f3nris
9605e1f0dc
feat(agents): operator sheets for 33 integrations (lot 4)
...
EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion
(Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk),
Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep
(Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID),
Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur
(VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer
(Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe),
Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift
(Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart
(FortiGate), Relay (Zscaler), Phantom (Darktrace).
Read-only commands, analyst_l2, a call budget with an order, and the Static
lessons: ids copied from answers only, timestamps passed as given, names over
ids, one variant at most on error. Each sheet passes Riposte's validator;
none is field-tested yet. Each integration gets a patch bump.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
2026-10-11 23:00:15 +00:00
934f2c52d7
feat(virustotal): complete v3 command coverage (script-based)
...
Expand the VirusTotal integration from 3 form-based commands to 15 script-based
commands covering the v3 API: ip/domain/file/url reputation (existing
get_ip_report/get_domain_report ids preserved), file rescan, URL scan,
analysis-get, intelligence search, file sandbox (behaviour) report, passive DNS,
and comments get/add/get-by-id/delete. Scripts handle URL base64 ids,
form-encoded URL submission and comment resource routing.
File-content upload (file-scan) and private scanning are intentionally omitted:
they require an XSOAR-style war-room file entry system Riposte does not have.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-27 15:53:22 +02:00
f3nris
Guillaume BOURGEOIS