index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>LimaCharlie IaC Generator</title>
    <link rel="icon" type="image/x-icon" href="https://storage.googleapis.com/limacharlie-io/favicon.png">
    <link rel="stylesheet" href="css/styles.css">
    <script src="js/script.js"></script>
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js"></script>
    <script src="https://cdn.jsdelivr.net/npm/prismjs/prism.js"></script>
    <script src="https://cdn.jsdelivr.net/npm/prismjs/plugins/line-numbers/prism-line-numbers.js"></script>
    <script src="https://cdn.jsdelivr.net/npm/prismjs/components/prism-yaml.min.js"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/js-yaml/4.1.0/js-yaml.min.js"></script>
    <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
    <link href="https://cdn.jsdelivr.net/npm/prismjs/themes/prism.css" rel="stylesheet">
    <link href="https://cdn.jsdelivr.net/npm/prismjs/plugins/line-numbers/prism-line-numbers.css" rel="stylesheet">
    <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css" rel="stylesheet">
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css">
    <!-- Google Tag Manager -->
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
    new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
    })(window,document,'script','dataLayer','GTM-TJRD9PG');</script>
    <!-- End Google Tag Manager -->
</head>
<body>
    <div class="container">
        <div class="app-version"></div>
        <h1>LimaCharlie IaC Generator</h1>

        <!-- To contribute, read the tips in the corresponding sections below -->

        <!-- Navigation Tabs -->
        <ul class="nav nav-tabs">
            <li class="active"><a data-toggle="tab" href="#about">About</a></li>
            <li><a data-toggle="tab" href="#preconfigured">Preconfigured Templates</a></li>
            <li><a data-toggle="tab" href="#api-resources">API Resources</a></li>
            <li><a data-toggle="tab" href="#lookup-resources">Lookup Resources</a></li>
            <li><a data-toggle="tab" href="#extensions">Extensions</a></li>
            <li><a data-toggle="tab" href="#artifact-collection">Artifact Collection</a></li>
            <li>
                <a data-toggle="tab" href="#user-inputs">User Inputs 
                    <span id="user-inputs-badge" class="badge">0</span>
                </a>
            </li>
            <li><a data-toggle="tab" href="#generated-template">Generated Template</a></li>
        </ul>

        <form id="yamlForm">
            <div class="tab-content">
                <!-- About Tab -->
                <div id="about" class="tab-pane fade in active">
                    <fieldset>
                        <legend>About</legend>
                        <div id="about-content">
                            <!-- README.md content will be injected here -->
                        </div>
                    </fieldset>
                </div>
                <!-- Preconfigured Templates Tab -->
                <!-- How to contribute a template
                    To add a new Preconfigured Template:
                        1. First place your new template in ./templates/
                            a. Ensure your template is self-describing using # Comments above the actual YAML. This is how the hoverover description is generated.
                            b. Make sure your YAML is valid: https://www.yamllint.com/
                            c. Make sure your template includes any required extensions/add-ons required for its functionality.
                        2. Within the <div class="multi-column"> section below, copy an existing code block and paste it after the existing ones. Tweak it to match your new template.
                        3. In your own dev environment, test that the app properly merges/unmerges your template without issue.
                            a. Does the hoverover description populate?
                            b. Do the required add-ons get enabled on their corresponding tabs?
                            c. etc.
                -->
                <div id="preconfigured" class="tab-pane fade">
                    <fieldset>
                        <legend>Preconfigured Templates</legend>
                        <div>
                            <div class="multi-column">
                                <label id="dfir-label" title="DFIR Automation"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    data-content="This template demonstrates the powerful DFIR extensions available in LimaCharlie.">
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="automate-dfir"
                                        id="automate-dfir"
                                        data-template-path="./templates/automate-dfir.yaml"
                                    >
                                    DFIR Automation
                                </label>
                                <br>

                                <label id="ps-transcripts-label" title="Acquire PowerShell Transcripts"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    data-content="This template sets up the necessary configuration to acquire PowerShell transcripts.">
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="acquire-ps-transcripts"
                                        id="automate-ps-transcripts"
                                        data-template-path="./templates/acquire-ps-transcripts.yaml"
                                    >
                                    Acquire PowerShell Transcripts
                                </label>
                                <br>

                                <label id="yara-ruleset-label" title="Leverage Elastic YARA Ruleset"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="leverage-elastic-yara"
                                        id="leverage-elastic-yara"
                                        data-template-path="./templates/leverage-elastic-yara.yaml"
                                    >
                                    Leverage Elastic YARA Ruleset
                                </label>
                                <br>

                                <label id="auto-tag-systems-label" title="Auto-Tag Systems"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="auto-tag-systems"
                                        id="auto-tag-systems"
                                        data-template-path="./templates/auto-tag-systems.yaml"
                                    >
                                    Auto-Tag Systems
                                </label>
                                <br>

                                <label id="informational-detections-label" title="Informational Detections"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="informational-detections"
                                        id="informational-detections"
                                        data-template-path="./templates/informational-detection-rules.yaml"
                                    >
                                    Informational Detections
                                </label>
                                <br>

                                <label id="generic-detection-rules-label" title="Generic Detection Rules"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="generic-detection-rules"
                                        id="generic-detection-rules"
                                        data-template-path="./templates/generic-detection-rules.yaml"
                                    >
                                    Generic Detection Rules
                                </label>
                                <br>

                                <label id="use-lookups-label" title="Use Lookups"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="use-lookups"
                                        id="use-lookups"
                                        data-template-path="./templates/use-lookups.yaml"
                                    >
                                    Use Lookups
                                </label>
                                <br>

                                <label id="yara-scan-webroot-label" title="YARA Scan Webroot"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="yara-scan-webroot"
                                        id="yara-scan-webroot"
                                        data-template-path="./templates/yara-scan-webroot.yaml"
                                    >
                                    YARA Scan Webroot
                                </label>
                                <br>

                                <label id="windows-defender-detection-rules-label" title="Windows Defender Detection Rules"
                                    data-toggle="popover"
                                    data-trigger="hover"
                                    data-placement="bottom"
                                    >
                                    <input type="checkbox"
                                        class="template-checkbox"
                                        name="windows-defender-detection-rules"
                                        id="windows-defender-detection-rules"
                                        data-template-path="./templates/windows-defender-detection-rules.yaml"
                                    >
                                    Windows Defender Detection Rules
                                </label>
                                <br>

                            </div>
                        </div>
                    </fieldset>
                </div>
                <!-- API Resources Tab -->
                <!-- How to contribute new API resource
                        1. Simply copy/paste a new code section from the list below.
                        2. Set the "title" to match the text at the end of the line.
                        3. Ensure the "value" matches exactly the YAML object that should be inserted into the generated YAML.
                -->
                <div id="api-resources" class="tab-pane fade">
                    <fieldset>
                    <legend>API Resources</legend>
                    <div class="select-all-container">
                        <label>
                            <input type="checkbox" id="selectAllApi" onclick="toggleSelectAll(this, 'api-resources')"> Select All
                        </label>
                    </div>
                    <div class="multi-column">
                        <label title="Alphamountain Category API" data-content="Query domains at alphamountain." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-alphamountain-category" name="api" value="alphamountain-category" 
                                user-inputs='[
                                    {"id": "alphamountain-api-key", "desc": "Alphamountain API Key", "path": "org-value.alphamountain"}
                                ]'> Alphamountain Category
                        </label><br>
                        
                        <label title="Alphamountain Popularity API" data-content="Query domains at alphamountain." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-alphamountain-popularity" name="api" value="alphamountain-popularity" 
                                user-inputs='[
                                    {"id": "alphamountain-api-key", "desc": "Alphamountain API Key", "path": "org-value.alphamountain"}
                                ]'> Alphamountain Popularity
                        </label><br>
                        
                        <label title="Alphamountain Threat API" data-content="Query domains at alphamountain." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-alphamountain-threat" name="api" value="alphamountain-threat" 
                                user-inputs='[
                                    {"id": "alphamountain-api-key", "desc": "Alphamountain API Key", "path": "org-value.alphamountain"}
                                ]'> Alphamountain Threat
                        </label><br>
                        
                        <label title="Echotrail Insights API" data-content="EchoTrail is an API service that allows you to perform a lookup of a file name or hash value. EchoTrail will return a summary of statistical details that describes the behavior of the submitted value, as observed from their sensors over time." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-echotrail-insights" name="api" value="echotrail-insights" 
                                user-inputs='[
                                    {"id": "echotrail-api-key", "desc": "EchoTrail API Key", "path": "org-value.echotrail"}
                                ]'> EchoTrail Insights
                        </label><br>
                        
                        <label title="Greynoise Noise Context API" data-content="Get more information about a given IP address. Returns time ranges, IP metadata (network owner, ASN, reverse DNS pointer, country), associated actors, activity tags, and raw port scan and web request information." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-greynoise-noise-context" name="api" value="greynoise-noise-context" 
                                user-inputs='[
                                    {"id": "greynoise-api-key", "desc": "Greynoise API Key", "path": "org-value.greynoise"}
                                ]'> Greynoise Noise Context
                        </label><br>
                        
                        <label title="Greynoise Riot API" data-content="RIOT identifies IPs from known benign services and organizations that commonly cause false positives in network security and threat intelligence products. The collection of IPs in RIOT is continually curated and verified to provide accurate results." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-greynoise-riot" name="api" value="greynoise-riot" 
                                user-inputs='[
                                    {"id": "greynoise-api-key", "desc": "Greynoise API Key", "path": "org-value.greynoise"}
                                ]'> Greynoise Riot
                        </label><br>
                        
                        <label title="Hybrid Analysis Overview API" data-content="Hybrid Analysis, aka Falcon Sandbox, is a powerful, free malware analysis service for the community that detects and analyzes unknown threats. The Search API accepts a SHA256 value, and provides an extensive overview of a hash (if previously observed by the platform)." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-hybrid-analysis-overview" name="api" value="hybrid-analysis-overview" 
                                user-inputs='[
                                    {"id": "hybrid-analysis-api-key", "desc": "Hybrid Analysis API Key", "path": "org-value.hybrid-analysis"}
                                ]'> Hybrid Analysis Overview
                        </label><br>
                        
                        <label title="Hybrid Analysis Search API" data-content="Hybrid Analysis, aka Falcon Sandbox, is a powerful, free malware analysis service for the community that detects and analyzes unknown threats. The Search lookup provides a basic lookup of a hash value." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-hybrid-analysis-search" name="api" value="hybrid-analysis-search" 
                                user-inputs='[
                                    {"id": "hybrid-analysis-api-key", "desc": "Hybrid Analysis API Key", "path": "org-value.hybrid-analysis"}
                                ]'> Hybrid Analysis Search
                        </label><br>                        
                        
                        <label title="Insight API" data-content="Insight provides storage, retention and searching of all data for up to one year." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-insight" name="api" value="insight"> Insight
                        </label><br>
                        
                        <label title="IP Geo API" data-content="API to perform IP Geolocation in D&R rules. Data provided by https://maxmind.com/." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-ip-geo" name="api" value="ip-geo"> IP Geo
                        </label><br>
                        
                        <label title="Pangea Domain Reputation API" data-content="The Domain Intel service allows you to retrieve intelligence about known domain names, giving you insight into the reputation of a domain." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-pangea-domain-reputation" name="api" value="pangea-domain-reputation" 
                                user-inputs='[
                                    {"id": "pangea-api-key", "desc": "Pangea API Key", "path": "org-value.pangea"}
                                ]'> Pangea Domain Reputation
                        </label><br>
                        
                        <label title="Pangea File Reputation API" data-content="The File Intel service enables you to submit a file's hash and get the file's attributes back - giving you insight into the disposition of the file." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-pangea-file-reputation" name="api" value="pangea-file-reputation" 
                                user-inputs='[
                                    {"id": "pangea-api-key", "desc": "Pangea API Key", "path": "org-value.pangea"}
                                ]'> Pangea File Reputation
                        </label><br>
                        
                        <label title="Pangea IP Reputation API" data-content="The IP Intel service allows you to retrieve security information about known IP addresses that have been collected across the internet for several decades, giving you insight into the reputation of an IP." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-pangea-ip-reputation" name="api" value="pangea-ip-reputation" 
                                user-inputs='[
                                    {"id": "pangea-api-key", "desc": "Pangea API Key", "path": "org-value.pangea"}
                                ]'> Pangea IP Reputation
                        </label><br>
                        
                        <label title="Pangea URL Reputation API" data-content="The URL Intel service allows you to retrieve intelligence about known URLs, giving you insight into the reputation of a URL." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-pangea-url-reputation" name="api" value="pangea-url-reputation" 
                                user-inputs='[
                                    {"id": "pangea-api-key", "desc": "Pangea API Key", "path": "org-value.pangea"}
                                ]'> Pangea URL Reputation
                        </label><br>
                        
                        <label title="Pangea User Reputation API" data-content="The User Intel service allows you to check a large repository of breach data to see if a user’s Personally Identifiable Data (PII) or credentials have been compromised." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-pangea-user-reputation" name="api" value="pangea-user-reputation" 
                                user-inputs='[
                                    {"id": "pangea-api-key", "desc": "Pangea API Key", "path": "org-value.pangea"} 
                                ]'> Pangea User Reputation
                        </label><br>                                       
                        
                        <label title="VirusTotal API" data-content="VirusTotal is an API that can be queried for AntiVirus results of a file by hash. Set the VirusTotal API Key in the Integrations section of your organization. Provided by https://virustotal.com/." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="api-vt" name="api" value="vt" 
                                user-inputs='[
                                    {"id": "vt-api-key", "desc": "VirusTotal API Key", "path": "org-value.vt"}
                                ]'> VirusTotal
                        </label><br>
                    </div>
                    </fieldset>
                </div>
                <!-- Lookup Resources Tab -->
                <!-- How to contribute new Lookup resource
                        1. Simply copy/paste a new code section from the list below.
                        2. Set the "label title" to match the text at the end of the line.
                        3. Ensure the "value" matches exactly the YAML object that should be inserted into the generated YAML.
                -->
                <div id="lookup-resources" class="tab-pane fade">
                    <fieldset>
                        <legend>Lookup Resources</legend>
                        <div class="select-all-container">
                            <label>
                                <input type="checkbox" id="selectAllLookup" onclick="toggleSelectAll(this, 'lookup-resources')"> Select All
                            </label>
                        </div>
                        <div class="multi-column">
                        <label title="AdLoad Mac IOCs" data-content="AdLoad Mac Malware IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-adload-mac-iocs" name="lookup" value="adload-mac-iocs"> AdLoad Mac IOCs
                        </label><br>

                        <label title="AlienVault IP Reputation" data-content="Lookup of disreputable IPs according to the OTX IP Reputation list." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-alienvault-ip-reputation" name="lookup" value="alienvault-ip-reputation"> AlienVault IP Reputation
                        </label><br>

                        <label title="Amnesty International MFA Phishing" data-content="Lookup of reported 2FA / MFA Phishing attacks in Middle East and North Africa from Amnesty International." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-amnesty-international-mfa-phishing" name="lookup" value="amnesty-international-mfa-phishing"> Amnesty International MFA Phishing
                        </label><br>

                        <label title="APT28 2018-10-29 22:03 GMT" data-content="Lookup of IP / Domains correlated to APT28 espionage campaigns up to October 29 2018 (22:03 GMT)." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-apt28-201810292203gmt" name="lookup" value="apt28-201810292203gmt"> APT28 2018-10-29 22:03 GMT
                        </label><br>

                        <label title="APT29 IOCs" data-content="APT29 Command and Control IPs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-apt29-iocs" name="lookup" value="apt29-iocs"> APT29 IOCs
                        </label><br>

                        <label title="Badies" data-content="Attacking IPs detected by NIDS Sensors in EU countries" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-badies" name="lookup" value="badies"> Badies
                        </label><br>

                        <label title="BSL Malware Domains" data-content="List of malware domains found in OSINT feeds." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-bslmaldomains" name="lookup" value="bslmaldomains"> BSL Malware Domains
                        </label><br>

                        <label title="BSL Malware Hashes" data-content="Malware file hashes gathered from open-source." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-bslmalhashes" name="lookup" value="bslmalhashes"> BSL Malware Hashes
                        </label><br>

                        <label title="China Malware Comms 2019-01-02 10:00" data-content="Lookup of IP / Domains correlated to Chinese espionage campaigns up to January 02 2019 (10:00 GMT)." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-china-malware-comms201901021000" name="lookup" value="china-malware-comms201901021000"> China Malware Comms 2019-01-02 10:00
                        </label><br>

                        <label title="China Malware Comms 2019-01-02 10:00 IPs" data-content="Lookup of IPs correlated to Chinese espionage campaigns up to January 02 2019 (10:00 GMT)" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-china-malware-comms201901021000ip" name="lookup" value="china-malware-comms201901021000ip"> China Malware Comms 2019-01-02 10:00 IPs
                        </label><br>

                        <label title="CINS Army" data-content="Chinese Army IP Addresses" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-cins-army" name="lookup" value="cins-army"> CINS Army
                        </label><br>

                        <label title="CloudMensis MacOS IOCs" data-content="CloudMensis macOS IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-cloudmensis-macos-ioc" name="lookup" value="cloudmensis-macos-ioc"> CloudMensis MacOS IOCs
                        </label><br>

                        <label title="CoinBlocker" data-content="Simple lists that can help prevent cryptomining in the browser or other applications." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-coinblocker" name="lookup" value="coinblocker"> CoinBlocker
                        </label><br>

                        <label title="COVID-19 Threat List" data-content="DomainTools COVID-19 Threat List updated every week. Lookup event/DOMAIN_NAME." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-covid19-threatlist-domaintools" name="lookup" value="covid19-threatlist-domaintools"> COVID-19 Threat List
                        </label><br>

                        <label title="Crimeware IPs" data-content="Curated list of IP addresses seen involved in criminal activity. This lookup list is updated 4 times a day." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-crimeware-ips" name="lookup" value="crimeware-ips"> Crimeware IPs
                        </label><br>

                        <label title="Cuba Ransomware IOCs" data-content="Cuba Ransomware IOCs containing hashes and IP addresses" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-cuba-ransomware-iocs" name="lookup" value="cuba-ransomware-iocs"> Cuba Ransomware IOCs
                        </label><br>

                        <label title="Dark Utilities IOCs" data-content="Dark Utilities IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-dark-utilities-iocs" name="lookup" value="dark-utilities-iocs"> Dark Utilities IOCs
                        </label><br>

                        <label title="Dynamic DNS" data-content="Dynamic Domains" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-dyn-dns" name="lookup" value="dyn-dns"> Dynamic DNS
                        </label><br>

                        <label title="Dyre IPs" data-content="Dyre Botnet" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-dyre-ips" name="lookup" value="dyre-ips"> Dyre IPs
                        </label><br>

                        <label title="Espionage 2018-10-07 15:47 GMT" data-content="IP / Domain list correlated to espionage campaigns up to October 07 2018 (15:47 GMT)" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-espionage201810071547gmt" name="lookup" value="espionage201810071547gmt"> Espionage 2018-10-07 15:47 GMT
                        </label><br>

                        <label title="Feodo IPs" data-content="Feodo (Cridex, Bugat) Command & Control" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-feodo-ips" name="lookup" value="feodo-ips"> Feodo IPs
                        </label><br>

                        <label title="FireEye Red Team Hashes IOC" data-content="Hashes IOCs for some of FireEye's Red Team tools" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-fireeye-red-team-hashes-ioc" name="lookup" value="fireeye-red-team-hashes-ioc"> FireEye Red Team Hashes IOC
                        </label><br>

                        <label title="GlobalHash" data-content="Curated list of hashes that have been detected as bad via incident response and submissions. List is updated daily." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-globalhash" name="lookup" value="globalhash"> GlobalHash
                        </label><br>

                        <label title="IP Distributing Linux Malware" data-content="Lookup of IPs known to be distributing Linux malware" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-ip-distributing-linux-malware" name="lookup" value="ip-distributing-linux-malware"> IP Distributing Linux Malware
                        </label><br>

                        <label title="Iran APT Fed Nov 2022 IOCs" data-content="IOCs from Iranian CryptoMining campaign detected on a USA Federal Network" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-iran-apt-fed-nov2022-iocs" name="lookup" value="iran-apt-fed-nov2022-iocs"> Iran APT Fed Nov 2022 IOCs
                        </label><br>

                        <label title="Linux Malware Hashes" data-content="Linux malware hashes (updated hourly)" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-linux-malware-hashes" name="lookup" value="linux-malware-hashes"> Linux Malware Hashes
                        </label><br>

                        <label title="Log4j IOCs" data-content="IP addresses that were seen exploiting the log4j exploit" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-log4j-iocs" name="lookup" value="log4j-iocs"> Log4j IOCs
                        </label><br>

                        <label title="Lojax UEFI Rootkit" data-content="Content of the add-on: C&C IP, DOMAIN, SHA256. UEFI implant for system’s SPI flash memory: This module is able to drop and execute malware on disk during the boot process. This persistence method is particularly invasive as it will not only survive an OS reinstall, but also a hard disk replacement." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-lojax-uefi-rootkit" name="lookup" value="lojax-uefi-rootkit"> Lojax UEFI Rootkit
                        </label><br>

                        <label title="Malware Domains" data-content="Lookup of domains that are known to be used to propagate malware and spyware, created and maintained by the DNS-BH project." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-malwaredomains" name="lookup" value="malwaredomains"> Malware Domains
                        </label><br>

                        <label title="MISP OSINT Feed" data-content="MISP OSINT feed" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-misp" name="lookup" value="misp"> MISP OSINT Feed
                        </label><br>

                        <label title="MoonBounce UEFI Rootkit IOCs" data-content="MoonBounce UEFI Rootkit IOCs - Files, IPs, Domains, Hashes" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-moonbounce-uefi-rootkit-iocs" name="lookup" value="moonbounce-uefi-rootkit-iocs"> MoonBounce UEFI Rootkit IOCs
                        </label><br>

                        <label title="MosaicLoader IOCs" data-content="MosaicLoader Hashes, Domain Names and IP Address" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-mosaicloader-iocs" name="lookup" value="mosaicloader-iocs"> MosaicLoader IOCs
                        </label><br>

                        <label title="MOVEit IOCs" data-content="MOVEit IOCS - IPs, Domain, Hashes" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-moveit-iocs" name="lookup" value="moveit-iocs"> MOVEit IOCs
                        </label><br>

                        <label title="MuddyWater IOCs" data-content="MuddyWater IOC" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-muddywater-ioc" name="lookup" value="muddywater-ioc"> MuddyWater IOCs
                        </label><br>

                        <label title="Mustang Panda APT Korplug Variant IOCs" data-content="Mustang Panda APT Korplug Variant IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-mustang-panda-hodur-korplug-variant-iocs" name="lookup" value="mustang-panda-hodur-korplug-variant-iocs"> Mustang Panda APT Korplug Variant IOCs
                        </label><br>

                        <label title="Mustang Panda APT New IOCs" data-content="Mustang Panda APT New IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-mustang-panda-new-iocs" name="lookup" value="mustang-panda-new-iocs"> Mustang Panda APT New IOCs
                        </label><br>

                        <label title="Nano MountLocker Hashes IOCs" data-content="MountLocker VirtualBox Hashes IOCS" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-nano-mountlocker-hashes-iocs" name="lookup" value="nano-mountlocker-hashes-iocs"> Nano MountLocker Hashes IOCs
                        </label><br>

                        <label title="Nano Public IOCs" data-content="Various IOCs IPs/Domain/Hashes" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-nano-public-ioc" name="lookup" value="nano-public-ioc"> Nano Public IOCs
                        </label><br>

                        <label title="Netfilter Hashes IOCs" data-content="Netfilter Rootkit Hashes" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-netfilter-hashes-iocs" name="lookup" value="netfilter-hashes-iocs"> Netfilter Hashes IOCs
                        </label><br>

                        <label title="Netfilter IP IOCs" data-content="Netfilter IP IOCs as published by Microsoft" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-netfilter-ip-ioc" name="lookup" value="netfilter-ip-ioc"> Netfilter IP IOCs
                        </label><br>

                        <label title="North Korean Malicious Cyber Activity" data-content="The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD) have identified the following malware variants used by the North Korean government." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-northkoreanmaliciouscyberactivity" name="lookup" value="northkoreanmaliciouscyberactivity"> North Korean Malicious Cyber Activity
                        </label><br>

                        <label title="Praying Mantis IOCs" data-content="Praying Mantis Malware IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-praying-mantis-iocs" name="lookup" value="praying-mantis-iocs"> Praying Mantis IOCs
                        </label><br>

                        <label title="Qakbot IOCs" data-content="Qakbot IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-qakbot-iocs" name="lookup" value="qakbot-iocs"> Qakbot IOCs
                        </label><br>

                        <label title="Ransomware Domains" data-content="Lookup of domains related to ransomware." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-ransomware-domains" name="lookup" value="ransomware-domains"> Ransomware Domains
                        </label><br>

                        <label title="RDP Brute Force IPs" data-content="IPs observed targeting RDP servers" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-rdp-brute" name="lookup" value="rdp-brute"> RDP Brute Force IPs
                        </label><br>

                        <label title="Remote Management Tools" data-content="Some remote management tools and Employee monitoring" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-remote-management-tools" name="lookup" value="remote-management-tools"> Remote Management Tools
                        </label><br>

                        <label title="Russia GRU Indictment October 2018" data-content="This Add-on is part of an investigation. Please consider this Add-on as EXPERIMENTAL" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-russia-gru-indictment-october-2018" name="lookup" value="russia-gru-indictment-october-2018"> Russia GRU Indictment October 2018
                        </label><br>

                        <label title="Scam Impersonation" data-content="Lookup of IPs / domains correlated to the scam of IT infrastructure impersonation." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-scam-impersonation" name="lookup" value="scam-impersonation"> Scam Impersonation
                        </label><br>

                        <label title="ScumBots SHA256 Malware Hashes" data-content="This feed scrapes the @ScumBots twitter feed provided by @pmelson and collects the sha256 hashes. It is common for threat actors to host their malicious code on paste sites so that it can then be pulled down and executed with CLI tools such as powershell. Should this lookup trigger an alert, you can reference either https://twitter.com/ScumBots or https://github.com/david-burkett/ScumBots-DataFeed to get more context around the alert itself, such as the C2 channels used and a link to the pastebin with the exact code executed on your organization's system." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-scumbots-sha256-malware-hashes" name="lookup" value="scumbots-sha256-malware-hashes"> ScumBots SHA256 Malware Hashes
                        </label><br>

                        <label title="Silver Sparrow Domains" data-content="IOC For the Silver Sparrow Mac Malware. Domain Lookup" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-silver-sparrow-domains" name="lookup" value="silver-sparrow-domains"> Silver Sparrow Domains
                        </label><br>

                        <label title="Silver Sparrow Files" data-content="IOC For the Silver Sparrow Mac Malware. Lookup files associated with malware" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-silver-sparrow-files" name="lookup" value="silver-sparrow-files"> Silver Sparrow Files
                        </label><br>

                        <label title="Silver Sparrow Hashes" data-content="IOCs for the Silver Sparrow Malware. Hashes lookup" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-silver-sparrow-hashes" name="lookup" value="silver-sparrow-hashes"> Silver Sparrow Hashes
                        </label><br>

                        <label title="SolarMaker IOCs" data-content="SolarMaker Malware IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-solarmaker-iocs" name="lookup" value="solarmaker-iocs"> SolarMaker IOCs
                        </label><br>

                        <label title="SSH Bad List" data-content="Lookup of IPs observed targeting SSH servers" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-ssh-bad-list" name="lookup" value="ssh-bad-list"> SSH Bad List
                        </label><br>

                        <label title="Sunburst Domain IPs C2" data-content="Sunburst IOC C&C IPs/Domains from various resources" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-sunburst-domain-ips-c2" name="lookup" value="sunburst-domain-ips-c2"> Sunburst Domain IPs C2
                        </label><br>

                        <label title="Sunburst Hashes" data-content="Sunburst IOC hashes from https://github.com/fireeye/sunburst_countermeasures/blob/main/indicator_release/Indicator_Release_Hashes.csv" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-sunburst-hashes" name="lookup" value="sunburst-hashes"> Sunburst Hashes
                        </label><br>

                        <label title="TajMahal APT Framework" data-content="Content of the add-on: C&C IP's, DOMAINS, HASHES. Description: ‘TajMahal’ is a previously unknown and technically sophisticated APT framework discovered by Kaspersky Lab in the autumn of 2018. This full-blown spying framework consists of two packages named ‘Tokyo’ and ‘Yokohama’. It includes backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents and cryptography key stealers, and even its own file indexer for the victim’s machine." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-tajmahal-apt-framework" name="lookup" value="tajmahal-apt-framework"> TajMahal APT Framework
                        </label><br>

                        <label title="Talos IP Blacklist" data-content="Lookup of IPs on Cisco Talos' blocklist." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-talos-ip-blacklist" name="lookup" value="talos-ip-blacklist"> Talos IP Blacklist
                        </label><br>

                        <label title="Tarrask Malware IOCs" data-content="Tarrask Malware IOCs - Hashes Only" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-tarrask-malware-ioc" name="lookup" value="tarrask-malware-ioc"> Tarrask Malware IOCs
                        </label><br>

                        <label title="TOR IPs" data-content="Lookup of TOR IPs." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-tor-ips" name="lookup" value="tor-ips"> TOR IPs
                        </label><br>

                        <label title="Trigona Ransomware IOCs" data-content="Trigona Ransomware IOCs. Hashed for the MS SQL Server Attack" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-trigona-ransome-ioc" name="lookup" value="trigona-ransome-ioc"> Trigona Ransomware IOCs
                        </label><br>

                        <label title="XCSET Mac Malware" data-content="XCSET Mac Malware Hash, Domain, IP IOCs" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-xcsset-mac-malware" name="lookup" value="xcsset-mac-malware"> XCSET Mac Malware
                        </label><br>

                        <label title="Yanluowang Hashes IOC" data-content="Hashes for the Yanluowang Ransomware." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-yanluowang-hashes-ioc" name="lookup" value="yanluowang-hashes-ioc"> Yanluowang Hashes IOC
                        </label><br>

                        <label title="Zeus Bad Domains" data-content="Lookup of domains from Zeus Command & Control Servers." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-zeus-bad-domains" name="lookup" value="zeus-bad-domains"> Zeus Bad Domains
                        </label><br>

                        <label title="Zeus Bad IPs" data-content="Lookup of IPs from Zeus Command & Control Servers." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                            <input type="checkbox" id="lookup-zeus-bad-ips" name="lookup" value="zeus-bad-ips"> Zeus Bad IPs
                        </label><br>

                        </div>
                    </fieldset>
                </div>
                <!-- Extensions Tab -->
                <!-- How to contribute new Extension
                        1. Simply copy/paste a new code section from the list below.
                        2. Set the "label title" to match the text at the end of the line, omitting the word "Extension" from the text at the end.
                        3. Ensure the "value" matches exactly the YAML object that should be inserted into the generated YAML.
                -->
                <div id="extensions" class="tab-pane fade">
                    <fieldset>
                        <legend>Extensions</legend>
                        <div class="multi-column">
                            <label title="Artifact Extension" data-content="Provides low-level artifact collection capability which can be configured to run automatically via sensors, or pushed via REST API." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-artifact" name="extensions" value="ext-artifact"> Artifact
                            </label><br>
                            
                            <label title="Atomic Red Team Extension" data-content="Atomic Red Team is a library of tests mapped to the MITRE ATT&CK framework, provided by Red Canary. With this extension, LimaCharlie users can use Atomic Red Team to quickly, portably, and reproducibly test their environments." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-atomic-red-team" name="extensions" value="ext-atomic-red-team"> Atomic Red Team
                            </label><br>
                            
                            <label title="BinLib Extension" data-content="BinLib (Binary Library) is the collection of data and metadata pertaining to executable binaries, such as EXE or ELF files, that have been observed within your organization." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="binlib" name="extensions" value="binlib"> BinLib
                            </label><br>
                            
                            <label title="Cloud CLI Extension" data-content="The Cloud CLI extension allows you to trigger actions within other tools such as AWS, GCP, and DigitalOcean based on events generated in LimaCharlie." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-cloud-cli" name="extensions" value="ext-cloud-cli"> Cloud CLI
                            </label><br>
                            
                            <label title="Dumper Extension" data-content="Memory and MFT dumping." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-dumper" name="extensions" value="ext-dumper"> Dumper
                            </label><br>
                            
                            <label title="Exfil Extension" data-content="Manage which events should get sent from sensors to the cloud in real-time. By default, LimaCharlie sensors send events to the cloud based on a standard profile based on the event types that sensor supports." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-exfil" name="extensions" value="ext-exfil"> Exfil
                            </label><br>
                            
                            <label title="Git Sync Extension" data-content="The Git Sync extension allows organizations to synchronize their LimaCharlie configurations with Git repositories. It supports bidirectional synchronization (push to Git/pull from Git) of various configuration items." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-git-sync" name="extensions" value="ext-git-sync"> Git Sync
                            </label><br>                            
                            
                            <label title="Govee Extension" data-content="The Govee extension allows you to change the color of your Govee lights based on D&R rule actions." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-govee" name="extensions" value="ext-govee" 
                                    user-inputs='[
                                        {"id": "govee-api-key", "desc": "Govee API Key", "path": "hives.secret.govee-api-key.data.secret"},
                                        {"id": "set-value", "path": "hives.secret.govee-api-key.usr_mtd.enabled", "value": true, "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-govee.data.api_key", "value": "hive://secret/govee-api-key", "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-govee.usr_mtd.enabled", "value": true, "hidden": true}
                                    ]'> Govee
                            </label><br>
                            
                            <label title="Hayabusa Extension" data-content="The Hayabusa extension allows you to run Hayabusa against Windows event logs based on D&R rule actions." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-hayabusa" name="extensions" value="ext-hayabusa"> Hayabusa
                            </label><br>
                            
                            <label title="Infrastructure Extension" data-content="Manage your organization's configuration as code. Allows teams to create new organizations from known templates and even to maintain common configuration across multiple organizations." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-infrastructure" name="extensions" value="ext-infrastructure"> Infrastructure
                            </label><br>
                            
                            <label title="Integrity Extension" data-content="The integrity extension allows you to manage all aspects of File Integrity Monitoring (FIM) and Registry Integrity Monitoring (RIM). It automates integrity checks of files & registry values through pattern-based rules." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-integrity" name="extensions" value="ext-integrity"> Integrity
                            </label><br>
                            
                            <label title="LimaCharlie CLI Extension" data-content="LimaCharlie CLI extension allows you to issue LimaCharlie CLI commands using extension requests." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-limacharlie-cli" name="extensions" value="ext-limacharlie-cli"> LimaCharlie CLI
                            </label><br>
                            
                            <label title="LOLDrivers Extension" data-content="Lookup of Living Off the Land hashes from loldrivers.io." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="loldrivers" name="extensions" value="loldrivers"> LOLDrivers
                            </label><br>
                            
                            <label title="Lookup Manager Extension" data-content="The Lookup Manager extension allows you to create, maintain & automatically refresh lookups in the organization to then reference them in Detection & Response Rules." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-lookup-manager" name="extensions" value="ext-lookup-manager"> Lookup Manager
                            </label><br>
                            
                            <label title="OTX Extension" data-content="Continuously import all your OTX pulses and the relevant D&R rules for most indicator types." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-otx" name="extensions" value="ext-otx" 
                                    user-inputs='[
                                        {"id": "otx-api-key", "desc": "OTX API Key", "path": "hives.secret.otx-api-key.data.secret"},
                                        {"id": "set-value", "path": "hives.secret.otx-api-key.usr_mtd.enabled", "value": true, "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-otx.data.api_key", "value": "hive://secret/otx-api-key", "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-otx.usr_mtd.enabled", "value": true, "hidden": true}
                                    ]'> OTX
                            </label><br>            
                            
                            <label title="PagerDuty Extension" data-content="The PagerDuty extension allows you to trigger events within PagerDuty." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-pagerduty" name="extensions" value="ext-pagerduty" 
                                    user-inputs='[
                                        {"id": "pagerduty-integration-key", "desc": "PagerDuty Integration Key", "path": "hives.secret.pagerduty-integration-key.data.secret"},
                                        {"id": "set-value", "path": "hives.secret.pagerduty-integration-key.usr_mtd.enabled", "value": true, "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-pagerduty.data.integration_key", "value": "hive://secret/pagerduty-integration-key", "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-pagerduty.usr_mtd.enabled", "value": true, "hidden": true}
                                    ]'> PagerDuty
                            </label><br>
                            
                            <label title="Payload Manager Extension" data-content="The Payloads Manager extension allows you to create, maintain & automatically refresh payloads in the organization to then deploy them on endpoints via Windows, Mac, or Linux sensors." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="payload-manager" name="extensions" value="payload-manager"> Payload Manager
                            </label><br>
                            
                            <label title="Plaso Extension" data-content="The Plaso extension allows you to run Plaso against forensic artifacts collected from endpoints based on D&R rule actions." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-plaso" name="extensions" value="ext-plaso"> Plaso
                            </label><br>
                            
                            <label title="Reliable Tasking Extension" data-content="Extension that enables you to task a sensor (or set of sensors) that are currently offline. The service will automatically send the tasks to the sensor once it becomes online." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-reliable-tasking" name="extensions" value="ext-reliable-tasking"> Reliable Tasking
                            </label><br>
                            
                            <label title="Sensor Cull Extension" data-content="Automated sensor deletion upon an expiration time. Ideal for cloud docker deployments of VM-based deployments creating sensors in continuous fashion." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-sensor-cull" name="extensions" value="ext-sensor-cull"> Sensor Cull
                            </label><br>
                            
                            <label title="Strelka Extension" data-content="Strelka is a real-time file scanning system used for threat hunting, threat detection, and incident response." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-strelka" name="extensions" value="ext-strelka"> Strelka
                            </label><br>
                            
                            <label title="Twilio Extension" data-content="The Twilio extension can send messages based on Detection & Response rules." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-twilio" name="extensions" value="ext-twilio" 
                                    user-inputs='[
                                        {"id": "twilio-api-key", "desc": "Twilio SID/Token", "path": "hives.secret.twilio-sid-token.data.secret"},
                                        {"id": "set-value", "path": "hives.secret.twilio-api-key.usr_mtd.enabled", "value": true, "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-twilio.data.sid_token", "value": "hive://secret/twilio-sid-token", "hidden": true},
                                        {"id": "set-value", "path": "hives.extension_config.ext-twilio.usr_mtd.enabled", "value": true, "hidden": true}
                                    ]'> Twilio
                            </label><br>

                            <label title="Velociraptor Extension" data-content="Velociraptor is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-velociraptor" name="extensions" value="ext-velociraptor"> Velociraptor
                            </label><br>
                            
                            <label title="YARA Extension" data-content="Automated YARA scanners in LimaCharlie will run continuously in the background without impacting performance, on all files loaded in memory (e.g. exe, dll, etc), and on the memory itself." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-yara" name="extensions" value="ext-yara"> YARA
                            </label><br>
                            
                            <label title="YARA Manager Extension" data-content="The Yara Manager extension allows you to create, maintain & automatically refresh Yara rules in the organization. Yara rules are records stored in config Hive that can be leveraged by other extensions such as BinLib to automate Yara scanning." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-yara-manager" name="extensions" value="ext-yara-manager"> YARA Manager
                            </label><br>
                            
                            <label title="Zeek Extension" data-content="Automatically generate Zeek (AKA Bro) logs from all PCAPs ingested." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                <input type="checkbox" id="ext-zeek" name="extensions" value="ext-zeek"> Zeek
                            </label><br>
                        </div> 
                    </fieldset>
                    <!-- Rulesets Sub-Category -->
                    <fieldset>
                        <legend>Rulesets</legend>
                            <div class="multi-column">
                                <label title="Sigma Extension" data-content="This extension provides a core set of the open-source Sigma rules in a managed fashion." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="ext-sigma" name="extensions" value="ext-sigma"> Sigma
                                </label><br>

                                <label title="SnapAttack Extension" data-content="Access the latest SnapAttack Community Rules." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="ext-snapattack" name="extensions" value="ext-snapattack"> SnapAttack
                                </label><br>

                                <label title="Soteria Rules AWS" data-content="Managed set of Detection & Response rules for AWS developed by Soteria." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="soteria-rules-aws" name="extensions" value="soteria-rules-aws"> Soteria Rules AWS
                                </label><br>
                                
                                <label title="Soteria Rules EDR" data-content="Soteria Rules EDR" data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="soteria-rules-edr" name="extensions" value="soteria-rules-edr"> Soteria Rules EDR
                                </label><br>

                                <label title="Soteria Rules O365" data-content="Managed set of Detection & Response rules for Office 365 developed by Soteria." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="soteria-rules-o365" name="extensions" value="soteria-rules-o365"> Soteria Rules O365
                                </label><br>
                            </div>
                    </fieldset>
                </div>
                <!-- Artifact Collection Tab -->
                <!-- How to contribute new Artifact Collection configuration
                        1. Determine if your pattern fits in one of the existing categories. If so, add the pattern to the existing category.
                        2. If you have an entirely new category, replicate the existing structure of a category with its patterns.
                        3. In your own dev environment, test your new artifact collection to ensure the patterns are added and removed as expected.
                -->
                <div id="artifact-collection" class="tab-pane fade">
                    <fieldset>
                        <legend>Artifact Collection</legend>
                        <div>
                            <label for="days_retention" data-content="How long should artifacts remain in the platform?" data-toggle="popover" data-trigger="hover" data-placement="bottom">Days Retention:</label>
                            <input type="text" id="days_retention" name="days_retention" value="30">
                            <span id="days_retention_error" class="error-message"></span><br>

                            <label for="is_delete_after" data-content="Should the artifact be deleted from the endpoint after upload?" data-toggle="popover" data-trigger="hover" data-placement="bottom">Delete After Upload:</label>
                            <input type="text" id="is_delete_after" name="is_delete_after" value="false">
                            <span id="is_delete_after_error" class="error-message"></span><br>

                            <label for="is_ignore_cert" data-content="Should we ignore SSL verification upon upload?" data-toggle="popover" data-trigger="hover" data-placement="bottom">Ignore Cert Validation:</label>
                            <input type="text" id="is_ignore_cert" name="is_ignore_cert" value="true">
                            <span id="is_ignore_cert_error" class="error-message"></span><br>
                        </div><br>

                        <!-- Windows Configuration -->
                        <fieldset>
                            <legend data-toggle="collapse" data-target="#windowsConfig" aria-expanded="false">
                                <span class="toggle-icon"><i class="fas fa-plus"></i></span> Windows
                            </legend>
                            <div id="windowsConfig" class="collapse">
                                <label title="Windows WEL Streaming" data-content="Steam WEL into the sensor timeline alongside EDR telemetry." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="windows-wel-streaming" name="windows-wel-streaming" onclick="toggleArtifactConfig('windows-wel-streaming')"> Windows WEL Streaming
                                </label>
                                <div id="patterns-windows-wel-streaming" style="margin-left: 20px;">
                                    <label><input type="checkbox" id="pattern-windows-wel-1" name="pattern-windows-wel-1" value="wel://system:*"> wel://system:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-2" name="pattern-windows-wel-2" value="wel://security:*"> wel://security:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-3" name="pattern-windows-wel-3" value="wel://application:*"> wel://application:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-4" name="pattern-windows-wel-4" value="wel://Microsoft-Windows-IIS-Configuration/Administrative:*"> wel://Microsoft-Windows-IIS-Configuration/Administrative:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-5" name="pattern-windows-wel-5" value="wel://Microsoft-Windows-IIS-Configuration/Operational:*"> wel://Microsoft-Windows-IIS-Configuration/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-6" name="pattern-windows-wel-6" value="wel://Microsoft-Windows-IIS-Logging/Logs:*"> wel://Microsoft-Windows-IIS-Logging/Logs:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-7" name="pattern-windows-wel-7" value="wel://Microsoft-Windows-PowerShell/Operational:*"> wel://Microsoft-Windows-PowerShell/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-8" name="pattern-windows-wel-8" value="wel://Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational:*"> wel://Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-9" name="pattern-windows-wel-9" value="wel://Microsoft-Windows-Sysmon/Operational:*"> wel://Microsoft-Windows-Sysmon/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-10" name="pattern-windows-wel-10" value="wel://Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational:*"> wel://Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-11" name="pattern-windows-wel-11" value="wel://Microsoft-Windows-Windows Defender/Operational:*"> wel://Microsoft-Windows-Windows Defender/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-12" name="pattern-windows-wel-12" value="wel://Microsoft-Windows-WMI-Activity/Operational:*"> wel://Microsoft-Windows-WMI-Activity/Operational:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-13" name="pattern-windows-wel-13" value="wel://Microsoft-Windows-Security-Mitigations/KernelMode:*"> wel://Microsoft-Windows-Security-Mitigations/KernelMode:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-14" name="pattern-windows-wel-14" value="wel://Directory Service:*"> wel://Directory Service:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-15" name="pattern-windows-wel-15" value="wel://DNS Server:*"> wel://DNS Server:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-16" name="pattern-windows-wel-16" value="wel://DFS Replication:*"> wel://DFS Replication:*</label><br>
                                    <label><input type="checkbox" id="pattern-windows-wel-17" name="pattern-windows-wel-17" value="wel://Active Directory Web Services:*"> wel://Active Directory Web Services:*</label><br>
                                </div>
                                <label title="Windows EVTX Uploads" data-content="Upload raw EVTX files as artifacts. NOTE: this does NOT stream WEL into the sensor timeline." data-toggle="popover" data-trigger="hover" data-placement="bottom">
                                    <input type="checkbox" id="windows-evtx-uploads" name="windows-evtx-uploads" onclick="toggleArtifactConfig('windows-evtx-uploads')"> Windows EVTX Uploads
                                </label>
                                <div id="patterns-windows-evtx-uploads" style="margin-left: 20px;">
                                    <label><input type="checkbox" id="pattern-windows-evtx-1" name="pattern-windows-evtx-1" value="%SystemRoot%\\system32\\winevt\\logs\\system.evtx"> system.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-2" name="pattern-windows-evtx-2" value="%SystemRoot%\\system32\\winevt\\logs\\security.evtx"> security.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-3" name="pattern-windows-evtx-3" value="%SystemRoot%\\system32\\winevt\\logs\\application.evtx"> application.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-4" name="pattern-windows-evtx-4" value="%SystemRoot%\\system32\\winevt\\logs\\Microsoft-Windows-PowerShell%4Operational.evtx"> Microsoft-Windows-PowerShell%4Operational.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-5" name="pattern-windows-evtx-5" value="%SystemRoot%\\system32\\winevt\\logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx"> Microsoft-Windows-WMI-Activity%4Operational.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-6" name="pattern-windows-evtx-6" value="%SystemRoot%\\system32\\winevt\\logs\\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx"> Microsoft-Windows-Security-Mitigations%4KernelMode.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-7" name="pattern-windows-evtx-7" value="%SystemRoot%\\system32\\winevt\\logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx"> Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-8" name="pattern-windows-evtx-8" value="%SystemRoot%\\system32\\winevt\\logs\\Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx"> Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-9" name="pattern-windows-evtx-9" value="%SystemRoot%\\System32\\Winevt\\Logs\\Microsoft-Windows-Security-Mitigations%4UserMode.evtx"> Microsoft-Windows-Security-Mitigations%4UserMode.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-10" name="pattern-windows-evtx-10" value="%SystemRoot%\\System32\\Winevt\\Logs\\Microsoft-Windows-Sysmon%4Operational.evtx"> Microsoft-Windows-Sysmon%4Operational.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-11" name="pattern-windows-evtx-11" value="%SystemRoot%\\System32\\Winevt\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx"> Microsoft-Windows-Windows Defender%4Operational.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-12" name="pattern-windows-evtx-12" value="%SystemRoot%\\System32\\Winevt\\Logs\\Microsoft-Windows-VHDMP-Operational.evtx"> Microsoft-Windows-VHDMP-Operational.evtx</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-13" name="pattern-windows-evtx-13" value="%SystemRoot%\\System32\\Winevt\\Logs\\Microsoft-Windows-TaskScheduler/Operational"> Microsoft-Windows-TaskScheduler/Operational</label><br>
                                    <label><input type="checkbox" id="pattern-windows-evtx-14" name="pattern-windows-evtx-14" value="%SystemRoot%\\System32\\Winevt\\Logs\\Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx"> Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx</label><br>                                </div>
                            </div>
                        </fieldset>

                        <!-- macOS Configuration -->
                        <fieldset>
                            <legend data-toggle="collapse" data-target="#macConfig" aria-expanded="false">
                                <span class="toggle-icon"><i class="fas fa-plus"></i></span> macOS
                            </legend>
                            <div id="macConfig" class="collapse">
                                <label title="macOS Logs">
                                    <input type="checkbox" id="mac-logs" name="mac-logs" onclick="toggleArtifactConfig('mac-logs')"> macOS Logs
                                </label>
                                <div id="patterns-mac-logs" style="margin-left: 20px;">
                                    <label><input type="checkbox" id="pattern-mac-logs-1" value="/var/log/*.1"> /var/log/*.1</label><br>
                                    <label><input type="checkbox" id="pattern-mac-logs-2" value="/var/log/*.1.gz"> /var/log/*.1.gz</label><br>
                                    <label><input type="checkbox" id="pattern-mac-logs-3" value="/var/log/*.1.bz2"> /var/log/*.1.bz2</label><br>
                                </div>
                            </div>
                        </fieldset>

                        <!-- Linux Configuration -->
                        <fieldset>
                            <legend data-toggle="collapse" data-target="#linuxConfig" aria-expanded="false">
                                <span class="toggle-icon"><i class="fas fa-plus"></i></span> Linux
                            </legend>
                            <div id="linuxConfig" class="collapse">
                                <label title="Linux Logs">
                                    <input type="checkbox" id="linux-logs" onclick="toggleArtifactConfig('linux-logs')"> Linux Logs
                                </label>
                                <div id="patterns-linux-logs" style="margin-left: 20px;">
                                    <label><input type="checkbox" id="pattern-linux-logs-1" value="/var/log/syslog.1"> /var/log/syslog.1</label><br>
                                    <label><input type="checkbox" id="pattern-linux-logs-2" value="/var/log/auth.log.1"> /var/log/auth.log.1</label><br>
                                </div>
                            </div>
                        </fieldset>
                    </fieldset>
                </div>
                <!-- User Inputs Tab -->
                <div id="user-inputs" class="tab-pane fade">
                    <fieldset>
                        <legend>User Inputs</legend>
                        <p id="user-inputs-placeholder">No inputs required. Enabling an option which requires user input (API keys, etc) will populate fields on this tab.</p>
                        <div id="user-input-fields">
                            <!-- Dynamic input fields will be inserted here -->
                        </div>
                    </fieldset>
                </div>
                <!-- Generated Template Tab -->
                <div id="generated-template" class="tab-pane fade">
                </div>                
                <!-- YAML Output Block -->
                <div id="yamlOutputSection" class="template-boundary">
                    <h2>Infrastructure-as-Code Template:</h2>
                    <div class="button-container">
                        <button type="button" onclick="resetForm()">Reset Template</button>
                        <button id="copyButton" type="button" onclick="copyToClipboard()">Copy to Clipboard</button>
                    </div>
                    <pre id="yamlOutputContainer" class="line-numbers language-yaml"><code id="yamlOutput" class="language-yaml"></code></pre>
                </div>
            </div>
        </form>
    </div>

    <!-- Toast container for notifications -->
    <div id="toast-container" style="position: fixed; top: 10px; right: 10px; z-index: 1000; display: none;">
        <div id="user-input-toast" class="toast">
            You have selected a feature which requires additional input. Please provide the necessary data under "User Inputs"
        </div>
    </div>

    <!-- Google Tag Manager (noscript) -->
    <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TJRD9PG"
    height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <!-- End Google Tag Manager (noscript) -->
</body>
</html>

