNS responses (A, AAAA, MX, NS, CNAME, TXT) and maps resolutions into the OpenCTI graph using `resolves-to` and `related-to` relationships. |
| pycti==6.0.5 | ||
| stix2>=3.0.1 | ||
| requests>=2.31.0 | ||
| pyyaml>=6.0.1 | ||
| python-dotenv>=1.0.0 No newline at end of file |
| "short_description": "Enrich domain, IP, and SSL observables with live WHOIS, DNS, Geolocation, and threat intelligence from WhoisFreaks.", | ||
| "logo": "https://whoisfreaks.com/images/logo.png", | ||
| "use_cases": [ |
| FROM python:3.11-slim | ||
|
|
||
| # Set working directory inside container | ||
| WORKDIR /opt/opencti-connector-whoisfreaks | ||
|
|
||
| # Install system runtime dependencies needed by pycti and stix2 | ||
| RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| git \ | ||
| libmagic1 \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| # Install Python package dependencies | ||
| COPY requirements.txt . | ||
| RUN pip install --no-cache-dir -r requirements.txt | ||
|
|
||
| # Copy source code and entrypoint | ||
| COPY src ./src | ||
| COPY entrypoint.sh . | ||
|
|
||
| # Ensure entrypoint is executable | ||
| RUN chmod +x entrypoint.sh | ||
|
|
||
| # Run startup script | ||
| ENTRYPOINT ["/bin/sh", "./entrypoint.sh"] No newline at end of file |
| def process_message(self, msg: Dict[str, Any]) -> str: | ||
| """Callback executed whenever an enrichment task is received from RabbitMQ.""" | ||
| entity_id = msg.get("entity_id") | ||
| observable_type, observable_value = self._get_entity_info(entity_id) | ||
|
|
There was a problem hiding this comment.
Test scripts added under tests directory
All Changes done |
Proposed changes
Related issues
Checklist
Further comments