feat: initial official marketplace catalog

- integrations/virustotal: VirusTotal v3 (request-based: IP & domain reports) - templates/: fully-commented manifest + script-command example - README: discovery rules, manifest schema, how to publish and wire into Riposte
2026-06-22 10:50:43 +02:00
commit 67d5e7da55
5 changed files with 314 additions and 0 deletions
@@ -0,0 +1,82 @@
+# =============================================================================
+# Integration manifest template — copy to integrations/<id>/manifest.yaml
+# This file is named *.example.yaml on purpose so Riposte never ingests it
+# (only files named exactly "manifest.yaml" are picked up).
+# =============================================================================
+
+id: example_integration          # required · unique slug · [a-z0-9_]
+name: Example Integration        # required · shown in the UI
+version: 1.0.0                   # semver · bump on every change
+description: One-line description of what this integration does.
+category: enrichment             # free text: enrichment | containment | ticketing | ...
+
+# ---------------------------------------------------------------------------
+# config_schema — per-instance settings the operator fills in when creating an
+# instance. JSON-Schema shape: { properties: {...}, required: [...] }.
+# Property fields: type (string|number|boolean), description, default,
+# and x-soar-sensitive: true for secrets (encrypted in the vault, never returned).
+# ---------------------------------------------------------------------------
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: API base URL
+      default: https://api.example.com/v1
+    api_key:
+      type: string
+      description: API key / token
+      x-soar-sensitive: true
+  required:
+    - api_key
+
+# ---------------------------------------------------------------------------
+# auth — authentication methods, referenced from commands via auth_ref.
+# value_template: {{secret}} is replaced by the value of secret_field.
+#   api_key in header → name is the header (e.g. x-apikey, Authorization)
+#   bearer            → typically name: Authorization, value_template: "Bearer {{secret}}"
+# ---------------------------------------------------------------------------
+auth:
+  - id: apikey
+    type: api_key                # api_key | bearer | basic | oauth2_client_credentials
+    in: header                   # header | query
+    name: Authorization
+    value_template: "Bearer {{secret}}"
+    secret_field: api_key
+
+commands:
+  # --- Request-based command (recommended: declarative, no sandbox) ---------
+  - id: lookup
+    name: Lookup indicator
+    description: Fetches a report for an indicator over HTTP.
+    inputs_schema:
+      properties:
+        indicator:
+          type: string
+          description: The value to look up
+      required:
+        - indicator
+    outputs_schema:
+      properties: {}
+    request:
+      method: GET                # GET | POST | PUT | PATCH | DELETE
+      path: /lookup/{indicator}  # {indicator} is substituted from inputs
+      query: []                  # input names to send as query params
+      body: []                   # input names to send as JSON body fields
+      auth_ref: apikey
+
+  # --- Script-based command -------------------------------------------------
+  # No `request:` block. Provide scripts/<id>.py next to this manifest.
+  # The script receives inputs in the global dict __inputs__ and MUST print
+  # exactly one JSON object to stdout (that becomes the command output).
+  # See templates/scripts/example_command.py.
+  - id: example_command
+    name: Example scripted command
+    description: Demonstrates a Python-backed command.
+    inputs_schema:
+      properties:
+        indicator:
+          type: string
+      required:
+        - indicator
+    outputs_schema:
+      properties: {}