feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/sekoia-xdr/agents/operator.yaml

@@ -0,0 +1,68 @@
+# The Sekoia XDR operator. Installed with the integration by Riposte 0.302.0
+# and later (older versions ignore this folder). Read-only by design: Riposte
+# refuses a sheet that lists a write.
+key: operator
+handle: Hexcore
+title: Sekoia XDR operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 12
+
+when_to_delegate: |
+  What Sekoia XDR holds about an alert: the alert (rule, urgency, source,
+  target, entity, ATT&CK techniques, kill chain step), the events behind it,
+  comments, the Sekoia cases it belongs to, the assets involved, and event
+  searches for the same user, host or IP over a time window. Not for other
+  vendors' alerts, and not for changing anything in Sekoia.
+
+needs: |
+  The Riposte alert id, or the Sekoia alert UUID or short_id (e.g.
+  ALUnyZCYZ9Ga). For an event search: the user, host or IP and a window.
+
+returns: |
+  Facts from Sekoia, each with the command, query and window that produced
+  it; "not found" when a lookup came back empty; the exact query and error
+  when one failed. No verdict.
+
+instructions: |
+  Your budget is 12 calls. Spend it in this order:
+  1. get_incident_context (1 call). Its source_ref is the Sekoia alert
+     uuid; the raw fields also carry short_id, first_seen_at, source,
+     target and entity.
+  2. get_alert(id=<the uuid>) (1 call). Note its short_id and
+     first_seen_at exactly as written.
+  3. The events behind the alert: search_events with
+     query "alert_short_ids:<short_id>", earliest_time = first_seen_at
+     exactly as the alert gives it, latest_time "now", max_last_events 50
+     (1 call). Never compute dates yourself.
+     If it answers pending with a job_uuid: events_status_query, then
+     events_results_query with that job_uuid (copy it, never retype it).
+  4. get_cases_alert(alert_id=<the uuid>) (1 call). It matches on the UUID
+     only: a short_id returns nothing.
+  5. Optional: get_comments (1 call); get_asset with an asset UUID read in
+     the alert (1 call each, at most 2); get_kill_chain with the alert's
+     kill chain short_id.
+  6. Reserve one search_events for the same user, host or IP elsewhere.
+     Use the same field:value form as above, with a field name copied from
+     an event you got back and its value exactly as written. Window:
+     earliest_time "-7d", latest_time "now", max_last_events 50.
+
+  Bound every search: always earliest_time, latest_time and
+  max_last_events. Copy ids only from a previous answer; never type or
+  adapt one. On an error: report the exact query and error; retry at most
+  once with a simpler query. 0 events is an answer: say "not found" with
+  the query and window.
+
+commands:
+  - get_alert
+  - search_events
+  - events_status_query
+  - events_results_query
+  - get_cases_alert
+  - get_comments
+  - get_asset
+  - get_kill_chain
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/sekoia-xdr/manifest.yaml

@@ -1,6 +1,6 @@
 id: sekoia_xdr
 name: Sekoia XDR
-version: 1.2.0
+version: 1.2.1
 description: "Sekoia Defend (XDR) REST API — alert ingestion and lifecycle (list/get/search, status workflow, comments), event search jobs (create/status/results + one-shot search), cases, asset management (get/list, attributes/keys add/remove), users, kill chains and a generic authenticated HTTP passthrough."
 changelog: "1.2.0 — Mapper reviewed on a real Entra ID alert. The incident source is now 'Sekoia XDR': it carried Sekoia's own `source` field, the alert's source address, which now goes to src_endpoint.ip (or .hostname for a host), and `target` to dst_endpoint instead of src_endpoint. The description is the alert's sentence with its {rule:<uuid>} placeholder replaced by the rule name, rather than the rule documentation (now finding_info.analytic.desc). Every TTP is mapped into attacks, not only the first; kill_chain_short_id, Sekoia's own kill chain, no longer poses as an ATT&CK tactic uid. Times are epoch milliseconds as OCSF expects (created_at/updated_at came in seconds, first/last seen as text); alert category in finding_info.types, detection type in analytic.category, product in metadata. | 1.1.0 — Declare the risk tier on the 1 command that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: alert ingestion (list_alerts) with an exhaustive OCSF mapper, 20 commands across alerts, event search, cases, assets, users and kill chains."
 category: siem