Guillaume BOURGEOIS
a2f2b8efa0
EclecticIQ Intelligence Center API v2, 4 commands: search entities/observables, get entity. Bearer-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
id: eclecticiq
|
|
name: EclecticIQ
|
|
version: 1.0.0
|
|
description: "EclecticIQ Intelligence Center (API v2) — threat intelligence: search entities and observables, and read an entity by ID. Bearer-token authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: search entities, get entity, search observables."
|
|
category: threat_intel
|
|
|
|
# Per-instance configuration. Auth header 'Authorization: Bearer <api_token>'.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Intelligence Center URL (e.g. https://eiq.example.com)"
|
|
api_token:
|
|
type: string
|
|
description: "API token"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- base_url
|
|
- api_token
|
|
|
|
commands:
|
|
- id: search_entities
|
|
name: eclecticiq-search-entities
|
|
description: "Search entities (indicators, reports, TTPs, ...) by text."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
query: { type: string, description: "Text to match in entity data" }
|
|
limit: { type: number, description: "Max entities (default 25)" }
|
|
required: [query]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_entity
|
|
name: eclecticiq-get-entity
|
|
description: "Get a single entity by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
entity_id: { type: string, description: "Entity ID" }
|
|
required: [entity_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: search_observables
|
|
name: eclecticiq-search-observables
|
|
description: "Search observables by value (IP, domain, hash, ...)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
value: { type: string, description: "Observable value" }
|
|
limit: { type: number, description: "Max observables (default 25)" }
|
|
required: [value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: eclecticiq-test-connection
|
|
description: "Verify the API token (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|