ChatGPT Plugin

Etugen

Threat intelligence & hunting

Brand: Unknown

Category: Pending
Primary Subcategory: Threat Detection & SIEM/XDR Monitoring

Integration details

Description

Etugen keeps track of malicious infrastructure on the internet, like command-and-control servers, malware hosts, phishing kits and attacker directories left open to the web. Connect your Etugen account and you can look all of this up right from the chat. Give it an IP and it tells you which ports are open, which network and country it sits in, what malware runs there, its TLS and JARM fingerprints, how risky it looks and why, and which other hosts share the same certificate or fingerprint. You can also search by malware family, network, country or port, check who registered a domain, or see which ATT&CK techniques have been most active lately. It's made for people who triage alerts, enrich indicators or write up investigations. Access is read-only and follows your Etugen plan. If we have no record of something, that means we haven't seen it, not that it's safe.

Integration type: Plugin
Verification status: Not applicable
Platform: ChatGPT
Category: Pending
Primary Subcategory: Threat Detection & SIEM/XDR Monitoring
Secondary Subcategories: None listed
Brand: Unknown
Access: Account required
First tracked: 2026-11-05
Tool count: 15
Market: US

Agent DiscoverabilityChatGPT Plugin Discovery Score

ChatGPT organic discovery is live

Your score is coming

ChatGPT now suggests Plugins on its own when they match a user's request.Your Plugin Discovery Score measures how often yours appears, and it will show here as soon as it’s ready.

ChatGPT recommends Airtable when a user asks it to update a CRM. — ChatGPT surfaces Airtable because it matches the user's request.

Primary Subcategory

Competing in ChatGPT Threat Detection & SIEM/XDR Monitoring

View Category

Listed in alphabetical order

Primary Subcategory

Above SecurityComing soonGet notified

BrandefenseComing soonGet notified

EtugenComing soonGet notified

Have I Been SquattedComing soonGet notified

Tools

15 tools agents can invoke

MITRE ATT&CK technique coverage across tracked malicious hosts: each observed technique (T-code) with how many hosts exhibit it. Use it to hunt by adversary behaviour or scope a campaign's TTPs.
get_techniques
The FLAGGED (YARA/rule-matched, high-signal) files exposed on a single host — the ones worth reading first (web shells, malware, credentials, C2). Pull them with get_file / read_file.
get_host_flagged
Pull a single open-dir file by its id: full metadata (host IP, name, size, category, detection labels, first/last seen) plus a text preview of its content. Use this to read and interpret what a file is. For the complete raw content use read_file.
get_file
Get the FULL context for one IP address in a single call: threat-catalog classification (malware/category/severity/confidence, ASN, geo, open ports, reverse-DNS, banners/TLS/JARM), the host's risk score with the factors behind it, whether the same IP also leaks an exposed open directory (and what's in it), and related infrastructure surfaced by shared JARM/certificate/malware/ASN pivots. This is the primary tool for investigating an indicator.
get_ip_context
Reputation summary for an autonomous system: how much malicious infrastructure we track on it, broken down by category and malware family, with first/last-seen and the worst hosts. Accepts an AS number (64500 or AS64500) or a name substring.
get_asn
Get the open-directory summary for a single IP: the exposed files found on it (with their ids), categories and detections. Use it to pivot from a threat IP to the artifacts it is serving, then read_file the interesting ones. For the combined threat + risk + pivot picture use get_ip_context instead.
lookup_host
Extract the full structured conversation transcript from a leaked AI coding-assistant session file (from search_sessions or search_files). Returns the parsed messages (user/assistant/tool turns) so you can read exactly what the operator asked and did.
get_transcript
Return the FULL decoded text of an open-dir file (up to 60,000 characters). Use for deep analysis when the get_file preview is not enough — e.g. reading an entire script, config, shell history, credential dump or C2 file. Binary files come back as a hex+ASCII dump instead of garbled text.
read_file
Run a READ-ONLY SQL SELECT over the platform's data (threat catalog, open-dir files, extracted loot, …) — the escape hatch for any question the other tools don't cover: custom aggregations, cross-joins, group-bys, time buckets. One statement, SELECT only (the sandbox rejects writes/DDL and non-allowlisted functions). Requires the Business plan. Returns columns + rows.
sql_query
Search leaked AI coding-assistant sessions (Claude / Codex / Gemini CLI transcripts) exposed on a host's open directory. Returns matching session files (ids) — pull the full conversation with get_transcript. Powerful for understanding what an operator was doing.
search_sessions
Hunt exposed open-directory files across the crawled internet — full advanced search. The convenience params (content/fileName/…) cover the common case; for anything richer use `filters`, a list of {field, operator, value} that all AND together and map 1:1 onto the platform's advanced-search engine. Fields: source_ip, source_port (num), country_code, asn_name, file_name, file_extension, content (full text), file_size (num, bytes), category (enum), tags (array), detection (array), first_seen (date YYYY-MM-DD), last_seen (date). Operators by type — string: eq, ne, in, nin, contains, ncontains · number: eq, ne, gt, lt, gte, lte · date: eq, after, before · array (tags/detection): contains, ncontains, eq · enum (category): eq, ne, in, nin. OR within a field = `in`/`nin` with a comma-separated value, e.g. {field:"file_name", operator:"in", value:"godzilla.jar, data.db"}. Numbers: {field:"file_size", operator:"gt", value:"1000000"}. Dates: {field:"first_seen", operator:"after", value:"2026-06-01"}. Returns matching files with their id (use get_file / read_file to pull content), source IP, name, category and a snippet.
search_files
Search 'loot' — indicators extracted from the CONTENT of open-dir files: Telegram/Discord exfil endpoints, RAT C2 configs, exposed API keys (OpenAI, Anthropic, OpenRouter, Venice, Cline, AWS, GitHub, Stripe, …), private keys and DB connection strings. Lets a victim org discover its own leaked secrets.
search_loot
Unified free-text lookup for ANY indicator — IP, domain, hostname, hash, JARM, ASN, keyword. Auto-detects the indicator type and returns matches across BOTH the threat catalog and exposed open directories, each with why it matched. The fastest 'what do you know about X?' entry point; for a full IP profile use get_ip_context.
search
Hunt / filter the threat catalog. Combine any filters to pivot: all malicious hosts on an ASN, in a country, running a malware family, on a port, in a CIDR, or matching a free-text query. Returns matching hosts with IP, ASN, country, open ports, malware, severity, tags and reverse-DNS.
get_threats
WHOIS lookup and reverse-WHOIS pivoting. Pass `domain` for a domain's WHOIS record; pass `reverse` (field + value, e.g. field=email value=abuse@example.com) to find every domain sharing a registrant attribute; pass `q` for a free-text WHOIS search.
get_whois

FAQs

Etugen ChatGPT Plugin FAQ

How the directory, categories and Discoverability Score work.

Read the methodology

How do I improve Etugen's ChatGPT Plugin discoverability?

The levers are the listing surface agents actually read: names, descriptions, keywords, tool metadata, and registry health. Which lever matters depends on where discovery breaks, which is what continuous measurement shows.

What are Etugen alternatives on ChatGPT?

As of 2026-11-05, Etugen competes with Above Security, Brandefense, Have I Been Squatted in ChatGPT Threat Detection & SIEM/XDR Monitoring, ranked by public Discoverability Score.

Where is this profile measured?

This profile uses the geography attached to the latest public registry snapshot: US. Locale tags are intentionally omitted.