Misp: 4th module type: Warninglist/lookup module

[iglocska]

the idea would be (for massive databases such as known good hashes) to have a module that would - on attribute view - pass values of certain types of attributes to a fast query system and check whether the value exists. If yes, add a warning.

[Rafiot]

Practical example: NSRL

[adulau]

Another example that would benefit from this, it's an automatic geographical lookup using the Maxmind local database to have a complete view of all geographic localization when viewing an event. There is not a warning but a list of results to display.