aboutsummaryrefslogtreecommitdiffstats
path: root/docs/specs
diff options
context:
space:
mode:
authorDanilo M. <danix@danix.xyz>2026-09-09 19:20:27 +0200
committerDanilo M. <danix@danix.xyz>2026-09-09 19:20:27 +0200
commit725c8ee4a3dff16c54bae6723a12ca2ef17d7e2f (patch)
tree45fdd4086309d99f4a78318a2a809de3d47677a4 /docs/specs
parentd8161dae1fce1b5e5ffd757f411e1123b2f5dfa5 (diff)
downloadabusectl-725c8ee4a3dff16c54bae6723a12ca2ef17d7e2f.tar.gz
abusectl-725c8ee4a3dff16c54bae6723a12ca2ef17d7e2f.zip
feat: list the indicators no abuse desk was found for
Not an error and not an exit code: a case where nothing resolved still reaches MISP and the vendors. Visible beats absent, so review can see it without diffing IOC lists. Two departures from the plan, both about the pair of lists agreeing. An indicator is unreportable only when NONE of its contacts produced a mailable address, not when any one of them failed. Contacts fold by host, so an indicator can sit in a domain contact that resolved and an IP contact that did not; listing it regardless puts it in the destinations and in the "no desk found" list at once, and a reviewer acting on the second hand-reports something already on its way to a desk. An abuse value with no "@", or with either half empty, no longer becomes a destination. RDAP jCard data is third-party and occasionally malformed, and such a value produced a pending destination with an unsendable target, which the unreportable array then skipped because the contact did have an abuse entry. Both functions now apply one mailability test, so the two lists partition the indicators exactly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xj1ayFRSUQ2u7cwb3S4axE
Diffstat (limited to 'docs/specs')
0 files changed, 0 insertions, 0 deletions