feat(sekoia): Sekoia XDR + SEKOIA Intelligence Center integrations

Sekoia XDR (siem): alert ingestion (list_alerts) with an exhaustive OCSF mapper and a bundled 'Sekoia XDR Alert' default type, plus 20 commands across alerts (list/get/search, status workflow, comments), event search jobs (create/status/ results + one-shot search_events), cases, asset management, users, kill chains and a generic authenticated HTTP passthrough. Bearer-token auth, EU host default. SEKOIA Intelligence Center (enrichment): observable/indicator/indicator-context CTI queries plus ip/url/domain/file/email reputation lookups (STIX type resolved automatically). No fetch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 15:04:22 +02:00
parent 8fd297169f
commit ef215daa88
34 changed files with 1646 additions and 0 deletions
@@ -0,0 +1,122 @@
+id: sekoia_intelligence_center
+name: SEKOIA Intelligence Center
+version: 1.0.0
+description: "SEKOIA.IO Intelligence Center (CTI) — query observables, indicators and full indicator context (STIX bundles), plus reputation lookups for IPs, URLs, domains, files and emails."
+changelog: "1.0.0 — Initial release: observable/indicator/indicator-context queries and ip/url/domain/file/email reputation lookups."
+category: enrichment
+
+# Per-instance configuration. An Organization API key is sent as a Bearer token.
+config_schema:
+  properties:
+    url:
+      type: string
+      description: "Sekoia API base URL, e.g. https://api.sekoia.io"
+      default: https://api.sekoia.io
+    api_key:
+      type: string
+      description: "Sekoia API key (Bearer token)"
+      x-soar-sensitive: true
+  required:
+    - url
+    - api_key
+
+auth:
+  - id: bearer
+    type: api_key
+    in: header
+    name: Authorization
+    value_template: "Bearer {{secret}}"
+    secret_field: api_key
+
+commands:
+  - id: get_observable
+    name: sekoia-intelligence-get-observable
+    description: "Query the Intelligence Center for information about an observable (value + type)."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Observable value" }
+        type: { type: string, description: "Observable type (e.g. ipv4-addr, domain-name, url, file, email-addr)" }
+      required: [value, type]
+    outputs_schema: { properties: {} }
+
+  - id: get_indicator
+    name: sekoia-intelligence-get-indicator
+    description: "Query the Intelligence Center for information about an indicator (IoC) by value + type. Returns nothing if the value is not a known indicator."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Indicator value" }
+        type: { type: string, description: "Indicator type (e.g. ipv4-addr, domain-name, url, file, email-addr)" }
+      required: [value, type]
+    outputs_schema: { properties: {} }
+
+  - id: get_indicator_context
+    name: sekoia-intelligence-get-indicator-context
+    description: "Retrieve the full context (STIX bundle: related malware, threat actors, kill chain, etc.) for an indicator by value + type."
+    risk: read
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Indicator value" }
+        type: { type: string, description: "Indicator type (e.g. ipv4-addr, domain-name, url, file, email-addr)" }
+      required: [value, type]
+    outputs_schema: { properties: {} }
+
+  - id: ip
+    name: sekoia-intelligence-ip
+    description: "Reputation lookup for an IP address (resolves the STIX type automatically, IPv4 or IPv6)."
+    risk: read
+    inputs_schema:
+      properties:
+        ip: { type: string, description: "IP address" }
+      required: [ip]
+    outputs_schema: { properties: {} }
+
+  - id: url
+    name: sekoia-intelligence-url
+    description: "Reputation lookup for a URL."
+    risk: read
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL" }
+      required: [url]
+    outputs_schema: { properties: {} }
+
+  - id: domain
+    name: sekoia-intelligence-domain
+    description: "Reputation lookup for a domain name."
+    risk: read
+    inputs_schema:
+      properties:
+        domain: { type: string, description: "Domain name" }
+      required: [domain]
+    outputs_schema: { properties: {} }
+
+  - id: file
+    name: sekoia-intelligence-file
+    description: "Reputation lookup for a file hash."
+    risk: read
+    inputs_schema:
+      properties:
+        file: { type: string, description: "File hash (MD5, SHA1 or SHA256)" }
+      required: [file]
+    outputs_schema: { properties: {} }
+
+  - id: email
+    name: sekoia-intelligence-email
+    description: "Reputation lookup for an email address."
+    risk: read
+    inputs_schema:
+      properties:
+        email: { type: string, description: "Email address" }
+      required: [email]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: sekoia-intelligence-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }