feat(microsoft-entra-id): new Microsoft Entra ID integration

14 commands (Microsoft Graph users): user get/list/create/update/delete,
account disable/enable, revoke sign-in sessions, reset password, assign
manager, and group/manager/auth-method reads. Azure AD OAuth 2.0
client-credentials, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

integrations/microsoft-defender-endpoint/incident-types/microsoft-defender-alert.yaml

@@ -0,0 +1,3 @@
+name: "Microsoft Defender Alert"
+color: "#0078d4"
+icon: "alert"

integrations/microsoft-defender-endpoint/manifest.yaml

@@ -0,0 +1,262 @@
+id: microsoft_defender_endpoint
+name: Microsoft Defender for Endpoint
+version: 1.0.0
+description: "Microsoft Defender for Endpoint (Security Center API) — machine isolation, app-execution restriction, antivirus scan, file quarantine, investigation package collection, offboarding, tagging, alert triage, advanced hunting (KQL), custom indicators, and alert ingestion (get_incidents) with an OCSF mapper. Azure AD OAuth 2.0 client-credentials authentication. Stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: alert ingestion + triage, machine actions (isolate/unisolate, restrict/unrestrict app execution, AV scan, quarantine file, collect package, offboard, tag), advanced hunting, custom indicators, and machine/action listing."
+category: endpoint
+
+# Per-instance configuration. Register an Azure AD application, grant it the
+# WindowsDefenderATP application permissions (Machine.Isolate, Machine.Scan,
+# Alert.Read.All, Ti.ReadWrite, AdvancedQuery.Read.All, …) and admin-consent
+# them. The scripts request a token from Azure AD (client-credentials) for the
+# Security Center resource, then call https://api.securitycenter.microsoft.com.
+config_schema:
+  properties:
+    tenant_id:
+      type: string
+      description: "Azure AD tenant (directory) ID"
+    client_id:
+      type: string
+      description: "Application (client) ID"
+    client_secret:
+      type: string
+      description: "Client secret"
+      x-soar-sensitive: true
+  required:
+    - tenant_id
+    - client_id
+    - client_secret
+
+commands:
+  # ── Ingestion / alerts ────────────────────────────────────────────────────
+  - id: get_incidents
+    name: microsoft-defender-endpoint-get-incidents
+    description: "Fetch Defender alerts for ingestion. Returns {result:[...]}; use result as the alert rule results path."
+    risk: read
+    inputs_schema:
+      properties:
+        status: { type: string, description: "Filter by status (New, InProgress, Resolved)" }
+        severity: { type: string, description: "Filter by severity (Informational, Low, Medium, High)" }
+        created_after: { type: string, description: "Lower bound on alertCreationTime, ISO8601 (incremental fetch watermark)" }
+        limit: { type: number, description: "Maximum alerts to fetch (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+    ingest:
+      results_path: result
+      dedup_key: id
+      incremental_field: created_after
+  - id: list_alerts
+    name: microsoft-defender-endpoint-list-alerts
+    description: "List alerts with an optional OData filter."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter expression" }
+        limit: { type: number, description: "Maximum alerts (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_alert
+    name: microsoft-defender-endpoint-get-alert
+    description: "Get a single alert by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Alert ID" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+  - id: update_alert
+    name: microsoft-defender-endpoint-update-alert
+    description: "Update an alert's status, classification, determination or assignment."
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Alert ID" }
+        status: { type: string, description: "New, InProgress or Resolved" }
+        classification: { type: string, description: "TruePositive, FalsePositive or InformationalExpectedActivity" }
+        determination: { type: string, description: "Determination, e.g. Malware, SecurityTesting" }
+        assigned_to: { type: string, description: "Assignee" }
+        comment: { type: string, description: "Comment" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+
+  # ── Machines ──────────────────────────────────────────────────────────────
+  - id: list_machines
+    name: microsoft-defender-endpoint-list-machines
+    description: "List machines with an optional OData filter."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter expression" }
+        limit: { type: number, description: "Maximum machines (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_machine
+    name: microsoft-defender-endpoint-get-machine
+    description: "Get a machine's details by machine ID."
+    risk: read
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine (device) ID" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: get_machine_by_ip
+    name: microsoft-defender-endpoint-get-machine-by-ip
+    description: "Find machines that last reported the given IP at a point in time."
+    risk: read
+    inputs_schema:
+      properties:
+        ip: { type: string, description: "IP address" }
+        timestamp: { type: string, description: "Point in time, ISO8601 (default now)" }
+      required: [ip]
+    outputs_schema: { properties: {} }
+  - id: isolate_machine
+    name: microsoft-defender-endpoint-isolate-machine
+    description: "Network-isolate a machine."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        comment: { type: string, description: "Reason for the action" }
+        isolation_type: { type: string, description: "Full or Selective (default Full)" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: unisolate_machine
+    name: microsoft-defender-endpoint-unisolate-machine
+    description: "Release a machine from network isolation."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: restrict_app_execution
+    name: microsoft-defender-endpoint-restrict-app-execution
+    description: "Restrict application execution on a machine (allow only Microsoft-signed binaries)."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: remove_app_restriction
+    name: microsoft-defender-endpoint-remove-app-restriction
+    description: "Remove the application-execution restriction from a machine."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: run_antivirus_scan
+    name: microsoft-defender-endpoint-run-antivirus-scan
+    description: "Trigger a Defender antivirus scan on a machine."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        scan_type: { type: string, description: "Quick or Full (default Quick)" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: stop_and_quarantine_file
+    name: microsoft-defender-endpoint-stop-and-quarantine-file
+    description: "Stop execution of a file (by SHA1) and quarantine it on a machine."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        sha1: { type: string, description: "SHA1 of the file" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id, sha1]
+    outputs_schema: { properties: {} }
+  - id: collect_investigation_package
+    name: microsoft-defender-endpoint-collect-investigation-package
+    description: "Collect a forensic investigation package from a machine (returns a machine action; poll it for the download URI)."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: offboard_machine
+    name: microsoft-defender-endpoint-offboard-machine
+    description: "Offboard a machine from Defender for Endpoint."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        comment: { type: string, description: "Reason for the action" }
+      required: [machine_id]
+    outputs_schema: { properties: {} }
+  - id: tag_machine
+    name: microsoft-defender-endpoint-tag-machine
+    description: "Add or remove a tag on a machine."
+    inputs_schema:
+      properties:
+        machine_id: { type: string, description: "Machine ID" }
+        tag: { type: string, description: "Tag value" }
+        action: { type: string, description: "Add or Remove (default Add)" }
+      required: [machine_id, tag]
+    outputs_schema: { properties: {} }
+  - id: list_machine_actions
+    name: microsoft-defender-endpoint-list-machine-actions
+    description: "List machine actions (their status), optionally filtered."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter expression (e.g. machineId eq '...')" }
+        limit: { type: number, description: "Maximum actions (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  # ── Hunting / indicators ──────────────────────────────────────────────────
+  - id: advanced_hunting
+    name: microsoft-defender-endpoint-advanced-hunting
+    description: "Run an advanced hunting KQL query."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "KQL query" }
+      required: [query]
+    outputs_schema: { properties: {} }
+  - id: list_indicators
+    name: microsoft-defender-endpoint-list-indicators
+    description: "List custom threat indicators."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter expression" }
+        limit: { type: number, description: "Maximum indicators (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: create_indicator
+    name: microsoft-defender-endpoint-create-indicator
+    description: "Create a custom indicator (file hash, IP, URL or domain) with an action."
+    inputs_schema:
+      properties:
+        indicator_value: { type: string, description: "Indicator value (hash, IP, URL or domain)" }
+        indicator_type: { type: string, description: "FileSha256, FileSha1, FileMd5, IpAddress, DomainName or Url" }
+        action: { type: string, description: "Alert, AlertAndBlock, Block, Allowed or Warn (default Alert)" }
+        title: { type: string, description: "Indicator title" }
+        description: { type: string, description: "Indicator description" }
+        severity: { type: string, description: "Informational, Low, Medium or High" }
+        expiration_time: { type: string, description: "Expiration, ISO8601" }
+      required: [indicator_value, indicator_type]
+    outputs_schema: { properties: {} }
+  - id: delete_indicator
+    name: microsoft-defender-endpoint-delete-indicator
+    description: "Delete a custom indicator by ID."
+    inputs_schema:
+      properties:
+        indicator_id: { type: string, description: "Indicator ID" }
+      required: [indicator_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: microsoft-defender-endpoint-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_incidents
+  mapper: get_incidents
+  default_incident_type: "Microsoft Defender Alert"

integrations/microsoft-defender-endpoint/mappers/get_incidents.yaml

@@ -0,0 +1,21 @@
+name: "Microsoft Defender Alerts → OCSF"
+description: "Maps a Defender for Endpoint alert (get_incidents, results_path = result) to OCSF finding fields. Uses the first evidence entry for host/user/file where present."
+field_mappings:
+  title: "title"
+  severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
+  description: "description"
+ocsf:
+  - { source_path: "id",                   ocsf_field: "finding_info.uid" }
+  - { source_path: "title",                ocsf_field: "finding_info.title" }
+  - { source_path: "description",          ocsf_field: "finding_info.desc" }
+  - { source_path: "category",             ocsf_field: "finding_info.analytic.category" }
+  - { source_path: "alertCreationTime",    ocsf_field: "finding_info.created_time" }
+  - { source_path: "lastUpdateTime",       ocsf_field: "finding_info.modified_time" }
+  - { source_path: "status",               ocsf_field: "status" }
+  - { source_path: "determination",        ocsf_field: "disposition" }
+  - { source_path: "detectionSource",      ocsf_field: "finding_info.analytic.name" }
+  - { source_path: "threatFamilyName",     ocsf_field: "malware.name" }
+  - { source_path: "computerDnsName",      ocsf_field: "device.hostname" }
+  - { source_path: "machineId",            ocsf_field: "device.uid" }
+  - { source_path: "assignedTo",           ocsf_field: "assignee.name" }
+  - { source_path: "mitreTechniques[0]",   ocsf_field: "attacks.technique.uid" }

integrations/microsoft-defender-endpoint/scripts/advanced_hunting.py

@@ -0,0 +1,62 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    query = inputs.get("query")
+    if not query:
+        raise Exception("query is required")
+    body = {"Query": query}
+    result = request("POST", "/advancedqueries/run", body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/collect_investigation_package.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Collect package via Riposte"}
+    path = "/machines/" + urllib.parse.quote(str(machine_id), safe="") + "/collectInvestigationPackage"
+    result = request("POST", path, body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/create_indicator.py

@@ -0,0 +1,81 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    indicator_value = inputs.get("indicator_value")
+    if not indicator_value:
+        raise Exception("indicator_value is required")
+    indicator_type = inputs.get("indicator_type")
+    if not indicator_type:
+        raise Exception("indicator_type is required")
+    action = inputs.get("action")
+    title = inputs.get("title")
+    description = inputs.get("description")
+    severity = inputs.get("severity")
+    expiration_time = inputs.get("expiration_time")
+
+    body = {}
+    body["indicatorValue"] = indicator_value
+    body["indicatorType"] = indicator_type
+    body["action"] = action or "Alert"
+    body["title"] = title or "Riposte indicator"
+    body["description"] = description or "Created via Riposte"
+    if severity not in (None, ""):
+        body["severity"] = severity
+    if expiration_time not in (None, ""):
+        body["expirationTime"] = expiration_time
+
+    result = request("POST", "/indicators", body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/delete_indicator.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    indicator_id = inputs.get("indicator_id")
+    if not indicator_id:
+        raise Exception("indicator_id is required")
+    path = "/indicators/" + urllib.parse.quote(str(indicator_id), safe="")
+    result = request("DELETE", path)
+    if not result:
+        result = {"ok": True, "indicator_id": indicator_id}
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_alert.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    alert_id = inputs.get("alert_id")
+    if not alert_id:
+        raise Exception("alert_id is required")
+    res = request("GET", "/alerts/" + quote(alert_id))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_incidents.py

@@ -0,0 +1,89 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+from datetime import datetime, timezone
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def _iso(s):
+    s = str(s)
+    if s.isdigit():
+        ts = int(s)
+        if ts > 10 ** 12:
+            ts = ts / 1000.0
+        return datetime.fromtimestamp(ts, tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    try:
+        return datetime.fromisoformat(s.replace("Z", "+00:00")).astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    except Exception:
+        return s
+
+
+def main():
+    status = inputs.get("status")
+    severity = inputs.get("severity")
+    created_after = inputs.get("created_after")
+    limit = inputs.get("limit") or 50
+
+    parts = []
+    if status:
+        parts.append("status eq '" + str(status) + "'")
+    if severity:
+        parts.append("severity eq '" + str(severity) + "'")
+    if created_after:
+        parts.append("alertCreationTime ge " + _iso(created_after))
+    filt = " and ".join(parts)
+
+    res = request("GET", "/alerts", params={"$filter": filt or None, "$top": limit, "$orderby": "alertCreationTime asc"})
+    print(json.dumps({"result": res.get("value", [])}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_machine.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    res = request("GET", "/machines/" + quote(machine_id))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/get_machine_by_ip.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+from datetime import datetime, timezone
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    ip = inputs.get("ip")
+    if not ip:
+        raise Exception("ip is required")
+    ts = inputs.get("timestamp") or datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    url = API + "/machines/findbyip(ip='" + str(ip) + "',timestamp=" + str(ts) + ")"
+    res = request("GET", "", full_url=url)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/isolate_machine.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    isolation_type = inputs.get("isolation_type")
+    body = {"Comment": comment or "Isolated via Riposte", "IsolationType": isolation_type or "Full"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/isolate", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_alerts.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    filt = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/alerts", params={"$filter": filt or None, "$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_indicators.py

@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filter_ = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    params = {"$filter": filter_ or None, "$top": limit}
+    result = request("GET", "/indicators", params=params)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_machine_actions.py

@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filter_ = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    params = {"$filter": filter_ or None, "$top": limit}
+    result = request("GET", "/machineactions", params=params)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/list_machines.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    filt = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/machines", params={"$filter": filt or None, "$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/offboard_machine.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Offboard via Riposte"}
+    path = "/machines/" + urllib.parse.quote(str(machine_id), safe="") + "/offboard"
+    result = request("POST", path, body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/remove_app_restriction.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Unrestricted via Riposte"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/unrestrictCodeExecution", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/restrict_app_execution.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Restricted via Riposte"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/restrictCodeExecution", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/run_antivirus_scan.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    scan_type = inputs.get("scan_type")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "AV scan via Riposte", "ScanType": scan_type or "Quick"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/runAntiVirusScan", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/stop_and_quarantine_file.py

@@ -0,0 +1,69 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    sha1 = inputs.get("sha1")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    if not sha1:
+        raise Exception("sha1 is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Quarantine via Riposte", "Sha1": sha1}
+    res = request("POST", "/machines/" + quote(machine_id) + "/StopAndQuarantineFile", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/tag_machine.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    tag = inputs.get("tag")
+    if not tag:
+        raise Exception("tag is required")
+    action = inputs.get("action")
+    body = {"Value": tag, "Action": action or "Add"}
+    path = "/machines/" + urllib.parse.quote(str(machine_id), safe="") + "/tags"
+    result = request("POST", path, body=body)
+    print(json.dumps(result))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/test_connection.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    res = request("GET", "/alerts", params={"$top": 1})
+    if "value" not in res:
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/unisolate_machine.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    machine_id = inputs.get("machine_id")
+    if not machine_id:
+        raise Exception("machine_id is required")
+    comment = inputs.get("comment")
+    body = {"Comment": comment or "Released via Riposte"}
+    res = request("POST", "/machines/" + quote(machine_id) + "/unisolate", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-defender-endpoint/scripts/update_alert.py

@@ -0,0 +1,79 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+SCOPE = "https://api.securitycenter.microsoft.com/.default"
+API = "https://api.securitycenter.microsoft.com/api"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": SCOPE,
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, full_url=None, token=None):
+    url = full_url or (API + path)
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+quote = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    alert_id = inputs.get("alert_id")
+    if not alert_id:
+        raise Exception("alert_id is required")
+
+    body = {}
+    if inputs.get("status"):
+        body["status"] = inputs.get("status")
+    if inputs.get("classification"):
+        body["classification"] = inputs.get("classification")
+    if inputs.get("determination"):
+        body["determination"] = inputs.get("determination")
+    if inputs.get("assigned_to"):
+        body["assignedTo"] = inputs.get("assigned_to")
+    if inputs.get("comment"):
+        body["comment"] = inputs.get("comment")
+    if not body:
+        raise Exception("nothing to update")
+
+    res = request("PATCH", "/alerts/" + quote(alert_id), body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/manifest.yaml

@@ -0,0 +1,172 @@
+id: microsoft_entra_id
+name: Microsoft Entra ID
+version: 1.0.0
+description: "Microsoft Entra ID (Microsoft Graph, users) — identity response and lifecycle: look up/list users, create/update/delete, disable and re-enable accounts, revoke sign-in sessions, force password reset, and read groups, manager and authentication methods. Azure AD OAuth 2.0 client-credentials authentication. Stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: user get/list/create/update/delete, account disable/enable, session revocation, password reset, and group/manager/auth-method reads."
+category: identity
+
+# Per-instance configuration. Register an Azure AD application, grant it the
+# Microsoft Graph application permissions (User.ReadWrite.All, Group.Read.All,
+# User.RevokeSessions.All, UserAuthenticationMethod.Read.All, Directory.Read.All)
+# and admin-consent them. The scripts request a Microsoft Graph token
+# (client-credentials) and call https://graph.microsoft.com/v1.0.
+config_schema:
+  properties:
+    tenant_id:
+      type: string
+      description: "Azure AD tenant (directory) ID"
+    client_id:
+      type: string
+      description: "Application (client) ID"
+    client_secret:
+      type: string
+      description: "Client secret"
+      x-soar-sensitive: true
+  required:
+    - tenant_id
+    - client_id
+    - client_secret
+
+# Every command that targets a user accepts user_id — the object ID or the
+# userPrincipalName (email) of the account.
+commands:
+  - id: list_users
+    name: microsoft-entra-id-list-users
+    description: "List directory users, optionally filtered."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter (e.g. startswith(displayName,'A'))" }
+        search: { type: string, description: "Free-text $search (e.g. displayName:john)" }
+        limit: { type: number, description: "Maximum users (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_user
+    name: microsoft-entra-id-get-user
+    description: "Get a user's profile by object ID or userPrincipalName."
+    risk: read
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: create_user
+    name: microsoft-entra-id-create-user
+    description: "Create a user account."
+    inputs_schema:
+      properties:
+        user_principal_name: { type: string, description: "userPrincipalName (email), e.g. jdoe@contoso.com" }
+        display_name: { type: string, description: "Display name" }
+        mail_nickname: { type: string, description: "Mail nickname (defaults to the UPN local part)" }
+        password: { type: string, description: "Initial password" }
+        force_change_password: { type: boolean, description: "Require a password change at next sign-in (default true)" }
+        account_enabled: { type: boolean, description: "Whether the account is enabled (default true)" }
+        given_name: { type: string, description: "First name" }
+        surname: { type: string, description: "Last name" }
+        job_title: { type: string, description: "Job title" }
+        department: { type: string, description: "Department" }
+      required: [user_principal_name, display_name, password]
+    outputs_schema: { properties: {} }
+  - id: update_user
+    name: microsoft-entra-id-update-user
+    description: "Update a user's profile fields."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+        display_name: { type: string, description: "Display name" }
+        given_name: { type: string, description: "First name" }
+        surname: { type: string, description: "Last name" }
+        job_title: { type: string, description: "Job title" }
+        department: { type: string, description: "Department" }
+        mobile_phone: { type: string, description: "Mobile phone" }
+        fields_json: { type: string, description: "Raw Graph user fields as a JSON object (advanced; merged last)" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: delete_user
+    name: microsoft-entra-id-delete-user
+    description: "Delete a user account."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: disable_account
+    name: microsoft-entra-id-disable-account
+    description: "Disable a user account (accountEnabled = false)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: enable_account
+    name: microsoft-entra-id-enable-account
+    description: "Re-enable a user account (accountEnabled = true)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: revoke_sessions
+    name: microsoft-entra-id-revoke-sessions
+    description: "Revoke all refresh tokens / sign-in sessions for a user (forces re-authentication)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: reset_password
+    name: microsoft-entra-id-reset-password
+    description: "Set a user's password (optionally forcing a change at next sign-in)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+        password: { type: string, description: "New password" }
+        force_change: { type: boolean, description: "Require a change at next sign-in (default true)" }
+      required: [user_id, password]
+    outputs_schema: { properties: {} }
+  - id: get_user_groups
+    name: microsoft-entra-id-get-user-groups
+    description: "List the groups a user is a member of."
+    risk: read
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+        limit: { type: number, description: "Maximum groups (default 50)" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: get_user_manager
+    name: microsoft-entra-id-get-user-manager
+    description: "Get a user's manager."
+    risk: read
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: assign_manager
+    name: microsoft-entra-id-assign-manager
+    description: "Set a user's manager."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+        manager_id: { type: string, description: "Manager's user object ID or userPrincipalName" }
+      required: [user_id, manager_id]
+    outputs_schema: { properties: {} }
+  - id: get_auth_methods
+    name: microsoft-entra-id-get-auth-methods
+    description: "List a user's registered authentication methods."
+    risk: read
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User object ID or userPrincipalName" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: microsoft-entra-id-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/microsoft-entra-id/scripts/assign_manager.py

@@ -0,0 +1,70 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    manager_id = inputs.get("manager_id")
+    if not manager_id:
+        raise Exception("manager_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    body = {"@odata.id": "https://graph.microsoft.com/v1.0/users/" + q(manager_id)}
+    resp = request("PUT", "/users/" + q(user_id) + "/manager/$ref", body=body)
+    if not resp:
+        resp = {"ok": True, "user_id": user_id, "manager_id": manager_id}
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/create_user.py

@@ -0,0 +1,92 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_principal_name = inputs.get("user_principal_name")
+    if not user_principal_name:
+        raise Exception("user_principal_name is required")
+    display_name = inputs.get("display_name")
+    if not display_name:
+        raise Exception("display_name is required")
+    password = inputs.get("password")
+    if not password:
+        raise Exception("password is required")
+
+    mail_nickname = inputs.get("mail_nickname") or str(user_principal_name).split("@")[0]
+    account_enabled = inputs.get("account_enabled", True)
+    force_change_password = inputs.get("force_change_password", True)
+
+    body = {
+        "accountEnabled": bool(account_enabled),
+        "displayName": display_name,
+        "userPrincipalName": user_principal_name,
+        "mailNickname": mail_nickname,
+        "passwordProfile": {
+            "password": password,
+            "forceChangePasswordNextSignIn": bool(force_change_password),
+        },
+    }
+    if inputs.get("given_name"):
+        body["givenName"] = inputs.get("given_name")
+    if inputs.get("surname"):
+        body["surname"] = inputs.get("surname")
+    if inputs.get("job_title"):
+        body["jobTitle"] = inputs.get("job_title")
+    if inputs.get("department"):
+        body["department"] = inputs.get("department")
+
+    resp = request("POST", "/users", body=body)
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/delete_user.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("DELETE", "/users/" + q(user_id))
+    if not resp:
+        resp = {"ok": True, "user_id": user_id}
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/disable_account.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("PATCH", "/users/" + q(user_id), body={"accountEnabled": False})
+    if not resp:
+        resp = {"ok": True, "user_id": user_id, "account_enabled": False}
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/enable_account.py

@@ -0,0 +1,66 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("PATCH", "/users/" + q(user_id), body={"accountEnabled": True})
+    if not resp:
+        resp = {"ok": True, "user_id": user_id, "account_enabled": True}
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/get_auth_methods.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("GET", "/users/" + q(user_id) + "/authentication/methods")
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/get_user.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("GET", "/users/" + q(user_id))
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/get_user_groups.py

@@ -0,0 +1,65 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    limit = inputs.get("limit", 50)
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("GET", "/users/" + q(user_id) + "/memberOf", params={"$top": limit})
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/get_user_manager.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("GET", "/users/" + q(user_id) + "/manager")
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/list_users.py

@@ -0,0 +1,72 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filt = inputs.get("filter")
+    search = inputs.get("search")
+    limit = inputs.get("limit", 50)
+
+    params = {"$top": limit}
+    extra_headers = None
+    if filt:
+        params["$filter"] = filt
+        extra_headers = {"ConsistencyLevel": "eventual"}
+    if search:
+        params["$search"] = "\"" + str(search) + "\""
+        extra_headers = {"ConsistencyLevel": "eventual"}
+
+    resp = request("GET", "/users", params=params, extra_headers=extra_headers)
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/reset_password.py

@@ -0,0 +1,76 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    password = inputs.get("password")
+    if not password:
+        raise Exception("password is required")
+    force_change = inputs.get("force_change", True)
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    body = {
+        "passwordProfile": {
+            "password": password,
+            "forceChangePasswordNextSignIn": bool(force_change),
+        }
+    }
+    resp = request("PATCH", "/users/" + q(user_id), body=body)
+    if not resp:
+        resp = {"ok": True, "user_id": user_id}
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/revoke_sessions.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    resp = request("POST", "/users/" + q(user_id) + "/revokeSignInSessions")
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/test_connection.py

@@ -0,0 +1,60 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    resp = request("GET", "/organization", params={"$select": "id,displayName", "$top": 1})
+    if "value" not in resp:
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-entra-id/scripts/update_user.py

@@ -0,0 +1,90 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API = "https://graph.microsoft.com/v1.0"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://graph.microsoft.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def request(method, path, params=None, body=None, extra_headers=None, token=None):
+    url = API + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+
+    body = {}
+    if inputs.get("display_name"):
+        body["displayName"] = inputs.get("display_name")
+    if inputs.get("given_name"):
+        body["givenName"] = inputs.get("given_name")
+    if inputs.get("surname"):
+        body["surname"] = inputs.get("surname")
+    if inputs.get("job_title"):
+        body["jobTitle"] = inputs.get("job_title")
+    if inputs.get("department"):
+        body["department"] = inputs.get("department")
+    if inputs.get("mobile_phone"):
+        body["mobilePhone"] = inputs.get("mobile_phone")
+
+    fields_json = inputs.get("fields_json")
+    if fields_json:
+        extra = json.loads(fields_json)
+        if not isinstance(extra, dict):
+            raise Exception("fields_json must be a JSON object")
+        body.update(extra)
+
+    if not body:
+        raise Exception("nothing to update")
+
+    resp = request("PATCH", "/users/" + q(user_id), body=body)
+    if not resp:
+        resp = {"ok": True, "user_id": user_id}
+    print(json.dumps(resp))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/incident-types/microsoft-sentinel-incident.yaml

@@ -0,0 +1,3 @@
+name: "Microsoft Sentinel Incident"
+color: "#0078d4"
+icon: "alert"

integrations/microsoft-sentinel/manifest.yaml

@@ -0,0 +1,248 @@
+id: microsoft_sentinel
+name: Microsoft Sentinel
+version: 1.0.0
+description: "Microsoft Sentinel (Azure Resource Manager API) — incident management (list/get/create/update/delete, comments, related alerts/entities), watchlists, threat indicators, and incident ingestion (get_incidents) with an OCSF mapper. Azure AD OAuth 2.0 client-credentials authentication. Stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: incident CRUD + comments + related data, watchlist listing/upsert, threat indicator CRUD, and incident ingestion with an OCSF mapper."
+category: siem
+
+# Per-instance configuration. Register an Azure AD application, grant it the
+# 'Microsoft Sentinel Contributor' (or Responder) role on the workspace's
+# resource group, and admin-consent it. The scripts request an Azure Resource
+# Manager token (client-credentials) and call https://management.azure.com.
+config_schema:
+  properties:
+    tenant_id:
+      type: string
+      description: "Azure AD tenant (directory) ID"
+    client_id:
+      type: string
+      description: "Application (client) ID"
+    client_secret:
+      type: string
+      description: "Client secret"
+      x-soar-sensitive: true
+    subscription_id:
+      type: string
+      description: "Azure subscription ID that holds the Sentinel workspace"
+    resource_group:
+      type: string
+      description: "Resource group of the Sentinel workspace"
+    workspace_name:
+      type: string
+      description: "Log Analytics workspace name backing Sentinel"
+  required:
+    - tenant_id
+    - client_id
+    - client_secret
+    - subscription_id
+    - resource_group
+    - workspace_name
+
+commands:
+  # ── Ingestion / incidents ─────────────────────────────────────────────────
+  - id: get_incidents
+    name: microsoft-sentinel-get-incidents
+    description: "Fetch Sentinel incidents for ingestion. Returns {result:[...]}; use result as the alert rule results path."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter (e.g. properties/status eq 'New')" }
+        created_after: { type: string, description: "Lower bound on createdTimeUtc, ISO8601 (incremental fetch watermark, applied via $filter)" }
+        limit: { type: number, description: "Maximum incidents (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+    ingest:
+      results_path: result
+      dedup_key: name
+      incremental_field: created_after
+  - id: list_incidents
+    name: microsoft-sentinel-list-incidents
+    description: "List incidents with optional OData filter and ordering."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter expression" }
+        orderby: { type: string, description: "OData $orderby (e.g. properties/createdTimeUtc desc)" }
+        limit: { type: number, description: "Maximum incidents (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_incident
+    name: microsoft-sentinel-get-incident
+    description: "Get a single incident by its name (GUID)."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: create_incident
+    name: microsoft-sentinel-create-incident
+    description: "Create an incident."
+    inputs_schema:
+      properties:
+        title: { type: string, description: "Incident title" }
+        severity: { type: string, description: "Informational, Low, Medium or High" }
+        status: { type: string, description: "New, Active or Closed (default New)" }
+        description: { type: string, description: "Description" }
+        assigned_to: { type: string, description: "Owner UPN/email" }
+      required: [title, severity]
+    outputs_schema: { properties: {} }
+  - id: update_incident
+    name: microsoft-sentinel-update-incident
+    description: "Update an incident's title, status, severity, classification or owner."
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+        title: { type: string, description: "New title" }
+        status: { type: string, description: "New, Active or Closed" }
+        severity: { type: string, description: "Informational, Low, Medium or High" }
+        classification: { type: string, description: "Closing classification (BenignPositive, FalsePositive, TruePositive, Undetermined)" }
+        classification_reason: { type: string, description: "Closing reason" }
+        assigned_to: { type: string, description: "Owner UPN/email" }
+        description: { type: string, description: "Description" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: delete_incident
+    name: microsoft-sentinel-delete-incident
+    description: "Delete an incident."
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: add_comment
+    name: microsoft-sentinel-add-comment
+    description: "Add a comment to an incident."
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+        comment: { type: string, description: "Comment message" }
+      required: [incident_id, comment]
+    outputs_schema: { properties: {} }
+  - id: list_comments
+    name: microsoft-sentinel-list-comments
+    description: "List an incident's comments."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+        limit: { type: number, description: "Maximum comments (default 50)" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: list_incident_alerts
+    name: microsoft-sentinel-list-incident-alerts
+    description: "List the alerts associated with an incident."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: list_incident_entities
+    name: microsoft-sentinel-list-incident-entities
+    description: "List the entities (accounts, hosts, IPs, …) of an incident."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+  - id: list_incident_relations
+    name: microsoft-sentinel-list-incident-relations
+    description: "List an incident's relations (linked bookmarks and alerts)."
+    risk: read
+    inputs_schema:
+      properties:
+        incident_id: { type: string, description: "Incident name/ID (GUID)" }
+      required: [incident_id]
+    outputs_schema: { properties: {} }
+
+  # ── Watchlists ────────────────────────────────────────────────────────────
+  - id: list_watchlists
+    name: microsoft-sentinel-list-watchlists
+    description: "List watchlists in the workspace."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Maximum watchlists (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: list_watchlist_items
+    name: microsoft-sentinel-list-watchlist-items
+    description: "List the items of a watchlist."
+    risk: read
+    inputs_schema:
+      properties:
+        watchlist_alias: { type: string, description: "Watchlist alias" }
+        limit: { type: number, description: "Maximum items (default 50)" }
+      required: [watchlist_alias]
+    outputs_schema: { properties: {} }
+  - id: upsert_watchlist_item
+    name: microsoft-sentinel-upsert-watchlist-item
+    description: "Create or update a watchlist item (properties as a JSON object)."
+    inputs_schema:
+      properties:
+        watchlist_alias: { type: string, description: "Watchlist alias" }
+        item_id: { type: string, description: "Watchlist item ID (GUID; generated when omitted)" }
+        item_json: { type: string, description: "Item key/value properties as a JSON object" }
+      required: [watchlist_alias, item_json]
+    outputs_schema: { properties: {} }
+
+  # ── Threat indicators ─────────────────────────────────────────────────────
+  - id: list_threat_indicators
+    name: microsoft-sentinel-list-threat-indicators
+    description: "List threat intelligence indicators."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "OData $filter expression" }
+        limit: { type: number, description: "Maximum indicators (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: create_threat_indicator
+    name: microsoft-sentinel-create-threat-indicator
+    description: "Create a threat intelligence indicator."
+    inputs_schema:
+      properties:
+        value: { type: string, description: "Indicator value" }
+        pattern_type: { type: string, description: "Type: ipv4-addr, domain-name, url, file:hashes.'SHA-256', …" }
+        display_name: { type: string, description: "Display name" }
+        threat_types: { type: string, description: "Comma-separated threat types (e.g. malicious-activity)" }
+        confidence: { type: number, description: "Confidence 0-100" }
+        valid_until: { type: string, description: "Expiration, ISO8601" }
+      required: [value, pattern_type]
+    outputs_schema: { properties: {} }
+  - id: update_threat_indicator
+    name: microsoft-sentinel-update-threat-indicator
+    description: "Update a threat intelligence indicator (display name, confidence, expiry, threat types)."
+    inputs_schema:
+      properties:
+        indicator_name: { type: string, description: "Indicator name (from list_threat_indicators)" }
+        display_name: { type: string, description: "Display name" }
+        confidence: { type: number, description: "Confidence 0-100" }
+        valid_until: { type: string, description: "Expiration, ISO8601" }
+        threat_types: { type: string, description: "Comma-separated threat types" }
+      required: [indicator_name]
+    outputs_schema: { properties: {} }
+  - id: delete_threat_indicator
+    name: microsoft-sentinel-delete-threat-indicator
+    description: "Delete a threat intelligence indicator by name."
+    inputs_schema:
+      properties:
+        indicator_name: { type: string, description: "Indicator name (from list_threat_indicators)" }
+      required: [indicator_name]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: microsoft-sentinel-test-connection
+    description: "Verify connectivity and credentials (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+
+ingestion:
+  command: get_incidents
+  mapper: get_incidents
+  default_incident_type: "Microsoft Sentinel Incident"

integrations/microsoft-sentinel/mappers/get_incidents.yaml

@@ -0,0 +1,18 @@
+name: "Microsoft Sentinel Incidents → OCSF"
+description: "Maps a Sentinel incident (get_incidents, results_path = result) to OCSF finding fields. The fetch script lifts the ARM 'properties' object to the top level and keeps the incident 'name' (GUID) as the id."
+field_mappings:
+  title: "title"
+  severity: "severity = 'High' ? 4 : (severity = 'Medium' ? 3 : (severity = 'Low' ? 2 : 1))"
+  description: "description"
+ocsf:
+  - { source_path: "name",              ocsf_field: "finding_info.uid" }
+  - { source_path: "incidentNumber",    ocsf_field: "finding_info.uid_alt" }
+  - { source_path: "title",             ocsf_field: "finding_info.title" }
+  - { source_path: "description",       ocsf_field: "finding_info.desc" }
+  - { source_path: "createdTimeUtc",    ocsf_field: "finding_info.created_time" }
+  - { source_path: "lastModifiedTimeUtc", ocsf_field: "finding_info.modified_time" }
+  - { source_path: "incidentUrl",       ocsf_field: "finding_info.src_url" }
+  - { source_path: "status",            ocsf_field: "status" }
+  - { source_path: "classification",    ocsf_field: "disposition" }
+  - { source_path: "owner.assignedTo",  ocsf_field: "assignee.name" }
+  - { source_path: "labels[0].labelName", ocsf_field: "finding_info.types" }

integrations/microsoft-sentinel/scripts/add_comment.py

@@ -0,0 +1,80 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+import uuid
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    comment = inputs.get("comment")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    if not comment:
+        raise Exception("comment is required")
+    comment_id = str(uuid.uuid4())
+    res = request("PUT", "/incidents/" + q(incident_id) + "/comments/" + comment_id,
+                  body={"properties": {"message": comment}})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/create_incident.py

@@ -0,0 +1,86 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+import uuid
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    title = inputs.get("title")
+    severity = inputs.get("severity")
+    if not title:
+        raise Exception("title is required")
+    if not severity:
+        raise Exception("severity is required")
+    status = inputs.get("status") or "New"
+    description = inputs.get("description")
+    assigned_to = inputs.get("assigned_to")
+
+    props = {"title": title, "severity": severity, "status": status}
+    if description:
+        props["description"] = description
+    if assigned_to:
+        props["owner"] = {"assignedTo": assigned_to}
+
+    new_guid = str(uuid.uuid4())
+    res = request("PUT", "/incidents/" + new_guid, body={"properties": props})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/create_threat_indicator.py

@@ -0,0 +1,102 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    value = inputs.get("value")
+    pattern_type = inputs.get("pattern_type")
+    if not value:
+        raise Exception("value is required")
+    if not pattern_type:
+        raise Exception("pattern_type is required")
+
+    display_name = inputs.get("display_name") or value
+    threat_types_raw = inputs.get("threat_types")
+    if threat_types_raw:
+        threat_types = [t.strip() for t in str(threat_types_raw).split(",") if t.strip()]
+    else:
+        threat_types = ["malicious-activity"]
+    confidence = inputs.get("confidence")
+    valid_until = inputs.get("valid_until")
+
+    if str(pattern_type).startswith("file"):
+        pattern = "[" + str(pattern_type) + " = '" + str(value) + "']"
+    else:
+        pattern = "[" + str(pattern_type) + ":value = '" + str(value) + "']"
+
+    props = {
+        "pattern": pattern,
+        "patternType": pattern_type,
+        "displayName": display_name,
+        "threatTypes": threat_types,
+        "source": "Riposte",
+    }
+    if confidence is not None and confidence != "":
+        props["confidence"] = int(confidence)
+    if valid_until:
+        props["validUntil"] = valid_until
+
+    body = {"kind": "indicator", "properties": props}
+    res = request("POST", "/threatIntelligence/main/createIndicator", body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/delete_incident.py

@@ -0,0 +1,74 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    request("DELETE", "/incidents/" + q(incident_id))
+    print(json.dumps({"ok": True, "incident_id": incident_id}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/delete_threat_indicator.py

@@ -0,0 +1,74 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    indicator_name = inputs.get("indicator_name")
+    if not indicator_name:
+        raise Exception("indicator_name is required")
+    request("DELETE", "/threatIntelligence/main/indicators/" + q(indicator_name))
+    print(json.dumps({"ok": True, "indicator_name": indicator_name}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/get_incident.py

@@ -0,0 +1,74 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    res = request("GET", "/incidents/" + q(incident_id))
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/get_incidents.py

@@ -0,0 +1,105 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+from datetime import datetime, timezone
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _normalize_iso(s):
+    s = str(s)
+    if s.isdigit():
+        ts = int(s)
+        if ts > 10 ** 12:
+            ts = ts / 1000.0
+        return datetime.fromtimestamp(ts, tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    try:
+        dt = datetime.fromisoformat(s.replace("Z", "+00:00")).astimezone(timezone.utc)
+        return dt.strftime("%Y-%m-%dT%H:%M:%SZ")
+    except Exception:
+        return s
+
+
+def _flatten(item):
+    flat = dict(item.get("properties", {}))
+    flat["name"] = item.get("name")
+    flat["id"] = item.get("id")
+    return flat
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filt = inputs.get("filter")
+    created_after = inputs.get("created_after")
+    limit = inputs.get("limit") or 50
+
+    filter_parts = []
+    if filt:
+        filter_parts.append(str(filt))
+    if created_after:
+        filter_parts.append("properties/createdTimeUtc ge " + _normalize_iso(created_after))
+    filter_str = " and ".join(filter_parts) if filter_parts else None
+
+    res = request("GET", "/incidents", params={
+        "$filter": filter_str,
+        "$top": limit,
+        "$orderby": "properties/createdTimeUtc asc",
+    })
+    print(json.dumps({"result": [_flatten(i) for i in res.get("value", [])]}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_comments.py

@@ -0,0 +1,75 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/incidents/" + q(incident_id) + "/comments", params={"$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_incident_alerts.py

@@ -0,0 +1,74 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    res = request("POST", "/incidents/" + q(incident_id) + "/alerts")
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_incident_entities.py

@@ -0,0 +1,74 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    res = request("POST", "/incidents/" + q(incident_id) + "/entities")
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_incident_relations.py

@@ -0,0 +1,74 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+    res = request("GET", "/incidents/" + q(incident_id) + "/relations")
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_incidents.py

@@ -0,0 +1,72 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    res = request("GET", "/incidents", params={
+        "$filter": inputs.get("filter"),
+        "$orderby": inputs.get("orderby"),
+        "$top": inputs.get("limit") or 50,
+    })
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_threat_indicators.py

@@ -0,0 +1,70 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    filt = inputs.get("filter")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/threatIntelligence/main/indicators", params={"$filter": filt or None, "$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_watchlist_items.py

@@ -0,0 +1,75 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    watchlist_alias = inputs.get("watchlist_alias")
+    if not watchlist_alias:
+        raise Exception("watchlist_alias is required")
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/watchlists/" + q(watchlist_alias) + "/watchlistItems", params={"$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/list_watchlists.py

@@ -0,0 +1,69 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    limit = inputs.get("limit") or 50
+    res = request("GET", "/watchlists", params={"$top": limit})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/test_connection.py

@@ -0,0 +1,69 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def main():
+    res = request("GET", "/incidents", params={"$top": 1})
+    if "value" not in res:
+        raise Exception("unexpected response")
+    print(json.dumps({"ok": True}))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/update_incident.py

@@ -0,0 +1,94 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    incident_id = inputs.get("incident_id")
+    if not incident_id:
+        raise Exception("incident_id is required")
+
+    existing = request("GET", "/incidents/" + q(incident_id))
+    props = dict(existing.get("properties", {}))
+
+    if inputs.get("title"):
+        props["title"] = inputs["title"]
+    if inputs.get("status"):
+        props["status"] = inputs["status"]
+    if inputs.get("severity"):
+        props["severity"] = inputs["severity"]
+    if inputs.get("description"):
+        props["description"] = inputs["description"]
+    if inputs.get("classification"):
+        props["classification"] = inputs["classification"]
+    if inputs.get("classification_reason"):
+        props["classificationReason"] = inputs["classification_reason"]
+    if inputs.get("assigned_to"):
+        props["owner"] = {"assignedTo": inputs["assigned_to"]}
+
+    body = {"properties": props, "etag": existing.get("etag")}
+    res = request("PUT", "/incidents/" + q(incident_id), body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/update_threat_indicator.py

@@ -0,0 +1,88 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    indicator_name = inputs.get("indicator_name")
+    if not indicator_name:
+        raise Exception("indicator_name is required")
+
+    existing = request("GET", "/threatIntelligence/main/indicators/" + q(indicator_name))
+    props = dict(existing.get("properties", {}))
+
+    if inputs.get("display_name"):
+        props["displayName"] = inputs["display_name"]
+    if inputs.get("confidence") is not None and inputs.get("confidence") != "":
+        props["confidence"] = int(inputs["confidence"])
+    if inputs.get("valid_until"):
+        props["validUntil"] = inputs["valid_until"]
+    if inputs.get("threat_types"):
+        props["threatTypes"] = [t.strip() for t in str(inputs["threat_types"]).split(",") if t.strip()]
+
+    body = {"kind": "indicator", "properties": props, "etag": existing.get("etag")}
+    res = request("PUT", "/threatIntelligence/main/indicators/" + q(indicator_name), body=body)
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/microsoft-sentinel/scripts/upsert_watchlist_item.py

@@ -0,0 +1,83 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+import uuid
+
+API_VERSION = "2023-11-01"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _token():
+    cfg = _cfg()
+    data = urllib.parse.urlencode({
+        "grant_type": "client_credentials",
+        "client_id": str(cfg.get("client_id") or ""),
+        "client_secret": str(cfg.get("client_secret") or ""),
+        "scope": "https://management.azure.com/.default",
+    }).encode("utf-8")
+    url = "https://login.microsoftonline.com/" + str(cfg.get("tenant_id") or "") + "/oauth2/v2.0/token"
+    req = urllib.request.Request(url, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+                                 method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def _si_base():
+    cfg = _cfg()
+    for key in ("subscription_id", "resource_group", "workspace_name"):
+        if not str(cfg.get(key) or ""):
+            raise Exception(key + " is not set")
+    return ("https://management.azure.com/subscriptions/" + str(cfg["subscription_id"])
+            + "/resourceGroups/" + str(cfg["resource_group"])
+            + "/providers/Microsoft.OperationalInsights/workspaces/" + str(cfg["workspace_name"])
+            + "/providers/Microsoft.SecurityInsights")
+
+
+def request(method, path, params=None, body=None, token=None):
+    url = _si_base() + path
+    q = {k: str(x) for k, x in (params or {}).items() if x not in (None, "")}
+    q["api-version"] = API_VERSION
+    url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + (token or _token())}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main():
+    inputs = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+    watchlist_alias = inputs.get("watchlist_alias")
+    item_json = inputs.get("item_json")
+    if not watchlist_alias:
+        raise Exception("watchlist_alias is required")
+    if not item_json:
+        raise Exception("item_json is required")
+    item = json.loads(item_json)
+    if not isinstance(item, dict):
+        raise Exception("item_json must be a JSON object")
+    item_id = inputs.get("item_id") or str(uuid.uuid4())
+    res = request("PUT", "/watchlists/" + q(watchlist_alias) + "/watchlistItems/" + q(item_id),
+                  body={"properties": {"itemsKeyValue": item}})
+    print(json.dumps(res))
+
+
+try:
+    main()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)