[adulau]

Add two analyst expansion modules for existing Lookyloo captures:

• lookyloo: pivot on IPv4/IPv6, domain/hostname, URL, resource SHA-512 and favicon SHA-512 using the five public occurrence APIs. Supports explicit pagination, composite MISP inputs, optional capture enrichment and deduplication.
• lookyloo_capture: retrieve metadata, status, redirects, IPs, hostnames, URLs, resource hashes, statistics, cached module responses and comparables from a capture link or UUID. Optional settings retrieve cookies, favicons, storage state, console messages, AI export, tree JSON, native MISP export and takedown contacts. Return links for screenshot, archive, downloaded files and video.

A lookyloo-capture object retains provenance and links observed URL, file, image and cookie objects. Named JSON attachments retain endpoint responses and lookup metadata. The new template is proposed in MISP/misp-objects#547 and an identical copy is bundled for PyMISP versions that do not ship it yet. Install that template on the MISP server for its fields to render correctly.

All new enrichment attributes use to_ids=false; the original input retains its UUID, tags, comment and detection flag. Requests use verified TLS, optional Authorization, bounded response sizes and timeouts. Missing secondary endpoints preserve successful enrichment and add a capture error. These modules do not submit URLs, trigger external analyses, push events, send reports or call administrative endpoints. JSON documentation provides defaults, examples, endpoint coverage and exclusions; hashes use SHA-512 rather than mmh3 or MD5.

Validation:

• 64 focused Lookyloo tests; 144 tests pass including URLScan and vulnerability lookup regressions.
• Flake8, whitespace checks, documentation rendering and strict PyMISP object validation pass.
• Live CIRCL API checks cover failed and successful captures, cookies, favicons, native MISP export error handling, and hostname/IP/SHA-512 pivots. A native export exceeding 5 MiB was reported on its capture while other results were retained.
• All 450 misp-objects definitions validate; UUID uniqueness, relationship checks and 22 object repository tests pass.

API reference: https://lookyloo.circl.lu/doc/

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T06:45:37.268764Z	8fa8f8f	PR opened
🔒 Security Review	✅ Completed 2026-10-16T06:47:42.720334Z	8fa8f8f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.