pduggusa/DugganUSA Threat Intel Scan
Scan code for IPs, domains, hashes, and CVEs against 1.5M+ threat indicators. Block PRs containing known-bad indicators.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-key | DugganUSA API key — free registered key from analytics.dugganusa.com/stix/register (feed is key-enforced) | no | "" |
| scan-patterns | Glob pattern for files to scan | no | **/*.{js,ts,py,json,yml,yaml,conf,cfg,ini,env,md,txt,tf,hcl} |
| fail-on-match | Fail the action (exit 1) if threat indicators are found | no | true |
| fail-on-unknown | Fail the action if an indicator could not be checked (expired key, rate limit, timeout, API outage). An unverified indicator is not a clean one -- a gate that could not run should not report a pass. Defaults to the value of fail-on-match. Set to false to let outages through. | no | "" |
| report-hits | Report confirmed indicators back to the DugganUSA feed-efficacy (liveness) axis. Indicator-only — never repo/file/actor context. Requires api-key. Set to false to opt out. | no | true |
| format | Output format: table, json, or markdown | no | table |
Outputs
| name | description |
|---|---|
| found | Number of threat indicators found |
| scanned | Number of IOC candidates scanned |
| clean | Number of IOC candidates successfully verified as clean |
| unknown | Number of IOC candidates that could NOT be checked (lookup failed). These are unverified, not clean. |