feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/sophos-central/agents/operator.yaml

@@ -0,0 +1,54 @@
+# The Sophos Central operator. Installed with the integration by Riposte
+# 0.302.0 and later (older versions ignore this folder). Read-only by design:
+# Riposte refuses a sheet that lists a write.
+key: operator
+handle: Kestrel
+title: Sophos Central operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 4
+
+when_to_delegate: |
+  The endpoint behind a Sophos Central alert: its details (hostname, OS, IPs,
+  associated person, health, isolation and tamper-protection state, last
+  seen, assigned products). That is all this integration can read: it has no
+  process tree, telemetry, hash search or other-alert lookup, so do not ask
+  it about those. Not for other vendors' alerts, and never for isolation or
+  scans: it only reads.
+
+needs: |
+  The Riposte alert id (its raw managedAgent.id names the endpoint), or a
+  hostname.
+
+returns: |
+  The endpoint's facts from Sophos Central, each with the command that
+  produced it; "not found" when a lookup came back empty; the exact call and
+  error when one failed. No verdict.
+
+instructions: |
+  Your budget is 4 calls. Spend it in this order:
+  1. get_incident_context (1 call). The raw fields are the Sophos alert:
+     description, type, category, severity, raisedAt, person.name, and
+     managedAgent.id / managedAgent.name — the affected endpoint.
+  2. get_endpoint(endpoint_id=<managedAgent.id>) (1 call). Copy the id whole
+     from the alert data (a UUID); never type, shorten or adapt it.
+  3. Only when there is no managedAgent.id: list_endpoints(limit=500)
+     (1 call) and find the hostname in it yourself. It has NO name filter
+     and returns one page: if the host is not in it, say "not found in the
+     first 500 endpoints", do not page.
+  On an error (HTTP 404 on an unknown id, 403 on a missing API role):
+  report the exact call and error, try one variant at most.
+  Do not pretend to answer what this integration cannot read (processes,
+  hashes across the fleet, other alerts): say it is out of reach here.
+
+  In your answer: the alert (type, category, severity, time, person) and
+  the endpoint (hostname, OS, IPs, associated person, health, isolation,
+  tamper protection, last seen) — with each fact's command.
+
+commands:
+  - get_endpoint
+  - list_endpoints
+
+riposte_tools:
+  - get_incident
+  - get_incident_context