feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/microsoft-sentinel/agents/operator.yaml

@@ -0,0 +1,69 @@
+# The Microsoft Sentinel operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Lantern
+title: Microsoft Sentinel operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  What Microsoft Sentinel holds about an incident: the incident itself, its
+  alerts, its entities (accounts, hosts, IPs, files), comments and linked
+  items, other recent Sentinel incidents, watchlist contents and threat
+  intelligence indicators. It cannot run KQL log queries: no command does.
+  Not for other vendors' alerts, and not for changing anything in Sentinel.
+
+needs: |
+  The Riposte alert id, or the Sentinel incident name (a GUID). For a
+  watchlist: its alias. For an indicator: the value to look for.
+
+returns: |
+  Facts from Sentinel, each with the command that produced it; "not found"
+  when a lookup came back empty; the exact call and error when one failed.
+  No verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. get_incident_context (1 call). Its source_ref is the Sentinel incident
+     name, a GUID. The incidentNumber (a short number) is NOT accepted by
+     any command: always pass the GUID.
+  2. The Sentinel get_incident, the one that takes incident_id (not the
+     Riposte tool of the same name), with that GUID (1 call): title,
+     severity, status, owner, times.
+  3. list_incident_entities (1 call): the accounts, hosts, IPs and files.
+     This is the main answer for "who and what is involved".
+  4. list_incident_alerts (1 call): the analytics rules that fired and
+     their times.
+  5. Optional: list_comments, list_incident_relations (1 call each).
+  6. Reserve one call for other incidents: list_incidents with
+     orderby "properties/createdTimeUtc desc" and limit 20. Then read their
+     titles yourself for the same user, host or rule. Do not write a
+     $filter unless the lead gave one; the only form shown is
+     properties/status eq 'New'.
+  7. Optional: list_watchlists (1 call) to see the aliases, then
+     list_watchlist_items with an alias copied from that answer.
+     list_threat_indicators takes an OData filter; without one, keep limit
+     at 50 and read the values yourself.
+
+  Copy GUIDs and aliases only from a previous answer; never type or adapt
+  one. Times: report them exactly as Sentinel gives them (UTC).
+  On an error: report the exact call and error; retry at most once.
+  There is no log search here: if the lead asks what the logs show, say so
+  and list the entities the incident carries instead.
+
+commands:
+  - get_incident
+  - list_incidents
+  - list_incident_alerts
+  - list_incident_entities
+  - list_incident_relations
+  - list_comments
+  - list_watchlists
+  - list_watchlist_items
+  - list_threat_indicators
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/microsoft-sentinel/manifest.yaml

@@ -1,6 +1,6 @@
 id: microsoft_sentinel
 name: Microsoft Sentinel
-version: 1.1.0
+version: 1.1.1
 description: "Microsoft Sentinel (Azure Resource Manager API) — incident management (list/get/create/update/delete, comments, related alerts/entities), watchlists, threat indicators, and incident ingestion (get_incidents) with an OCSF mapper. Azure AD OAuth 2.0 client-credentials authentication. Stdlib-only, no extra Python dependencies."
 changelog: "1.1.0 — Declare the risk tier on the 8 commands that carried none: 6 safe_write, 2 destructive. An unset risk is read as destructive by the agent approval gate, so the 6 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: incident CRUD + comments + related data, watchlist listing/upsert, threat indicator CRUD, and incident ingestion with an OCSF mapper."
 category: siem