diff --git a/README.md b/README.md index e548dc8083d40f6001e31a4ee7154f76ccc9c9d9..22aa9d4dcb3f9eae0143babb7f38e38dec53438d 100644 --- a/README.md +++ b/README.md @@ -26,8 +26,20 @@ supported are *append* and *scan* (and internally a *delete-older-than* that periodically wipes entries that are too old to be relevant anymore). -Querying reputation for an IP consists in scanning the database for -a pre-defined window of time in the past, and passing the results -to a *scoring script* (currently written in an embedded language), -that applies aggregation and weighting and returns the final score. +Querying reputation for an IP consists in scanning the database for a +pre-defined window of time in the past, and passing the results to a +*scoring script* (currently written in [an embedded +language](https://github.com/d5/tengo)), that applies aggregation and +weighting and returns the final score. +## RPC interface + +The server provides a simple GRPC interface that is used for event +submission and querying. The query API is a simple IP lookup, +returning a score. This conceivably could be turned into a DNS-based +API as well. + +## Third-party sources + +It would be nice to allow the scoring script to consult other IP-based +third-party sources, such as DNSBLs, or GeoIP lookups, etc.