f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
205 Commits 1 Branch 0 Tags
6d311740f97444e9a72c76d65e493b360f7a4b9c
Commit Graph

205 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Guillaume BOURGEOIS 9f88891457 feat(freshservice): new Freshservice ITSM integration 
Freshservice API v2, 7 commands: create/get/update/list tickets, add note
(public/private), list agents. API-key (Basic) auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:31:45 +02:00
Guillaume BOURGEOIS 9892f2cf06 feat(zendesk): new Zendesk ticketing integration 
Zendesk Support API v2, 7 commands: create/get/update/search tickets, add
comment (public/internal), list users. API-token (Basic) auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:31:44 +02:00
Guillaume BOURGEOIS be8bf9f822 feat(thehive): new TheHive case-management integration 
TheHive 5 API v1, 10 commands: case create/get/update/search, create task,
alert create/get/promote-to-case, add observable. Bearer (API key) auth,
stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:31:43 +02:00
Guillaume BOURGEOIS aca1db5cad feat(chronicle): new Google Chronicle SIEM integration 
Chronicle Backstory API, 5 commands: list IOCs, list alerts, list assets,
get IOC details. Service-account RS256 JWT auth (remote engine, PyJWT +
cryptography).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:25:51 +02:00
Guillaume BOURGEOIS d0d72c5171 feat(elasticsearch): new Elasticsearch log-search integration 
Elasticsearch REST API, 7 commands: search (DSL or query_string), count, get/
index document, list indices, delete by query. API-key auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:25:50 +02:00
Guillaume BOURGEOIS fd64c245f4 feat(qradar): new IBM QRadar SIEM integration 
QRadar REST API, 8 commands: list/get offenses, update offense (close/assign),
list reference sets, add/remove reference-set value (block lists), list assets.
SEC-token auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:25:49 +02:00
Guillaume BOURGEOIS 6cc0bb61bc feat(cisco-fmc): new Cisco Firepower Management Center integration 
FMC REST API, 7 commands: list/create/delete host objects, list access
policies/rules, create block access rule. Token auth (generatetoken, token +
domain UUID from response headers), stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:20:41 +02:00
Guillaume BOURGEOIS 496ac6d8ce feat(checkpoint): new Check Point firewall-containment integration 
Check Point Management Web API, 7 commands: show/add hosts, show access
rulebase, add access rule (drop), publish, install policy. Session (login)
auth with X-chkp-sid, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:20:41 +02:00
Guillaume BOURGEOIS 44d0836e1b feat(cloudflare): new Cloudflare edge-containment integration 
Cloudflare client API v4, 9 commands: list/get zones, block IP (firewall access
rule), list/delete access rules, list/create/delete DNS records. API-token
(Bearer) auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:20:40 +02:00
Guillaume BOURGEOIS 796a95d5f8 feat(mandiant): new Mandiant Advantage threat-intel integration 
Mandiant TI API v4, 8 commands: search/get indicator, get actor/malware/
vulnerability, list/get reports. Key+secret OAuth2 token exchange, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:15:12 +02:00
Guillaume BOURGEOIS a5db725529 feat(anomali-threatstream): new Anomali ThreatStream threat-intel integration 
ThreatStream API, 9 commands: ip/domain/file/url reputation, indicator search,
passive DNS, threat models, import indicator. apikey auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:15:11 +02:00
Guillaume BOURGEOIS ecc301d95d feat(threatconnect): new ThreatConnect threat-intel integration 
ThreatConnect API v3, 9 commands: list/get/create/delete indicators, list/get/
create groups, add indicator tag. HMAC-SHA256 signed auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:15:10 +02:00
Guillaume BOURGEOIS 6b8dd13297 feat(trend-vision-one): new Trend Vision One XDR integration 
Vision One API v3.0, 9 commands: list endpoints, isolate/restore endpoint
(containment), terminate process, list/get Workbench alerts, add/remove
suspicious object (block hash/URL/IP/domain). Bearer-token auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:06:32 +02:00
Guillaume BOURGEOIS 1c3936992b feat(cybereason): new Cybereason EDR integration 
Cybereason API, 7 commands: query Malops, list sensors, get machine details,
isolate/un-isolate machine (containment), block file hash. Session (login)
auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:06:32 +02:00
Guillaume BOURGEOIS 61da5ef145 feat(carbon-black-cloud): new VMware Carbon Black Cloud EDR integration 
Platform API, 10 commands: device search/get, quarantine/unquarantine
(network-isolate), background scan, update device policy, alert search,
ban/unban file hash (reputation override). API-token auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-12 00:06:31 +02:00
Guillaume BOURGEOIS f34363b450 feat(rapid7-insightvm): new Rapid7 InsightVM vulnerability integration 
InsightVM/Nexpose Console API v3, 9 commands: list/get assets, asset
vulnerabilities, list/get vulnerabilities, list sites, start site scan,
get scan. HTTP Basic auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:59:39 +02:00
Guillaume BOURGEOIS fcf30da5fc feat(qualys): new Qualys VMDR vulnerability integration 
Qualys API v2 (XML), 6 commands: host list, host detections, knowledge-base
vulnerability details, scan list, launch scan. HTTP Basic auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:59:38 +02:00
Guillaume BOURGEOIS 847d18f79b feat(tenable-io): new Tenable Vulnerability Management integration 
Tenable.io API, 9 commands: list/get assets, list vulnerabilities, per-asset
vulnerabilities, vulnerability (plugin) details, list scans, scan status,
launch scan. API-key (access/secret) auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:59:37 +02:00
Guillaume BOURGEOIS 5501297984 feat(gcp-security): new Google Cloud cloud-containment integration 
Compute Engine + Security Command Center, 7 commands: list/create/delete VPC
firewall rules (deny to isolate), list/stop instances, list SCC findings.
Service-account RS256 JWT auth (remote engine, PyJWT + cryptography).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:54:02 +02:00
Guillaume BOURGEOIS 31d0a5938a feat(azure-security): new Microsoft Azure cloud-containment integration 
Azure Resource Manager (Defender for Cloud + Network), 9 commands: list/get
security alerts, update alert state, secure score, list/get NSGs, create/delete
NSG security rules (deny inbound to isolate). OAuth2 client-credentials, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:54:01 +02:00
Guillaume BOURGEOIS 62a44aea28 feat(aws): new AWS cloud-containment integration 
EC2 + IAM + STS via AWS Query protocol (Signature V4), 9 commands: describe
instances/security-groups, authorize/revoke security-group ingress, modify
instance security groups (isolate), stop instances, list/update IAM access keys
(deactivate compromised key), STS caller identity. Stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:54:00 +02:00
Guillaume BOURGEOIS 14e5e102a9 feat(microsoft-defender-o365): new O365 email-remediation integration 
Microsoft Graph mail APIs, 7 commands: search mailbox messages, get message,
list attachments, list folders, move message, hard-delete (purge) message.
Azure AD OAuth2 client-credentials auth (Mail.ReadWrite), stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:46:36 +02:00
Guillaume BOURGEOIS 460dfaefba feat(mimecast): new Mimecast anti-phishing integration 
Email Security API, 11 commands: held-message list/release/reject, message
search + info, managed URL create/list (block), block sender, create
remediation, URL decode. HMAC-SHA1 signed auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:46:35 +02:00
Guillaume BOURGEOIS f826181704 feat(proofpoint-tap): new Proofpoint TAP email-threat integration 
TAP SIEM API v2, 11 commands: SIEM events (all/messages/clicks blocked+delivered+
permitted), threat/campaign forensics, campaign get/list, URL Defense decode,
top clickers. HTTP Basic (service principal) auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:46:35 +02:00
Guillaume BOURGEOIS 9da00ad7b9 feat(cyberark-pas): new CyberArk PAS privileged-access integration 
PVWA REST API, 11 commands: list/get accounts, change/verify/reconcile
credentials (CPM rotation), retrieve password, add/delete account, list safes,
list users. Session (logon) auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:37:54 +02:00
Guillaume BOURGEOIS 7bd6ad6a69 feat(duo): new Cisco Duo MFA-containment integration 
Duo Admin API, 9 commands: get users/user, modify user status
(disable/enable/bypass), delete user, bypass codes, devices, user devices,
authentication logs. HMAC-SHA1 signed auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:37:53 +02:00
Guillaume BOURGEOIS 26694b512a feat(okta): new Okta identity-containment integration 
Okta Core API, 14 commands: user lifecycle (suspend/unsuspend/deactivate/unlock),
clear sessions + tokens, expire password, reset MFA factors, get/list users,
get factors, system log, add/remove group membership. SSWS-token auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:37:52 +02:00
Guillaume BOURGEOIS e88805ccab feat(opsgenie): new Opsgenie alerting integration 
Alert API v2, 13 commands: alert create/close/acknowledge/get/list, add note/tags,
assign, snooze, delete, list schedules, on-calls. GenieKey auth (US/EU), stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:28:26 +02:00
Guillaume BOURGEOIS a279b58290 feat(pagerduty): new PagerDuty alerting integration 
Events API v2 + REST API v2, 10 commands: trigger/acknowledge/resolve incident,
list/get incident, add note, list on-calls/users/services. Token + routing-key
auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:28:26 +02:00
Guillaume BOURGEOIS df4cd98a9e feat(microsoft-teams): new Microsoft Teams notification integration 
Incoming-webhook / Power Automate Workflows, 3 commands: send message,
send Adaptive Card (title/text/facts/action button). Webhook-URL auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:28:25 +02:00
Guillaume BOURGEOIS e3c15ae972 feat(slack): new Slack notification/ChatOps integration 
Slack Web API, 8 commands: send message (text/Block Kit), list/create channel,
invite to channel, set topic, get user, add reaction. Bot-token auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:28:25 +02:00
Guillaume BOURGEOIS 26cd02d77a feat(panos): new PAN-OS / Panorama firewall-containment integration 
PAN-OS XML API, 10 commands: register/unregister IP tag (Dynamic Address
Group fast-block, no commit), address create/delete, custom URL category
create/edit, EDL list/refresh, commit. API-key auth, targets a vsys, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:13:35 +02:00
Guillaume BOURGEOIS 53034f35da feat(zscaler): new Zscaler Internet Access containment integration 
ZIA REST API, 12 commands: URL/IP block-list add/remove, block-list and
allow-list read, allow-list add, category URL add, Sandbox report, activate
changes. Session-based obfuscated-API-key auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:13:34 +02:00
Guillaume BOURGEOIS fb82de7f93 feat(cisco-umbrella-enforcement): new Cisco Umbrella Enforcement integration 
Umbrella Enforcement API, 4 commands: add domain (DNS-layer block),
list enforced domains, delete domain. Customer-key auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:13:24 +02:00
Guillaume BOURGEOIS 8ee19ffe85 feat(fortigate): new FortiGate network-containment integration 
FortiOS REST API v2, 11 commands: ban/unban/list banned IPs (quarantine),
firewall address object create/delete/list, address-group update/list,
firewall policy and service listing. Bearer-token auth, multi-VDOM, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-11 23:13:24 +02:00
Guillaume BOURGEOIS bcc79598e6 feat(ipqualityscore): new IPQualityScore enrichment integration 
6 commands: IP/URL/email/phone fraud reputation, leaked-email check.
API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:58:17 +02:00
Guillaume BOURGEOIS 7d0e4aa18a feat(misp): new MISP threat-intel integration 
10 commands: event/attribute search, event read/create/publish/delete,
attribute add, event tagging, sightings. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:58:16 +02:00
Guillaume BOURGEOIS 7bec81ad0a feat(vmray): new VMRay sandbox integration 
8 commands: file/URL detonation, sample/submission/analysis retrieval,
sample-by-hash lookup, IOCs. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:58:15 +02:00
Guillaume BOURGEOIS 1bdc71abee feat(intezer): new Intezer enrichment integration 
9 commands: analyze by file/hash/URL, analysis result, IOCs, metadata
and sub-analyses. API-key (token-exchange) auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:58:15 +02:00
Guillaume BOURGEOIS b8afff7678 feat(anyrun): new ANY.RUN sandbox integration 
7 commands: file/URL detonation, report + verdict retrieval, analysis
history, user limits, delete task. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:48:50 +02:00
Guillaume BOURGEOIS 239cc70672 feat(hybrid-analysis): new Hybrid Analysis (Falcon Sandbox) integration 
7 commands: file/URL detonation, report summary + state, hash search,
environment listing. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:48:49 +02:00
Guillaume BOURGEOIS 2655a14bc3 feat(joe-sandbox): new Joe Sandbox integration 
8 commands: file/URL detonation, submission + analysis info, search,
report download, account quota. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:48:49 +02:00
Guillaume BOURGEOIS 9589b4f0d1 feat(securitytrails): new SecurityTrails enrichment integration 
8 commands: domain details, subdomains, WHOIS, DNS history, associated
domains, IP neighbors, domain search. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:48:48 +02:00
Guillaume BOURGEOIS 203273715c feat(censys): new Censys enrichment integration 
3 commands: host lookup by IP and Censys Search Language host query.
API ID + secret (Basic) auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:39:29 +02:00
Guillaume BOURGEOIS 1294e3b330 feat(maltiverse): new Maltiverse enrichment integration 
5 commands: IP/domain/URL/file threat-intel reputation. Bearer-token
auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:39:29 +02:00
Guillaume BOURGEOIS 79d870a4e8 feat(emailrep): new EmailRep.io enrichment integration 
3 commands: email reputation lookup, report malicious address. API-key
auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:39:29 +02:00
Guillaume BOURGEOIS ac6a52cecd feat(pulsedive): new Pulsedive enrichment integration 
4 commands: indicator lookup, scan submission, scan-result retrieval.
API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:39:28 +02:00
Guillaume BOURGEOIS 419f891267 feat(urlscan): new urlscan.io enrichment integration 
4 commands: submit URL scan, retrieve result, search historical scans.
API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:33:10 +02:00
Guillaume BOURGEOIS 2b3b9fc10c feat(alienvault-otx): new AlienVault OTX enrichment integration 
9 commands: IP/domain/URL/file reputation, pulse details + search,
passive DNS and related URLs. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:33:10 +02:00
Guillaume BOURGEOIS 9ec84905be feat(greynoise): new GreyNoise enrichment integration 
7 commands: IP context, quick check, RIOT, GNQL query + stats, IP
timeline. API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-11 22:33:09 +02:00