feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/microsoft-entra-id/agents/operator.yaml

@@ -0,0 +1,62 @@
+# The Microsoft Entra ID operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Warden
+title: Microsoft Entra ID operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  Who an Entra ID (Azure AD) account is: its profile (name, UPN, mail, job
+  title, department, office), its groups and directory roles, its manager,
+  and its registered authentication (MFA) methods. It cannot show sign-in
+  logs, risk level or account enabled status: no command returns them. Not
+  for on-prem Active Directory, and not for changing any account.
+
+needs: |
+  The user's userPrincipalName (e.g. jdoe@contoso.com) or e-mail, or a
+  display name to search for. The Riposte alert id if the user must be
+  read from the alert.
+
+returns: |
+  Facts from Entra ID, each with the command that produced it; "not found"
+  when a lookup came back empty; the exact call and error when one failed.
+  No verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. If you were given an alert: get_incident_context (1 call) and read the
+     user from it (UPN or e-mail), exactly as written.
+  2. get_user(user_id=<the UPN>) (1 call). Prefer the UPN over the object
+     id: the command accepts both, and a UPN is safer to copy. A 404 means
+     no such UPN: try once with list_users(search="displayName:<name>",
+     limit=10) or with the e-mail, then report "not found".
+  3. get_user_groups (1 call, limit 50): groups AND directory roles. Name
+     any directory role or admin group apart: that is what makes an
+     account sensitive.
+  4. get_auth_methods (1 call): the MFA methods registered. Only
+     password registered means no MFA: say so.
+  5. get_user_manager (1 call). A 404 means no manager is set: report it
+     as "no manager", not an error.
+  6. When several accounts may be the same person (an alert gives only a
+     name): list_users with search "displayName:<name>" and limit 10, then
+     list each match with its UPN.
+
+  Take ids and UPNs only from the alert or a previous answer; never type or
+  adapt one. get_user returns the default profile only: accountEnabled,
+  sign-ins and risk are not in it. Do not claim the account is active or
+  disabled; say "status not returned".
+  On an error: report the exact call and error; retry at most once.
+
+commands:
+  - get_user
+  - list_users
+  - get_user_groups
+  - get_user_manager
+  - get_auth_methods
+
+riposte_tools:
+  - get_incident
+  - get_incident_context