IOC check: match IaC, container and dependency sources against threat feeds (#110)

[ms280690]

Closes #110. Stacked on #153 (issue-109-threat-feeds); retarget to main once that merges.

What

• .github/actions/ioc-check: stdlib-only ioc_check.py extracts IPv4 addresses, CIDRs, hostnames and URLs from selected files and matches them against threatfox.json, feodo.json and urlhaus.json. Categories: c2-ip (Feodo and ThreatFox ip), c2-domain (ThreatFox domain, subdomains included), malware-url (ThreatFox and URLhaus url). A source CIDR that contains a feed address counts. RFC 1918, loopback, link-local, RFC 5737, 0.0.0.0/8, CGNAT, multicast and 0.0.0.0/0 never match on either side. Malware URLs with a path are redacted to <feed>#<id> in annotations, summary, report and findings.json.
• Files come from git ls-files, or git diff --name-only <base-sha> HEAD on PRs, filtered by include and exclude globs (defaults cover Terraform, CDK, Dockerfiles, YAML/JSON/TOML and lockfiles; skip node_modules, .terraform, vendor, tests). block-on picks which categories fail; empty is advisory. Outputs match-count, blocking-count, report-path.
• ioc-check.yml reusable workflow: snapshot via the threat-feeds composite (feeds-ref), composite on changed files for PRs, ioc-check artefact, and one PR comment found by its <!-- ioc-check --> marker and edited in place (a clean run rewrites it to "no indicators matched"). Skipped on fork PRs. Caller grants pull-requests: write for the comment.
• normalize.py: ThreatFox entries keep the IOC id in meta.id so the redaction can cite it (URLhaus already had one).
• CI: new IOC Check job runs the fixture suite, scans the whole repo against the fixture feeds (must be clean), then the live snapshot in advisory mode once threat-feeds-latest exists (same skip pattern as the Threat Feeds job).
• README rows and "IOC Check (threat feeds)" section; docs/egress-allowlist.md row.

Tests

tests/ioc-check/run.sh with fixture feeds (class E addresses and .example domains) and one source fixture per extractor row of the issue: Terraform security-group CIDR and DNS record, Dockerfile FROM and curl, Helm hostAliases, package.json git URL and malware URL, go.mod replace, plus a negatives file with private, documentation, loopback and 0.0.0.0/0 values that the fixture feeds also list. Asserts the exact match set with file:line, CIDR containment, redaction in every output, advisory and subset block-on, include and exclude globs, --files-from, a clean tree and exit codes.

Deferred

• Seeded-fixture run against a Sparkgeo IaC repo and the first live-snapshot CI run wait for feat(#109): daily threat-feeds mirror and threat-feeds composite #153 to merge and the mirror to publish.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF