Adding Validin MISP Expansion module

[sreekarmad]

Overview

This PR adds a native integration between Validin and MISP. This module is structured as an expansion and hover module that enables users to enrich the following attribute types: domain, hostname, ip-src, and ip-dst with data from Validin's internet intelligence dataset.

Capabilities

You can enrich the following attribute types using the Validin expansion module:

• domain
• hostname
• ip-src
• ip-dst

The Validin enrichment module enriches with the following data sources:

• DNS (lookback of 14 days)
• Host Response (lookback of 21 days)
• Registration Records (lookback of 30 days)
• Subdomains
• Certificates

Requirements

You must have an account on Validin's community or enterprise platforms to be able to use this expansion module correctly. You will need to configure your API key and the correct Validin endpoint to use this in your MISP environments.

About Validin

Validin provides deep internet and infrastructure intelligence to help organizations hunt threats. The Validin platform delivers rich, continuously updated data across domains, IPs, DNS, certificates, and web services to power security research and threat detection.

Learn more about Validin at: https://www.validin.com

[sreekarmad]

Hi @adulau. My name is Sreekar and I am an engineer at Validin. We have built this enrichment module for MISP, and would like to get this merged. I think I have followed all the guidelines for contributing and documentation (as far as I know), please let me know if there's anything else we need to do in order to complete this process. Thanks for your time and support in advance.

[adulau]

Thank you very much for the contribution!