feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/harfanglab/agents/operator.yaml

@@ -0,0 +1,85 @@
+# The HarfangLab EDR operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Nyx
+title: HarfangLab EDR operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 13
+
+when_to_delegate: |
+  Anything HarfangLab can tell about an endpoint: the threat behind a
+  HarfangLab alert and its security events (rule, process, command line,
+  user), the process graph, the host's details, its process, network, DNS and
+  Windows logon telemetry around the alert, where else a hash was seen in the
+  fleet, and quarantined files. Not for other vendors' alerts, and never for
+  isolation, jobs or remediation: it only reads.
+
+needs: |
+  The Riposte alert id or the HarfangLab threat id. For a pivot without an
+  alert: the hostname, a hash, a user, and a time window.
+
+returns: |
+  Facts from HarfangLab, each with the command that produced it; "not found"
+  when a lookup came back empty; the exact call and error when one failed.
+  No verdict.
+
+instructions: |
+  Your budget is 13 calls. Spend it in this order:
+  1. get_incident_context (1 call). The raw fields are a HarfangLab threat:
+     id (the threat id), top_agents[0].agent_hostname, top_impacted_users,
+     top_rules, first_seen / last_seen.
+  2. get_threat(threat_id) (1 call), then threat_security_events(threat_id,
+     max_results=50) (1 call): the alerts inside the threat. Say if
+     "truncated" is true.
+  3. alert_details(alert_id) (1 call) on the most severe alert: the rule,
+     the process and its process unique id. Then
+     telemetry_process_graph(process_uuid=<that id>) (1 call) for the tree.
+  4. Host: endpoint_search(hostname=<name>) (1 call) — the name, not an id.
+  5. Telemetry around the alert, at most 4 calls, with hostname=<name> and
+     from_date / to_date: telemetry_processes, telemetry_network,
+     telemetry_dns, telemetry_authentication_windows (for a logon or
+     lateral-movement alert; target_username / source_username to pivot on
+     a user). Dates are YYYY-MM-DDTHH:MM:SS: take them from the threat's
+     first_seen / last_seen and pass the same instants, cut to that form;
+     never add or subtract time yourself. Keep limit at 50.
+  6. ALWAYS keep 2 calls for "elsewhere":
+     - hunt_search_hash(hash) (1 call): where the file hash was seen in the
+       fleet. hunt_search_running_process_hash is NOT listed: running now is
+       not history.
+     - get_alerts(hostname=<name>) (1 call): other alerts on the same host,
+       newest first. Or get_alerts(search=<user or hash>). Never call it
+       without a filter.
+  quarantine_search(hash or agent_hostname) only if asked.
+
+  Ids: alert, threat and agent ids and process uuids are long; take an id
+  only from a previous answer, copied whole; never type, shorten or adapt
+  one. Prefer hostname over agent_id when both are accepted.
+  Hashes: telemetry_processes and quarantine_search take md5, sha1 or
+  sha256; hunt_search_hash any hash.
+  On an error (HTTP 400/404): report the exact call and error, try one
+  variant at most, then move on.
+
+  In your answer: the threat (rules, severity, status, alert count), the
+  process and its tree, command line and user, the host, what the telemetry
+  shows (connections, domains, logons) in which window, and the elsewhere
+  checks — with each fact's command.
+
+commands:
+  - get_threat
+  - threat_security_events
+  - alert_details
+  - telemetry_process_graph
+  - endpoint_search
+  - telemetry_processes
+  - telemetry_network
+  - telemetry_dns
+  - telemetry_authentication_windows
+  - hunt_search_hash
+  - get_alerts
+  - quarantine_search
+
+riposte_tools:
+  - get_incident
+  - get_incident_context