m17hr1l
|
9a2a31ec9a
|
stage-23: IOC index + lookup — the actionable keystone
New iocs table (value, type, case_id, feed, severity, first_seen) +
lines/lookup.py: normalize() (CVE upper, rest lower), reindex() to
rebuild from the corpus, lookup() (normalization-insensitive, scans all
types), export_blocklist() (deduped, min-severity filter).
CLI: psyc reindex / lookup <indicator> / export-blocklist --type --min-severity.
Verified on the live corpus: 1288 IOCs from 598 cases; lookup of a real
IP/CVE resolves to its case+feed+severity; 8.8.8.8 correctly misses;
blocklist export yields 148 IPs / 289 domains / 150 URLs / 514 hashes /
108 CVEs. This primitive backs the upcoming search UI, asset matching,
and watchlist alerting.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-22 23:39:05 +02:00 |
|