From 324ca8edde501a1ac83eb6e64be22607882db0b8 Mon Sep 17 00:00:00 2001 From: Jonas Lejon Date: Sat, 29 Aug 2026 23:52:03 +0200 Subject: [PATCH 1/2] Document the ScanMalware analyzer and its configuration Companion to intelowlproject/IntelOwl#3975: adds ScanMalware to the analyzer list, and its three optional parameters to the special-configuration section. --- docs/IntelOwl/advanced_usage.md | 5 +++++ docs/IntelOwl/usage.md | 1 + 2 files changed, 6 insertions(+) diff --git a/docs/IntelOwl/advanced_usage.md b/docs/IntelOwl/advanced_usage.md index ccaea2e1..744c521f 100644 --- a/docs/IntelOwl/advanced_usage.md +++ b/docs/IntelOwl/advanced_usage.md @@ -253,6 +253,11 @@ To better understand how this integration works, here is a diagram showing how t Some analyzers could require a special configuration: +- `ScanMalware`: + - `max_results` (default `20`): bounds how much a single run returns. It caps both the scan list and the Certificate Transparency domain list for an IP, which the API returns unlimited; when it applies, the response says so and keeps the real total. + - `fetch_scan_details` (default `true`): also fetch the risk verdict, indicators and AI classification for the most recent scan. One extra request per run; set it to `false` for a lighter lookup. + - `api_key_name` (optional): the API is anonymous, a key only raises the rate limit. + - `GoogleWebRisk`: this analyzer needs a service account key with the Google Cloud credentials to work properly. You should follow the [official guide](https://cloud.google.com/web-risk/docs/quickstart) for creating the key. Then you can populate the secret `service_account_json` for that analyzer with the JSON of the service account file. diff --git a/docs/IntelOwl/usage.md b/docs/IntelOwl/usage.md index 2c27cdab..473c6893 100644 --- a/docs/IntelOwl/usage.md +++ b/docs/IntelOwl/usage.md @@ -226,6 +226,7 @@ The following is the list of the available analyzers you can run out-of-the-box. - `Quad9_DNS`: Retrieve current domain resolution with Quad9 DoH (DNS over HTTPS) - `Quad9_Malicious_Detector`: Leverages Quad9 DoH to check if a domain is related to malware - `Robtex`: scan a domain/IP against the Robtex Passive DNS DB +- `ScanMalware`: Look up a domain, URL or IP in the [ScanMalware](https://scanmalware.com) archive of sandboxed URL scans (no API key required) - `Securitytrails`: scan an IP/Domain against [Securitytrails](https://securitytrails.com/) API - `Shodan_Honeyscore`: scan an IP against [Shodan](https://www.shodan.io/) Honeyscore API - `Shodan_Search`: scan an IP against [Shodan](https://www.shodan.io/) Search API From 71d46f55cc34d6d91db85e69b5aac6c64d4ce668 Mon Sep 17 00:00:00 2001 From: Jonas Lejon Date: Sun, 30 Aug 2026 12:51:19 +0200 Subject: [PATCH 2/2] Correct the ScanMalware request cost fetch_scan_details makes three extra requests (/result, /ioc, /ai), not one. Operators size rate limits from that number. --- docs/IntelOwl/advanced_usage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/IntelOwl/advanced_usage.md b/docs/IntelOwl/advanced_usage.md index 744c521f..a83c1553 100644 --- a/docs/IntelOwl/advanced_usage.md +++ b/docs/IntelOwl/advanced_usage.md @@ -255,7 +255,7 @@ Some analyzers could require a special configuration: - `ScanMalware`: - `max_results` (default `20`): bounds how much a single run returns. It caps both the scan list and the Certificate Transparency domain list for an IP, which the API returns unlimited; when it applies, the response says so and keeps the real total. - - `fetch_scan_details` (default `true`): also fetch the risk verdict, indicators and AI classification for the most recent scan. One extra request per run; set it to `false` for a lighter lookup. + - `fetch_scan_details` (default `true`): also fetch the risk verdict, indicators and AI classification for the most recent scan. Three extra requests per run (`/result`, `/ioc`, `/ai`); set it to `false` for a lighter lookup. - `api_key_name` (optional): the API is anonymous, a key only raises the rate limit. - `GoogleWebRisk`: this analyzer needs a service account key with the Google Cloud credentials to work properly.