[pull] master from kevoreilly:master

conf/default/processing.conf.default

@@ -361,3 +361,8 @@ enabled = no
 # Code-similarity engine(s). See conf/integrations.conf [similarity].
 [similarity]
 enabled = no
+
+# Threat-intelligence enrichment. Engine and API settings live in
+# conf/threat_intel.conf.
+[threatintelligence]
+enabled = no

conf/default/threat_intel.conf.default

@@ -0,0 +1,126 @@
+# Threat-intelligence enrichment.
+#
+# Layout:
+#   [threatintelligence]  global behaviour shared by every engine
+#   [<engine>]            one section per engine; "enabled" turns it on and
+#                         all other keys are engine-local
+#
+# Engine sections inherit the global section, so an engine only needs to set
+# what differs. Adding a new engine means adding a section here and one line
+# in lib/cuckoo/common/integrations/threatintelligence/registry.py -- no
+# changes to this file's structure.
+#
+# Enable the processing module itself in processing.conf [threatintelligence].
+
+# ============================================================
+# Global behaviour
+# ============================================================
+[threatintelligence]
+
+# Per-lookup deadline (seconds).
+timeout = 20
+# Cap matches shown per host/domain (top N by confidence). 0 = no cap.
+max_results = 5
+# Best-effort cross-analysis cache to limit duplicate API calls.
+cache = yes
+cache_ttl = 86400
+# Run lookups concurrently.
+concurrent_lookups = yes
+max_workers = 4
+
+# ---- Indicator types looked up (global router gate) --------
+# Each engine only receives the types it supports. Indicators are
+# reconstructed from the analysis artifacts:
+#   ip addresses - contacted host IPs
+#   domains      - resolved / requested domains
+#   urls         - full URLs reconstructed from HTTP traffic
+#   sha256       - the submitted sample's sha256
+ip addresses = yes
+domains = yes
+urls = no
+sha256 = no
+
+# ---- Accuracy / false-positive control ---------------------
+# A `url` IOC also matches a contacted domain/IP by HOST, so a dedicated
+# malicious domain published as a url still tags. Dead-drop-resolver false
+# positives (a legitimate shared host carrying url IOCs for MANY families)
+# are auto-detected by family multiplicity on a single host and suppressed.
+# Enable `urls` above to additionally match the exact URL path fetched.
+#
+# strict_ioc_type_match: require same-type matching only (a url IOC then
+# never matches a bare domain/IP).
+strict_ioc_type_match = no
+#
+# Secondary safety valve: if a single indicator still resolves to more than
+# this many distinct families (e.g. a shared bulletproof IP), treat it as
+# ambiguous shared infrastructure and suppress its tags. 0 = off.
+max_families_per_indicator = 5
+
+# ---- Promotion to CAPE detections --------------------------
+# Append a CAPE detection for indicator hits. This does NOT set the headline
+# malfamily (it only adds a detection entry), so infrastructure attribution
+# never overrides CAPE's own classification. The report card enriches
+# regardless of these settings.
+promote_to_detection = no
+# Promote only C2 (botnet_cc) hits -- the high-confidence type. When yes,
+# other threat types still enrich the card but are not promoted.
+promote_c2_only = yes
+# Minimum confidence (0-100) required to promote.
+promote_minimum_confidence = 75
+
+# ---- Threat actors (master gate) ---------------------------
+# Attributing a sample to a named threat actor is a strong claim. Actor
+# engines are gated by this toggle AND their own "enabled" key, and are
+# intended to be driven by an authoritative, high-confidence source.
+threat actors = no
+# Build actor hints from the actors that matched families are attributed to.
+# Family<->actor links are often community-sourced, so this is opt-in even
+# when the master gate is on.
+actor_attribution_from_families = no
+
+# ============================================================
+# Engines
+# ============================================================
+
+# ---- ThreatFox (abuse.ch) -- indicator engine --------------
+[threatfox]
+enabled = no
+# Auth-Key -- REQUIRED by abuse.ch. The engine reports itself unavailable
+# when blank. Free key: https://auth.abuse.ch/
+api_key =
+host = https://threatfox-api.abuse.ch/api/v1/
+# Wildcard (no) vs exact (yes); results are host-exact post-filtered either
+# way, so leave as no.
+exact_match = no
+# ip:port precision: restrict ip:port IOC matches to the exact ports observed
+# in the analysis. Off = surface any port ThreatFox knows for a contacted IP.
+match_ports_only = no
+# Minimum confidence_level (0-100) for a match to be shown.
+minimum_confidence = 50
+# Rate-limit resilience: retry on HTTP 429 / 5xx / timeout with exponential
+# backoff (honours Retry-After).
+retries = 3
+backoff = 0.5
+
+# ---- Malpedia (Fraunhofer FKIE) -- family engine -----------
+[malpedia]
+enabled = yes
+# APIToken -- OPTIONAL. get/family and find/family are public; a token only
+# raises rate limits. Sent as "Authorization: apitoken <TOKEN>".
+api_key =
+host = https://malpedia.caad.fkie.fraunhofer.de/api
+# How many recent reference reports to link per family card.
+max_references = 4
+# Also describe families surfaced by indicator-engine infrastructure hits,
+# not only CAPE's own detections.
+from_threatfox = yes
+
+# ---- Malpedia actors -- actor engine (reference impl) ------
+# Reference implementation only, and additionally gated by the global
+# "threat actors" toggle. Malpedia actor data is community/MISP curated; a
+# dedicated high-confidence provider is preferred for confident attribution.
+[malpedia_actors]
+enabled = no
+api_key =
+host = https://malpedia.caad.fkie.fraunhofer.de/api
+max_references = 4