From 2991f830bb83ff45e61c20e2f9eeb7fb5e45fad7 Mon Sep 17 00:00:00 2001
From: Christopher Talib <christopher.talib@dcso.de>
Date: Fri, 7 Feb 2020 17:45:37 +0100
Subject: [PATCH] Update README with info about Balboa queries

---
 README.md      | 35 +++++++++++++++++++++++++++++------
 parser/main.go |  2 --
 2 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index b85cdf9..51eff7a 100644
--- a/README.md
+++ b/README.md
@@ -12,11 +12,12 @@ go build
 
 ### Meta
 
+`
 Node ------ Node
        ^
        |
      Edge
-
+`
 ```go
 type Node struct {
 	ID       string `json:"id"`
@@ -40,13 +41,14 @@ type Edge struct {
 
 ### Certstream
 
+`
 Node ---- CertNode ---- CertStreamRaw
        ^     |        ^
        |     |        |
       Edge-> |      Edge
              |
             Node(s) (domain)
-
+`
 ```go
 
 // CertStreamRaw is a wrapper around the stream function to unmarshall the
@@ -77,11 +79,12 @@ type CertNode struct {
 
 ### Pastebin
 
+`
 Node ---- PasteNode ---- FullPaste
        ^             ^
        |             |
       Edge         Edge
-
+`
 ```go
 // PasteNode is a node from PasteBin.
 type PasteNode struct {
@@ -100,12 +103,12 @@ type FullPaste struct {
 ```
 
 ### Shodan
-
+`
 Node ---- ShodanNode ---- Node(s) (hostnames and domains)
        ^              ^
        |              |
       Edge           Edge
-
+`
 ```go
 type ShodanNode struct {
 	ID       string           `json:"id"`
@@ -116,4 +119,24 @@ type ShodanNode struct {
 }
 ```
 
-### 
+### Balboa
+
+Balboa enrichment happens on domains and hostnames extracted from Certstream
+and Shodan streams and the node is created only if Balboa returns data.
+
+`
+Node ---- ShodanNode ---- Node (domain) ---- BalboaNode
+       ^              ^                   ^
+       |              |                   |
+      Edge           Edge                Edge
+`
+
+```go
+type BalboaNode struct {
+	ID       string           `json:"id"`
+	Type     string           `json:"type"`
+	Data     []balboa.Entries `json:"data"`
+	Created  string           `json:"created"`
+	Modified string           `json:"modified"`
+}
+```
diff --git a/parser/main.go b/parser/main.go
index f65f8b4..59dd919 100644
--- a/parser/main.go
+++ b/parser/main.go
@@ -51,5 +51,3 @@ func SaveDomains(domains []string) {
 		}
 	}
 }
-
-// Helpers