Merge pull request #60 from R1sh0bh-1/docs/advanced-feeds-enhancements

docs: adding advanced feeds enhancements (3.3.0)

Author: regulartim

docs/GreedyBear/Usage.md

@@ -66,6 +66,10 @@ The available query parameters are:
 
 - `feed_type`: see [Feeds API](#feeds)
 - `attack_type`: see [Feeds API](#feeds)
+- `asn`: Filter IOCs by their Autonomous System Number. (_Available from version >= 3.3.0_)
+- `port`: Filter IOCs that have attacked a specific destination port. (_Available from version >= 3.3.0_)
+- `min_score`: Filter IOCs by a minimum recurrence probability score (0.0 to 1.0). (_Available from version >= 3.3.0_)
+- `start_date` / `end_date`: Filter IOCs seen within a specific date range (format: `YYYY-MM-DD`). (_Available from version >= 3.3.0_)
 - `max_age`: Maximum number of days since last occurrence. (default: 3)
 - `min_days_seen`: Minimum number of days on which an IOC must have been seen. (default: 1)
 - `include_reputation`: `;`-separated list of reputation values to include, e.g. `known attacker` or `known attacker;` to include IOCs without reputation. (default: include all)
@@ -74,7 +78,7 @@ The available query parameters are:
 - `ordering`: Field to order results by, with optional `-` prefix for descending. (default: `-last_seen`)
 - `verbose`: `true` to include IOC properties that contain a lot of data, e.g. the list of days it was seen. (default: `false`)
 - `paginate`: `true` to paginate results. This forces the json format. (default: `false`)
-- `format_`: see [Feeds API](#feeds) (default: `json`)
+- `format_`: see [Feeds API](#feeds) (default: `json`). From version >= 3.3.0, additionally supports `stix21` for STIX 2.1 Bundle exports.
 
 The response includes a new field:
 
@@ -86,6 +90,15 @@ Check the [API specification](https://intelowlproject.github.io/docs/GreedyBear/
 
 This "Advanced Feeds" API is protected through authentication. Please reach out [Matteo Lodi](https://twitter.com/matte_lodi) or another member of [The Honeynet Project](https://twitter.com/ProjectHoneynet) if you are interested in gain access to this API.
 
+### Shareable Feeds API
+_Available from version >= 3.3.0_
+
+For authenticated users, GreedyBear allows sharing customized feeds via a signed token, which can be consumed publicly without an account.
+
+- **`/api/feeds/share` (GET)**: Accepts the same query parameters as the Advanced Feeds API. Returns a JSON response containing a public `url` to consume the feed and a `revoke_url`.
+- **`/api/feeds/consume/<token>` (GET)**: A strictly rate-limited public endpoint that allows anyone to consume the pre-configured feed using the generated token.
+- **`/api/feeds/revoke/<token>` (GET)**: Instantly invalidates the share token. This endpoint can be clicked or opened directly in the browser to revoke. Only the original creator of the token (or staff) can perform this action.
+
 ### ASN Aggregated Feeds API
 _Available from version >= 3.0.0_
 
@@ -271,4 +284,4 @@ Then you have to add some credentials for AWS: if you have GreedyBear deployed o
 to allow that just set `AWS_IAM_ACCESS` to `True`. If that is not the case, you have to set both `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.
 
 Additionally, if you are not using the default AWS region of us-east-1, you need to specify your `AWS_REGION`.
-You can customize the AWS Region location of you services by changing the environment variable `AWS_REGION`. Default is `eu-central-1`.
+You can customize the AWS Region location of you services by changing the environment variable `AWS_REGION`. Default is `eu-central-1`.