Skip to content
COEUS
Install
Sources

Host a pack of your own

Host a pack's JSON at any HTTPS address and share the URL.

A pack is a JSON file containing named sources. Publishing one needs no account and no Coeus service: write the file, host it at any HTTPS address you control, and share the URL. A browser subscribed to that URL fetches it so its source templates stay up to date. The pack format is the JSON reference.

Only Coeus publishes to its own library. The current extension manages visible destinations in Sources and has no separate Packs screen or flow for adding a new subscription URL, so this page covers the file, its hosting and how existing subscriptions refresh.

Start with a pack file

Write a pack, or export and adapt sources you already maintain. A minimal complete pack looks like this:

{
  "schema": 1,
  "id": "acme-soc",
  "name": "ACME SOC",
  "sources": [
    {
      "id": "acme-case-search",
      "name": "ACME case search",
      "desc": "Past tickets mentioning this entity",
      "tags": ["cases"],
      "auth": true,
      "url": {
        "ip": "https://cases.example.com/search?q={ioc}&type={type}",
        "domain": "https://cases.example.com/search?q={ioc}&type={type}",
        "hash": "https://cases.example.com/search?q={ioc}&type={type}"
      }
    }
  ]
}

Three details matter:

  • Keys can be a type or a group. hash covers MD5, SHA-1, and SHA-256. A concrete type wins over its group, so a source can give SHA-256 its own template and let the others fall through.
  • Placeholders encode values for you. {ioc} is URL-encoded, {ioc:raw} is not, {ioc:noscheme} strips a protocol, and the placeholder reference lists the rest.
  • auth: true is a label. It says the destination needs its own sign-in. Coeus does not store credentials for link sources.

Keep source ids stable. The extension uses an id to preserve source preferences across refreshes; renaming one is treated as deleting a source and adding another.

Host the file

Any host that serves a static file over HTTPS will do: a web server you already run, a code repository's raw file link or a static site. Put the complete pack at a stable URL that every intended browser can fetch, for example:

https://packs.example.com/acme-soc.json

Serve it as application/json. Send an ETag when your host supports it: Coeus uses If-None-Match on later refreshes, so an unchanged file can answer 304 Not Modified instead of sending the pack again.

Treat control of this URL as control of your own source menu. Packs are not signed, and a successful refresh replaces the previous pack as a whole. Keep the file in version control or in the system that owns your pack, and test a change there before making it live.

Do not publish internal hostnames, tenant names, or other material that must stay on a particular browser. A source marked "localOnly": true stays in that extension's local storage; it belongs in Sources, not in a shared hosted pack.

Existing subscriptions

Subscriptions already configured in an earlier Coeus version continue to fetch and validate their pack URLs. The current Sources screen shows the resulting destinations. Subscription data stays in the browser's own storage, so it follows Chrome sync if you use it. There is currently no separate Packs screen for adding a new URL.

The extension refreshes subscriptions every six hours by default and at browser startup when that setting is enabled. The schedule remains in existing settings records; the current Tools interface does not present a manual Packs refresh action.

  • A successful refresh replaces the complete pack: additions, edits, and removals all arrive together.
  • A failed refresh uses the last good copy and marks the subscription with its error.
  • Removing a subscription removes its cached sources from that browser.

If Chrome site access has been changed to On click, Coeus asks for access to the pack's origin before the first fetch. Declining leaves the subscription unadded.

Older source formats

The compatibility importer recognises the Coeus 1.x tools shape, a type-to-template map and a bare source array. For a file you maintain, prefer the documented pack format so its meaning stays clear on every browser that already subscribes to it.

Before sharing the URL

Open the hosted URL in a private browser window and make sure it returns the intended JSON. Then test from a profile with an existing subscription and try a representative indicator against each source. A broken URL template is otherwise repeated in every subscribed menu until the next refresh.