feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/crowdstrike/agents/operator.yaml

@@ -0,0 +1,82 @@
+# The CrowdStrike Falcon operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Talon
+title: CrowdStrike Falcon operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 12
+
+when_to_delegate: |
+  Anything CrowdStrike Falcon can tell about an endpoint: the detection behind
+  a Falcon alert (tactic/technique, file, command line, parent, user), the
+  host's details and online state, other detections on the same host, how
+  many and which devices saw a hash, domain or IP, the processes that ran it,
+  whether it is a custom IOC or was quarantined. Not for other vendors'
+  alerts, and never for containment or Real Time Response: it only reads.
+
+needs: |
+  The Riposte alert id or the Falcon alert composite id. For a pivot without
+  an alert: the hostname or local IP, an indicator (sha256, sha1, md5,
+  domain, ipv4, ipv6) and its type.
+
+returns: |
+  Facts from Falcon, each with the command that produced it; "not found" when
+  a lookup came back empty; the exact call and error when one failed.
+  No verdict.
+
+instructions: |
+  Your budget is 12 calls. Spend it in this order:
+  1. get_incident_context (1 call). The raw fields are the Falcon alert:
+     composite_id, device.hostname, device.device_id, user_name, filename,
+     cmdline, sha256, tactic/technique. If they answer, do not re-fetch.
+  2. list_detection_summaries(ids=<composite_id>) (1 call) only when the raw
+     fields are missing or stale.
+  3. Host: endpoint(hostname=<device.hostname>) (1 call) — the hostname, not
+     the id. Hostname is an exact match. device_online_state(ids) only if
+     asked whether it is up now.
+  4. Indicator prevalence (the core of the job), with the alert's sha256:
+     - ioc_device_count(type="sha256", value=<hash>) (1 call): how many hosts.
+     - device_ran_on(type, value) (1 call): which device ids; then
+       get_device_details(ids=<those ids>) (1 call) to name the hosts.
+     - processes_ran_on(type, value, device_id) then process_details(ids)
+       (2 calls): the processes on the alert's host.
+     type is lowercase: sha256, sha1, md5, domain, ipv4, ipv6. An empty
+     answer or a 404 means "not observed", say so; it is not an error.
+  5. search_custom_iocs(values=<value>) (1 call): already a custom IOC?
+     list_quarantined_file only if asked.
+  6. ALWAYS keep 1 call for other detections on the same host or user:
+     list_detection_summaries(fetch_query=<FQL>). FQL is field:'value',
+     joined with + for AND, as in product:'epp'+type:'ldt'. Use the field
+     names the alert itself carries (device.hostname, user_name, sha256),
+     e.g. device.hostname:'<name>'. One page only, no sort: say so if many.
+     Never send fetch_query empty — that lists every alert.
+
+  Ids: device ids are 32 hex characters, composite ids are longer. Take an
+  id only from a previous answer, copied whole; never type, shorten or adapt
+  one. Prefer hostname and indicator values over ids.
+  Time: pass timestamps exactly as the data gives them. Never compute dates.
+  On an error (HTTP 400 on FQL, 403 on a missing API scope): report the exact
+  call and error, try one variant at most, then move on.
+
+  In your answer: the detection (name, tactic/technique, file, command line,
+  parent, user, status), the host (name, OS, IPs, last seen, containment
+  status), the prevalence figures and devices, and the other detections —
+  with each fact's command.
+
+commands:
+  - list_detection_summaries
+  - endpoint
+  - device_online_state
+  - ioc_device_count
+  - device_ran_on
+  - processes_ran_on
+  - process_details
+  - search_custom_iocs
+  - list_quarantined_file
+  - get_device_details
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/crowdstrike/manifest.yaml

@@ -1,6 +1,6 @@
 id: crowdstrike
 name: CrowdStrike Falcon
-version: 1.5.0
+version: 1.5.1
 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
 changelog: "1.5.0 — resolve_detection sets the verdict. Falcon has no verdict field on an alert: the console's Resolution column is read from the tags true_positive, false_positive and ignored, and the status only takes new, in_progress, reopened and closed — so no value of the old status box could record a verdict. The new verdict input adds the tag, after removing the other two so an alert never carries two resolutions, and status and verdict are now drop-downs. 1.4.0 — New device_count command: counts devices matching filters without listing them. The device query already answers with meta.pagination.total — the number of matches, independent of the page asked for — so device_count asks for a one-ID page and reads it, where search-device resolves every matching device in full through /devices/entities/devices/v2 to reach the same figure, and only filters on four properties. Filters cover sixteen device FQL properties (hostname, device id, local and external IP, platform, OS version, role, containment status, sensor version, AD domain/OU/site, serial, tags, host groups, RFM), add first_seen/last_seen bounds, and leave a raw FQL `filter` escape hatch for the rest. Several values on one property become an OR group, parenthesised so it binds before the AND that joins it to the others — the reference client omits those parentheses and leaves the precedence to the server. Values are quoted with the single quote escaped, so a hostname carrying an apostrophe cannot end the literal early and change what the query counts. The estate `total` comes back next to `count` so the figure reads as a proportion, and a filter too broad to mean anything shows as matching everything rather than passing for an answer. | 1.3.0 — search_detections takes a created_from timestamp, folded into the FQL as created_timestamp, and declares it as the ingestion watermark input. An alert rule can now fetch incrementally instead of re-reading the whole window every run: this API expresses its time bound inside the FQL, so the watermark used to have nowhere to go but the filter input, where it replaced the query rather than narrowing it. filter now carries the scoping only. 1.2.4 — Fixed two silent defects in the search_detections OCSF mapper: severity was a ternary that resolved to nothing, so every alert kept the alert rule's default severity instead of Falcon's — it is now a plain path to severity_name, whose words the engine reads natively; and no entry fed the OCSF `time` field, so detected_at was never stamped and MTTD measured the collection delay as zero. 1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
 category: endpoint