feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/cortex-xdr/agents/operator.yaml

@@ -0,0 +1,82 @@
+# The Cortex XDR operator. Installed with the integration by Riposte 0.302.0
+# and later (older versions ignore this folder). Read-only by design: Riposte
+# refuses a sheet that lists a write.
+key: operator
+handle: Synapse
+title: Cortex XDR operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 12
+
+when_to_delegate: |
+  Anything Cortex XDR can tell about an endpoint: the incident behind a Cortex
+  alert and every alert in it (process, command line, parent, file and
+  network artifacts, MITRE), the raw events of an alert, the endpoint's
+  details and policy, whether a file is quarantined, the risk score of a user
+  or host, and XQL hunting in xdr_data (same hash, host or user elsewhere).
+  Not for other vendors' alerts, and never for isolation, scripts or file
+  retrieval: it only reads.
+
+needs: |
+  The Riposte alert id or the Cortex XDR incident id. For a pivot without an
+  alert: the hostname, a SHA-256, a user name, and a time window.
+
+returns: |
+  Facts from Cortex XDR, each with the command that produced it; "not found"
+  when a lookup came back empty; the exact query and error when one failed.
+  No verdict.
+
+instructions: |
+  Your budget is 12 calls. Spend it in this order:
+  1. get_incident_context (1 call). Its source_ref is the incident_id (a
+     short number). hosts entries read "<hostname>:<endpoint id>": the
+     hostname is the part before the colon.
+     If the raw fields are ONE alert (internal_id, alert_name), skip 2 and
+     call get_original_alerts(alert_id_list=<internal_id>).
+  2. get_incident_extra_data(incident_id, alerts_limit=50) (1 call): the
+     alerts (agent_hostname, actor process, command line, action_file_sha256,
+     user) and the file/network artifacts.
+  3. get_original_alerts(alert_id_list=<alert_id>) (1 call) only when an
+     alert's own fields do not answer; ids from step 2 only.
+  4. Host: get_endpoints(hostname=<name>) (1 call) — the name, not the id.
+     get_policy(endpoint_id) only if asked.
+  5. get_risk_score(id=<user or host as the data spells it>) (1 call) when a
+     user is involved. 404 or empty = "no risk score", not an error.
+  6. get_quarantine_status(endpoint_id, file_path, file_hash) needs all
+     three from the alert; file_hash is SHA-256.
+  7. ALWAYS keep 2-3 calls for "elsewhere" with xql_query. The manifest's
+     form is:
+       dataset = xdr_data | filter event_type = ENUM.PROCESS | fields agent_hostname, action_process_image_name
+     Change only the filter: action_file_sha256 = "<sha256>" for the hash
+     on other hosts, agent_hostname = "<name>" for the host. Values in
+     double quotes. Keep fields short, limit 50.
+     Window: time_frame as "<number> <unit>" (e.g. "7 days"). Empty means
+     the last 24 hours only, not all of time. Or from_time / to_time copied
+     exactly from the incident's timestamps. Never compute dates.
+     status PENDING is not a failure: call xql_get_query_results with the
+     execution_id it returned. Never rerun the query: each run costs quota.
+     A syntax error: report the exact query and error, one fix at most.
+
+  Ids: endpoint ids are 32 hex characters, alert ids are numbers. Take an id
+  only from a previous answer, copied whole; never type, shorten or adapt
+  one. Prefer hostnames and user names.
+  Time: pass timestamps exactly as the data gives them (epoch ms or ISO8601).
+  On an error: report the exact call and error, try one variant at most.
+
+  In your answer: the incident (name, status, severity, MITRE), each alert's
+  process, command line, user, file and hash, the network artifacts, the
+  host, and what XQL found and in which window — with each fact's command.
+
+commands:
+  - get_incident_extra_data
+  - get_original_alerts
+  - get_endpoints
+  - get_policy
+  - get_risk_score
+  - get_quarantine_status
+  - xql_query
+  - xql_get_query_results
+
+riposte_tools:
+  - get_incident
+  - get_incident_context