new: [import_mod] Darkmoon JSON findings import module

[MBK-fr]

Adds an import module for the JSON findings of Darkmoon, an open source (GPL-3.0) autonomous AI penetration testing platform. An LLM orchestrates specialist agents and offensive tools and tries to prove each finding with a real exploit; the open source CLI writes a JSON findings report.

What it does

import_mod/darkmoon_import.py follows the usual import module layout (handler, introspection, version, misp_standard output) and turns the report into MISP objects:

Darkmoon field	MISP
title	vulnerability object, summary
description, remediation, evidence_explanation, evidence_commands, evidence_logs, raw_request, raw_response	vulnerability description
cve	vulnerability id and NVD reference
cvss_score, cvss_vector	cvss-score, cvss-string
mitre_attack_id	ATT&CK reference, plus misp-galaxy:mitre-attack-pattern tag when the technique name is present
severity, status (exploited / confirmed / unconfirmed), category, discovered_by_agent	darkmoon:* tags
endpoint	url object, with a vulnerability affects url reference

One user option (include_unconfirmed) skips findings whose exploitation could not be confirmed. A bare list and {"findings": [...]} are both accepted. Input is rejected with a clear error unless every finding carries a title, discovered_by_agent and a Darkmoon exploitation status, so other JSON files (for example a Gitleaks-style findings list) are not misread.

Tests

tests/test_darkmoon_import.py (pytest, same style as test_cuckooimport.py) with tests/darkmoon_findings.json (exploited, confirmed and unconfirmed findings, with and without CVE / CVSS vector). 5 passed locally with PyMISP; black -l 120 and flake8 --max-line-length 120 are clean. Modules are auto-discovered, so no registration is needed, and the docs page is generated at release.

Scope: the module only reads the JSON file the open source CLI writes. No Darkmoon API or dashboard is involved.

Link to tool: https://github.com/ASCIT31/Dark-Moon

🤖 Generated with Claude Code

https://claude.ai/code/session_014HBQNzAf5C2E3MiJC48HQw

[MBK-fr]

The test matrix failure is unrelated to this module: the only failing case is tests/test_expansions.py::TestExpansions::test_dns, which asserts a live DNS A record (185.194.93.63 != 185.194.93.14) and is flaky on the resolver the runner uses. All five tests/test_darkmoon_import.py cases pass on every Python version (3.10-3.14), and the rest of the suite is green.

[adulau]

Thank you!