feat(microsoft-purview): new Microsoft Purview DLP integration

DLP alerts via Microsoft Graph Security API, 6 commands: list/get DLP alerts, update alert (status/assignee/determination), list/get incidents. Azure AD OAuth2 client-credentials auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 14:10:25 +02:00
parent 2a1eb73115
commit 4020e13df9
7 changed files with 519 additions and 0 deletions
@@ -0,0 +1,85 @@
+id: microsoft_purview
+name: Microsoft Purview
+version: 1.0.0
+description: "Microsoft Purview DLP alerts (via Microsoft Graph Security API) — data-loss-prevention triage: list and read DLP security alerts, update alert status/assignment, and list/read security incidents. Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list/get DLP alerts, update alert, list/get incidents."
+category: dlp
+
+# Per-instance configuration. Application (client-credentials) OAuth2. Needs Graph
+# application permissions SecurityAlert.ReadWrite.All and SecurityIncident.Read.All.
+config_schema:
+  properties:
+    tenant_id:
+      type: string
+      description: "Azure AD tenant ID"
+    client_id:
+      type: string
+      description: "App registration (client) ID"
+    client_secret:
+      type: string
+      description: "App registration client secret"
+      x-soar-sensitive: true
+  required:
+    - tenant_id
+    - client_id
+    - client_secret
+
+commands:
+  - id: list_dlp_alerts
+    name: purview-list-dlp-alerts
+    description: "List Data Loss Prevention alerts."
+    risk: read
+    inputs_schema:
+      properties:
+        status: { type: string, description: "Filter by status (new, inProgress, resolved)" }
+        limit: { type: number, description: "Max alerts (default 25)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_alert
+    name: purview-get-alert
+    description: "Get a single security alert by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Alert ID" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+  - id: update_alert
+    name: purview-update-alert
+    description: "Update an alert's status and/or assignee."
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Alert ID" }
+        status: { type: string, description: "new, inProgress, or resolved" }
+        assigned_to: { type: string, description: "Assignee (UPN)" }
+        determination: { type: string, description: "Optional determination (e.g. truePositive, falsePositive)" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+  - id: list_incidents
+    name: purview-list-incidents
+    description: "List security incidents."
+    risk: read
+    inputs_schema:
+      properties:
+        status: { type: string, description: "Filter by status (active, resolved, redirected)" }
+        limit: { type: number, description: "Max incidents (default 25)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_incident
+    name: purview-get-incident
+    description: "Get a single security incident by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident ID" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: purview-test-connection
+    description: "Verify connectivity and the app credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }