Add Flowtriq analyzer for DDoS threat intelligence

[jacob-masse]

Summary

• Adds a new analyzer that queries the Flowtriq API to check whether an IP address has been observed as a source or target of DDoS attacks
• Returns structured enrichment data: risk score (0-100), attack families (DNS amplification, NTP reflection, SYN flood, etc.), severity breakdown, peak traffic rates, ASN/country, and related attacker IPs
• Extracts co-occurring attacker IPs as artifacts for pivot investigation
• Includes proper error handling for authentication failures, rate limits, and API errors

Use case

SOC analysts investigating IPs involved in network-layer attacks can use this analyzer to quickly determine whether an IP has known DDoS attack history, what attack vectors it has been associated with, and what other IPs have participated in the same attack campaigns.

Files

• analyzers/Flowtriq/Flowtriq.json - Cortex descriptor
• analyzers/Flowtriq/flowtriq_analyzer.py - Analyzer implementation
• analyzers/Flowtriq/requirements.txt - Dependencies (cortexutils, requests)
• analyzers/Flowtriq/README.md - Configuration documentation
• analyzers/Flowtriq/assets/flowtriq.png - Service logo

Test plan

• Verify analyzer loads in Cortex with valid API key configuration
• Test with known DDoS source IP to confirm enrichment data returns correctly
• Test with clean IP to confirm safe/no-data response
• Test with invalid API key to confirm proper error handling
• Verify taxonomies display correctly in TheHive observable view