Add expansion module: Whisper

[elakkuvan-r]

New expansion + hover module: Whisper

Enriches ip-src/ip-dst, domain/hostname, and AS attributes with threat intelligence and infrastructure context (DNS, ASN/BGP, WHOIS) from the Whisper graph, returning misp_standard results built with PyMISP (domain-ip / asn objects with references back to the seed attribute, plus context notes).

Behavior highlights

• Both expansion (full multi-query pull) and hover (compact single-query threat verdict) module types.
• TLP egress ceiling: the max_tlp setting (default tlp:amber+strict) is enforced before any attribute value leaves MISP — enriching a marked attribute is egress, so the operator's ceiling is the consent boundary.
• Wall-clock budget: the timeout setting (default 8s, kept under Plugin.Enrichment_timeout) bounds every flow; anything the budget cuts is named in an analyst-visible truncation note rather than failing the enrichment, and content-free results return an honest status note instead of echoing the seed.
• Config: api_url, api_key, max_tlp, timeout.

Dependency

The support packages ship as whisper-misp on PyPI (MIT; depends only on pymisp and requests, both already in your tree) — added to the minimal and all extras following the existing vendor-library pattern.

Included

• misp_modules/modules/expansion/whisper.py (uses the package's check_input_attribute / standard_error_message; formatted with the repo's black/isort settings)
• documentation/logos/whisper.png + generated-doc entries in documentation/mkdocs/expansion.md and documentation/README.md, README module-list line
• No __init__.py change needed under the current auto-discovery loader

Testing

• Developed and maintained at whisper-sec/whisper-misp (MIT) with a 366-test suite, live-API integration tests, and a full analyst-loop E2E against a MISP 2.5 / misp-modules v3 docker stack (enrichEvent ingestion, hover, TLP gate, error taxonomy).
• Our CI includes an upstream-parity workflow that stages this module into your tree on every push and runs your flake8 config, server boot with a /modules registration check, and your pytest suite, on py3.10 and py3.14 — currently green.

🤖 Generated with Claude Code

[adulau]

Can you fix the module to pass the CI tests? Thank you very much.

[elakkuvan-r]

Fixed — poetry.lock regenerated (poetry 2.4.1, matching CI) to include the whisper-misp dependency; that was the cause of all the failing jobs (pyproject.toml changed significantly since poetry.lock was last generated). Thanks for the review, @adulau!

[adulau]

Thank you!