f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(gmail): new Gmail integration

Browse Source 
Gmail API + Directory API (27 commands): mailbox search/read/send/
trash/label/move, attachments retrieval, vacation auto-reply, filters,
forwarding addresses, delegates, and Workspace user administration;
message ingestion (get_incidents) with a bundled OCSF mapper.
Service-account auth with domain-wide delegation (JWT RS256), runs on
a remote engine (requires PyJWT + cryptography).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-10 23:18:07 +02:00
parent 3f754d14e9
commit 27615636e3
30 changed files with 2974 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/gmail/mappers/get_incidents.yaml
+15
View File
@@ -0,0 +1,15 @@
name: "Gmail Messages → OCSF"
description: "Maps a Gmail message (get_incidents, results_path = result) to OCSF finding fields. Messages are flattened by the fetch script (subject/from/to/date extracted from headers)."
field_mappings:
title: "subject"
severity: "2"
description: "snippet"
ocsf:
- { source_path: "id", ocsf_field: "finding_info.uid" }
- { source_path: "thread_id", ocsf_field: "finding_info.uid_alt" }
- { source_path: "subject", ocsf_field: "finding_info.title" }
- { source_path: "snippet", ocsf_field: "finding_info.desc" }
- { source_path: "date", ocsf_field: "finding_info.created_time" }
- { source_path: "labels", ocsf_field: "finding_info.types" }
- { source_path: "from", ocsf_field: "actor.user.name" }
- { source_path: "to", ocsf_field: "user.name" }