feat(darktrace): new Darktrace NDR integration

Darktrace Threat Visualizer API, 7 commands: get/acknowledge model breaches, get devices, get/activate Antigena actions (autonomous-response containment). HMAC-SHA1 signed auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 00:48:00 +02:00
parent 9be28a2ff7
commit 0775500b15
8 changed files with 633 additions and 0 deletions
@@ -0,0 +1,97 @@
+id: darktrace
+name: Darktrace
+version: 1.0.0
+description: "Darktrace (Threat Visualizer API) — network detection and autonomous response: read model breaches, acknowledge a breach, look up devices, and read/activate Antigena network actions (containment). HMAC-SHA1 signed authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: get/acknowledge model breaches, get devices, get/activate Antigena actions."
+category: ndr
+
+# Per-instance configuration. Requests are signed (HMAC-SHA1) with the public +
+# private API tokens (headers DTAPI-Token / DTAPI-Date / DTAPI-Signature).
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Darktrace master URL (e.g. https://darktrace.example.com)"
+    public_token:
+      type: string
+      description: "Public API token"
+    private_token:
+      type: string
+      description: "Private API token"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - base_url
+    - public_token
+    - private_token
+
+commands:
+  - id: get_model_breaches
+    name: darktrace-get-model-breaches
+    description: "List model breaches (optionally since a time)."
+    risk: read
+    inputs_schema:
+      properties:
+        min_score: { type: number, description: "Minimum breach score 0-1 (optional)" }
+        from_time: { type: string, description: "Start time YYYY-MM-DD HH:MM:SS (optional)" }
+        count: { type: number, description: "Max breaches (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_model_breach
+    name: darktrace-get-model-breach
+    description: "Get a single model breach by its PBID."
+    risk: read
+    inputs_schema:
+      properties:
+        pbid: { type: string, description: "Policy breach ID (PBID)" }
+      required: [pbid]
+    outputs_schema: { properties: {} }
+  - id: acknowledge_breach
+    name: darktrace-acknowledge-breach
+    description: "Acknowledge a model breach."
+    inputs_schema:
+      properties:
+        pbid: { type: string, description: "Policy breach ID (PBID)" }
+      required: [pbid]
+    outputs_schema: { properties: {} }
+  - id: get_devices
+    name: darktrace-get-devices
+    description: "Look up devices (by IP or device ID)."
+    risk: read
+    inputs_schema:
+      properties:
+        did: { type: string, description: "Device ID (optional)" }
+        ip: { type: string, description: "IP address (optional)" }
+        count: { type: number, description: "Max devices (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_antigena_actions
+    name: darktrace-get-antigena-actions
+    description: "List Antigena (autonomous response) actions."
+    risk: read
+    inputs_schema:
+      properties:
+        include_cleared: { type: boolean, description: "Include cleared actions (default false)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: activate_antigena
+    name: darktrace-activate-antigena
+    description: "Activate an Antigena action (containment — enforce autonomous response)."
+    inputs_schema:
+      properties:
+        codeid: { type: string, description: "Antigena action code ID" }
+        duration: { type: number, description: "Duration in seconds (optional)" }
+      required: [codeid]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: darktrace-test-connection
+    description: "Verify connectivity and the signed credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }