[adulau]

Lookyloo indicator searches return capture UUIDs, timestamps and titles, while capture endpoints add redirects, infrastructure and analysis context. Add lookyloo-capture to keep that provenance and link observed files, URLs, cookies and screenshots to the capture that contains them.

The template requires only instance and capture-id, since lookup results need not contain a root URL or page archive. Existing page-capture requires a URL and archived content; sandbox-report lacks capture-specific fields. Existing URL, file, image and cookie templates are reused for the actual resources. No attribute types or relationships are added.

New attributes default to to_ids=false. Capture metadata disables correlation; observed URLs, hostnames and IPs remain correlatable. Named JSON attachments preserve endpoint responses and pagination metadata, and redirect comments preserve chain order.

Validation: all 450 object definitions pass schema validation; UUID uniqueness and relationship validation pass; all 22 repository unit tests pass. The new definition was normalized with jq -S -j. The MISP modules implementation bundles an identical definition and was checked against the live public Lookyloo API.

API reference: https://lookyloo.circl.lu/doc/

Related implementation: MISP/misp-modules#939

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T06:43:09.252708Z	d599608	PR opened
🔒 Security Review	✅ Completed 2026-10-16T06:41:36.214548Z	d599608	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.