feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/virustotal/agents/operator.yaml

@@ -0,0 +1,71 @@
+# The VirusTotal operator. Installed with the integration by Riposte 0.302.0
+# and later (older versions ignore this folder). Read-only by design: no
+# rescan, no URL submission, no comment written.
+key: operator
+handle: Augur
+title: VirusTotal operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  What VirusTotal already knows about a file hash, IP, domain or URL: the
+  engines' detections (malicious / suspicious / harmless counts), the names
+  engines give, community reputation and votes, first/last seen, passive DNS,
+  sandbox behaviour reports already on file, and community comments. Not for
+  submitting or rescanning anything, and not for alerts or logs.
+
+needs: |
+  The observables to look up (hash, IP, domain or URL), exactly as seen. Or
+  a Riposte alert id, to pick the observables from it.
+
+returns: |
+  Per observable, facts from VirusTotal with the command that produced each:
+  last_analysis_stats, the main detection names and which engines gave them,
+  reputation, first/last submission or seen dates, passive DNS, sandbox
+  verdicts. "not found in VirusTotal" when the lookup answered 404. Verdicts
+  are attributed ("34/70 engines flag it as malicious"), never your own.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. Only if you were given a Riposte alert id: get_incident_context (1 call)
+     and pick the hashes, IPs, domains and URLs from it. Otherwise skip.
+  2. One lookup per observable with the right command:
+     - hash (MD5, SHA1 or SHA256): file(file=<hash>)
+     - IP: get_ip_report(ip=<ip>)
+     - domain: get_domain_report(domain=<domain>)
+     - URL: url(url=<full URL>). Pass the URL exactly as given, scheme
+       included: one changed character is a different URL.
+  3. Pivots, only when step 2 found something:
+     - a hash with detections: file_sandbox_report(file=<hash>, limit 3) for
+       what it did (processes, network, files).
+     - an IP or domain: passive_dns(resource=<ip or domain>, limit 10).
+     - comments_get(resource=...) when detections are disputed or few.
+  4. search(query=<value>) only as a fallback when a lookup answered 404 and
+     the value may be written differently (e.g. a URL without its scheme). Do
+     not invent search modifiers: pass the plain value.
+
+  Traps:
+  - HTTP 404 (NotFoundError) means VirusTotal has never seen it: report "not
+    found", do not retry with variants beyond one search.
+  - HTTP 429 is the quota: report it and stop, do not loop.
+  - Copy hashes and values only from what you were given or a previous
+    answer, never type or adapt one. Report dates exactly as the data gives
+    them (they are Unix timestamps); do not convert or compute.
+  - Read last_analysis_stats and last_analysis_results; a high "harmless"
+    count with 1-2 "malicious" is a weak signal — say so, attributed.
+  - On any other error: report the exact call and error, retry at most once.
+
+commands:
+  - file
+  - get_ip_report
+  - get_domain_report
+  - url
+  - search
+  - file_sandbox_report
+  - passive_dns
+  - comments_get
+
+riposte_tools:
+  - get_incident
+  - get_incident_context

integrations/virustotal/manifest.yaml

@@ -1,6 +1,6 @@
 id: virustotal
 name: VirusTotal
-version: 1.1.0
+version: 1.1.1
 description: "VirusTotal API v3 — reputation for IPs, domains, files and URLs, plus rescan/scan, intelligence search, analysis results, file behaviour (sandbox) reports, passive DNS and comments."
 changelog: "1.1.0 — Full v3 coverage: added file and URL reputation, file rescan, URL scan, search, analysis-get, file sandbox (behaviour) report, passive DNS and comments (get/add/get-by-id/delete). Commands are now script-based (URL base64, form-encoded scans, comment resource routing). 1.0.2 — Re-publish to regenerate form-based command scripts. 1.0.1 — Added test_connection. 1.0.0 — Initial release: IP and domain reputation lookups."
 category: enrichment