feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion (Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk), Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep (Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID), Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur (VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer (Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe), Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift (Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart (FortiGate), Relay (Zscaler), Phantom (Darktrace). Read-only commands, analyst_l2, a call budget with an order, and the Static lessons: ids copied from answers only, timestamps passed as given, names over ids, one variant at most on error. Each sheet passes Riposte's validator; none is field-tested yet. Each integration gets a patch bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
2026-10-11 23:00:15 +00:00
parent 2245d5500e
commit 9605e1f0dc
66 changed files with 2228 additions and 33 deletions
@@ -0,0 +1,55 @@
+# The SentinelOne SDL operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Tracer
+title: SentinelOne SDL operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  The full detail of a SentinelOne Unified Alert: the asset and its last
+  logged-in user, the process and command line, the file and its hashes,
+  the indicators with their ATT&CK tactics and techniques, the observables,
+  the storyline id, and the related alerts (read in turn). It cannot run
+  SDL log queries or search alerts by user, host or time: no command does.
+  Not for other vendors' alerts, and not for changing anything in
+  SentinelOne.
+
+needs: |
+  The Riposte alert id, or the SentinelOne alert id.
+
+returns: |
+  Facts from SentinelOne, each with the command that produced it; "not
+  found" when a lookup came back empty; the exact call and error when one
+  failed. No verdict.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. get_incident_context (1 call). Its source_ref is the SentinelOne alert
+     id (the raw "id" field). Take it from there exactly.
+  2. get_alert_details(alert_id=<that id>) (1 call). Read: asset (name,
+     osType, lastLoggedInUser), process (cmdLine, parentName, username,
+     file name, path and sha256), indicators (message, eventTime, attacks),
+     observables, storylineId, detectedAt, firstSeenAt, lastSeenAt.
+  3. relatedAlerts: this is your "same host or user elsewhere" check. Call
+     get_alert_details on each related alert id, copied from the answer,
+     most useful first, at most 6 calls. Note for each: its name, asset,
+     user, and detectedAt.
+  4. Stop there. Do not try other ids: an alert id is only ever one you
+     read in a previous answer; never type, shorten or adapt one.
+
+  Times: report them exactly as SentinelOne gives them; do not compute or
+  convert. A "GraphQL:" error means the id was refused: report the exact
+  call and error, retry at most once.
+  There is no log search or alert search here: if the lead asks what the
+  logs show, say so and give what the alert's indicators and observables
+  carry.
+
+commands:
+  - get_alert_details
+
+riposte_tools:
+  - get_incident
+  - get_incident_context