diff options
| author | Danilo M. <danix@danix.xyz> | 2026-09-09 19:20:27 +0200 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-09-09 19:20:27 +0200 |
| commit | 725c8ee4a3dff16c54bae6723a12ca2ef17d7e2f (patch) | |
| tree | 45fdd4086309d99f4a78318a2a809de3d47677a4 /AGENTS.md | |
| parent | d8161dae1fce1b5e5ffd757f411e1123b2f5dfa5 (diff) | |
| download | abusectl-725c8ee4a3dff16c54bae6723a12ca2ef17d7e2f.tar.gz abusectl-725c8ee4a3dff16c54bae6723a12ca2ef17d7e2f.zip | |
feat: list the indicators no abuse desk was found for
Not an error and not an exit code: a case where nothing resolved still
reaches MISP and the vendors. Visible beats absent, so review can see it
without diffing IOC lists.
Two departures from the plan, both about the pair of lists agreeing.
An indicator is unreportable only when NONE of its contacts produced a
mailable address, not when any one of them failed. Contacts fold by host,
so an indicator can sit in a domain contact that resolved and an IP
contact that did not; listing it regardless puts it in the destinations
and in the "no desk found" list at once, and a reviewer acting on the
second hand-reports something already on its way to a desk.
An abuse value with no "@", or with either half empty, no longer becomes
a destination. RDAP jCard data is third-party and occasionally malformed,
and such a value produced a pending destination with an unsendable
target, which the unreportable array then skipped because the contact
did have an abuse entry. Both functions now apply one mailability test,
so the two lists partition the indicators exactly.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Xj1ayFRSUQ2u7cwb3S4axE
Diffstat (limited to 'AGENTS.md')
0 files changed, 0 insertions, 0 deletions
