[thistehneisen]

Closes #1543.

Adds an analyzer for OffSeq Threat Radar with two flavors:

• OffSeqRadar_CVE (cve): priority score (0–100) with its factors, CVSS, CISA KEV dates and ransomware use, EPSS with percentile, exploit maturity and sources, ENISA EUVD status, product and CWEs. Calls GET /api/v1/threats/slug/{cve}, which resolves a CVE id to its authoritative record.
• OffSeqRadar_IOC (ip, domain, fqdn, url, hash, mail, filename): threat reports whose extracted indicators contain the observable, via POST /api/v1/threats/check-iocs. Radar matches by substring, so the report flags whether any match is exact and only exact matches raise the level to suspicious.

Includes short and long report templates, a README and a logo. Auth is the X-API-Key header; every Radar plan, including the free one, has API access within its quota. API reference: api-docs, OpenAPI.

Testing

• Both flavors run through cortexutils job directories against a local mock of the documented responses: found, not found, 401, 429 and unsupported data type.
• Ran in python:3-slim with the pinned requirements.txt, as the build workflow does.
• Live API: an invalid key returns the service's 401 message as the job error.
• The definitions pass the same jq checks as publish-catalogs.yml and build.yml; pyflakes is clean.

Happy to provide a test API key for review.

Disclosure: I work at OffSeq.