feat(signalsciences): new Signal Sciences (Fastly NGWAF) integration

Signal Sciences API v0, 5 commands: list sites, get suspicious IPs, list events, add IP to list (block). API-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 15:44:30 +02:00
parent 771c90ef0d
commit 3c282e8e53
6 changed files with 373 additions and 0 deletions
@@ -0,0 +1,72 @@
+id: signalsciences
+name: Signal Sciences
+version: 1.0.0
+description: "Signal Sciences (Fastly NGWAF, API v0) — web-attack visibility and containment: list sites, read suspicious IPs and events, and add an IP to a site list (block). API-token authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list sites, get suspicious IPs, list events, add IP to list."
+category: network
+
+# Per-instance configuration. Auth headers 'x-api-user' (email) and 'x-api-token'.
+config_schema:
+  properties:
+    email:
+      type: string
+      description: "API user email"
+    api_token:
+      type: string
+      description: "API token"
+      x-soar-sensitive: true
+    corp_name:
+      type: string
+      description: "Corp (organization) short name"
+  required:
+    - email
+    - api_token
+    - corp_name
+
+commands:
+  - id: list_sites
+    name: sigsci-list-sites
+    description: "List sites in the corp."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_suspicious_ips
+    name: sigsci-get-suspicious-ips
+    description: "List a site's suspicious IPs."
+    risk: read
+    inputs_schema:
+      properties:
+        site_name: { type: string, description: "Site short name" }
+      required: [site_name]
+    outputs_schema: { properties: {} }
+  - id: list_events
+    name: sigsci-list-events
+    description: "List a site's flagged-IP events."
+    risk: read
+    inputs_schema:
+      properties:
+        site_name: { type: string, description: "Site short name" }
+        limit: { type: number, description: "Max events (default 50)" }
+      required: [site_name]
+    outputs_schema: { properties: {} }
+  - id: add_ip_to_list
+    name: sigsci-add-ip-to-list
+    description: "Add an IP to a site custom list (e.g. a block list)."
+    inputs_schema:
+      properties:
+        site_name: { type: string, description: "Site short name" }
+        list_id: { type: string, description: "Custom list ID" }
+        ip: { type: string, description: "IP or CIDR to add" }
+      required: [site_name, list_id, ip]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: sigsci-test-connection
+    description: "Verify the API token (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }