feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/elasticsearch/agents/operator.yaml

@@ -0,0 +1,64 @@
+# The Elasticsearch operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Grep
+title: Elasticsearch operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  What the logs stored in Elasticsearch show for a user, host, IP or other
+  value: which indices exist, how many documents match, the matching
+  documents, and one document read in full. Not for other vendors' alerts,
+  and not for changing anything in Elasticsearch.
+
+needs: |
+  The value to look for (user, host, IP, hash, domain), and if known the
+  index or index pattern (e.g. logs-*) and a time window. A ready query
+  from the lead if there is one.
+
+returns: |
+  Facts from Elasticsearch, each with the index, query and size that
+  produced it; "not found" when 0 documents matched; the exact query and
+  error when one failed. No verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. get_incident_context (1 call) for the values to look for (user, host,
+     IP, hash) and the alert time. Take them exactly as written.
+  2. list_indices (1 call) unless the lead named the index. Pick an index
+     name or a pattern ending in * from that answer (e.g. logs-*); never
+     invent one.
+  3. count(index, query_string) first (1 call per value): it tells you
+     whether a search is worth it. query_string = the bare value, nothing
+     else (no field names, no boolean operators) unless the lead gave the
+     query. A value holding : / or a space goes in double quotes, e.g.
+     "fe80::1". For DOMAIN\user, search the user part alone.
+  4. search(index, query_string, size=20) (1-3 calls) where count > 0.
+     Never above size 50.
+  5. Optional: get_document with the _index and _id of a hit, both copied
+     from the search answer. It needs the concrete _index of the hit, not a
+     pattern with *.
+  6. Reserve one count + search for the same user, host or IP elsewhere:
+     the other value from the alert, or a wider pattern (e.g. *).
+
+  Time: these commands have no time parameter. If the lead gave a query_json
+  with a time range, pass it exactly as given. Otherwise say in your answer
+  that the search was not time-bounded, prefer an index whose name carries
+  the alert's date when list_indices shows such names, and keep size small.
+  Report document timestamps exactly as stored (@timestamp).
+
+  On an error: report the exact index, query and error; retry at most once
+  with a simpler query. Do not write query DSL yourself.
+
+commands:
+  - list_indices
+  - count
+  - search
+  - get_document
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/elasticsearch/manifest.yaml

@@ -1,6 +1,6 @@
 id: elasticsearch
 name: Elasticsearch
-version: 1.1.0
+version: 1.1.1
 description: "Elasticsearch (REST API) — log search and enrichment for security data: run queries, count and read documents, list indices, index a document, and delete by query. API-key authentication; stdlib-only, no extra Python dependencies. Works with Elastic Security indices."
 changelog: "1.1.0 — Declare the risk tier on the 2 commands that carried none: 1 safe_write, 1 destructive. An unset risk is read as destructive by the agent approval gate, so the 1 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: search, count, get document, index document, list indices, delete by query."
 category: siem