feat(cybereason): new Cybereason EDR integration

Cybereason API, 7 commands: query Malops, list sensors, get machine details,
isolate/un-isolate machine (containment), block file hash. Session (login)
auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integrations/cybereason/manifest.yaml

@@ -0,0 +1,95 @@
+id: cybereason
+name: Cybereason
+version: 1.0.0
+description: "Cybereason EDR — endpoint containment and investigation: query Malops, list sensors, isolate/un-isolate a machine (containment), block a file hash, and read machine details. Session (login) authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: query Malops, list sensors, isolate/un-isolate machine, block file, get machine details."
+category: endpoint
+
+# Per-instance configuration. Each command logs in (form POST to /login.html,
+# reusing the returned session cookie) then performs the action.
+config_schema:
+  properties:
+    server_url:
+      type: string
+      description: "Cybereason server URL (e.g. https://your-tenant.cybereason.net:443)"
+    username:
+      type: string
+      description: "Cybereason username"
+    password:
+      type: string
+      description: "Cybereason password"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - server_url
+    - username
+    - password
+
+commands:
+  - id: query_malops
+    name: cybereason-query-malops
+    description: "Query Malops (malicious operations) in a time window."
+    risk: read
+    inputs_schema:
+      properties:
+        start_time: { type: number, description: "Start time as Unix epoch milliseconds" }
+        end_time: { type: number, description: "End time as Unix epoch milliseconds" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: list_sensors
+    name: cybereason-list-sensors
+    description: "List sensors (endpoints)."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max sensors (default 100)" }
+        offset: { type: number, description: "Offset (default 0)" }
+        filter_field: { type: string, description: "Optional field to filter on (e.g. machineName)" }
+        filter_value: { type: string, description: "Value for the filter field (equals match)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_machine_details
+    name: cybereason-get-machine-details
+    description: "Get details for a sensor/machine by its sensor ID."
+    risk: read
+    inputs_schema:
+      properties:
+        sensor_id: { type: string, description: "Sensor ID" }
+      required: [sensor_id]
+    outputs_schema: { properties: {} }
+  - id: isolate_machine
+    name: cybereason-isolate-machine
+    description: "Isolate one or more machines from the network (containment)."
+    inputs_schema:
+      properties:
+        sensor_ids: { type: string, description: "Comma-separated sensor IDs to isolate" }
+      required: [sensor_ids]
+    outputs_schema: { properties: {} }
+  - id: unisolate_machine
+    name: cybereason-unisolate-machine
+    description: "Remove one or more machines from isolation."
+    inputs_schema:
+      properties:
+        sensor_ids: { type: string, description: "Comma-separated sensor IDs to un-isolate" }
+      required: [sensor_ids]
+    outputs_schema: { properties: {} }
+  - id: block_file
+    name: cybereason-block-file
+    description: "Block a file by hash (add to the block list)."
+    inputs_schema:
+      properties:
+        md5: { type: string, description: "MD5 hash of the file to block" }
+      required: [md5]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: cybereason-test-connection
+    description: "Verify connectivity and credentials by logging in (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }