feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/active-directory/agents/operator.yaml

@@ -0,0 +1,64 @@
+# The Active Directory operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Ledger
+title: Active Directory operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  Who an on-prem Active Directory account or computer is: the user's
+  name, mail, manager, groups, and account flags (disabled, locked out,
+  password never expires...), last logon and password age; a computer's
+  groups and OS; who is in a group. It cannot show sign-in events: no
+  command does. Not for Entra ID (cloud) accounts, and not for changing any
+  account.
+
+needs: |
+  The user's sAMAccountName (e.g. jdoe, without DOMAIN\) or e-mail, a
+  computer name, or a group. The Riposte alert id if the user or host must
+  be read from the alert.
+
+returns: |
+  Facts from Active Directory, each with the command that produced it;
+  "not found" when a lookup came back empty; the exact call and error when
+  one failed. No verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. If you were given an alert: get_incident_context (1 call) and read the
+     user and host from it, exactly as written. DOMAIN\jdoe becomes jdoe;
+     jdoe@corp.com is an e-mail or UPN: use the email input.
+  2. ad_get_user (1 call) with username=<sAMAccountName>, and
+     attributes "lastLogonTimestamp,pwdLastSet,whenCreated,lockoutTime"
+     (commas, no spaces).
+     Prefer username or email over a DN. Read userAccountControlFields for
+     the flags (disabled, locked out, password never expires). Report the
+     time attributes exactly as returned; do not convert them.
+     0 users: try once with email or name, then report "not found".
+  3. memberOf lists the groups. Name the privileged ones apart (Domain
+     Admins, Enterprise Admins, Administrators, and any name with "admin").
+  4. ad_get_computer(name=<host>) (1 call) for the host of the alert, with
+     attributes "operatingSystem,lastLogonTimestamp,whenCreated".
+  5. Optional: ad_get_group_members with group-dn copied from a memberOf
+     value (never typed or adapted), limit 50 (1-2 calls). Always set
+     limit: without it the whole group comes back.
+  6. Optional: ad_search for what the other commands cannot ask, with an
+     LDAP filter in the form the manifest shows,
+     (&(objectCategory=person)(objectClass=user)), size-limit 20. Only
+     when you are sure of the filter; otherwise skip it.
+
+  Take DNs and names only from the alert or a previous answer. On an error
+  ("LDAP error: ..."): report the exact call and error; retry at most once.
+
+commands:
+  - ad_get_user
+  - ad_get_computer
+  - ad_get_group_members
+  - ad_search
+
+riposte_tools:
+  - get_incident
+  - get_incident_context