f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: SentinelOne SDL + VirusTotal Hunting integrations

Browse Source 
SentinelOne SDL (endpoint): Unified Alerts via the GraphQL API. Alert ingestion
(get_alerts) with rich filtering and an exhaustive OCSF mapper + 'SentinelOne SDL
Alert' default type, full alert details, update (status/verdict/assignee), add
note and trigger mitigation action. ApiToken auth; watermark converted to epoch
ms for the detectedAt filter; alert edges flattened to nodes for ingestion.

VirusTotal Hunting (enrichment, Premium): Livehunt notification-file ingestion
(livehunt_files) with an OCSF mapper + 'VirusTotal Hunting File' default type
(severity bucketed from malicious AV detections), Livehunt notifications listing,
and Retrohunt job + matching-file listing.

The core VT v3 reputation already ships as 'virustotal'; the XSOAR-feed and
Premium file-download/zip/pcap commands were intentionally left out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-27 15:34:42 +02:00
parent fcf516ca82
commit 70dffb3b0a
17 changed files with 905 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/sentinelone-sdl/mappers/get_alerts.yaml
+52
View File
@@ -0,0 +1,52 @@
name: "SentinelOne SDL Alerts → OCSF"
description: "Maps a SentinelOne SDL Unified Alert (GraphQL alerts query, results_path = data — edges flattened to nodes) to OCSF Detection Finding fields."
field_mappings:
title: "name"
description: "description"
# toSeverity maps CRITICAL→5, HIGH→3, MEDIUM→2, LOW→1, INFO→1.
severity: "severity"
source: "detectionSource.vendor"
# results_path = data; source_path is JSONata over ONE alert node.
ocsf:
# ── Finding ───────────────────────────────────────────────────────
- { source_path: "id", ocsf_field: "finding_info.uid" }
- { source_path: "name", ocsf_field: "finding_info.title" }
- { source_path: "description", ocsf_field: "finding_info.desc" }
- { source_path: "detectedAt", ocsf_field: "finding_info.created_time" }
- { source_path: "updatedAt", ocsf_field: "finding_info.modified_time" }
- { source_path: "firstSeenAt", ocsf_field: "finding_info.first_seen_time" }
- { source_path: "lastSeenAt", ocsf_field: "finding_info.last_seen_time" }
- { source_path: "externalId", ocsf_field: "finding_info.uid_alt" }
# ── Incident state ────────────────────────────────────────────────
- { source_path: "status", ocsf_field: "status" }
- { source_path: "analystVerdict", ocsf_field: "disposition" }
- { source_path: "classification", ocsf_field: "activity_name" }
- { source_path: "confidenceLevel", ocsf_field: "confidence" }
- { source_path: "attackSurfaces[0]", ocsf_field: "metadata.labels" }
# ── Detection analytic ────────────────────────────────────────────
- { source_path: "analytics.name", ocsf_field: "finding_info.analytic.name" }
- { source_path: "analytics.uid", ocsf_field: "finding_info.analytic.uid" }
- { source_path: "analytics.category", ocsf_field: "finding_info.analytic.category" }
- { source_path: "detectionSource.vendor", ocsf_field: "metadata.product.vendor_name" }
- { source_path: "detectionSource.product", ocsf_field: "metadata.product.name" }
- { source_path: "detectionSource.engine", ocsf_field: "metadata.product.feature.name" }
# ── Affected device ───────────────────────────────────────────────
- { source_path: "asset.name", ocsf_field: "device.hostname" }
- { source_path: "asset.id", ocsf_field: "device.uid" }
- { source_path: "asset.osType", ocsf_field: "device.os.type" }
- { source_path: "asset.osVersion", ocsf_field: "device.os.build" }
- { source_path: "asset.agentVersion", ocsf_field: "device.agent.version" }
- { source_path: "asset.name", ocsf_field: "src_endpoint.hostname" }
- { source_path: "asset.lastLoggedInUser", ocsf_field: "user.name" }
# ── Offending process (actor) ─────────────────────────────────────
- { source_path: "process.cmdLine", ocsf_field: "actor.process.cmd_line" }
- { source_path: "process.parentName", ocsf_field: "actor.process.parent_process.name" }
- { source_path: "process.username", ocsf_field: "actor.user.name" }
- { source_path: "process.file.name", ocsf_field: "actor.process.file.name" }
- { source_path: "process.file.path", ocsf_field: "actor.process.file.path" }
- { source_path: "process.file.md5", ocsf_field: "actor.process.file.hashes.md5" }
- { source_path: "process.file.sha1", ocsf_field: "actor.process.file.hashes.sha1" }
- { source_path: "process.file.sha256", ocsf_field: "actor.process.file.hashes.sha256" }
# ── Assignee ──────────────────────────────────────────────────────
- { source_path: "assignee.fullName", ocsf_field: "assignee.name" }
- { source_path: "assignee.email", ocsf_field: "assignee.email_addr" }