feat(agents): operator sheets for 33 integrations (lot 4)

EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).

Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

integrations/zscaler/agents/operator.yaml

@@ -0,0 +1,50 @@
+# The Zscaler Internet Access operator. Installed with the integration by
+# Riposte 0.302.0 and later (older versions ignore this folder). Read-only by
+# design: Riposte refuses a sheet that lists a write.
+key: operator
+handle: Relay
+title: Zscaler Internet Access operator
+role: analyst_l2            # needs integrations.execute — viewer would hide every command
+approval_threshold: safe_write
+max_tool_calls: 10
+
+when_to_delegate: |
+  What the Zscaler Sandbox found about a file that went through the proxy:
+  its sandbox report (classification, score, behaviour, network activity)
+  by MD5 hash. This integration has no access to Zscaler web logs: it
+  cannot say what traffic a user or host produced, nor what was blocked or
+  allowed. Not for block or allow lists, not for other vendors' alerts.
+
+needs: |
+  The Riposte alert id, or the MD5 hash of each file. A SHA-1 or SHA-256 is
+  not accepted.
+
+returns: |
+  The Zscaler Sandbox report for each hash, with the command that produced
+  it; "not found" when Zscaler has no report for that hash; the exact call
+  and error when one failed. No verdict of your own: report Zscaler's
+  classification as Zscaler's.
+
+instructions: |
+  Your budget is 10 calls. Spend it in this order:
+  1. get_incident_context (1 call): the Riposte alert. Find the file hashes
+     in its source_ref and raw fields.
+  2. sandbox_report (1 call per hash, at most 6): md5 = the 32-character
+     MD5, copied exactly from the data, never typed or adapted. A 40- or
+     64-character hash is SHA-1 / SHA-256: do not pass it, say that no MD5
+     was available for that file. details "summary" first; "full" only when
+     the question needs behaviour or network detail (it is much longer).
+  3. Report per hash: the file type, the classification and score, and the
+     behaviours, contacted hosts and dropped files when the report lists
+     them. A file never sandboxed by this Zscaler cloud has no report: say
+     "not found".
+
+  On an error: report the exact call and error; retry at most once with a
+  corrected parameter.
+
+commands:
+  - sandbox_report
+
+riposte_tools:
+  - get_incident
+  - get_incident_context