Skip to content

Add RDAP analyzer - #1484

Open
yatuk wants to merge 1 commit into
TheHive-Project:developfrom
yatuk:add-rdap-analyzer
Open

Add RDAP analyzer#1484
yatuk wants to merge 1 commit into
TheHive-Project:developfrom
yatuk:add-rdap-analyzer

Conversation

@yatuk

@yatuk yatuk commented Aug 7, 2026

Copy link
Copy Markdown

Summary

Adds an RDAP analyzer for domain and IP lookups. It queries rdap.org, which resolves and redirects to the correct authoritative server for any TLD or RIR, so no per-registry configuration is needed. No API key is required.

The analyzer flags notable statuses such as client hold, server hold, pending delete, pending transfer, and redemption period, reports the registration date and registrar when available, and extracts nameservers as artifacts.

Test plan

  • Ran the analyzer directly against example.com (domain) and 8.8.8.8 (ip) with a JSON payload piped over stdin, and confirmed correct taxonomies and artifacts in both cases.
  • Confirmed the summary handles the not-found case for a lookup with no registration data.

@nusantara-self
nusantara-self changed the base branch from master to develop August 12, 2026 08:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant