feat(forcepoint-dlp): new Forcepoint DLP integration

Forcepoint DLP REST API v1, 4 commands: list incidents, get incident, update incident (status/severity/assignee). Token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-12 14:10:26 +02:00
parent 4020e13df9
commit 70c66f7386
5 changed files with 393 additions and 0 deletions
@@ -0,0 +1,70 @@
+id: forcepoint_dlp
+name: Forcepoint DLP
+version: 1.0.0
+description: "Forcepoint DLP (Security Manager REST API v1) — data-loss-prevention incident handling: list incidents in a time window, read an incident, and update incident status/severity/assignment. Token authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list incidents, get incident, update incident."
+category: dlp
+
+# Per-instance configuration. Credentials are exchanged for an access token
+# (Bearer) used on the DLP REST API.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Forcepoint Security Manager URL (e.g. https://fsm.example.com:9443)"
+    username:
+      type: string
+      description: "API username"
+    password:
+      type: string
+      description: "API password"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - base_url
+    - username
+    - password
+
+commands:
+  - id: list_incidents
+    name: forcepoint-list-incidents
+    description: "List DLP incidents in a time window."
+    risk: read
+    inputs_schema:
+      properties:
+        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
+        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
+        action: { type: string, description: "Optional action filter (e.g. Blocked, Permitted)" }
+      required: [from_date, to_date]
+    outputs_schema: { properties: {} }
+  - id: get_incident
+    name: forcepoint-get-incident
+    description: "Get a single DLP incident by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident ID" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: update_incident
+    name: forcepoint-update-incident
+    description: "Update DLP incidents (status, severity, or assignee)."
+    inputs_schema:
+      properties:
+        incident_ids: { type: string, description: "Comma-separated incident IDs" }
+        action_type: { type: string, description: "Field to update: STATUS, SEVERITY, or ASSIGNED_TO" }
+        value: { type: string, description: "New value for the field" }
+      required: [incident_ids, action_type, value]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: forcepoint-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }