update

README.md

@@ -26,7 +26,13 @@ actor or a non-existent CVE — it **refuses to fabricate** (evidence-gated hone
 
 ## Files
 `Dockerfile` · `app.py` · `requirements.txt` · `corpus.json` (retrieval data) · `robot.png`.
-Optional Space secret `NVD_API_KEY` raises the NVD rate limit (works without it).
+
+## Optional Space secrets
+- `NVD_API_KEY` — higher NVD rate limit (CVE lookups work without it).
+- `THREATFOX_API_KEY`, `OTX_API_KEY`, `VT_API_KEY` — enable **live IOC enrichment**: a
+  pasted IP / domain / hash / URL is looked up across abuse.ch ThreatFox, AlienVault OTX,
+  and VirusTotal, formatted into a `[Threat Report]`, and analyzed. Without them the app
+  still runs (the IOC text passes straight to the model).
 
 ## Push updates
 With the `hf` CLI authenticated, from the `osint-project` root:

app.py

@@ -215,6 +215,137 @@ def live_cve(cid):
     }
 
 
+# --- live IOC enrichment: ThreatFox + OTX + VirusTotal (uses Space secrets) ------
+def _refang(s):
+    return s.replace("[.]", ".").replace("[:]", ":").replace("hxxps", "https").replace("hxxp", "http")
+
+
+def detect_ioc(q):
+    q = _refang(q)                       # normalise defanged IOCs (hxxp, [.]) first
+    m = re.search(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b", q)
+    if m:
+        return m.group(0), "ip"
+    m = re.search(r"\b[a-fA-F0-9]{64}\b|\b[a-fA-F0-9]{40}\b|\b[a-fA-F0-9]{32}\b", q)
+    if m:
+        return m.group(0), "file"
+    m = re.search(r"https?://([^\s/:]+)", q, re.I)
+    if m:
+        host = m.group(1)
+        return host, ("ip" if re.match(r"\d+\.\d+\.\d+\.\d+", host) else "domain")
+    return None, None
+
+
+def _have_ioc_keys():
+    return any(os.environ.get(k) for k in ("THREATFOX_API_KEY", "OTX_API_KEY", "VT_API_KEY"))
+
+
+def _safe(fn, *a):
+    try:
+        return fn(*a)
+    except Exception:
+        return None
+
+
+@st.cache_data(ttl=900, show_spinner=False)
+def _threatfox(ioc):
+    key = os.environ.get("THREATFOX_API_KEY")
+    if not key:
+        return None
+    body = json.dumps({"query": "search_ioc", "search_term": ioc}).encode()
+    req = urllib.request.Request("https://threatfox-api.abuse.ch/api/v1/", data=body,
+        headers={"Auth-Key": key, "Content-Type": "application/json", "User-Agent": "TextScout-demo"})
+    d = json.loads(urllib.request.urlopen(req, timeout=15).read())
+    rows = d.get("data") if d.get("query_status") == "ok" else None
+    if not isinstance(rows, list) or not rows:
+        return None
+    return {
+        "families": sorted({r.get("malware_printable") or r.get("malware") for r in rows if r.get("malware")}),
+        "threat_types": sorted({r.get("threat_type_desc") or r.get("threat_type") for r in rows if r.get("threat_type")}),
+        "confidence": max((r.get("confidence_level") or 0) for r in rows),
+    }
+
+
+@st.cache_data(ttl=900, show_spinner=False)
+def _otx(ioc, ioc_type):
+    key = os.environ.get("OTX_API_KEY")
+    section = {"ip": "IPv4", "domain": "domain", "url": "url", "file": "file"}.get(ioc_type)
+    if not key or not section:
+        return None
+    url = f"https://otx.alienvault.com/api/v1/indicators/{section}/{urllib.parse.quote(ioc, safe='')}/general"
+    req = urllib.request.Request(url, headers={"X-OTX-API-KEY": key, "User-Agent": "TextScout-demo"})
+    pi = json.loads(urllib.request.urlopen(req, timeout=15).read()).get("pulse_info") or {}
+    pulses = pi.get("pulses") or []
+
+    def ids(p):
+        return [a if isinstance(a, str) else a.get("id", "") for a in (p.get("attack_ids") or [])]
+    fams = {m if isinstance(m, str) else m.get("display_name", "")
+            for p in pulses for m in (p.get("malware_families") or [])} - {""}
+    return {
+        "pulse_count": pi.get("count", 0),
+        "families": sorted(fams),
+        "attack": sorted({a for p in pulses for a in ids(p) if a}),
+        "adversary": next((p.get("adversary") for p in pulses if p.get("adversary")), ""),
+        "industries": sorted({i for p in pulses for i in (p.get("industries") or [])}),
+        "countries": sorted({c for p in pulses for c in (p.get("targeted_countries") or [])}),
+    }
+
+
+@st.cache_data(ttl=900, show_spinner=False)
+def _vt(ioc, ioc_type):
+    key = os.environ.get("VT_API_KEY")
+    if not key:
+        return None
+    if ioc_type == "ip":
+        path = "ip_addresses/" + ioc
+    elif ioc_type == "domain":
+        path = "domains/" + ioc
+    elif ioc_type == "file":
+        path = "files/" + ioc
+    elif ioc_type == "url":
+        import base64
+        path = "urls/" + base64.urlsafe_b64encode(ioc.encode()).decode().strip("=")
+    else:
+        return None
+    req = urllib.request.Request("https://www.virustotal.com/api/v3/" + path,
+        headers={"x-apikey": key, "User-Agent": "TextScout-demo"})
+    a = (json.loads(urllib.request.urlopen(req, timeout=15).read()).get("data") or {}).get("attributes") or {}
+    s = a.get("last_analysis_stats") or {}
+    return {"malicious": s.get("malicious", 0), "total": sum(s.values()) if s else 0}
+
+
+def enrich_ioc(ioc, ioc_type):
+    tf = _safe(_threatfox, ioc)
+    otx = _safe(_otx, ioc, ioc_type) or {}
+    vt = _safe(_vt, ioc, ioc_type)
+    families = sorted(set((tf or {}).get("families", []) + otx.get("families", [])))
+    bits = []
+    if tf:
+        d = f"abuse.ch ThreatFox: {', '.join(tf['families']) or 'tracked indicator'}"
+        if tf.get("threat_types"):
+            d += f" ({', '.join(tf['threat_types'])})"
+        if tf.get("confidence"):
+            d += f", confidence {tf['confidence']}%"
+        bits.append(d + ".")
+    if vt and vt.get("total"):
+        bits.append(f"VirusTotal: {vt['malicious']}/{vt['total']} engines flagged it malicious.")
+    if otx.get("pulse_count"):
+        bits.append(f"AlienVault OTX: referenced in {otx['pulse_count']} threat pulse(s).")
+    if not bits:
+        bits.append("No current threat-intelligence records for this indicator across ThreatFox, OTX, or VirusTotal.")
+    label = {"ip": "IP Addresses", "domain": "Domains", "url": "URLs", "file": "File Hashes"}.get(ioc_type, "Indicators")
+    return ("Analyze this threat intelligence report. Produce a structured red-team summary using only "
+            "what the report states. Do not invent actors, malware, or indicators.\n\n"
+            "[Threat Report]\n"
+            f"Title: Live IOC enrichment — {ioc}\n\n"
+            f"{' '.join(bits)}\n\n"
+            f"Reported indicators:\n  {label}: {ioc}\n"
+            f"Analyst-tagged ATT&CK: {', '.join(otx.get('attack', [])) or 'none tagged'}\n"
+            f"Malware families: {', '.join(families) or 'none named'}\n"
+            f"Attributed actor: {otx.get('adversary') or 'none specified'}\n"
+            f"Targeted industries: {', '.join(otx.get('industries', [])) or 'not specified'}\n"
+            f"Targeted countries: {', '.join(otx.get('countries', [])) or 'not specified'}")
+
+
 # --- bundled retrieval -----------------------------------------------------------
 IOC_RE = re.compile(r"hxxp|https?://|\b\d{1,3}\[?\.\]?\d{1,3}\[?\.\]?\d{1,3}\[?\.\]?\d{1,3}\b|\b[a-f0-9]{32,64}\b", re.I)
 ACTOR_KW = re.compile(r"\b(actor|group|apt|adversary|profile|who is|what did|techniques does|ttps|campaign)\b", re.I)
@@ -292,6 +423,11 @@ def route(q):
         p = t_tech(tech_idx[m.group(0).upper()]); return p, p, "MITRE ATT&CK", None
 
     if IOC_RE.search(q):
+        ioc, ioc_type = detect_ioc(q)
+        if ioc and _have_ioc_keys():
+            p = _safe(enrich_ioc, ioc, ioc_type)
+            if p:
+                return p, p, "live ThreatFox + OTX + VirusTotal", None
         return q, None, "the report you provided", None
 
     a = _longest(actor_re, q)
@@ -330,9 +466,8 @@ SUGGESTIONS = {
     "🛠️ Who uses Cobalt Strike?": "Which threat actors use the Cobalt Strike tool?",
     "📖 Explain technique T1059.001": "Explain MITRE ATT&CK technique T1059.001",
     "🔓 Assess CVE-2025-0282 (live)": "Assess CVE-2025-0282 for offensive relevance",
-    "🌐 Extract IOCs from a report": ("Extract the IOCs from this abuse.ch report and assess red "
-                                       "team relevance: hxxp://27.204.192.167:41628/i was flagged "
-                                       "as a malware_download host."),
+    "🌐 Look up a live IOC": ("Look up live threat intelligence for the indicator "
+                              "27.204.192.167 and assess its red team relevance."),
 }
 
 if "messages" not in st.session_state:
@@ -355,7 +490,7 @@ for msg in st.session_state.messages:
             st.caption(msg["badge"])
         st.markdown(msg["content"])
 
-user_input = st.chat_input("Ask TextScout… e.g. profile APT28, assess CVE-2025-0282") or clicked
+user_input = st.chat_input("Ask TextScout… profile APT28 · assess CVE-2025-0282 · look up an IP/domain/hash") or clicked
 
 if user_input:
     st.session_state.messages.append({"role": "user", "content": user_input})