🔥

DarkWick — Enrichment API

Look up any IP and get back everything DarkWick knows — indicator, dossier, detections, provenance.

GET https://darkwick.netlify.app/api/enrich?ip=<ip> Free No auth

Query any IP address (also ?url=, ?domain=, or ?q=) and get the full enrichment record. A miss returns {"found": false} with HTTP 200 — a miss is an answer, not an error. TLP:GREEN public data only.

Try it live

Response fields

Field	Type	Description
found	bool	Whether DarkWick has a record for this indicator
matched_by	string	`exact` (IP match) or `cidr` (inside a hostile netblock)
indicator	object	Full indicator record — type, score, confidence, sources, geo, ASN, tags, provenance
dossier	object\|null	Behavioral profile if observed by honeypot — sessions, creds tried, commands, SSH clients, skill assessment
related_detections	array	Sigma detection rules matched to this attacker, with MITRE technique IDs
provenance_note	string	Explains the provenance classes (observed / inferred / feed)
generated	ISO 8601	When the underlying data was last generated by the pipeline

Provenance classes

Class	Meaning
observed	Witnessed first-hand by a DarkWick honeypot sensor
inferred	Derived from witnessed evidence (e.g. C2 carved from a captured sample)
feed	Aggregated from a named open source feed (secondhand)

Examples

curl

# Look up a known attacker
curl "https://darkwick.netlify.app/api/enrich?ip=91.92.42.168"

# Check a netblock (CIDR matching)
curl "https://darkwick.netlify.app/api/enrich?ip=45.9.148.100"

# Miss — not in dataset
curl "https://darkwick.netlify.app/api/enrich?ip=8.8.8.8"
# → {"found": false, "queried": "8.8.8.8", ...}

Python (SOAR playbook)

import requests

def enrich_ip(ip):
    r = requests.get(f"https://darkwick.netlify.app/api/enrich?ip={ip}")
    data = r.json()
    if data["found"]:
        return {
            "score": data["indicator"]["score"],
            "provenance": data["indicator"]["provenance"]["class"],
            "dossier": data["dossier"],
        }
    return None

Splunk (scheduled lookup)

| inputlookup darkwick_alerts.csv
| lookup darkwick_enrichment ip AS src_ip OUTPUT score, provenance_class
| where score >= 70

Microsoft Sentinel (KQL)

// Join sign-in logs against DarkWick watchlist
SigninLogs
| join kind=inner (
    _GetWatchlist('darkwick')
) on $left.IPAddress == $right.indicator
| where score_d >= 70

Rate limits & cost

Free tier: 125,000 invocations/month (Netlify Functions). No API key, no signup, no billing. The data refreshes every 6 hours via the DarkWick pipeline. Responses are cached for 5 minutes at the CDN edge.

Bulk feeds (static files)

For SIEM ingestion at scale, use the static enrichment feeds instead of polling the API per-indicator:

Format	URL	For
STIX 2.1	darkwick.stix2.json	OpenCTI, MISP, Sentinel, ThreatConnect
Splunk CSV	darkwick-splunk.csv	Splunk automatic lookups
Sentinel CSV	darkwick-sentinel.csv	Sentinel watchlists
Elastic ECS	darkwick-elastic.ndjson	Elastic Security indicator-match
Blocklist	blocklist.txt	Firewall rules (plain IP/CIDR)
Manifest	index.json	Machine-readable feed discovery

← Back to DarkWick Globe