Microsoft Graph mail APIs, 7 commands: search mailbox messages, get message,
list attachments, list folders, move message, hard-delete (purge) message.
Azure AD OAuth2 client-credentials auth (Mail.ReadWrite), stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Duo Admin API, 9 commands: get users/user, modify user status
(disable/enable/bypass), delete user, bypass codes, devices, user devices,
authentication logs. HMAC-SHA1 signed auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Slack Web API, 8 commands: send message (text/Block Kit), list/create channel,
invite to channel, set topic, get user, add reaction. Bot-token auth, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
PAN-OS XML API, 10 commands: register/unregister IP tag (Dynamic Address
Group fast-block, no commit), address create/delete, custom URL category
create/edit, EDL list/refresh, commit. API-key auth, targets a vsys, stdlib-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 commands: host lookup by IP and Censys Search Language host query.
API ID + secret (Basic) auth, stdlib-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Jira Cloud and On-Prem/Data Center (27 commands): JQL ingestion with an
OCSF mapper and JQL query, full issue lifecycle (create/get/edit/delete,
transitions, assign), comments, remote web links and issue links,
attachments (upload/download/delete), field and user lookups, and agile
boards/sprints/epics. Basic (email + API token) or Personal Access Token
authentication; API v3 + ADF bodies on Cloud, v2 on On-Prem.
Stdlib-only, no extra Python dependencies.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Send email over SMTP: plain-text and HTML bodies with inline data-URI
images, base64 file attachment, CC/BCC, Reply-To and custom headers.
Plain / STARTTLS / SSL-TLS with optional authentication. Stdlib-only
(smtplib), no extra Python dependencies.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gmail for one mailbox over OAuth 2.0 (no service account / delegation):
auth-link + exchange-code to obtain a refresh token, connectivity test,
message search/get, send/reply with attachments, attachment retrieval,
and get_incidents ingestion with an OCSF mapper. Refresh-token grant,
stdlib-only (no extra Python dependencies).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Calendar API v3 ACL management: create access control rules (grant a
role to a user/group/domain/public) and list a calendar's ACL rules.
Service-account auth with domain-wide delegation (JWT RS256), runs on
a remote engine (requires PyJWT + cryptography).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Identity lifecycle on the sys_user table: get/create/update user
(resolved by sys_id, username or email), enable user (active=true +
locked_out cleared), disable user, and user field discovery via
sys_dictionary for mapping. Basic or OAuth 2.0 (password grant)
authentication, stdlib-only scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CMDB Instance API: records list by CI class, record get with
attributes + inbound/outbound relations, record create/update with
attributes and discovery source, add/delete relations. Basic or
OAuth 2.0 (password grant) authentication, stdlib-only scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
31 commands: ticket lifecycle (create/update/resolve/delete, comments,
work notes, links, tags, journal notes, attachments), generic table
records CRUD and discovery, CMDB/user/group queries, service catalog
ordering, standard change from template, AWA queue routing, generic
API call, plus get_incidents ingestion with a bundled OCSF mapper.
Basic or OAuth 2.0 (password grant) authentication, stdlib-only scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add a marketplace integration for the OpenCTI platform (GraphQL API,
compatible with OpenCTI 5.x/6.x), built on the Python pycti client and
run from a remote engine.
26 commands: observables (list/create/delete/field update/add/remove),
indicators (list/create/update/field add/remove, types), incidents
(list/create/delete, types) with an OCSF ingestion mapper, relationships
(list/create/delete), and reference data (organizations, labels, marking
definitions, external references).
- Ingestion: get_incidents to an OCSF finding mapper + an OpenCTI Incident type.
- Auth: user API key (Bearer) via pycti; requires pip install pycti on
the engine host.
- Scripts are self-contained (INTEGRATION_SECRETS/INTEGRATION_INPUTS in,
JSON out) following the established marketplace pattern.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add three commands to the Cortex XDR integration (v1.2.0):
- update_incident: change status, severity, assignment and resolve
comment on an incident (closes the SOAR ingest→action loop).
- insert_parsed_alerts: push external parsed alerts into Cortex XDR.
- insert_cef_alerts: push external CEF-format alerts.
Scripts follow the existing self-contained standard/advanced auth pattern.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The mock now emits incidents already in an OCSF-aligned shape (src_endpoint,
device, user, rule, dst_endpoint, dns_query, cloud, metadata). Map those nested
fields through to OCSF instead of only the flat OpenAPI fields.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Built from the published OpenAPI spec for mock instance s1 (type: edr).
Incident ingestion (list_incidents) with since/after_id paging and an OCSF
mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss
incident action. X-API-Key auth; the instance path segment is configurable.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Guillaume BOURGEOIS