Skip to content

Add MODAT Magnify infrastructure enrichment module #919

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adulau merged 2 commits into from
Oct 13, 2026
Merged

Add MODAT Magnify infrastructure enrichment module #919

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40b79d0
new: [modat] Add Magnify infrastructure enrichment module
adulau Oct 12, 2026
7032a31
fix: [modat] Keep generated identities local to each enrichment
adulau Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
195 changes: 195 additions & 0 deletions documentation/expansion/modat-attribute-coverage.csv
View file
Open in desktop

Large diffs are not rendered by default.

24 changes: 24 additions & 0 deletions documentation/expansion/modat-dns-field-mapping.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
MODAT field,MISP object,Object relation,MISP attribute type
fqdn,modat-dns-record,fqdn,domain
rrtype,modat-dns-record,rrtype,text
ttl,modat-dns-record,ttl,integer
created_at,modat-dns-record,created-at,datetime
deleted_at,modat-dns-record,deleted-at,datetime
ip,modat-dns-record,ip,ip-dst
cname,modat-dns-record,cname,domain
host,modat-dns-record,host,hostname
ns,modat-dns-record,ns,hostname
priority,modat-dns-record,priority,integer
target,modat-dns-record,target,text
params,modat-dns-record,params,text
mname,modat-dns-record,mname,hostname
rname,modat-dns-record,rname,text
serial,modat-dns-record,serial,integer
refresh,modat-dns-record,refresh,integer
retry,modat-dns-record,retry,integer
expire,modat-dns-record,expire,integer
minimum,modat-dns-record,minimum,integer
weight,modat-dns-record,weight,integer
port,modat-dns-record,port,port
value,modat-dns-record,value,text
raw-json,modat-dns-record,raw-json,attachment
131 changes: 131 additions & 0 deletions documentation/expansion/modat-service-field-mapping.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,131 @@
MODAT field,MISP object,Object relation,MISP attribute type
transport,modat-service,transport,text
ports,modat-service,ports,port
last_scanned_port,modat-service,last-scanned-port,port
protocol,modat-service,protocol,text
scanned_at,modat-service,scanned-at,datetime
discovered_at,modat-service,discovered-at,datetime
is_match,modat-service,is-match,boolean
banner,modat-service,banner,text
banner_hex,modat-service,banner-hex,text
banner_sha1,modat-service,banner-sha1,sha1
banner_sha256,modat-service,banner-sha256,sha256
banner_mmh3,modat-service,banner-mmh3,integer
ssh.hassh,modat-service,ssh-hassh,hasshserver-md5
ssh.server_id,modat-service,ssh-server-id,text
ssh.server_key_exchange.cookie,modat-service,ssh-server-key-exchange-cookie,text
ssh.server_key_exchange.kex_algorithms,modat-service,ssh-server-key-exchange-kex-algorithms,text
ssh.server_key_exchange.host_key_algorithms,modat-service,ssh-server-key-exchange-host-key-algorithms,text
ssh.server_key_exchange.client_to_server_ciphers,modat-service,ssh-server-key-exchange-client-to-server-ciphers,text
ssh.server_key_exchange.server_to_client_ciphers,modat-service,ssh-server-key-exchange-server-to-client-ciphers,text
ssh.server_key_exchange.client_to_server_macs,modat-service,ssh-server-key-exchange-client-to-server-macs,text
ssh.server_key_exchange.server_to_client_macs,modat-service,ssh-server-key-exchange-server-to-client-macs,text
ssh.server_key_exchange.client_to_server_compression,modat-service,ssh-server-key-exchange-client-to-server-compression,text
ssh.server_key_exchange.server_to_client_compression,modat-service,ssh-server-key-exchange-server-to-client-compression,text
ssh.server_key_exchange.first_kex_follows,modat-service,ssh-server-key-exchange-first-kex-follows,boolean
ssh.server_key_exchange.reserved,modat-service,ssh-server-key-exchange-reserved,integer
ssh.algorithm_selection.dh_kex_algorithm,modat-service,ssh-algorithm-selection-dh-kex-algorithm,text
ssh.algorithm_selection.host_key_algorithm,modat-service,ssh-algorithm-selection-host-key-algorithm,text
ssh.algorithm_selection.client_to_server_alg_group.cipher,modat-service,ssh-algorithm-selection-client-to-server-alg-group-cipher,text
ssh.algorithm_selection.client_to_server_alg_group.mac,modat-service,ssh-algorithm-selection-client-to-server-alg-group-mac,text
ssh.algorithm_selection.client_to_server_alg_group.compression,modat-service,ssh-algorithm-selection-client-to-server-alg-group-compression,text
ssh.algorithm_selection.server_to_client_alg_group.cipher,modat-service,ssh-algorithm-selection-server-to-client-alg-group-cipher,text
ssh.algorithm_selection.server_to_client_alg_group.mac,modat-service,ssh-algorithm-selection-server-to-client-alg-group-mac,text
ssh.algorithm_selection.server_to_client_alg_group.compression,modat-service,ssh-algorithm-selection-server-to-client-alg-group-compression,text
ssh.key_exchange.curve25519_sha256_params.server_public,modat-service,ssh-key-exchange-curve25519-sha256-params-server-public,text
ssh.key_exchange.server_signature.parsed.algorithm,modat-service,ssh-key-exchange-server-signature-parsed-algorithm,text
ssh.key_exchange.server_signature.parsed.value,modat-service,ssh-key-exchange-server-signature-parsed-value,text
ssh.key_exchange.server_signature.raw,modat-service,ssh-key-exchange-server-signature-raw,text
ssh.key_exchange.server_signature.h,modat-service,ssh-key-exchange-server-signature-h,text
ssh.key_exchange.server_host_key.rsa_public_key.exponent,modat-service,ssh-key-exchange-server-host-key-rsa-public-key-exponent,integer
ssh.key_exchange.server_host_key.rsa_public_key.modulus,modat-service,ssh-key-exchange-server-host-key-rsa-public-key-modulus,text
ssh.key_exchange.server_host_key.rsa_public_key.length,modat-service,ssh-key-exchange-server-host-key-rsa-public-key-length,integer
ssh.key_exchange.server_host_key.ecdsa_public_key.b,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-b,text
ssh.key_exchange.server_host_key.ecdsa_public_key.curve,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-curve,text
ssh.key_exchange.server_host_key.ecdsa_public_key.gx,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-gx,text
ssh.key_exchange.server_host_key.ecdsa_public_key.gy,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-gy,text
ssh.key_exchange.server_host_key.ecdsa_public_key.length,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-length,integer
ssh.key_exchange.server_host_key.ecdsa_public_key.n,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-n,text
ssh.key_exchange.server_host_key.ecdsa_public_key.p,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-p,text
ssh.key_exchange.server_host_key.ecdsa_public_key.x,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-x,text
ssh.key_exchange.server_host_key.ecdsa_public_key.y,modat-service,ssh-key-exchange-server-host-key-ecdsa-public-key-y,text
ssh.key_exchange.server_host_key.raw,modat-service,ssh-key-exchange-server-host-key-raw,text
ssh.key_exchange.server_host_key.algorithm,modat-service,ssh-key-exchange-server-host-key-algorithm,text
ssh.key_exchange.server_host_key.fingerprint_sha256,modat-service,ssh-key-exchange-server-host-key-fingerprint-sha256,ssh-fingerprint
tcp.window_size,modat-service,tcp-window-size,integer
tls.is_self_signed,modat-service,tls-is-self-signed,boolean
tls.is_trusted,modat-service,tls-is-trusted,boolean
tls.valid_from,modat-service,tls-valid-from,datetime
tls.expires_at,modat-service,tls-expires-at,datetime
tls.validity_seconds,modat-service,tls-validity-seconds,integer
tls.supported_versions,modat-service,tls-supported-versions,text
tls.fingerprint_sha256,modat-service,tls-fingerprint-sha256,x509-fingerprint-sha256
tls.fingerprint_sha1,modat-service,tls-fingerprint-sha1,x509-fingerprint-sha1
tls.jarm,modat-service,tls-jarm,jarm-fingerprint
tls.ja3s,modat-service,tls-ja3s,text
tls.ja4s,modat-service,tls-ja4s,text
tls.ja4x,modat-service,tls-ja4x,text
tls.ja4scan_tls,modat-service,tls-ja4scan-tls,text
tls.serial_number,modat-service,tls-serial-number,text
tls.issuer.common_name,modat-service,tls-issuer-common-name,text
tls.issuer.country,modat-service,tls-issuer-country,text
tls.issuer.organization,modat-service,tls-issuer-organization,text
tls.issuer.organizational_unit,modat-service,tls-issuer-organizational-unit,text
tls.issuer.province,modat-service,tls-issuer-province,text
tls.issuer.locality,modat-service,tls-issuer-locality,text
tls.issuer.email_address,modat-service,tls-issuer-email-address,email
tls.subject.common_name,modat-service,tls-subject-common-name,text
tls.subject.country,modat-service,tls-subject-country,text
tls.subject.organization,modat-service,tls-subject-organization,text
tls.subject.organizational_unit,modat-service,tls-subject-organizational-unit,text
tls.subject.province,modat-service,tls-subject-province,text
tls.subject.locality,modat-service,tls-subject-locality,text
tls.subject.email_address,modat-service,tls-subject-email-address,email
tls.extensions.subject_alt_name.dns,modat-service,tls-extensions-subject-alt-name-dns,domain
tls.extensions.subject_alt_name.ipv4,modat-service,tls-extensions-subject-alt-name-ipv4,ip-dst
tls.extensions.subject_alt_name.ipv6,modat-service,tls-extensions-subject-alt-name-ipv6,ip-dst
tls.extensions.subject_alt_name.email,modat-service,tls-extensions-subject-alt-name-email,email
tls.extensions.subject_alt_name.uri,modat-service,tls-extensions-subject-alt-name-uri,uri
tls.extensions.subject_alt_name.directory,modat-service,tls-extensions-subject-alt-name-directory,text
tls.extensions.subject_alt_name.other_names.id,modat-service,tls-extensions-subject-alt-name-other-names-id,text
tls.extensions.subject_alt_name.other_names.value,modat-service,tls-extensions-subject-alt-name-other-names-value,text
tls.extensions.issuer_alt_name.dns,modat-service,tls-extensions-issuer-alt-name-dns,domain
tls.extensions.issuer_alt_name.ipv4,modat-service,tls-extensions-issuer-alt-name-ipv4,ip-dst
tls.extensions.issuer_alt_name.ipv6,modat-service,tls-extensions-issuer-alt-name-ipv6,ip-dst
tls.extensions.issuer_alt_name.email,modat-service,tls-extensions-issuer-alt-name-email,email
tls.extensions.issuer_alt_name.uri,modat-service,tls-extensions-issuer-alt-name-uri,uri
tls.extensions.issuer_alt_name.directory,modat-service,tls-extensions-issuer-alt-name-directory,text
tls.extensions.issuer_alt_name.other_names.id,modat-service,tls-extensions-issuer-alt-name-other-names-id,text
tls.extensions.issuer_alt_name.other_names.value,modat-service,tls-extensions-issuer-alt-name-other-names-value,text
tls.raw,modat-service,tls-raw,text
tls.is_valid,modat-service,tls-is-valid,boolean
fingerprints.os.product,modat-service,fingerprints-os-product,text
fingerprints.os.version,modat-service,fingerprints-os-version,text
fingerprints.os.arch,modat-service,fingerprints-os-arch,text
fingerprints.os.icon_url,modat-service,fingerprints-os-icon-url,link
fingerprints.service.product,modat-service,fingerprints-service-product,text
fingerprints.service.version,modat-service,fingerprints-service-version,text
fingerprints.service.icon_url,modat-service,fingerprints-service-icon-url,link
fingerprints.technologies.name,modat-service,fingerprints-technologies-name,text
fingerprints.technologies.version,modat-service,fingerprints-technologies-version,text
fingerprints.technologies.icon_url,modat-service,fingerprints-technologies-icon-url,link
fingerprints.tags,modat-service,fingerprints-tags,text
http.title,modat-service,http-title,text
http.status_code,modat-service,http-status-code,integer
http.headers,modat-service,http-headers,text
http.headers_sha256,modat-service,http-headers-sha256,sha256
http.body,modat-service,http-body,text
http.body_mmh3,modat-service,http-body-mmh3,integer
http.body_sha1,modat-service,http-body-sha1,sha1
http.body_sha256,modat-service,http-body-sha256,sha256
http.css_mmh3,modat-service,http-css-mmh3,integer
http.js_mmh3,modat-service,http-js-mmh3,integer
http.files.path,modat-service,http-files-path,text
http.files.category,modat-service,http-files-category,text
http.files.sha256,modat-service,http-files-sha256,sha256
http.files.sha1,modat-service,http-files-sha1,sha1
http.files.mmh3,modat-service,http-files-mmh3,favicon-mmh3
cves.id,modat-service,cves-id,text
cves.cvss,modat-service,cves-cvss,float
cves.is_kev,modat-service,cves-is-kev,boolean
port (service search),modat-service,ports,port
Loading