feat(withsecure): new WithSecure Elements endpoint integration

WithSecure Elements Connect API, 7 commands: list/get devices, isolate/release
(containment), scan, list incidents. OAuth2 client-credentials auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-12 15:04:02 +02:00
parent 1949c98cf7
commit cf950cf6e4
8 changed files with 599 additions and 0 deletions
+88
View File
@@ -0,0 +1,88 @@
id: withsecure
name: WithSecure Elements
version: 1.0.0
description: "WithSecure Elements (Connect API) — endpoint containment: list and read devices, isolate/release a device, trigger a malware scan, and list incidents. OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get devices, isolate/release device, scan, list incidents."
category: endpoint
# Per-instance configuration. Client credentials are exchanged for a bearer token.
# organization_id scopes the device and incident queries.
config_schema:
properties:
client_id:
type: string
description: "API client ID"
client_secret:
type: string
description: "API client secret"
x-soar-sensitive: true
organization_id:
type: string
description: "Organization ID"
required:
- client_id
- client_secret
- organization_id
commands:
- id: list_devices
name: withsecure-list-devices
description: "List devices."
risk: read
inputs_schema:
properties:
limit: { type: number, description: "Max devices (default 50)" }
required: []
outputs_schema: { properties: {} }
- id: get_device
name: withsecure-get-device
description: "Get a single device by ID."
risk: read
inputs_schema:
properties:
device_id: { type: string, description: "Device ID" }
required: [device_id]
outputs_schema: { properties: {} }
- id: isolate_device
name: withsecure-isolate-device
description: "Isolate a device from the network (containment)."
inputs_schema:
properties:
device_id: { type: string, description: "Device ID" }
message: { type: string, description: "Optional message shown to the user" }
required: [device_id]
outputs_schema: { properties: {} }
- id: release_device
name: withsecure-release-device
description: "Release a device from network isolation."
inputs_schema:
properties:
device_id: { type: string, description: "Device ID" }
required: [device_id]
outputs_schema: { properties: {} }
- id: scan_device
name: withsecure-scan-device
description: "Trigger a malware scan on a device."
inputs_schema:
properties:
device_id: { type: string, description: "Device ID" }
required: [device_id]
outputs_schema: { properties: {} }
- id: list_incidents
name: withsecure-list-incidents
description: "List incidents (detections)."
risk: read
inputs_schema:
properties:
limit: { type: number, description: "Max incidents (default 50)" }
required: []
outputs_schema: { properties: {} }
- id: test_connection
name: withsecure-test-connection
description: "Verify the credentials via the token exchange (used by the Test button)."
risk: read
inputs_schema:
properties: {}
required: []
outputs_schema: { properties: {} }
@@ -0,0 +1,73 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
q = lambda v: urllib.parse.quote(str(v), safe="")
def main(cfg, token, inputs):
device_id = inputs.get("device_id")
if not device_id:
raise Exception("device_id is required")
return request("GET", "/devices/v1/devices/" + q(device_id), token, params={"organizationId": org(cfg)})
_run(main)
@@ -0,0 +1,76 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
def main(cfg, token, inputs):
device_id = inputs.get("device_id")
if not device_id:
raise Exception("device_id is required")
message = inputs.get("message")
body = {"operation": "isolateFromNetwork", "targets": [device_id], "organizationId": org(cfg)}
if message:
body["parameters"] = {"message": message}
return request("POST", "/devices/v1/operations", token, body=body)
_run(main)
@@ -0,0 +1,70 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
def main(cfg, token, inputs):
limit = inputs.get("limit") or 50
return request("GET", "/devices/v1/devices", token, params={"organizationId": org(cfg), "limit": int(limit)})
_run(main)
@@ -0,0 +1,70 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
def main(cfg, token, inputs):
limit = inputs.get("limit") or 50
return request("GET", "/incidents/v1/incidents", token, params={"organizationId": org(cfg), "limit": int(limit)})
_run(main)
@@ -0,0 +1,76 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
def main(cfg, token, inputs):
device_id = inputs.get("device_id")
if not device_id:
raise Exception("device_id is required")
return request("POST", "/devices/v1/operations", token, body={
"operation": "releaseFromNetworkIsolation",
"targets": [device_id],
"organizationId": org(cfg),
})
_run(main)
@@ -0,0 +1,76 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
def main(cfg, token, inputs):
device_id = inputs.get("device_id")
if not device_id:
raise Exception("device_id is required")
return request("POST", "/devices/v1/operations", token, body={
"operation": "scanForMalware",
"targets": [device_id],
"organizationId": org(cfg),
})
_run(main)
@@ -0,0 +1,70 @@
import json, os, sys, base64, urllib.parse, urllib.request, urllib.error
BASE = "https://api.connect.withsecure.com"
def _cfg():
return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
def _inputs():
return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def _token(cfg):
basic = base64.b64encode((str(cfg.get("client_id", "")) + ":" + str(cfg.get("client_secret", ""))).encode("utf-8")).decode("utf-8")
form = urllib.parse.urlencode({
"grant_type": "client_credentials",
"scope": "connect.api.read connect.api.write",
}).encode("utf-8")
req = urllib.request.Request(BASE + "/as/token.oauth2", data=form, headers={
"Authorization": "Basic " + basic,
"Content-Type": "application/x-www-form-urlencoded",
"Accept": "application/json",
}, method="POST")
with urllib.request.urlopen(req, timeout=60) as r:
tok = json.loads(r.read())
if not tok.get("access_token"):
raise Exception("Token request failed: " + json.dumps(tok))
return tok["access_token"]
def request(method, path, token, body=None, params=None):
url = BASE + path
if params:
clean = {k: v for k, v in params.items() if v not in (None, "")}
if clean:
url += "?" + urllib.parse.urlencode(clean)
data = json.dumps(body).encode("utf-8") if body is not None else None
headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
if data is not None:
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=90) as r:
raw = r.read()
return json.loads(raw) if raw else {}
def _run(fn):
try:
cfg = _cfg()
inputs = _inputs()
token = _token(cfg)
print(json.dumps(fn(cfg, token, inputs)))
except urllib.error.HTTPError as e:
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
sys.exit(1)
except Exception as e:
print(json.dumps({"error": str(e)}))
sys.exit(1)
org = lambda cfg: str(cfg.get("organization_id", ""))
def main(cfg, token, inputs):
request("GET", "/devices/v1/devices", token, params={"organizationId": org(cfg), "limit": 1})
return {"ok": True}
_run(main)