How arshiyamars/marsti works
MarsTI is a small interactive threat-intelligence CLI. A user selects one provider or all providers, enters one or more indicators, and the CLI defangs and classifies each valid value before dispatching lookups. Provider adapters query external services, normalize responses through shared HTTP/result helpers, and return results for terminal display and CSV export; the CLI also configures file logging. README documents IP, domain, and hash support, but AbuseIPDB supports only IPs. The source excerpts show the main flow and provider integrations; no separate storage or processing layer is evident.
Main entry points: main.py Interactive CLI · settings.py Runtime settings · virustotal.py VirusTotal adapter · abuseipdb.py AbuseIPDB adapter
Components 14
CLI workflow
- Interactive CLI
main.py
Shared API layer
- IOC normalization
api/__init__.py - Runtime settings
config/settings.py - HTTP and results
api/__init__.py
Threat sources
- VirusTotal adapter
api/virustotal.py - AbuseIPDB adapter
api/abuseipdb.py - AlienVault OTX adapter
api/alienvault.py
Run outputs
- Terminal report
main.py - CSV reports
main.py - Log file
main.py
Other components
- CLI user
- VirusTotal
- AbuseIPDB
- AlienVault OTX
Connections 23
- CLI user → Interactive CLI: enters choices and IOCs
main.py - Interactive CLI → IOC normalization: cleans and classifies
main.py - Interactive CLI → VirusTotal adapter: dispatches lookup
main.py - Interactive CLI → AbuseIPDB adapter: dispatches lookup
main.py - Interactive CLI → AlienVault OTX adapter: dispatches lookup
main.py - VirusTotal adapter → HTTP and results: fetches and builds result
api/virustotal.py - AbuseIPDB adapter → HTTP and results: fetches and builds result
api/abuseipdb.py - AlienVault OTX adapter → HTTP and results: fetches and builds result
api/alienvault.py - HTTP and results → Runtime settings: reads timeout
api/__init__.py - VirusTotal adapter → Runtime settings: reads API key
api/virustotal.py - AbuseIPDB adapter → Runtime settings: reads API key and age
api/abuseipdb.py - AlienVault OTX adapter → Runtime settings: reads API key
api/alienvault.py - VirusTotal adapter → VirusTotal: queries
api/virustotal.py - AbuseIPDB adapter → AbuseIPDB: queries
api/abuseipdb.py - AlienVault OTX adapter → AlienVault OTX: queries
api/alienvault.py - VirusTotal adapter → Interactive CLI: returns result
main.py - AbuseIPDB adapter → Interactive CLI: returns result
main.py - AlienVault OTX adapter → Interactive CLI: returns result
main.py - Interactive CLI → Terminal report: renders results
main.py - Interactive CLI → CSV reports: writes report
main.py - Interactive CLI → Log file: configures logging
main.py - Runtime settings → CSV reports: provides output path
main.py - Runtime settings → Log file: provides output path
main.py