Feature ipqs by RamboV · Pull Request #3431 · intelowlproject/IntelOwl

RamboV · 2026-03-05T19:44:22Z

Description

Added darkwebleak api to ipqs observable analyzer.
Added malicious file scanner in file analyzer.

Type of change

New feature (non-breaking change which adds functionality).

Checklist

I have read and understood the rules about how to Contribute to this project
The pull request is for the branch develop
A new plugin (analyzer, connector, visualizer, playbook, pivot or ingestor) was added or changed, in which case:
- I strictly followed the documentation "How to create a Plugin"
- Usage file was updated. A link to the PR to the docs repo has been added as a comment here.
- I have dumped the configuration from Django Admin using the dumpplugin command and added it in the project as a data migration. ("How to share a plugin with the community")
- If a new analyzer has beed added, I have created a unittest for it in the appropriate dir. I have also mocked all the external calls, so that no real calls are being made while testing.
- I have added that raw JSON sample to the get_mocker_response() method of the unittest class. This serves us to provide a valid sample for testing.
Linters (Black, Flake, Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.

Screenshots and raw_json

darkweb_leak_raw_resp.txt

ip_raw_json.txt

malware_file_scanner_raw_json.txt

phone_raw_json.txt

api_app/analyzers_manager/observable_analyzers/ipqs.py

RamboV · 2026-03-09T14:53:50Z

intelowlproject/docs#47
PR for docs

RamboV · 2026-03-09T20:54:42Z

@mlodic can you please review it.

mlodic · 2026-03-12T09:40:41Z

you removed from the PR checklist the screenshot and raw JSON requirements. provide them or the PR won't be reviewed

RamboV · 2026-03-12T14:22:12Z

@mlodic I've updated the requested screenshots and the raw_json in description. Thanks!

mlodic · 2026-03-13T08:26:23Z

api_app/analyzers_manager/migrations/0178_analyzer_config_ipqs_file_url_scanner.py

+
+plugin = {'python_module': {'health_check_schedule': None, 'update_schedule': None, 'module': 'ipqsurl.IPQSUrlScan', 'base_path': 'api_app.analyzers_manager.observable_analyzers'}, 'name': 'IPQS_File_URL_Scanner', 'description': 'Scans files hosted or accessible via a URL using IPQualityScore’s malware detection API.', 'disabled': False, 'soft_time_limit': 60, 'routing_key': 'default', 'health_check_status': True, 'type': 'observable', 'docker_based': False, 'maximum_tlp': 'RED', 'observable_supported': ['url'], 'supported_filetypes': [], 'run_hash': False, 'run_hash_type': '', 'not_supported_filetypes': [], 'mapping_data_model': {}, 'model': 'analyzers_manager.AnalyzerConfig'}
+
+params = [{'python_module': {'module': 'ipqsurl.IPQSUrlScan', 'base_path': 'api_app.analyzers_manager.observable_analyzers'}, 'name': 'ipqs_api_key', 'type': 'str', 'description': 'Please provide the IPQS API key.', 'is_secret': True, 'required': True}]


format these dicts appropriately please, this is not readable

mlodic · 2026-03-13T08:26:43Z

api_app/analyzers_manager/migrations/0178_analyzer_config_ipqs_file_url_scanner.py

+    ReverseOneToOneDescriptor,
+)
+
+plugin = {'python_module': {'health_check_schedule': None, 'update_schedule': None, 'module': 'ipqsurl.IPQSUrlScan', 'base_path': 'api_app.analyzers_manager.observable_analyzers'}, 'name': 'IPQS_File_URL_Scanner', 'description': 'Scans files hosted or accessible via a URL using IPQualityScore’s malware detection API.', 'disabled': False, 'soft_time_limit': 60, 'routing_key': 'default', 'health_check_status': True, 'type': 'observable', 'docker_based': False, 'maximum_tlp': 'RED', 'observable_supported': ['url'], 'supported_filetypes': [], 'run_hash': False, 'run_hash_type': '', 'not_supported_filetypes': [], 'mapping_data_model': {}, 'model': 'analyzers_manager.AnalyzerConfig'}


in the description use markdown to add link to the service, this will be rendered in the GUI

mlodic · 2026-03-13T08:27:02Z

api_app/analyzers_manager/migrations/0178_analyzer_config_ipqs_file_url_scanner.py

+)
+
+plugin = {'python_module': {'health_check_schedule': None, 'update_schedule': None, 'module': 'ipqsurl.IPQSUrlScan', 'base_path': 'api_app.analyzers_manager.observable_analyzers'}, 'name': 'IPQS_File_URL_Scanner', 'description': 'Scans files hosted or accessible via a URL using IPQualityScore’s malware detection API.', 'disabled': False, 'soft_time_limit': 60, 'routing_key': 'default', 'health_check_status': True, 'type': 'observable', 'docker_based': False, 'maximum_tlp': 'RED', 'observable_supported': ['url'], 'supported_filetypes': [], 'run_hash': False, 'run_hash_type': '', 'not_supported_filetypes': [], 'mapping_data_model': {}, 'model': 'analyzers_manager.AnalyzerConfig'}
+


max TLP must be AMBER for external services

mlodic · 2026-03-13T08:27:16Z

api_app/analyzers_manager/migrations/0179_analyzer_config_ipqs_malware_file_scanner.py

+
+plugin = {'python_module': {'health_check_schedule': None, 'update_schedule': None, 'module': 'ipqsfile.IPQSFileScan', 'base_path': 'api_app.analyzers_manager.file_analyzers'}, 'name': 'IPQS_Malware_File_Scanner', 'description': 'Scan files for malware, viruses, and malicious payloads in real-time using IPQualityScore’s advanced file scanning engine.', 'disabled': False, 'soft_time_limit': 60, 'routing_key': 'default', 'health_check_status': True, 'type': 'file', 'docker_based': False, 'maximum_tlp': 'RED', 'observable_supported': [], 'supported_filetypes': ['application/w-script-file', 'application/javascript', 'application/x-javascript', 'text/javascript', 'application/x-vbscript', 'text/x-ms-iqy', 'application/vnd.android.package-archive', 'application/x-dex', 'application/onenote', 'application/zip', 'multipart/x-zip', 'application/java-archive', 'text/rtf', 'application/rtf', 'application/x-sharedlib', 'application/vnd.microsoft.portable-executable', 'application/x-elf', 'application/octet-stream', 'application/vnd.tcpdump.pcap', 'application/pdf', 'text/html', 'application/x-mspublisher', 'application/vnd.ms-excel.addin.macroEnabled', 'application/vnd.ms-excel.sheet.macroEnabled.12', 'application/vnd.ms-excel', 'application/excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/xml', 'text/xml', 'application/encrypted', 'text/plain', 'text/csv', 'application/vnd.openxmlformats-officedocument.presentationml.presentation', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/vnd.ms-powerpoint', 'application/vnd.ms-office', 'application/x-binary', 'application/x-macbinary', 'application/mac-binary', 'application/x-mach-binary', 'application/x-zip-compressed', 'application/x-compressed', 'application/vnd.ms-outlook', 'message/rfc822', 'application/pkcs7-signature', 'application/x-pkcs7-signature', 'multipart/mixed', 'text/x-shellscript', 'application/x-chrome-extension', 'application/json', 'application/x-executable', 'text/x-java', 'text/x-kotlin', 'text/x-swift', 'text/x-objective-c', 'application/x-ms-shortcut', 'application/gzip'], 'run_hash': False, 'run_hash_type': '', 'not_supported_filetypes': [], 'mapping_data_model': {}, 'model': 'analyzers_manager.AnalyzerConfig'}
+
+params = [{'python_module': {'module': 'ipqsfile.IPQSFileScan', 'base_path': 'api_app.analyzers_manager.file_analyzers'}, 'name': 'ipqs_api_key', 'type': 'str', 'description': 'Please provide the IPQS API key.', 'is_secret': True, 'required': True}]


same for thsese, not readable

mlodic · 2026-03-13T08:30:40Z

api_app/mixins.py

+
+        try:
+            # Increase timeout for the initial upload/scan
+            request_timeout = 120 if files else 30


you must change the soft time limit parameter in the migration to be at least the maximum amount of time of the worst case scenario, otherwise an expection would raise and the analysis would fail

mlodic · 2026-03-13T08:31:47Z

api_app/mixins.py

+class IPQualityScoreMixin:
+    base_url: str = "https://www.ipqualityscore.com/api/json"  # Ensure correct API base
+    _ipqs_api_key: str
+    polling_interval: int = 10  # Increased for large file stability


polling_interval and max_retries should be parameters of the analyzers (see othera analyzers). In this way the user can adjust them based on the case

github-actions · 2026-03-28T09:42:00Z

This pull request has been marked as stale because it has had no activity for 10 days. If you are still working on this, please provide some updates or it will be closed in 5 days.

mlodic · 2026-04-01T12:14:05Z

closing this for inactivity

RamboV added 6 commits March 6, 2026 01:01

Add files via upload

4be648e

Add files via upload

3bc5e1d

Add files via upload

c43b164

IPQS mixin

174232f

Add files via upload

00b3b5a

Add files via upload

5be04c1

github-advanced-security bot found potential problems Mar 5, 2026

View reviewed changes

api_app/analyzers_manager/observable_analyzers/ipqs.py Fixed Show fixed Hide fixed

RamboV added 7 commits March 6, 2026 01:20

fix linting

24c0e90

Update ipqs.py

d28b642

Update mixins.py

94d486a

Update ipqs.py

a709d36

Update mixins.py

ecfbfda

Update ipqsurl.py

2a3a33f

Update ipqs.py

a6d1cbf

RamboV mentioned this pull request Mar 9, 2026

Update ipqs in docs intelowlproject/docs#47

Open

2 tasks

Update test_ipqsfile.py

bb82c9e

mlodic requested changes Mar 13, 2026

View reviewed changes

RamboV added 7 commits March 14, 2026 02:56

update 0178_analyzer_config_ipqs_file_url_scanner.py

fd02b47

update 0179_analyzer_config_ipqs_malware_file_scanner.py

7e3fc58

Refactor IPQualityScoreMixin for polling and timeout

4f041a2

update linters

13a1606

Add polling interval and max retries to config

c20eef8

Add polling_interval and max_retries to config

e6b0c79

update linting

e3b2306

github-actions bot added the stale label Mar 28, 2026

mlodic closed this Apr 1, 2026


		plugin = {'python_module': {'health_check_schedule': None, 'update_schedule': None, 'module': 'ipqsurl.IPQSUrlScan', 'base_path': 'api_app.analyzers_manager.observable_analyzers'}, 'name': 'IPQS_File_URL_Scanner', 'description': 'Scans files hosted or accessible via a URL using IPQualityScore’s malware detection API.', 'disabled': False, 'soft_time_limit': 60, 'routing_key': 'default', 'health_check_status': True, 'type': 'observable', 'docker_based': False, 'maximum_tlp': 'RED', 'observable_supported': ['url'], 'supported_filetypes': [], 'run_hash': False, 'run_hash_type': '', 'not_supported_filetypes': [], 'mapping_data_model': {}, 'model': 'analyzers_manager.AnalyzerConfig'}

		params = [{'python_module': {'module': 'ipqsurl.IPQSUrlScan', 'base_path': 'api_app.analyzers_manager.observable_analyzers'}, 'name': 'ipqs_api_key', 'type': 'str', 'description': 'Please provide the IPQS API key.', 'is_secret': True, 'required': True}]

Uh oh!

Conversation

RamboV commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist

Uh oh!

Uh oh!

RamboV commented Mar 9, 2026

Uh oh!

RamboV commented Mar 9, 2026

Uh oh!

mlodic commented Mar 12, 2026

Uh oh!

RamboV commented Mar 12, 2026

Uh oh!

mlodic Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

mlodic Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 28, 2026

Uh oh!

mlodic commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

RamboV commented Mar 5, 2026 •

edited

Loading