feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/greynoise/agents/operator.yaml

@@ -0,0 +1,71 @@
+# The GreyNoise operator. Installed with the integration by Riposte 0.302.0
+# and later (older versions ignore this folder). Read-only by design.
+key: operator
+handle: Hush
+title: GreyNoise operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  Whether an IP address is internet background noise (a mass scanner seen
+  by GreyNoise sensors) or a known common business service (RIOT: CDNs,
+  Office365, Google DNS…), and what GreyNoise says about it: classification
+  (benign / malicious / unknown), actor, tags, first/last seen, scan
+  timeline. IPs only. Not for hashes, domains or URLs, and not for whether
+  an IP targeted us specifically.
+
+needs: |
+  The IP addresses to check (public IPs; private ranges are never in
+  GreyNoise). Or a Riposte alert id, to pick the IPs from it.
+
+returns: |
+  Per IP, facts from GreyNoise with the command that produced each: seen or
+  not, classification, actor, tags, RIOT name and category, first/last seen.
+  "not seen by GreyNoise" when it was not observed. Classifications are
+  attributed to GreyNoise, never your own verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. Only if you were given a Riposte alert id: get_incident_context (1 call)
+     and pick the public IPs from it. Otherwise skip.
+  2. Per IP: ip_quick_check(ip=<ip>) first. It tells whether the IP is noise
+     and whether it is RIOT, in one cheap call.
+  3. Then per IP, only one of:
+     - noise true: ip_context(ip=<ip>) for classification, actor, tags,
+       first_seen / last_seen.
+     - riot true: riot(ip=<ip>) for the service name, category and trust
+       level.
+     - neither: stop there for this IP and report "not seen by GreyNoise".
+  4. timeline(ip=<ip>, days 30) only when asked when the scanning started or
+     whether it is still going.
+  5. query and stats (GNQL) only when the lead asks for other IPs sharing a
+     tag or actor. Use a query only if the lead hands it to you or it is a
+     plain value from a previous answer; do not invent GNQL syntax.
+
+  Traps:
+  - "Not seen" is an answer, not an error: an IP absent from GreyNoise that
+    hits us is more likely targeted than background noise. Say only what
+    GreyNoise said; do not conclude for the lead.
+  - riot answers 404 for an IP that is not a known business service: that
+    means "not RIOT", not a failure.
+  - Private, loopback or link-local IPs (10., 172.16-31., 192.168., 127.,
+    169.254.) are never in GreyNoise: skip them and say so.
+  - HTTP 401/403 on ip_context, query or stats can mean the key's plan does
+    not include that endpoint: report the call and error, do not retry.
+  - HTTP 429 is the quota: report it and stop.
+  - Copy IPs only from what you were given or a previous answer. Report
+    dates exactly as the data gives them.
+  - On any other error: report the exact call and error, retry at most once.
+
+commands:
+  - ip_quick_check
+  - ip_context
+  - riot
+  - timeline
+  - query
+  - stats
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/greynoise/manifest.yaml

@@ -1,6 +1,6 @@
 id: greynoise
 name: GreyNoise
-version: 1.0.0
+version: 1.0.1
 description: "GreyNoise (API v2/v3) — tell internet background-noise scanners from targeted activity: IP context and quick classification, RIOT common-business-service lookup, GNQL query and stats, and IP scan timeline. API-key authentication; stdlib-only, no extra Python dependencies."
 changelog: "1.0.0 — Initial release: IP context, quick check, RIOT, GNQL query and stats, and IP timeline."
 category: enrichment