Jira Cloud and On-Prem/Data Center (27 commands): JQL ingestion with an
OCSF mapper and JQL query, full issue lifecycle (create/get/edit/delete,
transitions, assign), comments, remote web links and issue links,
attachments (upload/download/delete), field and user lookups, and agile
boards/sprints/epics. Basic (email + API token) or Personal Access Token
authentication; API v3 + ADF bodies on Cloud, v2 on On-Prem.
Stdlib-only, no extra Python dependencies.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Send email over SMTP: plain-text and HTML bodies with inline data-URI
images, base64 file attachment, CC/BCC, Reply-To and custom headers.
Plain / STARTTLS / SSL-TLS with optional authentication. Stdlib-only
(smtplib), no extra Python dependencies.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Gmail for one mailbox over OAuth 2.0 (no service account / delegation):
auth-link + exchange-code to obtain a refresh token, connectivity test,
message search/get, send/reply with attachments, attachment retrieval,
and get_incidents ingestion with an OCSF mapper. Refresh-token grant,
stdlib-only (no extra Python dependencies).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Calendar API v3 ACL management: create access control rules (grant a
role to a user/group/domain/public) and list a calendar's ACL rules.
Service-account auth with domain-wide delegation (JWT RS256), runs on
a remote engine (requires PyJWT + cryptography).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Identity lifecycle on the sys_user table: get/create/update user
(resolved by sys_id, username or email), enable user (active=true +
locked_out cleared), disable user, and user field discovery via
sys_dictionary for mapping. Basic or OAuth 2.0 (password grant)
authentication, stdlib-only scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
CMDB Instance API: records list by CI class, record get with
attributes + inbound/outbound relations, record create/update with
attributes and discovery source, add/delete relations. Basic or
OAuth 2.0 (password grant) authentication, stdlib-only scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
31 commands: ticket lifecycle (create/update/resolve/delete, comments,
work notes, links, tags, journal notes, attachments), generic table
records CRUD and discovery, CMDB/user/group queries, service catalog
ordering, standard change from template, AWA queue routing, generic
API call, plus get_incidents ingestion with a bundled OCSF mapper.
Basic or OAuth 2.0 (password grant) authentication, stdlib-only scripts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add a marketplace integration for the OpenCTI platform (GraphQL API,
compatible with OpenCTI 5.x/6.x), built on the Python pycti client and
run from a remote engine.
26 commands: observables (list/create/delete/field update/add/remove),
indicators (list/create/update/field add/remove, types), incidents
(list/create/delete, types) with an OCSF ingestion mapper, relationships
(list/create/delete), and reference data (organizations, labels, marking
definitions, external references).
- Ingestion: get_incidents to an OCSF finding mapper + an OpenCTI Incident type.
- Auth: user API key (Bearer) via pycti; requires pip install pycti on
the engine host.
- Scripts are self-contained (INTEGRATION_SECRETS/INTEGRATION_INPUTS in,
JSON out) following the established marketplace pattern.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add three commands to the Cortex XDR integration (v1.2.0):
- update_incident: change status, severity, assignment and resolve
comment on an incident (closes the SOAR ingest→action loop).
- insert_parsed_alerts: push external parsed alerts into Cortex XDR.
- insert_cef_alerts: push external CEF-format alerts.
Scripts follow the existing self-contained standard/advanced auth pattern.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The mock now emits incidents already in an OCSF-aligned shape (src_endpoint,
device, user, rule, dst_endpoint, dns_query, cloud, metadata). Map those nested
fields through to OCSF instead of only the flat OpenAPI fields.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Built from the published OpenAPI spec for mock instance s1 (type: edr).
Incident ingestion (list_incidents) with since/after_id paging and an OCSF
mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss
incident action. X-API-Key auth; the instance path segment is configurable.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SentinelOne SDL (endpoint): Unified Alerts via the GraphQL API. Alert ingestion
(get_alerts) with rich filtering and an exhaustive OCSF mapper + 'SentinelOne SDL
Alert' default type, full alert details, update (status/verdict/assignee), add
note and trigger mitigation action. ApiToken auth; watermark converted to epoch
ms for the detectedAt filter; alert edges flattened to nodes for ingestion.
VirusTotal Hunting (enrichment, Premium): Livehunt notification-file ingestion
(livehunt_files) with an OCSF mapper + 'VirusTotal Hunting File' default type
(severity bucketed from malicious AV detections), Livehunt notifications listing,
and Retrohunt job + matching-file listing.
The core VT v3 reputation already ships as 'virustotal'; the XSOAR-feed and
Premium file-download/zip/pcap commands were intentionally left out.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Recorded Future (enrichment): native ConnectAPI v2 (X-RFToken). ip/domain/url/
file/cve risk reputation, full entity intelligence, and alert ingestion (alerts
search) with an OCSF mapper and a 'Recorded Future Alert' default type, plus
alert lookup and alert-rule search.
Recorded Future ASI (enrichment): Attack Surface Intelligence (SecurityTrails
API, APIKEY header, project-scoped). Project issue ingestion (project_issues)
with an OCSF mapper and a 'Recorded Future ASI Issue' default type, filtered by
a configurable minimum severity, plus recent-issues and recent-issues-by-host
queries.
The XSOAR-gateway packs (alerts/lists) were re-implemented against Recorded
Future's native ConnectAPI rather than the XSOAR-coupled gateway protocol.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sekoia XDR (siem): alert ingestion (list_alerts) with an exhaustive OCSF mapper
and a bundled 'Sekoia XDR Alert' default type, plus 20 commands across alerts
(list/get/search, status workflow, comments), event search jobs (create/status/
results + one-shot search_events), cases, asset management, users, kill chains
and a generic authenticated HTTP passthrough. Bearer-token auth, EU host default.
SEKOIA Intelligence Center (enrichment): observable/indicator/indicator-context
CTI queries plus ip/url/domain/file/email reputation lookups (STIX type resolved
automatically). No fetch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Declare get_threats as the default fetch command (results_path data, dedup id,
incremental created_after) with the bundled get_threats OCSF mapper and a
'SentinelOne Threat' default incident type. get_alerts is also marked
ingestion-ready (incremental created_from). Existing filters (mitigation
status, query, created window, limit) let an operator fetch a subset.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
REST API integration for Rapid7 InsightIDR. Investigation ingestion
(list_investigations) with an exhaustive OCSF mapper and a bundled default
incident type, plus 18 commands across investigations (list/get/search/
create/update/assign/set-status/bulk-close), investigation alerts and Rapid7
product alerts, custom threat indicators (add/replace), log management and
LEQL log/log-set queries with downloads, and user directory search.
API v1/v2 selectable per instance (is_v2) and per command (api_version);
multi-customer query parameter supported on v2 calls.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block
(fetch command + bundled mapper + default incident type) and a bundled default
incident type under incident-types/, so the instance Collect section is pre-filled
on first configuration and the default type is created on install.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Microsoft Graph file management for OneDrive / SharePoint / Teams with app-only
(client credentials) authentication, stateless over urllib (no dependency). 19
commands: browse sites/drives/content, create folders, delete/upload/replace/
download files (content passed via base64 or source URL; download returns the
pre-authenticated Graph URL), site permission management (list/create/update/
delete), SharePoint list reading (lists/items/get-item), and Excel worksheet
editing (append row, read range, update cell).
Each script obtains a bearer token via the client-credentials grant and calls
Graph directly. Re-implemented cleanly from a customized source: dropped the
hosted-proxy/auth-code/managed-identity/certificate flows, the duplicated and
broken Excel helpers, and the platform-specific file-entry handling.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LDAP authentication over the ldap3 library, designed to run on a remote engine
inside the directory network. Auto-detects the vendor (OpenLDAP or Active
Directory). 5 commands: test connection, ad-authenticate (simple bind),
ad-groups (fetch all or specific groups), ad-authenticate-and-roles (bind +
return the user's groups and attributes), and ad-entries-search (generic LDAP
search with cn/uid/objectClass/description filters, scope, attribute selection
and paging).
Scripts share a ported LdapClient that handles SSL/LDAPS/Start TLS, vendor
detection, OpenLDAP vs AD group/role resolution and paged search. ldap3 is
imported defensively with a clear "pip install ldap3" message when missing. No
ingestion source, so no OCSF mapper.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Active Directory over LDAP/LDAPS via the ldap3 library, designed to run on a
remote engine inside the AD network. 24 commands: raw search, get
user/computer/group-members (with userAccountControl decoding), enable/disable/
unlock accounts, set/expire password, password-never-expire, add/remove group
membership, move user/computer OU, create/update/delete user/contact/group, and
credential testing.
Scripts share an ldap3 connection helper that handles SSL/LDAPS/Start TLS, NTLM
bind, certificate trust and paged search. ldap3 is imported defensively: if it
is missing on the engine host the command returns a clear "pip install ldap3"
message instead of crashing. No ingestion source, so no OCSF mapper.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 commands over the management port (8089) with token or basic auth:
SPL search (oneshot) as an ingestion source with an OCSF mapper for
notable/CIM findings; async search jobs (create/status/results); index
listing; event submission (receivers/simple + HEC); the complete KV Store
command set (collection create/config/delete, list, data list/add/delete,
entry search/delete/update); user list/delete; and a connectivity test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Patch bump so an Update is offered once the InstallFromSource fix is deployed, regenerating the form-based command scripts without losing instances.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
IP enrichment (geolocation, ASN/network, privacy flags): lookup_ip,
lookup_field, lookup_me, batch (code-first), and test_connection.
Token auth via the `token` query parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Host enrichment, search/count, DNS resolve/reverse, domain info, api-info
and scan status as form-based GET commands; active scan is code-first
(form-encoded POST) and marked destructive. API key sent as the `key`
query parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Brings the SentinelOne integration to 83 commands. New: threat-analysis,
threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file,
get-remote-script-task-status, get-remote-script-task-results, get-service-users,
list-installed-singularity-marketplace-applications, update-uam-alert-status,
update-uam-alert-verdict, run-powerquery (Singularity Data Lake), create-tag-rule.
Each command ships a stdlib-only script against API v2.1.
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
Guillaume BOURGEOIS
f3nris