-
bf273b959a
feat(cortex-xdr): watermark incidents on modification_time, not creation
main
f3nris
2026-08-18 23:50:24 +02:00
-
ba68d19e51
refactor(cortex-xdr): name the full fetch get-incidents-full (v1.3.1)
f3nris
2026-08-18 23:47:17 +02:00
-
a6e1245c79
feat(cortex-xdr): fetch incidents with their alerts, not a 21-field summary
f3nris
2026-08-18 23:41:27 +02:00
-
d06f8ea413
fix(cortex-xdr): the alerts endpoint never answered — wrong request dialect
f3nris
2026-08-18 23:34:26 +02:00
-
17318d4225
feat(cortex-xdr): ingest alerts, not only incidents (v1.3.0)
f3nris
2026-08-18 23:26:31 +02:00
-
c22982c8af
chore: retire the Riposte Sextant integration
f3nris
2026-08-17 09:02:43 +02:00
-
1d475a6cf5
fix(sentinelone): count-agents can be asked about the whole fleet again
f3nris
2026-08-14 23:48:40 +02:00
-
93309ac74d
feat(sentinelone): count-agents can be scoped to an account
f3nris
2026-08-14 23:40:13 +02:00
-
a5095d3f0f
feat(sentinelone): count-agents can tell the active fleet from the dormant one
f3nris
2026-08-14 23:30:47 +02:00
-
cebb3af796
feat(sentinelone): count-agents can ask about versions, state and hardware
f3nris
2026-08-14 22:36:32 +02:00
-
ba6bcd19f4
fix(cortex-xdr): say what went wrong when the API answers something other than JSON (v1.2.1)
f3nris
2026-08-13 14:35:54 +02:00
-
aabe1a6837
feat(riposte-sextant): list the clients, and the identifier to deposit under (v1.1.0)
f3nris
2026-08-11 09:04:30 +02:00
-
50358ef8a1
feat(riposte-sextant): push agent readings into the SOC steering file
f3nris
2026-08-11 08:46:10 +02:00
-
82f22fdbb3
feat(harfanglab): split image_name into the process path and the threat name (v1.4.1)
f3nris
2026-08-06 18:15:44 +02:00
-
f7c5e99cc5
feat(harfanglab): map the fields the alert and threat payloads actually carry (v1.4.0)
f3nris
2026-08-06 17:30:01 +02:00
-
6343a0c952
feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)
f3nris
2026-08-05 21:01:43 +02:00
-
7efc873867
feat(sentinelone): scope threat and alert fetches to given accounts (v1.4.0)
Guillaume BOURGEOIS
2026-08-04 15:56:47 +02:00
-
144089a099
fix(harfanglab): flag get_alerts as ingestion-ready (v1.3.1)
f3nris
2026-07-21 23:19:58 +02:00
-
a4b5b44157
fix(harfanglab): null guards and stable attacks array in get_threats mapper
f3nris
2026-07-21 22:52:11 +02:00
-
4ea3af6c1d
fix(harfanglab): rework get_threats OCSF mapper from live threat sample
f3nris
2026-07-21 22:49:31 +02:00
-
952dc7efda
feat(harfanglab): v1.3.0 — response & triage expansion (27 commands + alert mappers)
f3nris
2026-07-21 22:33:59 +02:00
-
cba746a9f9
feat(harfanglab): exhaustive alert OCSF mappers (get_alerts + upgraded get_security_events)
f3nris
2026-07-21 22:26:19 +02:00
-
5d6f823189
feat(harfanglab): threat triage commands (status, level, comment, note, history)
f3nris
2026-07-21 22:20:54 +02:00
-
098b90d6f3
feat(harfanglab): alert triage commands (tag, comment, details, history)
f3nris
2026-07-21 22:18:01 +02:00
-
db902c35bc
feat(harfanglab): alert search and single-threat read commands
f3nris
2026-07-21 22:14:25 +02:00
-
59e9211c0d
feat(harfanglab): threat-level isolation and job lifecycle commands
f3nris
2026-07-21 22:09:56 +02:00
-
fcbd2ff135
feat(harfanglab): quarantine management commands
f3nris
2026-07-21 22:04:47 +02:00
-
ef60cec0fa
feat(harfanglab): file/service/scheduled-task deletion commands
f3nris
2026-07-21 22:01:22 +02:00
-
6d993f584f
feat(harfanglab): on-demand AV and YARA scan commands
f3nris
2026-07-21 21:57:37 +02:00
-
6d311740f9
feat(harfanglab): kill/dump process response commands
f3nris
2026-07-21 21:52:39 +02:00
-
f6b8c84285
feat(edr): OCSF mappers + ingestion for 6 EDR integrations
f3nris
2026-07-15 22:37:07 +02:00
-
5ee7352652
fix(ransomware-live): keyless — drop optional API key, no auth required
f3nris
2026-07-15 19:18:49 +02:00
-
534748f16a
feat(ransomware-live): add Ransomware.live OSINT integration
f3nris
2026-07-15 18:56:50 +02:00
-
a2c9f998c3
feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)
Guillaume BOURGEOIS
2026-07-13 12:15:50 +02:00
-
ae7c494658
feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)
Guillaume BOURGEOIS
2026-07-13 12:15:50 +02:00
-
40252dadcb
feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)
Guillaume BOURGEOIS
2026-07-13 12:15:49 +02:00
-
ac2203f9a5
feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)
Guillaume BOURGEOIS
2026-07-13 12:12:35 +02:00
-
8248c60da8
feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)
Guillaume BOURGEOIS
2026-07-13 12:12:34 +02:00
-
4206b44e78
feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)
Guillaume BOURGEOIS
2026-07-13 12:12:34 +02:00
-
9cffefbb36
feat(feed): add GCP IP ranges feed connector (allowlist / known infra)
Guillaume BOURGEOIS
2026-07-13 12:08:49 +02:00
-
f7791402a3
feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)
Guillaume BOURGEOIS
2026-07-13 12:08:49 +02:00
-
c42a9cef03
feat(feed): add AWS IP ranges feed connector (allowlist / known infra)
Guillaume BOURGEOIS
2026-07-13 12:08:48 +02:00
-
f6ff018f09
feat(feed): add OpenPhish feed connector (community phishing URLs)
Guillaume BOURGEOIS
2026-07-12 23:02:11 +02:00
-
c091800434
feat(feed): add Emerging Threats feed connector (ET Open reputation lists)
Guillaume BOURGEOIS
2026-07-12 23:02:11 +02:00
-
929b4166d6
feat(feed): add generic JSON feed connector (configurable field mapping)
Guillaume BOURGEOIS
2026-07-12 23:02:10 +02:00
-
381b42b6c7
feat(feed): add CINS Army feed connector (CI Army bad-guys list)
Guillaume BOURGEOIS
2026-07-12 22:59:20 +02:00
-
5715f21603
feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)
Guillaume BOURGEOIS
2026-07-12 22:59:19 +02:00
-
7543a95711
feat(feed): add DShield block list feed connector (SANS ISC)
Guillaume BOURGEOIS
2026-07-12 22:59:18 +02:00
-
7187e7b607
feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)
Guillaume BOURGEOIS
2026-07-12 22:56:36 +02:00
-
5bb465eb18
feat(feed): add ThreatFox feed connector (abuse.ch IOC export)
Guillaume BOURGEOIS
2026-07-12 22:56:36 +02:00
-
a4dcd00cc7
feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)
Guillaume BOURGEOIS
2026-07-12 22:56:35 +02:00
-
cf923301a7
feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)
Guillaume BOURGEOIS
2026-07-12 22:49:30 +02:00
-
f833bfe3a5
feat(feed): add Tor exit nodes feed connector
Guillaume BOURGEOIS
2026-07-12 22:49:29 +02:00
-
d6129f5d79
feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)
Guillaume BOURGEOIS
2026-07-12 22:49:28 +02:00
-
c779c38dab
feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector
Guillaume BOURGEOIS
2026-07-12 22:43:17 +02:00
-
4f94b59e17
feat(feed-plaintext): new generic plain-text threat-intel feed connector
Guillaume BOURGEOIS
2026-07-12 22:43:17 +02:00
-
f09d00114f
feat(feed-csv): new generic CSV threat-intel feed connector
Guillaume BOURGEOIS
2026-07-12 22:43:16 +02:00
-
a4241a5a5d
feat(cisco-ise): new Cisco ISE NAC integration
Guillaume BOURGEOIS
2026-07-12 21:59:07 +02:00
-
232e310f77
feat(automox): new Automox patch-management integration
Guillaume BOURGEOIS
2026-07-12 21:59:06 +02:00
-
b231b648bc
feat(domaintools): new DomainTools DNS-intel integration
Guillaume BOURGEOIS
2026-07-12 21:59:05 +02:00
-
087b9abd19
feat(thinkst-canary): new Thinkst Canary deception integration
Guillaume BOURGEOIS
2026-07-12 21:53:59 +02:00
-
e91febd319
feat(intune): new Microsoft Intune MDM integration
Guillaume BOURGEOIS
2026-07-12 21:53:59 +02:00
-
374e4184ff
feat(meraki): new Cisco Meraki network integration
Guillaume BOURGEOIS
2026-07-12 21:53:58 +02:00
-
82353947d6
feat(mailinblack): new Mailinblack email-security integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 21:37:32 +02:00
-
ac47315b30
feat(cybelangel): new CybelAngel attack-surface integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 21:37:31 +02:00
-
631292fcc7
feat(scaleway): new Scaleway cloud integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 21:37:31 +02:00
-
d8bb41b4c5
feat(vade): new Vade email-security integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 21:13:24 +02:00
-
855f1b132c
feat(ovhcloud): new OVHcloud integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 21:13:23 +02:00
-
74bf6126fb
feat(efficientip): new EfficientIP SOLIDserver DNS/DDI integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 21:13:22 +02:00
-
dd574e550b
feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 16:12:38 +02:00
-
8a7e5a33a2
feat(tehtris): new TEHTRIS XDR integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 16:12:37 +02:00
-
3c348b7601
feat(glimps): new GLIMPS Detect malware-analysis integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 16:12:37 +02:00
-
2475c4b56e
feat(stormshield): new Stormshield SNS firewall integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 16:07:38 +02:00
-
3be14f2f00
feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 16:07:38 +02:00
-
3a4d06441c
feat(crowdsec): new CrowdSec CTI integration (French vendor)
Guillaume BOURGEOIS
2026-07-12 16:07:37 +02:00
-
ce319c2fea
feat(intel471): new Intel 471 threat-intel integration
Guillaume BOURGEOIS
2026-07-12 15:49:17 +02:00
-
8f3d9607df
feat(threatq): new ThreatQ threat-intel integration
Guillaume BOURGEOIS
2026-07-12 15:49:17 +02:00
-
a2f2b8efa0
feat(eclecticiq): new EclecticIQ threat-intel integration
Guillaume BOURGEOIS
2026-07-12 15:49:16 +02:00
-
3c282e8e53
feat(signalsciences): new Signal Sciences (Fastly NGWAF) integration
Guillaume BOURGEOIS
2026-07-12 15:44:30 +02:00
-
771c90ef0d
feat(imperva): new Imperva Cloud WAF integration
Guillaume BOURGEOIS
2026-07-12 15:44:29 +02:00
-
9fb5b65e4a
feat(f5-bigip): new F5 BIG-IP integration
Guillaume BOURGEOIS
2026-07-12 15:44:28 +02:00
-
16fe51ee99
feat(sailpoint): new SailPoint IdentityNow IGA integration
Guillaume BOURGEOIS
2026-07-12 15:39:19 +02:00
-
5089e4466d
feat(beyondtrust-password-safe): new BeyondTrust Password Safe PAM integration
Guillaume BOURGEOIS
2026-07-12 15:39:18 +02:00
-
8fa1ade945
feat(delinea-secret-server): new Delinea Secret Server PAM integration
Guillaume BOURGEOIS
2026-07-12 15:39:18 +02:00
-
54b077bfc9
feat(confluence): new Confluence runbook/knowledge integration
Guillaume BOURGEOIS
2026-07-12 15:23:56 +02:00
-
6d38896892
feat(dropbox): new Dropbox file/evidence integration
Guillaume BOURGEOIS
2026-07-12 15:23:56 +02:00
-
223dfd34e3
feat(box): new Box file/evidence integration
Guillaume BOURGEOIS
2026-07-12 15:23:56 +02:00
-
83c1736d47
feat(snyk): new Snyk appsec-posture integration
Guillaume BOURGEOIS
2026-07-12 15:18:48 +02:00
-
bc100eef67
feat(gitlab): new GitLab project-security integration
Guillaume BOURGEOIS
2026-07-12 15:18:48 +02:00
-
5f2e946c0a
feat(github): new GitHub code-security integration
Guillaume BOURGEOIS
2026-07-12 15:18:47 +02:00
-
86fdd8483a
feat(pingone): new PingOne identity-containment integration
Guillaume BOURGEOIS
2026-07-12 15:14:01 +02:00
-
cd02c26b45
feat(jumpcloud): new JumpCloud identity integration
Guillaume BOURGEOIS
2026-07-12 15:14:01 +02:00
-
ab68b3ae71
feat(onelogin): new OneLogin identity-containment integration
Guillaume BOURGEOIS
2026-07-12 15:14:00 +02:00
-
046fb79008
feat(datadog): new Datadog observability integration
Guillaume BOURGEOIS
2026-07-12 15:08:51 +02:00
-
6548740890
feat(sumologic): new Sumo Logic log-search integration
Guillaume BOURGEOIS
2026-07-12 15:08:51 +02:00
-
16deec38f8
feat(graylog): new Graylog log-search integration
Guillaume BOURGEOIS
2026-07-12 15:08:50 +02:00
-
cf950cf6e4
feat(withsecure): new WithSecure Elements endpoint integration
Guillaume BOURGEOIS
2026-07-12 15:04:02 +02:00
-
1949c98cf7
feat(sophos-central): new Sophos Central endpoint integration
Guillaume BOURGEOIS
2026-07-12 15:04:02 +02:00
-
addaeadae5
feat(cisco-secure-endpoint): new Cisco Secure Endpoint (AMP) integration
Guillaume BOURGEOIS
2026-07-12 15:04:01 +02:00
-
b137e49be4
feat(yaraify): new YARAify file/YARA-intel integration
Guillaume BOURGEOIS
2026-07-12 14:58:08 +02:00