Guillaume BOURGEOIS
5bf679cfe0
Symantec DLP Enforce REST API v2, 5 commands: list/get incidents, get incident history, update incident (status/severity). OAuth2 password-grant auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
79 lines
2.7 KiB
YAML
79 lines
2.7 KiB
YAML
id: symantec_dlp
|
|
name: Symantec DLP
|
|
version: 1.0.0
|
|
description: "Symantec DLP (Enforce Server REST API v2) — data-loss-prevention incident handling: list incidents, read an incident and its history, and update incident status/severity. OAuth2 password-grant authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list/get incidents, get incident history, update incident."
|
|
category: dlp
|
|
|
|
# Per-instance configuration. The username/password are exchanged (OAuth2
|
|
# password grant) for a bearer token used on the Enforce v2 REST API.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Enforce Server URL (e.g. https://enforce.example.com)"
|
|
username:
|
|
type: string
|
|
description: "Enforce username"
|
|
password:
|
|
type: string
|
|
description: "Enforce password"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- username
|
|
- password
|
|
|
|
commands:
|
|
- id: list_incidents
|
|
name: symantec-dlp-list-incidents
|
|
description: "List incidents matching a filter."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
creation_date_after: { type: string, description: "ISO-8601 lower bound on creation date (optional)" }
|
|
limit: { type: number, description: "Max incidents (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_incident
|
|
name: symantec-dlp-get-incident
|
|
description: "Get a single incident by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_incident_history
|
|
name: symantec-dlp-get-incident-history
|
|
description: "Get an incident's history."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: update_incident
|
|
name: symantec-dlp-update-incident
|
|
description: "Update an incident's status and/or severity."
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID" }
|
|
status: { type: string, description: "New status ID/name (optional)" }
|
|
severity: { type: string, description: "New severity (optional)" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: symantec-dlp-test-connection
|
|
description: "Verify connectivity and the token exchange (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|