feat(trend-vision-one): new Trend Vision One XDR integration

Vision One API v3.0, 9 commands: list endpoints, isolate/restore endpoint
(containment), terminate process, list/get Workbench alerts, add/remove
suspicious object (block hash/URL/IP/domain). Bearer-token auth, stdlib-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integrations/carbon-black-cloud/manifest.yaml

@@ -0,0 +1,121 @@
+id: carbon_black_cloud
+name: VMware Carbon Black Cloud
+version: 1.0.0
+description: "VMware Carbon Black Cloud (Platform API) — endpoint containment: search and read devices, quarantine/unquarantine an endpoint, trigger a background scan, update a device's policy, search alerts, and ban/unban a file hash (reputation override). API-token authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: device search/get, quarantine/unquarantine, background scan, update policy, alert search, ban hash, delete reputation override."
+category: endpoint
+
+# Per-instance configuration. The API token is sent as
+# 'X-Auth-Token: <api_secret_key>/<api_id>'. org_key identifies the org.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Carbon Black Cloud URL (e.g. https://defense.conferdeploy.net)"
+    api_id:
+      type: string
+      description: "API key ID"
+    api_secret_key:
+      type: string
+      description: "API secret key"
+      x-soar-sensitive: true
+    org_key:
+      type: string
+      description: "Organization key"
+  required:
+    - base_url
+    - api_id
+    - api_secret_key
+    - org_key
+
+commands:
+  - id: list_devices
+    name: cbc-list-devices
+    description: "Search devices (optionally by hostname or IP)."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Free-text query (hostname, user, IP)" }
+        rows: { type: number, description: "Max devices (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_device
+    name: cbc-get-device
+    description: "Get a single device by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        device_id: { type: string, description: "Device ID" }
+      required: [device_id]
+    outputs_schema: { properties: {} }
+  - id: quarantine_device
+    name: cbc-quarantine-device
+    description: "Quarantine (network-isolate) a device."
+    inputs_schema:
+      properties:
+        device_id: { type: string, description: "Device ID" }
+      required: [device_id]
+    outputs_schema: { properties: {} }
+  - id: unquarantine_device
+    name: cbc-unquarantine-device
+    description: "Remove a device from quarantine."
+    inputs_schema:
+      properties:
+        device_id: { type: string, description: "Device ID" }
+      required: [device_id]
+    outputs_schema: { properties: {} }
+  - id: background_scan
+    name: cbc-background-scan
+    description: "Start or stop a background scan on a device."
+    inputs_schema:
+      properties:
+        device_id: { type: string, description: "Device ID" }
+        toggle: { type: string, description: "ON or OFF (default ON)" }
+      required: [device_id]
+    outputs_schema: { properties: {} }
+  - id: update_device_policy
+    name: cbc-update-device-policy
+    description: "Assign a device to a different policy."
+    inputs_schema:
+      properties:
+        device_id: { type: string, description: "Device ID" }
+        policy_id: { type: string, description: "Target policy ID" }
+      required: [device_id, policy_id]
+    outputs_schema: { properties: {} }
+  - id: search_alerts
+    name: cbc-search-alerts
+    description: "Search alerts."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Free-text alert query" }
+        rows: { type: number, description: "Max alerts (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: ban_hash
+    name: cbc-ban-hash
+    description: "Ban a file by SHA-256 hash (reputation deny-list override)."
+    inputs_schema:
+      properties:
+        sha256: { type: string, description: "SHA-256 hash to ban" }
+        filename: { type: string, description: "Optional associated file name" }
+        description: { type: string, description: "Optional reason/description" }
+      required: [sha256]
+    outputs_schema: { properties: {} }
+  - id: delete_reputation_override
+    name: cbc-delete-reputation-override
+    description: "Delete a reputation override (unban) by its ID."
+    inputs_schema:
+      properties:
+        override_id: { type: string, description: "Reputation override ID" }
+      required: [override_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: cbc-test-connection
+    description: "Verify connectivity and the API token (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/carbon-black-cloud/scripts/background_scan.py

@@ -0,0 +1,60 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    device_id = inputs.get("device_id")
+    if not device_id:
+        raise Exception("device_id is required")
+    toggle = inputs.get("toggle")
+    body = {
+        "action_type": "BACKGROUND_SCAN",
+        "device_id": [int(device_id)],
+        "options": {"toggle": (toggle or "ON")},
+    }
+    request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/device_actions", cfg, body=body)
+    return {"ok": True}
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/ban_hash.py

@@ -0,0 +1,62 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    sha256 = inputs.get("sha256")
+    if not sha256:
+        raise Exception("sha256 is required")
+    filename = inputs.get("filename")
+    description = inputs.get("description")
+    body = {
+        "override_list": "BLACK_LIST",
+        "override_type": "SHA256_HASH",
+        "sha256_hash": sha256,
+        "filename": (filename or "unknown"),
+        "description": (description or "Blocked via Riposte"),
+    }
+    return request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/reputations/overrides", cfg, body=body)
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/delete_reputation_override.py

@@ -0,0 +1,57 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    override_id = inputs.get("override_id")
+    if not override_id:
+        raise Exception("override_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    resp = request("DELETE", "/appservices/v6/orgs/" + _org(cfg) + "/reputations/overrides/" + q(override_id), cfg)
+    if not resp:
+        return {"ok": True, "deleted": override_id}
+    return resp
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/get_device.py

@@ -0,0 +1,54 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    device_id = inputs.get("device_id")
+    if not device_id:
+        raise Exception("device_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/appservices/v6/orgs/" + _org(cfg) + "/devices/" + q(device_id), cfg)
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/list_devices.py

@@ -0,0 +1,55 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    query = inputs.get("query")
+    rows = inputs.get("rows")
+    body = {"rows": int(rows or 50)}
+    if query:
+        body["query"] = query
+    return request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/devices/_search", cfg, body=body)
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/quarantine_device.py

@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    device_id = inputs.get("device_id")
+    if not device_id:
+        raise Exception("device_id is required")
+    body = {
+        "action_type": "QUARANTINE",
+        "device_id": [int(device_id)],
+        "options": {"toggle": "ON"},
+    }
+    resp = request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/device_actions", cfg, body=body)
+    if not resp:
+        return {"ok": True, "device_id": device_id, "action": "quarantine"}
+    return resp
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/search_alerts.py

@@ -0,0 +1,55 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    query = inputs.get("query")
+    rows = inputs.get("rows")
+    body = {"rows": int(rows or 50)}
+    if query:
+        body["query"] = query
+    return request("POST", "/api/alerts/v7/orgs/" + _org(cfg) + "/alerts/_search", cfg, body=body)
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/test_connection.py

@@ -0,0 +1,51 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/devices/_search", cfg, body={"rows": 1})
+    return {"ok": True}
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/unquarantine_device.py

@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    device_id = inputs.get("device_id")
+    if not device_id:
+        raise Exception("device_id is required")
+    body = {
+        "action_type": "QUARANTINE",
+        "device_id": [int(device_id)],
+        "options": {"toggle": "OFF"},
+    }
+    resp = request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/device_actions", cfg, body=body)
+    if not resp:
+        return {"ok": True, "device_id": device_id, "action": "unquarantine"}
+    return resp
+
+
+_run(main)

integrations/carbon-black-cloud/scripts/update_device_policy.py

@@ -0,0 +1,62 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _org(cfg):
+    return str(cfg.get("org_key", ""))
+
+
+def request(method, path, cfg, body=None, params=None):
+    url = str(cfg.get("base_url", "")).rstrip("/") + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "X-Auth-Token": str(cfg.get("api_secret_key", "")) + "/" + str(cfg.get("api_id", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    device_id = inputs.get("device_id")
+    if not device_id:
+        raise Exception("device_id is required")
+    policy_id = inputs.get("policy_id")
+    if not policy_id:
+        raise Exception("policy_id is required")
+    body = {
+        "action_type": "UPDATE_POLICY",
+        "device_id": [int(device_id)],
+        "options": {"policy_id": int(policy_id)},
+    }
+    request("POST", "/appservices/v6/orgs/" + _org(cfg) + "/device_actions", cfg, body=body)
+    return {"ok": True}
+
+
+_run(main)

integrations/cybereason/manifest.yaml

@@ -0,0 +1,95 @@
+id: cybereason
+name: Cybereason
+version: 1.0.0
+description: "Cybereason EDR — endpoint containment and investigation: query Malops, list sensors, isolate/un-isolate a machine (containment), block a file hash, and read machine details. Session (login) authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: query Malops, list sensors, isolate/un-isolate machine, block file, get machine details."
+category: endpoint
+
+# Per-instance configuration. Each command logs in (form POST to /login.html,
+# reusing the returned session cookie) then performs the action.
+config_schema:
+  properties:
+    server_url:
+      type: string
+      description: "Cybereason server URL (e.g. https://your-tenant.cybereason.net:443)"
+    username:
+      type: string
+      description: "Cybereason username"
+    password:
+      type: string
+      description: "Cybereason password"
+      x-soar-sensitive: true
+    insecure:
+      type: boolean
+      description: "Trust any TLS certificate (not secure)"
+      default: false
+  required:
+    - server_url
+    - username
+    - password
+
+commands:
+  - id: query_malops
+    name: cybereason-query-malops
+    description: "Query Malops (malicious operations) in a time window."
+    risk: read
+    inputs_schema:
+      properties:
+        start_time: { type: number, description: "Start time as Unix epoch milliseconds" }
+        end_time: { type: number, description: "End time as Unix epoch milliseconds" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: list_sensors
+    name: cybereason-list-sensors
+    description: "List sensors (endpoints)."
+    risk: read
+    inputs_schema:
+      properties:
+        limit: { type: number, description: "Max sensors (default 100)" }
+        offset: { type: number, description: "Offset (default 0)" }
+        filter_field: { type: string, description: "Optional field to filter on (e.g. machineName)" }
+        filter_value: { type: string, description: "Value for the filter field (equals match)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_machine_details
+    name: cybereason-get-machine-details
+    description: "Get details for a sensor/machine by its sensor ID."
+    risk: read
+    inputs_schema:
+      properties:
+        sensor_id: { type: string, description: "Sensor ID" }
+      required: [sensor_id]
+    outputs_schema: { properties: {} }
+  - id: isolate_machine
+    name: cybereason-isolate-machine
+    description: "Isolate one or more machines from the network (containment)."
+    inputs_schema:
+      properties:
+        sensor_ids: { type: string, description: "Comma-separated sensor IDs to isolate" }
+      required: [sensor_ids]
+    outputs_schema: { properties: {} }
+  - id: unisolate_machine
+    name: cybereason-unisolate-machine
+    description: "Remove one or more machines from isolation."
+    inputs_schema:
+      properties:
+        sensor_ids: { type: string, description: "Comma-separated sensor IDs to un-isolate" }
+      required: [sensor_ids]
+    outputs_schema: { properties: {} }
+  - id: block_file
+    name: cybereason-block-file
+    description: "Block a file by hash (add to the block list)."
+    inputs_schema:
+      properties:
+        md5: { type: string, description: "MD5 hash of the file to block" }
+      required: [md5]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: cybereason-test-connection
+    description: "Verify connectivity and credentials by logging in (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/cybereason/scripts/block_file.py

@@ -0,0 +1,89 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    md5 = inputs.get("md5")
+    if not md5:
+        raise Exception("md5 is required")
+
+    body = [{
+        "keys": [{"dataType": "MD5", "value": md5}],
+        "maliciousType": "blacklist",
+        "remove": False,
+        "prventExecution": True,
+    }]
+
+    resp = client.call("POST", "/rest/classification/update", body)
+    if not resp:
+        return {"ok": True, "blocked": md5}
+    return resp
+
+
+_run(main)

integrations/cybereason/scripts/get_machine_details.py

@@ -0,0 +1,85 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    sensor_id = inputs.get("sensor_id")
+    if not sensor_id:
+        raise Exception("sensor_id is required")
+
+    body = {
+        "limit": 1,
+        "offset": 0,
+        "filters": [{"fieldName": "sensorId", "operator": "Equals", "values": [sensor_id]}],
+    }
+
+    return client.call("POST", "/rest/sensors/query", body)
+
+
+_run(main)

integrations/cybereason/scripts/isolate_machine.py

@@ -0,0 +1,86 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    sensor_ids = inputs.get("sensor_ids")
+    if not sensor_ids:
+        raise Exception("sensor_ids is required")
+
+    sensor_ids_list = [s.strip() for s in str(sensor_ids).split(",") if s.strip()]
+    if not sensor_ids_list:
+        raise Exception("sensor_ids is required")
+
+    resp = client.call("POST", "/rest/sensors/actions/isolate", {"sensorsIds": sensor_ids_list})
+    if not resp:
+        return {"ok": True, "isolated": sensor_ids_list}
+    return resp
+
+
+_run(main)

integrations/cybereason/scripts/list_sensors.py

@@ -0,0 +1,90 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    limit = inputs.get("limit")
+    offset = inputs.get("offset")
+    filter_field = inputs.get("filter_field")
+    filter_value = inputs.get("filter_value")
+
+    filters = []
+    if filter_field not in (None, "") and filter_value not in (None, ""):
+        filters = [{"fieldName": filter_field, "operator": "Equals", "values": [filter_value]}]
+
+    body = {
+        "limit": int(limit) if limit not in (None, "") else 100,
+        "offset": int(offset) if offset not in (None, "") else 0,
+        "filters": filters,
+    }
+
+    return client.call("POST", "/rest/sensors/query", body)
+
+
+_run(main)

integrations/cybereason/scripts/query_malops.py

@@ -0,0 +1,84 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    start_time = inputs.get("start_time")
+    end_time = inputs.get("end_time")
+
+    body = {}
+    if start_time not in (None, ""):
+        body["startTime"] = int(start_time)
+    if end_time not in (None, ""):
+        body["endTime"] = int(end_time)
+
+    return client.call("POST", "/rest/detection/inbox", body)
+
+
+_run(main)

integrations/cybereason/scripts/test_connection.py

@@ -0,0 +1,76 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    client.call("POST", "/rest/sensors/query", {"limit": 1, "offset": 0, "filters": []})
+    return {"ok": True}
+
+
+_run(main)

integrations/cybereason/scripts/unisolate_machine.py

@@ -0,0 +1,86 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error, http.cookiejar, ssl
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _ctx(cfg):
+    if cfg.get("insecure"):
+        c = ssl.create_default_context()
+        c.check_hostname = False
+        c.verify_mode = ssl.CERT_NONE
+        return c
+    return None
+
+
+class Client:
+    def __init__(self, cfg):
+        self.cfg = cfg
+        self.base = str(cfg.get("server_url", "")).rstrip("/")
+        ctx = _ctx(cfg)
+        self.opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),
+            urllib.request.HTTPSHandler(context=ctx) if ctx else urllib.request.HTTPSHandler(),
+        )
+
+    def login(self):
+        form = urllib.parse.urlencode({
+            "username": self.cfg.get("username", ""),
+            "password": self.cfg.get("password", ""),
+        }).encode("utf-8")
+        req = urllib.request.Request(self.base + "/login.html", data=form,
+                                     headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+        with self.opener.open(req, timeout=60) as r:
+            r.read()
+
+    def call(self, method, path, body=None):
+        url = self.base + path
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        headers = {"Accept": "application/json"}
+        if data is not None:
+            headers["Content-Type"] = "application/json"
+        req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        with self.opener.open(req, timeout=90) as r:
+            raw = r.read()
+            try:
+                return json.loads(raw) if raw else {}
+            except Exception:
+                return {"raw": raw.decode("utf-8", "replace")}
+
+
+def _run(fn):
+    try:
+        cfg = _cfg()
+        inputs = _inputs()
+        client = Client(cfg)
+        client.login()
+        print(json.dumps(fn(client, inputs)))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(client, inputs):
+    sensor_ids = inputs.get("sensor_ids")
+    if not sensor_ids:
+        raise Exception("sensor_ids is required")
+
+    sensor_ids_list = [s.strip() for s in str(sensor_ids).split(",") if s.strip()]
+    if not sensor_ids_list:
+        raise Exception("sensor_ids is required")
+
+    resp = client.call("POST", "/rest/sensors/actions/unisolate", {"sensorsIds": sensor_ids_list})
+    if not resp:
+        return {"ok": True, "unisolated": sensor_ids_list}
+    return resp
+
+
+_run(main)

integrations/trend-vision-one/manifest.yaml

@@ -0,0 +1,112 @@
+id: trend_vision_one
+name: Trend Vision One
+version: 1.0.0
+description: "Trend Micro Vision One (XDR, API v3.0) — endpoint containment and threat response: list endpoints, isolate/restore an endpoint, terminate a process, list and read Workbench alerts, and add/remove suspicious objects (block hash/URL/IP/domain). Bearer-token authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: list endpoints, isolate/restore endpoint, terminate process, list/get Workbench alerts, add/remove suspicious object."
+category: endpoint
+
+# Per-instance configuration. The API token is sent as 'Authorization: Bearer <api_token>'.
+# base_url is the regional Vision One API host.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Vision One API base URL (e.g. https://api.xdr.trendmicro.com or a regional host)"
+      default: "https://api.xdr.trendmicro.com"
+    api_token:
+      type: string
+      description: "Vision One API token"
+      x-soar-sensitive: true
+  required:
+    - api_token
+
+commands:
+  - id: list_endpoints
+    name: tmv1-list-endpoints
+    description: "List endpoints from the endpoint inventory."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Optional filter, e.g. endpointName eq 'host01' (TMV1 query syntax)" }
+        top: { type: number, description: "Max endpoints (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: isolate_endpoint
+    name: tmv1-isolate-endpoint
+    description: "Isolate an endpoint from the network (containment)."
+    inputs_schema:
+      properties:
+        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
+        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
+        description: { type: string, description: "Optional reason" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: restore_endpoint
+    name: tmv1-restore-endpoint
+    description: "Restore (un-isolate) an endpoint's network connection."
+    inputs_schema:
+      properties:
+        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
+        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
+        description: { type: string, description: "Optional reason" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: terminate_process
+    name: tmv1-terminate-process
+    description: "Terminate a process on an endpoint by file SHA-1."
+    inputs_schema:
+      properties:
+        endpoint_name: { type: string, description: "Endpoint hostname (provide this or agent_guid)" }
+        agent_guid: { type: string, description: "Agent GUID (provide this or endpoint_name)" }
+        file_sha1: { type: string, description: "SHA-1 of the process image to terminate" }
+        description: { type: string, description: "Optional reason" }
+      required: [file_sha1]
+    outputs_schema: { properties: {} }
+  - id: list_alerts
+    name: tmv1-list-alerts
+    description: "List Workbench alerts in a time window."
+    risk: read
+    inputs_schema:
+      properties:
+        start_datetime: { type: string, description: "ISO-8601 start (e.g. 2024-01-01T00:00:00Z)" }
+        end_datetime: { type: string, description: "ISO-8601 end" }
+        top: { type: number, description: "Max alerts (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_alert
+    name: tmv1-get-alert
+    description: "Get a single Workbench alert by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        alert_id: { type: string, description: "Workbench alert ID" }
+      required: [alert_id]
+    outputs_schema: { properties: {} }
+  - id: add_to_block_list
+    name: tmv1-add-to-block-list
+    description: "Add a suspicious object (file SHA-1, URL, IP, domain, or sender) to the block list."
+    inputs_schema:
+      properties:
+        object_type: { type: string, description: "One of: fileSha1, url, ip, domain, senderMailAddress" }
+        object_value: { type: string, description: "The value to block" }
+        description: { type: string, description: "Optional reason" }
+      required: [object_type, object_value]
+    outputs_schema: { properties: {} }
+  - id: remove_from_block_list
+    name: tmv1-remove-from-block-list
+    description: "Remove a suspicious object from the block list."
+    inputs_schema:
+      properties:
+        object_type: { type: string, description: "One of: fileSha1, url, ip, domain, senderMailAddress" }
+        object_value: { type: string, description: "The value to remove" }
+      required: [object_type, object_value]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: tmv1-test-connection
+    description: "Verify connectivity and the API token (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/trend-vision-one/scripts/add_to_block_list.py

@@ -0,0 +1,64 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+_VALID_OBJECT_TYPES = {"fileSha1", "url", "ip", "domain", "senderMailAddress"}
+
+
+def main(cfg, inputs):
+    object_type = inputs.get("object_type")
+    object_value = inputs.get("object_value")
+    description = inputs.get("description")
+    if not object_type:
+        raise Exception("object_type is required")
+    if not object_value:
+        raise Exception("object_value is required")
+    if object_type not in _VALID_OBJECT_TYPES:
+        raise Exception(
+            "object_type must be one of: " + ", ".join(sorted(_VALID_OBJECT_TYPES))
+        )
+    entry = {object_type: object_value, "description": description or "Added via Riposte"}
+    return request("POST", "/v3.0/threatintel/suspiciousObjects", cfg, body=[entry])
+
+
+_run(main)

integrations/trend-vision-one/scripts/get_alert.py

@@ -0,0 +1,55 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main(cfg, inputs):
+    alert_id = inputs.get("alert_id")
+    if not alert_id:
+        raise Exception("alert_id is required")
+    return request("GET", "/v3.0/workbench/alerts/" + q(alert_id), cfg)
+
+
+_run(main)

integrations/trend-vision-one/scripts/isolate_endpoint.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def _target(inputs):
+    t = {}
+    if inputs.get("endpoint_name"):
+        t["endpointName"] = inputs["endpoint_name"]
+    elif inputs.get("agent_guid"):
+        t["agentGuid"] = inputs["agent_guid"]
+    else:
+        raise Exception("endpoint_name or agent_guid is required")
+    if inputs.get("description"):
+        t["description"] = inputs["description"]
+    return t
+
+
+def main(cfg, inputs):
+    target = _target(inputs)
+    return request("POST", "/v3.0/response/endpoints/isolate", cfg, body=[target])
+
+
+_run(main)

integrations/trend-vision-one/scripts/list_alerts.py

@@ -0,0 +1,57 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    start_datetime = inputs.get("start_datetime")
+    end_datetime = inputs.get("end_datetime")
+    top = inputs.get("top")
+    params = {
+        "startDateTime": start_datetime,
+        "endDateTime": end_datetime,
+        "top": int(top or 50),
+    }
+    return request("GET", "/v3.0/workbench/alerts", cfg, params=params)
+
+
+_run(main)

integrations/trend-vision-one/scripts/list_endpoints.py

@@ -0,0 +1,55 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    query = inputs.get("query")
+    top = inputs.get("top")
+    params = {"top": int(top or 50)}
+    extra_headers = None
+    if query:
+        extra_headers = {"TMV1-Filter": query}
+    return request("GET", "/v3.0/eiqs/endpoints", cfg, params=params, extra_headers=extra_headers)
+
+
+_run(main)

integrations/trend-vision-one/scripts/remove_from_block_list.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+_VALID_OBJECT_TYPES = {"fileSha1", "url", "ip", "domain", "senderMailAddress"}
+
+
+def main(cfg, inputs):
+    object_type = inputs.get("object_type")
+    object_value = inputs.get("object_value")
+    if not object_type:
+        raise Exception("object_type is required")
+    if not object_value:
+        raise Exception("object_value is required")
+    if object_type not in _VALID_OBJECT_TYPES:
+        raise Exception(
+            "object_type must be one of: " + ", ".join(sorted(_VALID_OBJECT_TYPES))
+        )
+    entry = {object_type: object_value}
+    return request("POST", "/v3.0/threatintel/suspiciousObjects/delete", cfg, body=[entry])
+
+
+_run(main)

integrations/trend-vision-one/scripts/restore_endpoint.py

@@ -0,0 +1,63 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def _target(inputs):
+    t = {}
+    if inputs.get("endpoint_name"):
+        t["endpointName"] = inputs["endpoint_name"]
+    elif inputs.get("agent_guid"):
+        t["agentGuid"] = inputs["agent_guid"]
+    else:
+        raise Exception("endpoint_name or agent_guid is required")
+    if inputs.get("description"):
+        t["description"] = inputs["description"]
+    return t
+
+
+def main(cfg, inputs):
+    target = _target(inputs)
+    return request("POST", "/v3.0/response/endpoints/restore", cfg, body=[target])
+
+
+_run(main)

integrations/trend-vision-one/scripts/terminate_process.py

@@ -0,0 +1,67 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def _target(inputs):
+    t = {}
+    if inputs.get("endpoint_name"):
+        t["endpointName"] = inputs["endpoint_name"]
+    elif inputs.get("agent_guid"):
+        t["agentGuid"] = inputs["agent_guid"]
+    else:
+        raise Exception("endpoint_name or agent_guid is required")
+    if inputs.get("description"):
+        t["description"] = inputs["description"]
+    return t
+
+
+def main(cfg, inputs):
+    file_sha1 = inputs.get("file_sha1")
+    if not file_sha1:
+        raise Exception("file_sha1 is required")
+    target = _target(inputs)
+    target["fileSha1"] = file_sha1
+    return request("POST", "/v3.0/response/endpoints/terminateProcess", cfg, body=[target])
+
+
+_run(main)

integrations/trend-vision-one/scripts/test_connection.py

@@ -0,0 +1,50 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _base(cfg):
+    return (str(cfg.get("base_url") or "https://api.xdr.trendmicro.com")).rstrip("/")
+
+
+def request(method, path, cfg, body=None, params=None, extra_headers=None):
+    url = _base(cfg) + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Authorization": "Bearer " + str(cfg.get("api_token", "")), "Accept": "application/json"}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if extra_headers:
+        headers.update(extra_headers)
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    request("GET", "/v3.0/eiqs/endpoints", cfg, params={"top": 1})
+    return {"ok": True}
+
+
+_run(main)