f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: SentinelOne SDL + VirusTotal Hunting integrations

Browse Source 
SentinelOne SDL (endpoint): Unified Alerts via the GraphQL API. Alert ingestion
(get_alerts) with rich filtering and an exhaustive OCSF mapper + 'SentinelOne SDL
Alert' default type, full alert details, update (status/verdict/assignee), add
note and trigger mitigation action. ApiToken auth; watermark converted to epoch
ms for the detectedAt filter; alert edges flattened to nodes for ingestion.

VirusTotal Hunting (enrichment, Premium): Livehunt notification-file ingestion
(livehunt_files) with an OCSF mapper + 'VirusTotal Hunting File' default type
(severity bucketed from malicious AV detections), Livehunt notifications listing,
and Retrohunt job + matching-file listing.

The core VT v3 reputation already ships as 'virustotal'; the XSOAR-feed and
Premium file-download/zip/pcap commands were intentionally left out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-27 15:34:42 +02:00
parent fcf516ca82
commit 70dffb3b0a
17 changed files with 905 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/virustotal-hunting/mappers/livehunt_files.yaml
+29
View File
@@ -0,0 +1,29 @@
name: "VirusTotal Livehunt Files → OCSF"
description: "Maps a VirusTotal Livehunt notification file (intelligence/hunting_notification_files, results_path = data) to OCSF Detection Finding fields. Each item is a file that matched a Livehunt YARA ruleset."
field_mappings:
title: "attributes.meaningful_name"
# Bucket the number of malicious AV detections onto the 1-5 incident scale.
# No parentheses (right-associative); the lowest band uses '>= 0 ? 1' so the literal sits in a then-branch.
severity: "attributes.last_analysis_stats.malicious >= 20 ? 5 : attributes.last_analysis_stats.malicious >= 10 ? 4 : attributes.last_analysis_stats.malicious >= 5 ? 3 : attributes.last_analysis_stats.malicious >= 1 ? 2 : attributes.last_analysis_stats.malicious >= 0 ? 1 : 1"
# results_path = data; source_path is JSONata over ONE file object.
ocsf:
# ── Finding ───────────────────────────────────────────────────────
- { source_path: "id", ocsf_field: "finding_info.uid" }
- { source_path: "attributes.meaningful_name", ocsf_field: "finding_info.title" }
- { source_path: "context_attributes.notification_date", ocsf_field: "finding_info.created_time" }
- { source_path: "attributes.first_submission_date", ocsf_field: "finding_info.first_seen_time" }
- { source_path: "attributes.last_submission_date", ocsf_field: "finding_info.last_seen_time" }
- { source_path: "attributes.reputation", ocsf_field: "risk_score" }
- { source_path: "attributes.last_analysis_stats.malicious", ocsf_field: "count" }
# ── Matching Livehunt rule (analytic) ─────────────────────────────
- { source_path: "context_attributes.rule_name", ocsf_field: "finding_info.analytic.name" }
- { source_path: "context_attributes.ruleset_name", ocsf_field: "finding_info.analytic.uid" }
- { source_path: "context_attributes.ruleset_name", ocsf_field: "malware.name" }
# ── Matched file ──────────────────────────────────────────────────
- { source_path: "attributes.meaningful_name", ocsf_field: "file.name" }
- { source_path: "attributes.type_description", ocsf_field: "file.type" }
- { source_path: "attributes.size", ocsf_field: "file.size" }
- { source_path: "attributes.sha256", ocsf_field: "file.hashes.sha256" }
- { source_path: "attributes.sha1", ocsf_field: "file.hashes.sha1" }
- { source_path: "attributes.md5", ocsf_field: "file.hashes.md5" }
- { source_path: "attributes.ssdeep", ocsf_field: "file.hashes.ssdeep" }