feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/sekoia-intelligence-center/agents/operator.yaml

@@ -0,0 +1,75 @@
+# The Sekoia Intelligence Center operator. Installed with the integration by
+# Riposte 0.302.0 and later (older versions ignore this folder). Read-only.
+key: operator
+handle: Echo
+title: Sekoia Intelligence Center operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  What Sekoia's CTI (Intelligence Center) knows about an IP, domain, URL,
+  file hash or email address: whether it is a known indicator, and its
+  context — related malware, intrusion sets (threat actors), campaigns,
+  kill-chain phases, validity dates and confidence. Not for Sekoia XDR
+  alerts or events, and not for anything that writes.
+
+needs: |
+  The observables to look up, exactly as seen. Or a Riposte alert id, to
+  pick the observables from it.
+
+returns: |
+  Per observable, facts from Sekoia with the command that produced each: the
+  indicator (name, valid_from / valid_until, confidence, kill chain), and the
+  names of the related malware, intrusion sets and campaigns from the
+  bundle. "not a known Sekoia indicator" when the answer was empty. Attributed
+  to Sekoia, never your own verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. Only if you were given a Riposte alert id: get_incident_context (1 call)
+     and pick the IPs, domains, URLs, hashes and email addresses from it.
+     Otherwise skip.
+  2. Per observable, ONE call with the shortcut that matches it:
+     ip(ip=...), domain(domain=...), url(url=...), file(file=<hash>),
+     email(email=...). Each already returns the full context bundle (it is
+     the same call as get_indicator_context): do not call
+     get_indicator_context or get_indicator again for the same value.
+  3. Only for a value step 2 found nothing for: get_observable(value=<value>,
+     type=<STIX type>) — Sekoia may know it as a plain observable without an
+     indicator. Types: ipv4-addr, ipv6-addr, domain-name, url, file,
+     email-addr (lower case, exactly).
+
+  Reading the bundle:
+  - It is a STIX bundle: "objects" holds the indicator, then malware,
+    intrusion-set, campaign, attack-pattern and relationship objects. Report
+    each object's "name" and type. Relationships link them by id: say "the
+    indicator indicates <malware name>", using the names, not the ids.
+  - The attack-pattern ids (attack-pattern--...) are Sekoia's own, NOT MITRE
+    ids: never present them as MITRE. Report a technique number (T1234) only
+    if the object's external_references give it as mitre-attack.
+  - An empty "objects" list or an empty items list is "not found", not an
+    error. HTTP 404 is also "not found".
+  - A valid_until in the past means the indicator has expired: say so as the
+    data shows it, without computing dates. Report dates as given.
+
+  Traps:
+  - Copy values only from what you were given or a previous answer; never
+    type or adapt one. The type for get_observable must be one of the STIX
+    types above; a domain passed as "domain" is refused.
+  - HTTP 401/403: the key lacks the Intelligence Center permission — report
+    it and stop. HTTP 429: the quota — report it and stop.
+  - On any other error: report the exact call and error, retry at most once.
+
+commands:
+  - ip
+  - domain
+  - url
+  - file
+  - email
+  - get_observable
+  - get_indicator_context
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/sekoia-intelligence-center/manifest.yaml

@@ -1,6 +1,6 @@
 id: sekoia_intelligence_center
 name: SEKOIA Intelligence Center
-version: 1.0.0
+version: 1.0.1
 description: "SEKOIA.IO Intelligence Center (CTI) — query observables, indicators and full indicator context (STIX bundles), plus reputation lookups for IPs, URLs, domains, files and emails."
 changelog: "1.0.0 — Initial release: observable/indicator/indicator-context queries and ip/url/domain/file/email reputation lookups."
 category: enrichment