Add my own OSINT tool to the dropdown list

[CyberIQ-ai-LLC]

Still relatively new to SO, so forgive the newb-ness of this question...

When you left click and get the dropdown with Include, Exclude, Actions... I know this is a lot to hope for, but is that list configurable? I have my own OSINT tool that I use to lookup domains and IPs. I would like to call the URL of my tool and pass it, for instance, https://recon.cyberiq.ai/Network/?ip=[IP ADDRESS], which would call my app and pass it the IP instead of selecting VirusTotals or Google.

Is there a configuration file in SO that I could add an item to that list?

[cm-ops]

If you want to add your own custom actions see https://docs.securityonion.net/en/latest/alerts.html?highlight=Actions#actions

[CyberIQ-ai-LLC]

Awesome! Thanks a lot. And thanks for replying so quickly.

[CyberIQ-ai-LLC]

Also, I had to do this with the hunt.actions.json file so the choice would show up in Hunt. Everything is working! Thank you.