041cadade2
feat(extrahop): new ExtraHop Reveal(x) NDR integration
...
ExtraHop REST API v1, 6 commands: search/get detections, list/search devices,
get device. ESA API-key auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:48:03 +02:00
41e8aa8e7e
feat(vectra): new Vectra AI NDR integration
...
Vectra Detect API v2.3, 8 commands: list/get detections, mark detection fixed,
add note, list/get hosts, list accounts. Token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:48:01 +02:00
0775500b15
feat(darktrace): new Darktrace NDR integration
...
Darktrace Threat Visualizer API, 7 commands: get/acknowledge model breaches,
get devices, get/activate Antigena actions (autonomous-response containment).
HMAC-SHA1 signed auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:48:00 +02:00
9be28a2ff7
feat(triage): new Hatching Triage sandbox integration
...
Triage API v0, 7 commands: submit file (multipart _json+file) / URL, get
sample, get report overview, list samples, search. Bearer-token auth,
stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:42:02 +02:00
1292a8c798
feat(cape): new CAPE Sandbox integration
...
CAPE APIv2, 6 commands: submit file (multipart) / URL, get task, get report,
list tasks. Token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:42:01 +02:00
b6af7d1b68
feat(cuckoo): new Cuckoo Sandbox integration
...
Cuckoo REST API, 7 commands: submit file (multipart) / URL, get task, get
report, list tasks, delete task. Optional Bearer-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:42:00 +02:00
d5b7e38dd7
feat(infoblox): new Infoblox NIOS DNS-containment integration
...
Infoblox WAPI, 7 commands: add RPZ domain (DNS sinkhole/block), list/delete RPZ
records, search hosts, get networks, add A record. HTTP Basic auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:37:12 +02:00
6de01f85bb
feat(zscaler-zpa): new Zscaler Private Access integration
...
ZPA config API, 7 commands: list/get application segments, list servers,
server groups, segment groups, access policy rules. OAuth2 client-credentials
(signin) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:37:11 +02:00
86e7f11227
feat(netskope): new Netskope SASE/CASB integration
...
Netskope REST API v2, 6 commands: list/get URL lists, replace URL list (block
list), deploy URL lists, list users. API-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:37:10 +02:00
9f88891457
feat(freshservice): new Freshservice ITSM integration
...
Freshservice API v2, 7 commands: create/get/update/list tickets, add note
(public/private), list agents. API-key (Basic) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:31:45 +02:00
9892f2cf06
feat(zendesk): new Zendesk ticketing integration
...
Zendesk Support API v2, 7 commands: create/get/update/search tickets, add
comment (public/internal), list users. API-token (Basic) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:31:44 +02:00
be8bf9f822
feat(thehive): new TheHive case-management integration
...
TheHive 5 API v1, 10 commands: case create/get/update/search, create task,
alert create/get/promote-to-case, add observable. Bearer (API key) auth,
stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:31:43 +02:00
aca1db5cad
feat(chronicle): new Google Chronicle SIEM integration
...
Chronicle Backstory API, 5 commands: list IOCs, list alerts, list assets,
get IOC details. Service-account RS256 JWT auth (remote engine, PyJWT +
cryptography).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:25:51 +02:00
d0d72c5171
feat(elasticsearch): new Elasticsearch log-search integration
...
Elasticsearch REST API, 7 commands: search (DSL or query_string), count, get/
index document, list indices, delete by query. API-key auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:25:50 +02:00
fd64c245f4
feat(qradar): new IBM QRadar SIEM integration
...
QRadar REST API, 8 commands: list/get offenses, update offense (close/assign),
list reference sets, add/remove reference-set value (block lists), list assets.
SEC-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:25:49 +02:00
6cc0bb61bc
feat(cisco-fmc): new Cisco Firepower Management Center integration
...
FMC REST API, 7 commands: list/create/delete host objects, list access
policies/rules, create block access rule. Token auth (generatetoken, token +
domain UUID from response headers), stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:20:41 +02:00
496ac6d8ce
feat(checkpoint): new Check Point firewall-containment integration
...
Check Point Management Web API, 7 commands: show/add hosts, show access
rulebase, add access rule (drop), publish, install policy. Session (login)
auth with X-chkp-sid, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:20:41 +02:00
44d0836e1b
feat(cloudflare): new Cloudflare edge-containment integration
...
Cloudflare client API v4, 9 commands: list/get zones, block IP (firewall access
rule), list/delete access rules, list/create/delete DNS records. API-token
(Bearer) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:20:40 +02:00
796a95d5f8
feat(mandiant): new Mandiant Advantage threat-intel integration
...
Mandiant TI API v4, 8 commands: search/get indicator, get actor/malware/
vulnerability, list/get reports. Key+secret OAuth2 token exchange, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:15:12 +02:00
a5db725529
feat(anomali-threatstream): new Anomali ThreatStream threat-intel integration
...
ThreatStream API, 9 commands: ip/domain/file/url reputation, indicator search,
passive DNS, threat models, import indicator. apikey auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:15:11 +02:00
ecc301d95d
feat(threatconnect): new ThreatConnect threat-intel integration
...
ThreatConnect API v3, 9 commands: list/get/create/delete indicators, list/get/
create groups, add indicator tag. HMAC-SHA256 signed auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:15:10 +02:00
6b8dd13297
feat(trend-vision-one): new Trend Vision One XDR integration
...
Vision One API v3.0, 9 commands: list endpoints, isolate/restore endpoint
(containment), terminate process, list/get Workbench alerts, add/remove
suspicious object (block hash/URL/IP/domain). Bearer-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:06:32 +02:00
1c3936992b
feat(cybereason): new Cybereason EDR integration
...
Cybereason API, 7 commands: query Malops, list sensors, get machine details,
isolate/un-isolate machine (containment), block file hash. Session (login)
auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:06:32 +02:00
61da5ef145
feat(carbon-black-cloud): new VMware Carbon Black Cloud EDR integration
...
Platform API, 10 commands: device search/get, quarantine/unquarantine
(network-isolate), background scan, update device policy, alert search,
ban/unban file hash (reputation override). API-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-12 00:06:31 +02:00
f34363b450
feat(rapid7-insightvm): new Rapid7 InsightVM vulnerability integration
...
InsightVM/Nexpose Console API v3, 9 commands: list/get assets, asset
vulnerabilities, list/get vulnerabilities, list sites, start site scan,
get scan. HTTP Basic auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:59:39 +02:00
fcf30da5fc
feat(qualys): new Qualys VMDR vulnerability integration
...
Qualys API v2 (XML), 6 commands: host list, host detections, knowledge-base
vulnerability details, scan list, launch scan. HTTP Basic auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:59:38 +02:00
847d18f79b
feat(tenable-io): new Tenable Vulnerability Management integration
...
Tenable.io API, 9 commands: list/get assets, list vulnerabilities, per-asset
vulnerabilities, vulnerability (plugin) details, list scans, scan status,
launch scan. API-key (access/secret) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:59:37 +02:00
5501297984
feat(gcp-security): new Google Cloud cloud-containment integration
...
Compute Engine + Security Command Center, 7 commands: list/create/delete VPC
firewall rules (deny to isolate), list/stop instances, list SCC findings.
Service-account RS256 JWT auth (remote engine, PyJWT + cryptography).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:54:02 +02:00
31d0a5938a
feat(azure-security): new Microsoft Azure cloud-containment integration
...
Azure Resource Manager (Defender for Cloud + Network), 9 commands: list/get
security alerts, update alert state, secure score, list/get NSGs, create/delete
NSG security rules (deny inbound to isolate). OAuth2 client-credentials, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:54:01 +02:00
62a44aea28
feat(aws): new AWS cloud-containment integration
...
EC2 + IAM + STS via AWS Query protocol (Signature V4), 9 commands: describe
instances/security-groups, authorize/revoke security-group ingress, modify
instance security groups (isolate), stop instances, list/update IAM access keys
(deactivate compromised key), STS caller identity. Stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:54:00 +02:00
14e5e102a9
feat(microsoft-defender-o365): new O365 email-remediation integration
...
Microsoft Graph mail APIs, 7 commands: search mailbox messages, get message,
list attachments, list folders, move message, hard-delete (purge) message.
Azure AD OAuth2 client-credentials auth (Mail.ReadWrite), stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:46:36 +02:00
460dfaefba
feat(mimecast): new Mimecast anti-phishing integration
...
Email Security API, 11 commands: held-message list/release/reject, message
search + info, managed URL create/list (block), block sender, create
remediation, URL decode. HMAC-SHA1 signed auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:46:35 +02:00
f826181704
feat(proofpoint-tap): new Proofpoint TAP email-threat integration
...
TAP SIEM API v2, 11 commands: SIEM events (all/messages/clicks blocked+delivered+
permitted), threat/campaign forensics, campaign get/list, URL Defense decode,
top clickers. HTTP Basic (service principal) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:46:35 +02:00
9da00ad7b9
feat(cyberark-pas): new CyberArk PAS privileged-access integration
...
PVWA REST API, 11 commands: list/get accounts, change/verify/reconcile
credentials (CPM rotation), retrieve password, add/delete account, list safes,
list users. Session (logon) auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:37:54 +02:00
7bd6ad6a69
feat(duo): new Cisco Duo MFA-containment integration
...
Duo Admin API, 9 commands: get users/user, modify user status
(disable/enable/bypass), delete user, bypass codes, devices, user devices,
authentication logs. HMAC-SHA1 signed auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:37:53 +02:00
26694b512a
feat(okta): new Okta identity-containment integration
...
Okta Core API, 14 commands: user lifecycle (suspend/unsuspend/deactivate/unlock),
clear sessions + tokens, expire password, reset MFA factors, get/list users,
get factors, system log, add/remove group membership. SSWS-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:37:52 +02:00
e88805ccab
feat(opsgenie): new Opsgenie alerting integration
...
Alert API v2, 13 commands: alert create/close/acknowledge/get/list, add note/tags,
assign, snooze, delete, list schedules, on-calls. GenieKey auth (US/EU), stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:28:26 +02:00
a279b58290
feat(pagerduty): new PagerDuty alerting integration
...
Events API v2 + REST API v2, 10 commands: trigger/acknowledge/resolve incident,
list/get incident, add note, list on-calls/users/services. Token + routing-key
auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:28:26 +02:00
df4cd98a9e
feat(microsoft-teams): new Microsoft Teams notification integration
...
Incoming-webhook / Power Automate Workflows, 3 commands: send message,
send Adaptive Card (title/text/facts/action button). Webhook-URL auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:28:25 +02:00
e3c15ae972
feat(slack): new Slack notification/ChatOps integration
...
Slack Web API, 8 commands: send message (text/Block Kit), list/create channel,
invite to channel, set topic, get user, add reaction. Bot-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:28:25 +02:00
26cd02d77a
feat(panos): new PAN-OS / Panorama firewall-containment integration
...
PAN-OS XML API, 10 commands: register/unregister IP tag (Dynamic Address
Group fast-block, no commit), address create/delete, custom URL category
create/edit, EDL list/refresh, commit. API-key auth, targets a vsys, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:13:35 +02:00
53034f35da
feat(zscaler): new Zscaler Internet Access containment integration
...
ZIA REST API, 12 commands: URL/IP block-list add/remove, block-list and
allow-list read, allow-list add, category URL add, Sandbox report, activate
changes. Session-based obfuscated-API-key auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:13:34 +02:00
fb82de7f93
feat(cisco-umbrella-enforcement): new Cisco Umbrella Enforcement integration
...
Umbrella Enforcement API, 4 commands: add domain (DNS-layer block),
list enforced domains, delete domain. Customer-key auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:13:24 +02:00
8ee19ffe85
feat(fortigate): new FortiGate network-containment integration
...
FortiOS REST API v2, 11 commands: ban/unban/list banned IPs (quarantine),
firewall address object create/delete/list, address-group update/list,
firewall policy and service listing. Bearer-token auth, multi-VDOM, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-11 23:13:24 +02:00
bcc79598e6
feat(ipqualityscore): new IPQualityScore enrichment integration
...
6 commands: IP/URL/email/phone fraud reputation, leaked-email check.
API-key auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-11 22:58:17 +02:00
7d0e4aa18a
feat(misp): new MISP threat-intel integration
...
10 commands: event/attribute search, event read/create/publish/delete,
attribute add, event tagging, sightings. API-key auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-11 22:58:16 +02:00
7bec81ad0a
feat(vmray): new VMRay sandbox integration
...
8 commands: file/URL detonation, sample/submission/analysis retrieval,
sample-by-hash lookup, IOCs. API-key auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-11 22:58:15 +02:00
1bdc71abee
feat(intezer): new Intezer enrichment integration
...
9 commands: analyze by file/hash/URL, analysis result, IOCs, metadata
and sub-analyses. API-key (token-exchange) auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-11 22:58:15 +02:00
b8afff7678
feat(anyrun): new ANY.RUN sandbox integration
...
7 commands: file/URL detonation, report + verdict retrieval, analysis
history, user limits, delete task. API-key auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-11 22:48:50 +02:00
239cc70672
feat(hybrid-analysis): new Hybrid Analysis (Falcon Sandbox) integration
...
7 commands: file/URL detonation, report summary + state, hash search,
environment listing. API-key auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-11 22:48:49 +02:00
Guillaume BOURGEOIS