feat(pulsedive): new Pulsedive enrichment integration
4 commands: indicator lookup, scan submission, scan-result retrieval. API-key auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,53 @@
|
||||
id: pulsedive
|
||||
name: Pulsedive
|
||||
version: 1.0.0
|
||||
description: "Pulsedive (API) — reputation and threat context for any indicator (IP, domain, URL or hash), plus on-demand scanning and scan-result retrieval. API-key authentication; stdlib-only, no extra Python dependencies."
|
||||
changelog: "1.0.0 — Initial release: indicator lookup, scan submission and scan-result retrieval."
|
||||
category: enrichment
|
||||
|
||||
config_schema:
|
||||
properties:
|
||||
api_key:
|
||||
type: string
|
||||
description: "Pulsedive API key"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- api_key
|
||||
|
||||
commands:
|
||||
- id: lookup_indicator
|
||||
name: pulsedive-lookup-indicator
|
||||
description: "Look up the reputation and threat context of an indicator (IP, domain, URL or hash)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
indicator: { type: string, description: "Indicator value (IP, domain, URL or hash)" }
|
||||
required: [indicator]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: scan
|
||||
name: pulsedive-scan
|
||||
description: "Submit an indicator for an on-demand scan. Returns a qid; retrieve the report with pulsedive-scan-result once it finishes."
|
||||
inputs_schema:
|
||||
properties:
|
||||
value: { type: string, description: "Indicator to scan (IP, domain or URL)" }
|
||||
probe: { type: boolean, description: "Actively probe the indicator (default true)" }
|
||||
required: [value]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: scan_result
|
||||
name: pulsedive-scan-result
|
||||
description: "Retrieve the result of a scan by its qid."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
qid: { type: string, description: "Scan qid (from pulsedive-scan)" }
|
||||
required: [qid]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: pulsedive-test-connection
|
||||
description: "Verify the API key (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user