Clue is a super useful way to aggregate enrichment of strings. It connects to various external tools via plugins to aggregate and unify information.

When writing a MISP plugin for clue, e2e testing came with a bit of toil via the UI so I opted to write a tiny cli wrapper for their API. There's a lot to do to make this actually useful, mainly formatting the output in a useful way, but it works for quick testing.

clue-cli [flags] [indicators...]   # enrich indicators
strings malware.bin | clue-cli     # or from stdin

clue-cli login                     # sign in via browser
clue-cli config                    # set api/auth url, client secret, query configuration

# Flags
clue-cli --hide                     # count only suppress output
clue-cli --json                     # raw json results

If using keycloak for clue's auth, you'll need to allow OAuth for browser based token login.

1. Login to keycloak as admin
2. Edit the clue client scope
3. Open settings
4. Toggle true: OAuth 2.0 Device Authorization Grant Enabled

Then try logging in

clue-cli login