f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7 Commits 1 Branch 0 Tags
e3e363c2f9ae9b3d252816239a479e020c038aea
Commit Graph

7 Commits

Author SHA1 Message Date
f3nris e3e363c2f9 feat(marketplace): prefix official command names with the technology 
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
 2026-06-22 14:41:22 +02:00
f3nris 6b65c5f9df feat(harfanglab): HarfangLab EDR integration (71 analyst commands) 
Endpoint management & isolation, policy assignment, IOC & whitelist (threat
intelligence), security-event triage, telemetry hunting (processes, network,
DNS, authentications, event logs, binaries), hash threat hunting, and forensic
collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services,
processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) plus their
result-retrieval commands. Script-based (urllib, INTEGRATION_SECRETS/INPUTS
contract; Authorization: Token header). Platform-specific XSOAR mirroring/fetch
commands intentionally excluded.
 2026-06-22 13:50:20 +02:00
f3nris e5237c0df6 docs(sentinelone): reword changelog to reference the SentinelOne API directly 2026-06-22 12:58:51 +02:00
f3nris 9c04290a34 feat(sentinelone): full command coverage (70 commands, SentinelOne API v2.1) 
Expand from 9 to 70 commands covering the official + DEV SentinelOne V2
integrations: agents (actions/info/tags/count), threats & alerts (verdict/status/
notes/mitigate/fetch-file), hash blocklist & exclusions, IOCs, STAR rules,
Deep Visibility, remote scripts, endpoint tags, firewall rules and network
discovery. All script-based (urllib, INTEGRATION_SECRETS/INPUTS contract);
inputs prioritized from the DEV integration.
 2026-06-22 12:48:43 +02:00
f3nris a3ac1ee30d feat(sentinelone): curated EDR integration (9 analyst commands, API v2.1) 
Endpoints derived from the SentinelOne API v2.1.
Script-based (urllib, INTEGRATION_SECRETS/INPUTS contract) to express S1's nested
filter bodies. Config: console url + api_token (ApiToken header).

Commands:
- enrich: get_threats, list_agents, get_agent, get_hash_verdict
- respond: isolate_agent (disconnect), reconnect_agent (connect), mitigate_threat
  (kill/quarantine/remediate/rollback), initiate_scan, write_threat_note
 2026-06-22 12:31:45 +02:00
f3nris d701284f46 docs: add changelog field to manifests (template, VirusTotal, README) 2026-06-22 11:25:48 +02:00
f3nris 67d5e7da55 feat: initial official marketplace catalog 
- integrations/virustotal: VirusTotal v3 (request-based: IP & domain reports)
- templates/: fully-commented manifest + script-command example
- README: discovery rules, manifest schema, how to publish and wire into Riposte
 2026-06-22 10:50:43 +02:00