Summary

• Expansion module (flowtriq.py): Enriches IP attributes (ip-src, ip-dst) with DDoS attack history from Flowtriq's network monitoring platform. Returns attack families, severity breakdown, peak traffic rates, ASN, country, risk scores, related attacker IPs, and threat intel feed matches.
• Export module (flowtriq_export.py): Exports ip-src attributes from MISP events to Flowtriq's threat intelligence pipeline for network-level attack correlation and real-time blocking. Supports batch export with full MISP event context (threat level, tags, attack type derivation).

Both modules require a Flowtriq API key and optionally accept a custom API URL. They follow the standard MISP module interface (handler, introspection, version) and require only requests as an external dependency.

Flowtriq is a DDoS detection and mitigation platform. These modules enable bidirectional threat intelligence sharing between MISP communities and Flowtriq-monitored infrastructure.

Module details

Expansion module

• Input: ip-src, ip-dst
• Output format: misp_standard
• Module types: expansion, hover
• Config: api_key, api_url

Export module

• Input: MISP events with ip-src attributes (IDS-flagged)
• Output: text summary of exported indicators
• Config: api_key, api_url