Active Directory over LDAP/LDAPS via the ldap3 library, designed to run on a
remote engine inside the AD network. 24 commands: raw search, get
user/computer/group-members (with userAccountControl decoding), enable/disable/
unlock accounts, set/expire password, password-never-expire, add/remove group
membership, move user/computer OU, create/update/delete user/contact/group, and
credential testing.
Scripts share an ldap3 connection helper that handles SSL/LDAPS/Start TLS, NTLM
bind, certificate trust and paged search. ldap3 is imported defensively: if it
is missing on the engine host the command returns a clear "pip install ldap3"
message instead of crashing. No ingestion source, so no OCSF mapper.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 commands over the management port (8089) with token or basic auth:
SPL search (oneshot) as an ingestion source with an OCSF mapper for
notable/CIM findings; async search jobs (create/status/results); index
listing; event submission (receivers/simple + HEC); the complete KV Store
command set (collection create/config/delete, list, data list/add/delete,
entry search/delete/update); user list/delete; and a connectivity test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Patch bump so an Update is offered once the InstallFromSource fix is deployed, regenerating the form-based command scripts without losing instances.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
IP enrichment (geolocation, ASN/network, privacy flags): lookup_ip,
lookup_field, lookup_me, batch (code-first), and test_connection.
Token auth via the `token` query parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Host enrichment, search/count, DNS resolve/reverse, domain info, api-info
and scan status as form-based GET commands; active scan is code-first
(form-encoded POST) and marked destructive. API key sent as the `key`
query parameter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Brings the SentinelOne integration to 83 commands. New: threat-analysis,
threat-download-from-cloud, abort-endpoint-scan, endpoint-fetch-logs, fetch-file,
get-remote-script-task-status, get-remote-script-task-results, get-service-users,
list-installed-singularity-marketplace-applications, update-uam-alert-status,
update-uam-alert-verdict, run-powerquery (Singularity Data Lake), create-tag-rule.
Each command ships a stdlib-only script against API v2.1.
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
Expand from 9 to 70 commands covering the official + DEV SentinelOne V2
integrations: agents (actions/info/tags/count), threats & alerts (verdict/status/
notes/mitigate/fetch-file), hash blocklist & exclusions, IOCs, STAR rules,
Deep Visibility, remote scripts, endpoint tags, firewall rules and network
discovery. All script-based (urllib, INTEGRATION_SECRETS/INPUTS contract);
inputs prioritized from the DEV integration.
- integrations/virustotal: VirusTotal v3 (request-based: IP & domain reports)
- templates/: fully-commented manifest + script-command example
- README: discovery rules, manifest schema, how to publish and wire into Riposte
Guillaume BOURGEOIS
f3nris