From d7a2481978573d9d0d93c0fa4a016b8e68f4c7d5 Mon Sep 17 00:00:00 2001
From: grafana-watcher <grafana-watcher@bojemoi.lab>
Date: Thu, 6 Aug 2026 23:06:36 +0200
Subject: [PATCH] post: commit 3c9a935 in bojemoi

---
 .../commits/2026-08-06-commit-3c9a935.md      | 54 +++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 content/posts/commits/2026-08-06-commit-3c9a935.md

diff --git a/content/posts/commits/2026-08-06-commit-3c9a935.md b/content/posts/commits/2026-08-06-commit-3c9a935.md
new file mode 100644
index 0000000..397aa43
--- /dev/null
+++ b/content/posts/commits/2026-08-06-commit-3c9a935.md
@@ -0,0 +1,54 @@
+---
+title: "[bojemoi] feat(cti): ThreatFox + cross-référence MSF dans le MCP server"
+date: 2026-08-06T23:06:36+02:00
+draft: false
+tags: ["commit", "bojemoi", "main"]
+categories: ["Git Activity"]
+summary: "Commit 3c9a935 par grafana-watcher dans bojemoi"
+author: "grafana-watcher"
+---
+
+## Commit `3c9a935`
+
+| | |
+|---|---|
+| **Repository** | bojemoi |
+| **Branch** | `main` |
+| **Author** | grafana-watcher |
+| **Hash** | `3c9a9358aefa13abfd244995f93b1588597be57c` |
+
+
+### Description
+
+- Nouveau module sdk/bojemoi/cti.py :
+  - threatfox_recent() : IOCs récents depuis ThreatFox (filtrables par type/malware)
+  - threatfox_search() : recherche d'un IOC spécifique
+  - ioc_crossref() : croise les C2 ThreatFox avec les 6.15M hosts MSF
+    → fallback Feodo Tracker si pas de clé API
+- 3 nouveaux tools MCP exposés (threatfox_recent, threatfox_search, ioc_crossref)
+- Secret Docker threatfox_api_key intégré (stack 49-service-mcp.yml)
+- Pin mcp<2.0.0 (breaking API change en 2.0.0)
+
+Premier hit : 45.8.159.205:8596 Cobalt Strike C2 (tag drb-ra, confiance 75%)
+documenté dans DefectDojo #368610.
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+
+### Files Changed
+
+```
+M	mcp-server/requirements.txt
+M	mcp-server/server.py
+A	sdk/bojemoi/cti.py
+M	stack/49-service-mcp.yml
+```
+
+### Diff Summary
+
+```
+ mcp-server/requirements.txt |   2 +-
+ mcp-server/server.py        |  84 +++++++++++
+ sdk/bojemoi/cti.py          | 336 ++++++++++++++++++++++++++++++++++++++++++++
+ stack/49-service-mcp.yml    |   3 +
+ 4 files changed, 424 insertions(+), 1 deletion(-)
+```