User Guide

Synapse-Netcraft User Guide

Synapse-Netcraft adds new Storm commands to allow you to query the Netcraft API using your existing API key.

Getting Started

Check with your Admin to enable permissions and find out if you need a personal API key.

Examples

Setting your personal API key

To set-up a personal use API key:

> netcraft.config.add myconfig myapikey --scope self
Synapse-Netcraft config "myconfig" added

Use `netcraft.takedown.attacks.get` to retrieve an existing takedown

> netcraft.takedown.attack.get --id 74507201 --yield
risk:alert=14d1fa2f63a929e5ee0988a984882aad
        .created = 2025/10/31 16:33:12.205
        :_netcraft:takedown:authorized = true
        :_netcraft:takedown:group:id = 74503794
        :_netcraft:takedown:status = verified
        :desc = Added by Netcraft Phishing Feed
        :detected = 2025/08/27 16:52:01.000
        :ext:id = 74507201
        :service:platform = 2a592ccd54e101ee12c955a4c1f18c66
        :type = netcraft.phishing_url
        :updated = 2025/10/20 03:59:14.000
        :url = https://incident.netcraft.com/41d3fc0c4e88/

Use of `meta:source` nodes

Synapse-Netcraft uses a meta:source node and -(seen)> light weight edges to track nodes observed from the Netcraft API.

> meta:source=e75b64f78e94f7aa7c75cf904c52174d
meta:source=e75b64f78e94f7aa7c75cf904c52174d
        .created = 2025/10/31 16:33:12.197
        :name = netcraft api
        :type = synapse.netcraft

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Netcraft. The following example shows how to filter the results of a query to include only results observed by Synapse-Netcraft:

> #cool.tag.lift +{ <(seen)- meta:source=e75b64f78e94f7aa7c75cf904c52174d }

Model Extensions

The following extended props are created by the Synapse-Netcraft powerup:

risk:alert:_netcraft:takedown:group:id
    int - The ID of the group that the takedown belongs to.

risk:alert:_netcraft:takedown:status
    str - The status of the takedown.

risk:alert:_netcraft:takedown:authorized
    bool - Set to true if the takedown has been authorized.