Guillaume BOURGEOIS
3c282e8e53
Signal Sciences API v0, 5 commands: list sites, get suspicious IPs, list events, add IP to list (block). API-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
73 lines
2.3 KiB
YAML
73 lines
2.3 KiB
YAML
id: signalsciences
|
|
name: Signal Sciences
|
|
version: 1.0.0
|
|
description: "Signal Sciences (Fastly NGWAF, API v0) — web-attack visibility and containment: list sites, read suspicious IPs and events, and add an IP to a site list (block). API-token authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list sites, get suspicious IPs, list events, add IP to list."
|
|
category: network
|
|
|
|
# Per-instance configuration. Auth headers 'x-api-user' (email) and 'x-api-token'.
|
|
config_schema:
|
|
properties:
|
|
email:
|
|
type: string
|
|
description: "API user email"
|
|
api_token:
|
|
type: string
|
|
description: "API token"
|
|
x-soar-sensitive: true
|
|
corp_name:
|
|
type: string
|
|
description: "Corp (organization) short name"
|
|
required:
|
|
- email
|
|
- api_token
|
|
- corp_name
|
|
|
|
commands:
|
|
- id: list_sites
|
|
name: sigsci-list-sites
|
|
description: "List sites in the corp."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_suspicious_ips
|
|
name: sigsci-get-suspicious-ips
|
|
description: "List a site's suspicious IPs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
site_name: { type: string, description: "Site short name" }
|
|
required: [site_name]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_events
|
|
name: sigsci-list-events
|
|
description: "List a site's flagged-IP events."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
site_name: { type: string, description: "Site short name" }
|
|
limit: { type: number, description: "Max events (default 50)" }
|
|
required: [site_name]
|
|
outputs_schema: { properties: {} }
|
|
- id: add_ip_to_list
|
|
name: sigsci-add-ip-to-list
|
|
description: "Add an IP to a site custom list (e.g. a block list)."
|
|
inputs_schema:
|
|
properties:
|
|
site_name: { type: string, description: "Site short name" }
|
|
list_id: { type: string, description: "Custom list ID" }
|
|
ip: { type: string, description: "IP or CIDR to add" }
|
|
required: [site_name, list_id, ip]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: sigsci-test-connection
|
|
description: "Verify the API token (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|