Add Signal and IRC workflow action modules

README.md

@@ -263,12 +263,14 @@ For further Information see the [license file](https://misp.github.io/misp-modul
 ### Action Modules
 * [CrowdStrike IOC Publish](https://misp.github.io/misp-modules/action_mod/#crowdstrike-ioc-publish) - Create and renew module-owned Falcon custom IOCs from MISP event and object attributes.
 * [Export to Sentinel or Defender](https://misp.github.io/misp-modules/action_mod/#export-to-sentinel-or-defender) - Export indicators to Microsoft Sentinel or Microsoft Defender. Requires an existing installation of MISP2Sentinel or MISP2Defender.
+* [IRC](https://misp.github.io/misp-modules/action_mod/#irc) - Send a message to an IRC channel.
 * [Matrix](https://misp.github.io/misp-modules/action_mod/#matrix) - Send a message to an unencrypted Matrix room.
 * [Mattermost](https://misp.github.io/misp-modules/action_mod/#mattermost) - Simplistic module to send message to a Mattermost channel.
 * [Nextcloud talk](https://misp.github.io/misp-modules/action_mod/#nextcloud-talk) - Simplistic module to send a message to a Nextcloud talk conversation.
 * [OSQuery Pack Publish](https://misp.github.io/misp-modules/action_mod/#osquery-pack-publish) - Publish a MISP query pack to a configured local osquery pack directory.
 * [QRadar Reference Set Publish](https://misp.github.io/misp-modules/action_mod/#qradar-reference-set-publish) - Publish typed MISP indicators to an existing QRadar reference set and explicit domain.
 * [SentinelOne IOC Publish](https://misp.github.io/misp-modules/action_mod/#sentinelone-ioc-publish) - Publish MISP event and object indicators to SentinelOne Threat Intelligence with explicit scope.
+* [Signal](https://misp.github.io/misp-modules/action_mod/#signal) - Send a message to Signal recipients or a group through signal-cli-rest-api.
 * [Slack](https://misp.github.io/misp-modules/action_mod/#slack) - Simplistic module to send messages to a Slack channel.
 * [Test action](https://misp.github.io/misp-modules/action_mod/#test-action) - This module is merely a test, always returning true. Triggers on event publishing.
 * [Wazuh CDB Publish](https://misp.github.io/misp-modules/action_mod/#wazuh-cdb-publish) - Upload MISP event and object indicators to an explicitly named Wazuh CDB source list.

documentation/README.md

@@ -4642,6 +4642,28 @@ Create and renew module-owned Falcon custom IOCs from MISP event and object attr
 
 -----
 
+#### [IRC](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/irc.py)
+
+Send a message to an IRC channel.
+[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/irc.py)]
+
+- **features**:
+>Renders Jinja2 templates using matchingData when present, otherwise data, with a JSON fallback. Supports verified TLS, server passwords and channel keys. Splits multiline and long UTF-8 messages into IRC PRIVMSG lines. See the [usage guide](https://github.com/MISP/misp-modules/blob/main/documentation/action_mod/irc.md).
+
+- **config**:
+>{'params': {'irc_server': {'type': 'string', 'description': 'IRC server hostname', 'value': 'irc.example.org'}, 'irc_port': {'type': 'string', 'description': 'IRC server port', 'value': '6697'}, 'use_tls': {'type': 'string', 'description': 'true for verified TLS, false for a plaintext connection', 'value': 'true'}, 'nickname': {'type': 'string', 'description': 'Nickname for this connection', 'value': 'misp'}, 'channel': {'type': 'string', 'description': 'IRC channel to join', 'value': '#misp'}, 'server_password': {'type': 'string', 'description': 'Optional server PASS password', 'value': ''}, 'channel_key': {'type': 'string', 'description': 'Optional channel JOIN key', 'value': ''}, 'message_template': {'type': 'large_string', 'description': 'Jinja2 message template; leave empty to send the workflow data as JSON', 'value': 'MISP event: {{ Event.info }}', 'jinja_supported': True}}, 'blocking': False, 'support_filters': True, 'expect_misp_core_format': False}
+
+- **input**:
+>Workflow data or matchingData, and an optional Jinja2 message template.
+
+- **output**:
+>Boolean success after server processing; IRC provides no recipient delivery receipt.
+
+- **references**:
+>https://modern.ircdocs.horse/
+
+-----
+
 #### [Matrix](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/matrix.py)
 
 Send a message to an unencrypted Matrix room.
@@ -4773,6 +4795,32 @@ Publish MISP event and object indicators to SentinelOne Threat Intelligence with
 
 -----
 
+#### [Signal](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/signal.py)
+
+Send a message to Signal recipients or a group through signal-cli-rest-api.
+[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/signal.py)]
+
+- **features**:
+>Renders Jinja2 templates using matchingData when present, otherwise data, with a JSON fallback. Sends plain-text messages through POST /v2/send. See the [usage guide](https://github.com/MISP/misp-modules/blob/main/documentation/action_mod/signal.md).
+
+- **config**:
+>{'params': {'signal_api_url': {'type': 'string', 'description': 'Base URL of your signal-cli-rest-api service, including any proxy path prefix', 'value': 'http://localhost:8080'}, 'sender_number': {'type': 'string', 'description': 'Registered or linked Signal account number in international format, e.g. +33123456789'}, 'recipients': {'type': 'string', 'description': 'Comma-separated international phone numbers or signal-cli-rest-api group IDs (group.…)'}, 'message_template': {'type': 'large_string', 'description': 'Jinja2 message template; leave empty to send the workflow data as JSON', 'value': 'MISP event: {{ Event.info }}', 'jinja_supported': True}}, 'blocking': False, 'support_filters': True, 'expect_misp_core_format': False}
+
+- **input**:
+>Workflow data or matchingData, and an optional Jinja2 message template.
+
+- **output**:
+>Boolean success; errors indicate an unsuccessful or unacknowledged send.
+
+- **references**:
+>https://github.com/bbernhard/signal-cli-rest-api
+
+- **requirements**:
+> - requests
+> - A configured signal-cli-rest-api service with a registered or linked account
+
+-----
+
 #### [Slack](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/slack.py)
 
 Simplistic module to send messages to a Slack channel.

documentation/action_mod/irc.md

@@ -0,0 +1,41 @@
+# IRC action module
+
+Send a plain-text message from a MISP workflow to an IRC channel. The action
+follows the Mattermost module's template and workflow data conventions. It uses
+Python's standard library, so no extra IRC client dependency is needed.
+
+| Parameter | Description |
+| --- | --- |
+| `irc_server` | Server hostname, without a URL scheme. |
+| `irc_port` | Server port; defaults to `6697`. Set `6667` explicitly for a typical plaintext server. |
+| `use_tls` | `true` (default) uses TLS with certificate and hostname verification. `false` selects plaintext. |
+| `nickname` | Nickname for the connection; must be available on the server. |
+| `channel` | One channel starting with `#` or `&`, such as `#misp`. |
+| `server_password` | Optional server password, sent using `PASS`. |
+| `channel_key` | Optional channel key, sent with `JOIN`. |
+| `message_template` | Optional Jinja2 template. Empty or omitted sends JSON inside triple backticks. |
+
+For example, use `MISP event {{ Event.id }}: {{ Event.info }}` when the workflow
+supplies an `Event` object. Templates use `matchingData` whenever that key is
+present, including an empty value; otherwise they use `data`. Workflow filters
+are supported.
+
+Each invocation connects, registers, joins the channel, sends `PRIVMSG` lines,
+and disconnects. The connection answers server `PING` messages. It waits for
+registration and its own channel join before sending. Newlines become separate
+messages, tabs become spaces, and long lines split at UTF-8 character boundaries
+to fit IRC's 512-byte command limit. Empty lines are omitted. Other control
+characters, including CTCP framing, are rejected. Markdown markers are literal.
+
+After sending, the action waits for a server `PONG` to a unique token to observe
+errors from preceding commands before reporting success. IRC provides no
+recipient delivery receipt; a successful result means the server processed the
+commands without returning an error. Connection failures, nickname collisions,
+channel access errors and send rejections return `data: false` without server
+error text or credentials. The operation has a 30-second I/O budget, with no
+automatic retries. Like Mattermost, this action is nonblocking.
+
+Choose a channel the account can join and write to. SASL, NickServ authentication
+and client certificates are unsupported. Each invocation needs an available
+nickname; concurrent runs using the same nickname can collide. Keep templates
+concise and account for your IRC network's flood limits when scheduling workflows.

documentation/action_mod/signal.md

@@ -0,0 +1,38 @@
+# Signal action module
+
+Send a plain-text message from a MISP workflow to Signal phone numbers or a group.
+The action follows the Mattermost module's template and workflow data conventions.
+It uses the existing `requests` dependency with
+[signal-cli-rest-api](https://github.com/bbernhard/signal-cli-rest-api).
+
+Run a signal-cli-rest-api service reachable from the module server, and register
+or link the sending account there. The account must already belong to any target
+group. Use the service's group listing endpoint to obtain the group's `id`, with
+the `group.` prefix. Account registration, linking and group management are done
+in that service, outside this action.
+
+| Parameter | Description |
+| --- | --- |
+| `signal_api_url` | Service base URL, such as `http://localhost:8080`. Include any reverse proxy path prefix; omit `/v2/send`. HTTPS URLs are also supported. |
+| `sender_number` | Registered or linked account number in international format, such as `+33123456789`. |
+| `recipients` | Comma-separated international phone numbers or `group.…` IDs returned by signal-cli-rest-api. |
+| `message_template` | Optional Jinja2 template. Empty or omitted sends JSON inside triple backticks. |
+
+For example, use `MISP event {{ Event.id }}: {{ Event.info }}` when the workflow
+supplies an `Event` object. Templates use `matchingData` whenever that key is
+present, including an empty value; otherwise they use `data`. Workflow filters
+are supported. Messages are plain text, so Markdown markers remain literal text.
+
+The action sends `POST /v2/send` with `number`, `recipients` and `message`, using
+a 30-second timeout. Success requires HTTP 201, a positive `timestamp`, and an
+absent or empty `errors` field in the response. Recipient errors, including
+partial failures with a valid timestamp, return `data: false`. A successful
+response acknowledges the service's send operation, not recipient delivery.
+Errors are reported without exposing phone numbers or the response body.
+Requests are not automatically retried; a timeout can leave delivery uncertain.
+Like Mattermost, this action is nonblocking.
+
+The API service handles Signal account keys and sees the workflow message in
+plain text before Signal encrypts it. Keep access to that service restricted to
+trusted clients. This action targets the service's native API and does not
+configure authentication for a reverse proxy.

documentation/mkdocs/action_mod.md

@@ -27,6 +27,28 @@ Create and renew module-owned Falcon custom IOCs from MISP event and object attr
 
 -----
 
+#### [IRC](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/irc.py)
+
+Send a message to an IRC channel.
+[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/irc.py)]
+
+- **features**:
+>Renders Jinja2 templates using matchingData when present, otherwise data, with a JSON fallback. Supports verified TLS, server passwords and channel keys. Splits multiline and long UTF-8 messages into IRC PRIVMSG lines. See the [usage guide](https://github.com/MISP/misp-modules/blob/main/documentation/action_mod/irc.md).
+
+- **config**:
+>{'params': {'irc_server': {'type': 'string', 'description': 'IRC server hostname', 'value': 'irc.example.org'}, 'irc_port': {'type': 'string', 'description': 'IRC server port', 'value': '6697'}, 'use_tls': {'type': 'string', 'description': 'true for verified TLS, false for a plaintext connection', 'value': 'true'}, 'nickname': {'type': 'string', 'description': 'Nickname for this connection', 'value': 'misp'}, 'channel': {'type': 'string', 'description': 'IRC channel to join', 'value': '#misp'}, 'server_password': {'type': 'string', 'description': 'Optional server PASS password', 'value': ''}, 'channel_key': {'type': 'string', 'description': 'Optional channel JOIN key', 'value': ''}, 'message_template': {'type': 'large_string', 'description': 'Jinja2 message template; leave empty to send the workflow data as JSON', 'value': 'MISP event: {{ Event.info }}', 'jinja_supported': True}}, 'blocking': False, 'support_filters': True, 'expect_misp_core_format': False}
+
+- **input**:
+>Workflow data or matchingData, and an optional Jinja2 message template.
+
+- **output**:
+>Boolean success after server processing; IRC provides no recipient delivery receipt.
+
+- **references**:
+>https://modern.ircdocs.horse/
+
+-----
+
 #### [Matrix](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/matrix.py)
 
 Send a message to an unencrypted Matrix room.
@@ -158,6 +180,32 @@ Publish MISP event and object indicators to SentinelOne Threat Intelligence with
 
 -----
 
+#### [Signal](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/signal.py)
+
+Send a message to Signal recipients or a group through signal-cli-rest-api.
+[[source code](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/signal.py)]
+
+- **features**:
+>Renders Jinja2 templates using matchingData when present, otherwise data, with a JSON fallback. Sends plain-text messages through POST /v2/send. See the [usage guide](https://github.com/MISP/misp-modules/blob/main/documentation/action_mod/signal.md).
+
+- **config**:
+>{'params': {'signal_api_url': {'type': 'string', 'description': 'Base URL of your signal-cli-rest-api service, including any proxy path prefix', 'value': 'http://localhost:8080'}, 'sender_number': {'type': 'string', 'description': 'Registered or linked Signal account number in international format, e.g. +33123456789'}, 'recipients': {'type': 'string', 'description': 'Comma-separated international phone numbers or signal-cli-rest-api group IDs (group.…)'}, 'message_template': {'type': 'large_string', 'description': 'Jinja2 message template; leave empty to send the workflow data as JSON', 'value': 'MISP event: {{ Event.info }}', 'jinja_supported': True}}, 'blocking': False, 'support_filters': True, 'expect_misp_core_format': False}
+
+- **input**:
+>Workflow data or matchingData, and an optional Jinja2 message template.
+
+- **output**:
+>Boolean success; errors indicate an unsuccessful or unacknowledged send.
+
+- **references**:
+>https://github.com/bbernhard/signal-cli-rest-api
+
+- **requirements**:
+> - requests
+> - A configured signal-cli-rest-api service with a registered or linked account
+
+-----
+
 #### [Slack](https://github.com/MISP/misp-modules/tree/main/misp_modules/modules/action_mod/slack.py)
 
 Simplistic module to send messages to a Slack channel.

documentation/mkdocs/index.md

@@ -198,12 +198,14 @@ For more information: [Extending MISP with Python modules](https://www.misp-proj
 
 ### Action Modules
 * [CrowdStrike IOC Publish](https://misp.github.io/misp-modules/action_mod/#crowdstrike-ioc-publish) - Create and renew module-owned Falcon custom IOCs from MISP event and object attributes.
+* [IRC](https://misp.github.io/misp-modules/action_mod/#irc) - Send a message to an IRC channel.
 * [Matrix](https://misp.github.io/misp-modules/action_mod/#matrix) - Send a message to an unencrypted Matrix room.
 * [Mattermost](https://misp.github.io/misp-modules/action_mod/#mattermost) - Simplistic module to send message to a Mattermost channel.
 * [Nextcloud talk](https://misp.github.io/misp-modules/action_mod/#nextcloud-talk) - Simplistic module to send a message to a Nextcloud talk conversation.
 * [OSQuery Pack Publish](https://misp.github.io/misp-modules/action_mod/#osquery-pack-publish) - Publish a MISP query pack to a configured local osquery pack directory.
 * [QRadar Reference Set Publish](https://misp.github.io/misp-modules/action_mod/#qradar-reference-set-publish) - Publish typed MISP indicators to an existing QRadar reference set and explicit domain.
 * [SentinelOne IOC Publish](https://misp.github.io/misp-modules/action_mod/#sentinelone-ioc-publish) - Publish MISP event and object indicators to SentinelOne Threat Intelligence with explicit scope.
+* [Signal](https://misp.github.io/misp-modules/action_mod/#signal) - Send a message to Signal recipients or a group through signal-cli-rest-api.
 * [Slack](https://misp.github.io/misp-modules/action_mod/#slack) - Simplistic module to send messages to a Slack channel.
 * [Test action](https://misp.github.io/misp-modules/action_mod/#test-action) - This module is merely a test, always returning true. Triggers on event publishing.
 * [Wazuh CDB Publish](https://misp.github.io/misp-modules/action_mod/#wazuh-cdb-publish) - Upload MISP event and object indicators to an explicitly named Wazuh CDB source list.