Add TweetFeed Lookup expansion/hover module

[0xDanielLopez]

What

New expansion + hover module TweetFeed Lookup (misp_modules/modules/expansion/tweetfeed.py).

TweetFeed is a free, CC0 feed of URLs, domains, IPs and MD5/SHA-256 hashes that security researchers share on X/Twitter, extracted every 15 minutes since 2021. MISP already consumes it as a bulk feed; this module adds the per-attribute half: given an ip-src, ip-dst, domain, hostname, url, md5 or sha256 attribute it calls GET https://api.tweetfeed.live/v1/ioc?value=<v> (no API key, 365-day window plus an older archive) and returns misp_standard results.

Mapping

• each source tweet -> a microblog object (type Twitter, url, username parsed from the tweet URL, one hashtag per tag, creation-date when unambiguous), referenced to the queried attribute with mentions;
• IOCs co-reported in the same tweet -> attributes (to_ids false) referenced from the microblog object with mentions;
• domain registration / hosting (reg) -> a domain-ip object (apex, IPs, registration-date, registrar / NS / ASN / age in text);
• IP network metadata, cross-feed corroboration (URLhaus, ThreatFox, MalwareBazaar, USOM, IPsum), AI-generated context and campaign membership -> text / link attributes with disable_correlation;
• reports older than 365 days -> microblog objects built from the archived tweet id.

Deliberately no tag and no confidence score are set from this data: it is community reported and not independently verified. The AI summary is labelled as LLM-generated in the attribute comment.

Tests and docs

• tests/test_tweetfeed.py: 13 pytest cases that mock requests.get with verbatim captures of the live API (domain, url, ip, sha256, md5, corroborated, archive-only, miss, error paths, hover call without uuid, introspection/version). Same style as tests/test_xposedornot.py.
• flake8 clean at the project's 120-column limit.
• README.md bullet and the documentation/README.md / documentation/mkdocs/expansion.md blocks were added by hand following the generator layout; happy to regenerate if you prefer.

Note for reviewers

While writing the tests I found that adding an object with misp_event.add_object(**obj) drops the references added earlier with obj.add_reference(...): a standalone MISPObject does not serialise ObjectReference, so the unpacked dict never carries them. Passing the instance (misp_event.add_object(obj)) keeps them. This module uses the instance form; other modules that use the **obj form after add_reference may be affected.

Author: Daniel López (TweetFeed maintainer).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[adulau]

Thank you!