get_ip_reputation (reputation_intel.py)

skills/threat_analyst/reputation_intel.py Fetches reputation intelligence for IPs and domains from public APIs: - AbuseIPDB: IP abuse history - Talos: IP intelligence - AlienVault OTX: Domain/IP threat data - VirusTotal: File/URL/IP/Domain intelligence - MITRE ATT&CK: Vulnerabili

"""
skills/threat_analyst/reputation_intel.py

Fetches reputation intelligence for IPs and domains from public APIs:
- AbuseIPDB: IP abuse history
- Talos: IP intelligence
- AlienVault OTX: Domain/IP threat data
- VirusTotal: File/URL/IP/Domain intelligence
- MITRE ATT&CK: Vulnerability and technique data

Gracefully handles missing API keys and network failures.
"""
from __future__ import annotations

import logging
import os
import re
from typing import Optional
from datetime import datetime

import requests

logger = logging.getLogger(__name__)

# API endpoints and configuration
ABUSEIPDB_URL = "https://api.abuseipdb.com/api/v2/check"
ABUSEIPDB_KEY = os.getenv("ABUSEIPDB_API_KEY", "")

ALIENVAULT_URL = "https://otx.alienvault.com/api/v1/indicators"
ALIENVAULT_KEY = os.getenv("ALIENVAULT

... (truncated -- full source via MCP)