feat(recorded-future): Recorded Future + ASI integrations

Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/
file/cve risk reputation, full entity intelligence, and alert ingestion (alerts
search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus
alert lookup and alert-rule search.

Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails
API, APIKEY header, project-scoped). Project issue ingestion (project_issues)
with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by
a configurable minimum severity, plus recent-issues and recent-issues-by-host
queries.

The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded
Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/recorded-future-asi/manifest.yaml

@@ -0,0 +1,84 @@
+id: recorded_future_asi
+name: Recorded Future ASI
+version: 1.0.0
+description: "Recorded Future Attack Surface Intelligence (SecurityTrails) — fetch attack-surface risk issues for a project (ingestion), and query recent added issues globally or grouped by host."
+changelog: "1.0.0 — Initial release: project issue ingestion (project_issues) with an OCSF mapper, plus recent-issues and recent-issues-by-host queries."
+category: enrichment
+
+# Per-instance configuration. The SecurityTrails ASI API is authenticated with an
+# API key sent in the APIKEY header and scoped to a project.
+config_schema:
+  properties:
+    api_key:
+      type: string
+      description: "SecurityTrails / ASI API key"
+      x-soar-sensitive: true
+    project_id:
+      type: string
+      description: "ASI Project ID to fetch issues from"
+    min_severity:
+      type: string
+      description: "Minimum issue severity to fetch: Informational, Moderate or Critical (default Moderate)"
+      default: Moderate
+  required:
+    - api_key
+    - project_id
+
+auth:
+  - id: apikey
+    type: api_key
+    in: header
+    name: APIKEY
+    value_template: "{{secret}}"
+    secret_field: api_key
+
+commands:
+  # ── Ingestion ───────────────────────────────────────────────────────────────
+  - id: project_issues
+    name: asi-project-issues
+    description: "Fetch the current attack-surface risk issues for the project. Used for ingestion: results path = data. Issues below the configured minimum severity are filtered out."
+    risk: read
+    inputs_schema:
+      properties:
+        snapshot: { type: string, description: "Snapshot to read (default 'recent')" }
+      required: []
+    outputs_schema: { properties: {} }
+    ingest:
+      results_path: data
+      dedup_key: name
+
+  - id: recent_issues
+    name: asi-recent-issues
+    description: "List risk issues added to the project since a given time, filtered by the configured minimum severity."
+    risk: read
+    inputs_schema:
+      properties:
+        start: { type: string, description: "Lower bound: a timestamp or snapshot date" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: recent_issues_by_host
+    name: asi-recent-issues-by-host
+    description: "List hosts with risk issues added since a given time, with per-host risk-score changes."
+    risk: read
+    inputs_schema:
+      properties:
+        last_checked: { type: string, description: "Lower bound: a timestamp or snapshot date" }
+        limit: { type: number, description: "Maximum number of hosts to return (default 200)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  # ── Connectivity test ─────────────────────────────────────────────────────
+  - id: test_connection
+    name: asi-test-connection
+    description: "Verify connectivity, credentials and project access (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+
+ingestion:
+  command: project_issues
+  mapper: project_issues
+  default_incident_type: "Recorded Future ASI Issue"