Threat Intel

Overview

Query multiple external threat intelligence services to enrich observables (IPs, domains, URLs, hashes). Aggregates data from security vendors, open-source feeds, and specialized platforms to provide comprehensive IOC context.

Supported Observable Types:

• IP addresses - Reputation, geolocation, ASN, open ports, malicious activity
• Domains - WHOIS, DNS records, reputation, phishing detection
• URLs - Scan reports, redirects, phishing detection, screenshot analysis
• Hashes (MD5/SHA1/SHA256) - Malware detection, file analysis, known samples

Quick Start

Basic Usage

# Check an IP across multiple services
openclaw threat-intel ip 8.8.8.8 --services greynoise,abuseipdb,virustotal