From 689c904d85a8a617fa7a0e8c194aae84237d43d1 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 29 Oct 2026 18:11:08 +0100 Subject: [PATCH 1/2] docs: [domaintools_support] clarify support status and API coverage --- documentation/expansion/domaintools.md | 17 +++++++++++++++++ misp_modules/modules/expansion/domaintools.py | 4 +++- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 documentation/expansion/domaintools.md mode change 100755 => 100644 misp_modules/modules/expansion/domaintools.py diff --git a/documentation/expansion/domaintools.md b/documentation/expansion/domaintools.md new file mode 100644 index 000000000..370e8f487 --- /dev/null +++ b/documentation/expansion/domaintools.md @@ -0,0 +1,17 @@ +# DomainTools module support and coverage + +The bundled `domaintools` expansion and hover module uses the DomainTools Python API client with a username and API key. Its source carries a warning that the module does not appear to be actively maintained. + +## Existing lookups + +Domain attributes use parsed WHOIS, domain profile, reputation and reverse-IP services. Registrant email, name and phone attributes use reverse WHOIS. IP attributes use host-domain lookup. Results are mapped to MISP attributes such as domains, WHOIS fields and explanatory text. + +An existing module is not evidence that every service remains available under a current subscription. Confirm the API endpoints, account entitlements and Python client compatibility before deploying it. The current module does not implement Iris Investigate or Iris Enrich. + +## Provider supported integration + +DomainTools maintains a separate MISP integration at https://github.com/DomainTools/domaintools_misp. Evaluate its supported services and deployment instructions when choosing a maintained integration. The bundled module and that integration have separate installation and configuration requirements; this guide does not migrate credentials or replace either installation. + +## Future maintenance + +A functional update should select the required DomainTools service, document supported account entitlements, preserve current configuration where possible, and supply sanitized response fixtures and mapping tests for the selected API. New API coverage should have its own explicit module name when its authentication or output contract differs materially from the legacy module. diff --git a/misp_modules/modules/expansion/domaintools.py b/misp_modules/modules/expansion/domaintools.py old mode 100755 new mode 100644 index d270ce9a4..218a3ef0f --- a/misp_modules/modules/expansion/domaintools.py +++ b/misp_modules/modules/expansion/domaintools.py @@ -43,7 +43,7 @@ moduleinfo = { "version": "0.1", "author": "Raphaël Vinot", - "description": "DomainTools MISP expansion module.", + "description": "Legacy DomainTools WHOIS, reputation and reverse lookup expansion module.", "module-type": ["expansion", "hover"], "name": "DomainTools Lookup", "logo": "domaintools.png", @@ -52,6 +52,8 @@ "A Domaintools API access (username & apikey)", ], "features": ( + "This legacy module does not appear to be actively maintained. See documentation/expansion/domaintools.md " + "for API coverage and the provider-supported MISP integration.\n\n" "This module takes a MISP attribute as input to query the Domaintools API. The API returns then the result of" " the query with some types we map into compatible types we add as MISP attributes.\n\nPlease note that" " composite attributes composed by at least one of the input types mentionned below (domains, IPs, hostnames)" From 9dac5290746613745b219cec67ed3785c1ad0d69 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 29 Oct 2026 23:27:10 +0100 Subject: [PATCH 2/2] fix: [domaintools_support] address review findings --- documentation/mkdocs/domaintools.md | 17 +++++++++++++++++ misp_modules/modules/expansion/domaintools.py | 2 +- 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 documentation/mkdocs/domaintools.md diff --git a/documentation/mkdocs/domaintools.md b/documentation/mkdocs/domaintools.md new file mode 100644 index 000000000..370e8f487 --- /dev/null +++ b/documentation/mkdocs/domaintools.md @@ -0,0 +1,17 @@ +# DomainTools module support and coverage + +The bundled `domaintools` expansion and hover module uses the DomainTools Python API client with a username and API key. Its source carries a warning that the module does not appear to be actively maintained. + +## Existing lookups + +Domain attributes use parsed WHOIS, domain profile, reputation and reverse-IP services. Registrant email, name and phone attributes use reverse WHOIS. IP attributes use host-domain lookup. Results are mapped to MISP attributes such as domains, WHOIS fields and explanatory text. + +An existing module is not evidence that every service remains available under a current subscription. Confirm the API endpoints, account entitlements and Python client compatibility before deploying it. The current module does not implement Iris Investigate or Iris Enrich. + +## Provider supported integration + +DomainTools maintains a separate MISP integration at https://github.com/DomainTools/domaintools_misp. Evaluate its supported services and deployment instructions when choosing a maintained integration. The bundled module and that integration have separate installation and configuration requirements; this guide does not migrate credentials or replace either installation. + +## Future maintenance + +A functional update should select the required DomainTools service, document supported account entitlements, preserve current configuration where possible, and supply sanitized response fixtures and mapping tests for the selected API. New API coverage should have its own explicit module name when its authentication or output contract differs materially from the legacy module. diff --git a/misp_modules/modules/expansion/domaintools.py b/misp_modules/modules/expansion/domaintools.py index 218a3ef0f..8c62cce33 100644 --- a/misp_modules/modules/expansion/domaintools.py +++ b/misp_modules/modules/expansion/domaintools.py @@ -52,7 +52,7 @@ "A Domaintools API access (username & apikey)", ], "features": ( - "This legacy module does not appear to be actively maintained. See documentation/expansion/domaintools.md " + "This legacy module does not appear to be actively maintained. See https://misp.github.io/misp-modules/domaintools/ " "for API coverage and the provider-supported MISP integration.\n\n" "This module takes a MISP attribute as input to query the Domaintools API. The API returns then the result of" " the query with some types we map into compatible types we add as MISP attributes.\n\nPlease note that"