Add three commands to the Cortex XDR integration (v1.2.0):
- update_incident: change status, severity, assignment and resolve
comment on an incident (closes the SOAR ingest→action loop).
- insert_parsed_alerts: push external parsed alerts into Cortex XDR.
- insert_cef_alerts: push external CEF-format alerts.
Scripts follow the existing self-contained standard/advanced auth pattern.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The mock now emits incidents already in an OCSF-aligned shape (src_endpoint,
device, user, rule, dst_endpoint, dns_query, cloud, metadata). Map those nested
fields through to OCSF instead of only the flat OpenAPI fields.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Built from the published OpenAPI spec for mock instance s1 (type: edr).
Incident ingestion (list_incidents) with since/after_id paging and an OCSF
mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss
incident action. X-API-Key auth; the instance path segment is configurable.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SentinelOne SDL (endpoint): Unified Alerts via the GraphQL API. Alert ingestion
(get_alerts) with rich filtering and an exhaustive OCSF mapper + 'SentinelOne SDL
Alert' default type, full alert details, update (status/verdict/assignee), add
note and trigger mitigation action. ApiToken auth; watermark converted to epoch
ms for the detectedAt filter; alert edges flattened to nodes for ingestion.
VirusTotal Hunting (enrichment, Premium): Livehunt notification-file ingestion
(livehunt_files) with an OCSF mapper + 'VirusTotal Hunting File' default type
(severity bucketed from malicious AV detections), Livehunt notifications listing,
and Retrohunt job + matching-file listing.
The core VT v3 reputation already ships as 'virustotal'; the XSOAR-feed and
Premium file-download/zip/pcap commands were intentionally left out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/
file/cve risk reputation, full entity intelligence, and alert ingestion (alerts
search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus
alert lookup and alert-rule search.
Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails
API, APIKEY header, project-scoped). Project issue ingestion (project_issues)
with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by
a configurable minimum severity, plus recent-issues and recent-issues-by-host
queries.
The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded
Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sekoia XDR (siem): alert ingestion (list_alerts) with an exhaustive OCSF mapper
and a bundled 'Sekoia XDR Alert' default type, plus 20 commands across alerts
(list/get/search, status workflow, comments), event search jobs (create/status/
results + one-shot search_events), cases, asset management, users, kill chains
and a generic authenticated HTTP passthrough. Bearer-token auth, EU host default.
SEKOIA Intelligence Center (enrichment): observable/indicator/indicator-context
CTI queries plus ip/url/domain/file/email reputation lookups (STIX type resolved
automatically). No fetch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Declare get_threats as the default fetch command (results_path data, dedup id,
incremental created_after) with the bundled get_threats OCSF mapper and a
'SentinelOne Threat' default incident type. get_alerts is also marked
ingestion-ready (incremental created_from). Existing filters (mitigation
status, query, created window, limit) let an operator fetch a subset.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
REST API integration for Rapid7 InsightIDR. Investigation ingestion
(list_investigations) with an exhaustive OCSF mapper and a bundled default
incident type, plus 18 commands across investigations (list/get/search/
create/update/assign/set-status/bulk-close), investigation alerts and Rapid7
product alerts, custom threat indicators (add/replace), log management and
LEQL log/log-set queries with downloads, and user directory search.
API v1/v2 selectable per instance (is_v2) and per command (api_version);
multi-customer query parameter supported on v2 calls.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block
(fetch command + bundled mapper + default incident type) and a bundled default
incident type under incident-types/, so the instance Collect section is pre-filled
on first configuration and the default type is created on install.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Microsoft Graph file management for OneDrive / SharePoint / Teams with app-only
(client credentials) authentication, stateless over urllib (no dependency). 19
commands: browse sites/drives/content, create folders, delete/upload/replace/
download files (content passed via base64 or source URL; download returns the
pre-authenticated Graph URL), site permission management (list/create/update/
delete), SharePoint list reading (lists/items/get-item), and Excel worksheet
editing (append row, read range, update cell).
Each script obtains a bearer token via the client-credentials grant and calls
Graph directly. Re-implemented cleanly from a customized source: dropped the
hosted-proxy/auth-code/managed-identity/certificate flows, the duplicated and
broken Excel helpers, and the platform-specific file-entry handling.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LDAP authentication over the ldap3 library, designed to run on a remote engine
inside the directory network. Auto-detects the vendor (OpenLDAP or Active
Directory). 5 commands: test connection, ad-authenticate (simple bind),
ad-groups (fetch all or specific groups), ad-authenticate-and-roles (bind +
return the user's groups and attributes), and ad-entries-search (generic LDAP
search with cn/uid/objectClass/description filters, scope, attribute selection
and paging).
Scripts share a ported LdapClient that handles SSL/LDAPS/Start TLS, vendor
detection, OpenLDAP vs AD group/role resolution and paged search. ldap3 is
imported defensively with a clear "pip install ldap3" message when missing. No
ingestion source, so no OCSF mapper.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Active Directory over LDAP/LDAPS via the ldap3 library, designed to run on a
remote engine inside the AD network. 24 commands: raw search, get
user/computer/group-members (with userAccountControl decoding), enable/disable/
unlock accounts, set/expire password, password-never-expire, add/remove group
membership, move user/computer OU, create/update/delete user/contact/group, and
credential testing.
Scripts share an ldap3 connection helper that handles SSL/LDAPS/Start TLS, NTLM
bind, certificate trust and paged search. ldap3 is imported defensively: if it
is missing on the engine host the command returns a clear "pip install ldap3"
message instead of crashing. No ingestion source, so no OCSF mapper.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 commands over the management port (8089) with token or basic auth:
SPL search (oneshot) as an ingestion source with an OCSF mapper for
notable/CIM findings; async search jobs (create/status/results); index
listing; event submission (receivers/simple + HEC); the complete KV Store
command set (collection create/config/delete, list, data list/add/delete,
entry search/delete/update); user list/delete; and a connectivity test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Patch bump so an Update is offered once the InstallFromSource fix is deployed, regenerating the form-based command scripts without losing instances.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
IP enrichment (geolocation, ASN/network, privacy flags): lookup_ip,
lookup_field, lookup_me, batch (code-first), and test_connection.
Token auth via the `token` query parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Host enrichment, search/count, DNS resolve/reverse, domain info, api-info
and scan status as form-based GET commands; active scan is code-first
(form-encoded POST) and marked destructive. API key sent as the `key`
query parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Brings the SentinelOne integration to 83 commands. New: threat-analysis,
threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file,
get-remote-script-task-status, get-remote-script-task-results, get-service-users,
list-installed-singularity-marketplace-applications, update-uam-alert-status,
update-uam-alert-verdict, run-powerquery (Singularity Data Lake), create-tag-rule.
Each command ships a stdlib-only script against API v2.1.
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
Expand from 9 to 70 commands covering the official + DEV SentinelOne V2
integrations: agents (actions/info/tags/count), threats & alerts (verdict/status/
notes/mitigate/fetch-file), hash blocklist & exclusions, IOCs, STAR rules,
Deep Visibility, remote scripts, endpoint tags, firewall rules and network
discovery. All script-based (urllib, INTEGRATION_SECRETS/INPUTS contract);
inputs prioritized from the DEV integration.
- integrations/virustotal: VirusTotal v3 (request-based: IP & domain reports)
- templates/: fully-commented manifest + script-command example
- README: discovery rules, manifest schema, how to publish and wire into Riposte
Guillaume BOURGEOIS
f3nris