Hillstone Threat Intelligence Skill

Features: Query IP addresses, domains, URLs, and file hashes in the Hillstone threat intelligence database.

New Features (v2.2.4)

• - English Only: Simplified to pure English version for better international compatibility
• Automatic IOC Type Detection: Automatically detect IP, domain, URL, hash, and other IOC types
• Smart Caching: Built-in LRU cache with statistics and size limits, significantly improved query performance (40-60%)
• Connection Pool Management: HTTP connection pool for efficient connection reuse, reduced network latency (30%)
• Batch Operations: Import IOC lists from CSV, TXT, JSON files, support batch queries with progress tracking
• Exponential Backoff Retry: Intelligent retry mechanism for better handling of temporary network failures
• Circuit Breaker Pattern: Prevent cascading failures, improve system stability
• Result Formatting: Support for text, JSON, table, and other formats
• Result Export: Support for exporting to CSV, JSON, HTML, Markdown, and other formats
• Logging: Complete operation logging with automatic sensitive data masking
• Error Handling: Comprehensive error handling and retry mechanisms
• Type Hints: Full type annotations for better code maintainability
• API Key Management: Support for HILLSTONEAPIKEY environment variable, priority over config file
• Security Enhancements: Sensitive data masking, log security, file permission management
• Search Optimization: 70+ keywords covering brand, security, features, and more

Configuration

You need to create a config.json file and configure a valid API Key:

1. 1. Copy config.example.json to INLINECODE2

1. 2. Fill in your API Key in config.json:

CODEBLOCK0

Configuration Parameters:

• - api_key: Hillstone Threat Intelligence API Key (required)
• INLINECODE5: API URL (optional, default: https://ti.hillstonenet.com.cn)
• INLINECODE6: Request timeout in seconds (optional, default: 30)
• INLINECODE7: Maximum retry attempts (optional, default: 3)
• INLINECODE8: Retry delay in seconds (optional, default: 1)
• INLINECODE9: Enable cache (optional, default: true)
• INLINECODE10: Cache time-to-live in seconds (optional, default: 3600)

Usage Examples

CODEBLOCK1

Advanced API

Use -a parameter to call the advanced API and get more detailed threat intelligence:
CODEBLOCK2

Advanced API provides:

• - Basic Info: Network, carrier, location, country, province, city, coordinates
• ASN Info: Autonomous System information
• Threat Type: Malicious type classification
• Tags: Threat-related tags
• DNS Records: Reverse DNS records (up to 10)
• Domain Info: Current and historical domains (up to 10)
• File Associations: Downloaded, referenced, and related file hashes (malicious only)
• Port Info: Open ports, application protocols, application names, versions

Supported IOC Types

• - IP Address: Automatically detect and query INLINECODE12
• Domain: Automatically detect and query INLINECODE13
• URL: Automatically detect and query INLINECODE14
• File Hash: Supports MD5/SHA1/SHA256, query INLINECODE15

Response Time Statistics

Each query displays detailed performance statistics:

• - Single Query: Display response time for current call
• Batch Query: Display statistics for current batch (avg/max/min/median)
• Cumulative Statistics: Display cumulative statistics and total call count for all historical queries

Dependencies

• - Python 3.8+
• Hillstone Threat Intelligence API access permission
• This skill uses Python standard library, no additional dependencies required

API Endpoints

Reputation API

• - IP Query: INLINECODE16
• Domain Query: INLINECODE17
• URL Query: INLINECODE18
• File Hash Query: INLINECODE19

Advanced Detail API

• - IP Advanced Query: INLINECODE20
• Domain Advanced Query: INLINECODE21
• URL Advanced Query: INLINECODE22
• File Hash Advanced Query: INLINECODE23

Troubleshooting

• - Invalid API Key: Ensure you are using a valid Hillstone API Key
• Network Connection Issues: Check if you can access INLINECODE24
• Query Timeout: Default timeout is 30 seconds, can be adjusted in config.json
• Encoding Issues: Ensure your system supports UTF-8 encoding
• Log Viewing: Log file is located at INLINECODE25

Security Best Practices

API Key Management

Recommended Approach:

• - Use environment variable for API key (recommended)

  export HILLSTONE_API_KEY="your-api-key-here"
  

• - Ensure environment variable is not logged to history

Configuration File Approach:

• - If configuration file must be used, ensure:

File Permissions

Configuration File:
CODEBLOCK5

Log File:
CODEBLOCK6

Version History

[2.2.4] - 2026-04-02

• - Changed to pure English version
• Removed all Chinese content for better international compatibility
• Simplified documentation structure

[2.2.3] - 2026-04-01

• - Added environment variable support (HILLSTONEAPIKEY)
• Enhanced log security with automatic sensitive data masking
• Added comprehensive security documentation (SECURITY.md)
• Improved transparency in package.json

[2.2.2] - 2026-03-31

• - Added LRU cache mechanism
• Implemented HTTP connection pool
• Added batch operations support
• Implemented exponential backoff retry
• Added circuit breaker pattern
• Enhanced error handling
• Added comprehensive type hints
• Optimized search keywords

License

MIT License

Support

• - Homepage: https://clawhub.ai/maxjia/hs-ti
• Issues: https://github.com/your-repo/hs-ti/issues