2 Commits

Author	SHA1	Message	Date
Claude	6f51520fb5	feat(sentinelone): investigate_alert, one call for an agent (1.19.0) ... Wraith spent ten calls on a real unified alert and still lost the host: it took the UAM asset id for an agent id and the raw agent list ran past what a tool result carries. investigate_alert reads the alert, its detail, the host's agent (by id or UUID, then name), the other alerts and threats on that host around the detection, and the file SHA1's reputation, blocklist and fleet-wide threats, summarised in one answer. The operator sheet now starts with it (budget 8). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ	2026-10-12 11:27:36 +00:00
f3nris	9605e1f0dc	feat(agents): operator sheets for 33 integrations (lot 4) ... EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion (Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk), Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep (Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID), Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur (VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer (Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe), Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift (Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart (FortiGate), Relay (Zscaler), Phantom (Darktrace). Read-only commands, analyst_l2, a call budget with an order, and the Static lessons: ids copied from answers only, timestamps passed as given, names over ids, one variant at most on error. Each sheet passes Riposte's validator; none is field-tested yet. Each integration gets a patch bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ	2026-10-11 23:00:15 +00:00