f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
26d6273f6049c65817949ba25045a115b0a0cb1d
riposte-marketplace/integrations/active-directory/manifest.yaml
T
f3nris 45e9cbd269 feat: declare a risk tier on every command in the catalog 
467 of the 1592 commands carried no `risk:`. An unset risk is read as
destructive by the agent approval gate, so half the catalog's write side sat
behind the same prompt — and, in HarfangLab's case, 39 pure lookups did too.
A gate that stops everything stops being read as a signal, which is the
argument already made for the toolkit and for sentinelone (df27876).

The catalog is now 1027 read, 261 safe_write, 304 destructive, with nothing
defaulted. The line follows the one sentinelone drew: impact on the estate,
not reversibility — isolate-agent is reversible and is the canonical
destructive example.

  read        only queries; changes nothing outside Riposte
  safe_write  additive or reversible inside the tool's own case/enrichment
              plane: comments, tickets, tags, alert statuses, threat-intel
              records, sandbox submissions, collection jobs, outbound messages
  destructive changes the estate or weakens a control: containment, blocklists
              and allowlists, exclusions and detection rules, every delete,
              identity and credential operations, code on a host, generic
              API escape hatches

Three calls that were not obvious, and are now applied throughout:

- Undoing a containment is tiered like the containment it lifts. Un-isolating
  a host or un-banning an IP mid-incident is its own decision, not a return to
  a neutral state. The catalog contradicted itself here — crowdstrike's
  lift_containment was destructive while harfanglab's deisolate_from_threat
  was safe_write — so deisolate_from_threat and unquarantine_file are
  re-tiered to destructive, the only two existing tiers this pass changes.
- Retrieving a live secret is destructive: cyberark get_password, delinea
  get_secret, vault read_secret, beyondtrust get_credential. It is a GET, but
  the tier describes the stake, not the HTTP verb.
- Sending outward to humans stays safe_write — slack, teams, twilio, telegram,
  mail. Irreversible, but it is the collaboration plane, not the estate.

An object created but not yet referenced by a rule is safe_write; editing one
a rule already reads is destructive. That is why fortigate create_address and
panos create_custom_url_category are safe_write while update_address_group and
edit_custom_url_category are not.

The template and README never documented the field, which is how 467 commands
came to omit it. Both now carry the tier table and these rules, so the next
integration declares a tier instead of inheriting one.

111 packages get a MINOR bump and a changelog entry: an instance compares
versions to offer an update, so an unbumped manifest would leave the tiers
sitting in the catalog and never reaching the estates that need them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-08 12:55:20 +02:00

367 lines
19 KiB
YAML
Raw Blame History

id: active_directory
name: Active Directory
version: 1.1.0
description: "Active Directory over LDAP/LDAPS — query and manage users, computers, groups and contacts (search, enable/disable/unlock, set/expire password, group membership, OU moves, create/update/delete). Runs on a remote engine inside the AD network. Requires the Python 'ldap3' library on the engine host (pip install ldap3)."
changelog: "1.1.0 — Declare the risk tier on the 18 commands that carried none: 3 safe_write, 15 destructive. An unset risk is read as destructive by the agent approval gate, so the 3 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: full directory administration over LDAP (search, get user/computer/group-members, create/update/delete user/contact/group, enable/disable/unlock, set/expire password, password-never-expire, add/remove group membership, move user/computer OU, test credentials)."
category: identity
# Per-instance configuration. The integration binds to a Domain Controller over
# LDAP (389) or LDAPS (636). Secure connection (SSL/Start TLS) is required for
# password operations. Run this integration on a remote engine that can reach the
# Domain Controller. The bundled scripts require the Python 'ldap3' library to be
# installed on the engine host: pip install ldap3
config_schema:
properties:
server_ip:
type: string
description: "Domain Controller host or IP (e.g. dc01.company.com or 192.168.0.1)"
port:
type: string
description: "LDAP port. Default 389 for LDAP / Start TLS, 636 for LDAPS."
username:
type: string
description: "Bind username (e.g. DOMAIN\\\\user or user@company.com)"
password:
type: string
description: "Bind password"
x-soar-sensitive: true
base_dn:
type: string
description: "Base DN (e.g. dc=company,dc=com)"
secure_connection:
type: string
description: "Connection security: None, SSL (LDAPS), TLS, or Start TLS. Password operations require SSL or TLS."
default: SSL
ssl_version:
type: string
description: "SSL/TLS protocol: None, TLS, TLSv1, TLSv1_1, TLSv1_2, or TLS_CLIENT. Default None (let the library negotiate)."
default: None
ntlm:
type: boolean
description: "Use NTLM authentication for the bind"
default: false
unsecure:
type: boolean
description: "Trust any TLS certificate (not secure)"
default: false
page_size:
type: string
description: "LDAP paging size for searches"
default: "500"
default_base_query:
type: string
description: "Default LDAP filter used by ad-get-user when no query argument is given"
default: "(&(objectClass=User)(objectCategory=person))"
required:
- server_ip
- username
- password
- base_dn
commands:
# ── Connectivity ──────────────────────────────────────────────────────────
- id: test_connection
name: ad-test-connection
description: "Bind to the Domain Controller and verify the configured base DN (used by the Test button)."
risk: read
inputs_schema:
properties: {}
required: []
outputs_schema: { properties: {} }
# ── Search / read ─────────────────────────────────────────────────────────
- id: ad_search
name: ad-search
description: "Run a raw LDAP query and return the matching entries. Paging is handled internally up to size-limit."
risk: read
inputs_schema:
properties:
filter: { type: string, description: "LDAP search filter, e.g. (&(objectCategory=person)(objectClass=user))" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
attributes: { type: string, description: "CSV list of attributes to return, or ALL for every attribute" }
size-limit: { type: number, description: "Maximum entries to return (default 50)" }
time-limit: { type: number, description: "Maximum search time in seconds" }
page-size: { type: number, description: "Paging size (overrides size-limit when set)" }
required: [filter]
outputs_schema: { properties: {} }
- id: ad_get_user
name: ad-get-user
description: "Retrieve user accounts by DN, name, email, sAMAccountName or a custom attribute. Decodes userAccountControl flags."
risk: read
inputs_schema:
properties:
dn: { type: string, description: "Distinguished Name of the user" }
name: { type: string, description: "Common name (cn) of the user" }
email: { type: string, description: "User email (mail)" }
username: { type: string, description: "sAMAccountName" }
sAMAccountName: { type: string, description: "sAMAccountName (alias of username)" }
custom-field-type: { type: string, description: "Attribute name to query by" }
custom-field-data: { type: string, description: "Attribute value (required with custom-field-type)" }
attributes: { type: string, description: "CSV list of extra attributes to add to the defaults" }
attributes-to-exclude: { type: string, description: "CSV list of attributes to remove from the result" }
limit: { type: number, description: "Maximum users to return (default 20)" }
page-size: { type: number, description: "Paging size (overrides limit when set)" }
required: []
outputs_schema: { properties: {} }
- id: ad_get_computer
name: ad-get-computer
description: "Retrieve computer accounts by DN, name or a custom attribute."
risk: read
inputs_schema:
properties:
dn: { type: string, description: "Distinguished Name of the computer" }
name: { type: string, description: "Computer name" }
custom-field-type: { type: string, description: "Attribute name to query by" }
custom-field-data: { type: string, description: "Attribute value (required with custom-field-type)" }
attributes: { type: string, description: "CSV list of extra attributes to add to the defaults" }
limit: { type: number, description: "Maximum computers to return" }
page-size: { type: number, description: "Paging size (overrides limit when set)" }
required: []
outputs_schema: { properties: {} }
- id: ad_get_group_members
name: ad-get-group-members
description: "List the users, computers or nested groups that are members of a group (recursive by default)."
risk: read
inputs_schema:
properties:
group-dn: { type: string, description: "Distinguished Name of the group" }
member-type: { type: string, description: "Member type to return: person, computer or group (default person)" }
attributes: { type: string, description: "CSV list of extra attributes to add to the defaults" }
time_limit: { type: number, description: "Search time limit in seconds (default 180)" }
disable-nested-search: { type: string, description: "Set true to disable recursive membership resolution (default false)" }
sAMAccountName: { type: string, description: "Filter members by sAMAccountName (default *)" }
limit: { type: number, description: "Maximum members to return" }
page-size: { type: number, description: "Paging size (overrides limit when set)" }
required: [group-dn]
outputs_schema: { properties: {} }
# ── Account state ─────────────────────────────────────────────────────────
- id: ad_enable_account
name: ad-enable-account
description: "Enable a previously disabled user account."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName of the account to enable" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
restore_user: { type: string, description: "Set true to restore the account's previous userAccountControl flags" }
required: [username]
outputs_schema: { properties: {} }
- id: ad_disable_account
name: ad-disable-account
description: "Disable a user account."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName of the account to disable" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [username]
outputs_schema: { properties: {} }
- id: ad_unlock_account
name: ad-unlock-account
description: "Unlock a locked-out user account."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName of the account to unlock" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [username]
outputs_schema: { properties: {} }
- id: ad_set_new_password
name: ad-set-new-password
description: "Set a new password for a user. Requires a secure connection (SSL or TLS)."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName whose password will be set" }
password: { type: string, description: "New password", x-soar-sensitive: true }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [username, password]
outputs_schema: { properties: {} }
- id: ad_expire_password
name: ad-expire-password
description: "Force a user to change their password at next login."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName of the user" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [username]
outputs_schema: { properties: {} }
- id: ad_modify_password_never_expire
name: ad-modify-password-never-expire
description: "Set or clear the 'Password Never Expire' flag on a user account."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName of the user" }
value: { type: string, description: "true to set 'Password Never Expire', false to clear it" }
required: [username, value]
outputs_schema: { properties: {} }
# ── Group membership ──────────────────────────────────────────────────────
- id: ad_add_to_group
name: ad-add-to-group
description: "Add a user, computer or nested group to a group."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "Username(s) to add (single or CSV). Mutually exclusive with computer-name." }
computer-name: { type: string, description: "Computer name(s) to add (single or CSV)" }
nested_group_cn: { type: string, description: "A group CN to add as a nested member" }
group-cn: { type: string, description: "Target group CN" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [group-cn]
outputs_schema: { properties: {} }
- id: ad_remove_from_group
name: ad-remove-from-group
description: "Remove a user or computer from a group."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "Username to remove. Mutually exclusive with computer-name." }
computer-name: { type: string, description: "Computer name to remove" }
group-cn: { type: string, description: "Target group CN" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [group-cn]
outputs_schema: { properties: {} }
# ── Organizational unit ───────────────────────────────────────────────────
- id: ad_modify_user_ou
name: ad-modify-user-ou
description: "Move a user to a different organizational unit within the domain."
risk: destructive
inputs_schema:
properties:
user-name: { type: string, description: "Name of the user to move" }
full-superior-dn: { type: string, description: "Target OU DN, e.g. OU=users,DC=domain,DC=com" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [user-name, full-superior-dn]
outputs_schema: { properties: {} }
- id: ad_modify_computer_ou
name: ad-modify-computer-ou
description: "Move a computer to a different organizational unit within the domain."
risk: destructive
inputs_schema:
properties:
computer-name: { type: string, description: "Name of the computer to move" }
full-superior-dn: { type: string, description: "Target OU DN, e.g. OU=computers,DC=domain,DC=com" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [computer-name, full-superior-dn]
outputs_schema: { properties: {} }
# ── Object lifecycle: users ───────────────────────────────────────────────
- id: ad_create_user
name: ad-create-user
description: "Create a user account, set its initial password and enable it. Requires a secure connection (SSL or TLS)."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName for the new user" }
password: { type: string, description: "Initial password (user must change at next login)", x-soar-sensitive: true }
user-dn: { type: string, description: "Full DN of the new user" }
display-name: { type: string, description: "Display name" }
description: { type: string, description: "Description" }
email: { type: string, description: "Email (mail)" }
telephone-number: { type: string, description: "Telephone number" }
title: { type: string, description: "Job title" }
custom-attributes: { type: string, description: "JSON object of extra attributes, e.g. {\"company\":\"ACME\"}" }
required: [username, password, user-dn]
outputs_schema: { properties: {} }
- id: ad_update_user
name: ad-update-user
description: "Replace a single attribute on an existing user."
risk: destructive
inputs_schema:
properties:
username: { type: string, description: "sAMAccountName of the user" }
attribute-name: { type: string, description: "Attribute to modify (e.g. sn, displayName, mail)" }
attribute-value: { type: string, description: "New value" }
base-dn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [username, attribute-name, attribute-value]
outputs_schema: { properties: {} }
- id: ad_delete_user
name: ad-delete-user
description: "Delete a user (or any object) by its DN."
risk: destructive
inputs_schema:
properties:
user-dn: { type: string, description: "DN of the object to delete" }
required: [user-dn]
outputs_schema: { properties: {} }
# ── Object lifecycle: contacts ────────────────────────────────────────────
- id: ad_create_contact
name: ad-create-contact
description: "Create a contact object."
risk: safe_write
inputs_schema:
properties:
contact-dn: { type: string, description: "Full DN of the new contact" }
display-name: { type: string, description: "Display name" }
description: { type: string, description: "Description" }
email: { type: string, description: "Email (mail)" }
telephone-number: { type: string, description: "Telephone number" }
title: { type: string, description: "Job title" }
custom-attributes: { type: string, description: "JSON object of extra attributes" }
required: [contact-dn]
outputs_schema: { properties: {} }
- id: ad_update_contact
name: ad-update-contact
description: "Replace a single attribute on an existing contact."
risk: safe_write
inputs_schema:
properties:
contact-dn: { type: string, description: "DN of the contact" }
attribute-name: { type: string, description: "Attribute to modify" }
attribute-value: { type: string, description: "New value" }
required: [contact-dn, attribute-name, attribute-value]
outputs_schema: { properties: {} }
# ── Object lifecycle: groups ──────────────────────────────────────────────
- id: ad_create_group
name: ad-create-group
description: "Create a security or distribution group."
risk: safe_write
inputs_schema:
properties:
name: { type: string, description: "Group name (sAMAccountName)" }
group-type: { type: string, description: "security or distribution" }
dn: { type: string, description: "Full DN of the new group" }
members: { type: array, description: "DNs of initial members" }
required: [name, group-type, dn]
outputs_schema: { properties: {} }
- id: ad_update_group
name: ad-update-group
description: "Replace a single attribute on an existing group."
risk: destructive
inputs_schema:
properties:
groupname: { type: string, description: "Group name (cn) to update" }
attributename: { type: string, description: "Attribute to modify (e.g. description, displayName)" }
attributevalue: { type: string, description: "New value" }
basedn: { type: string, description: "Search base (defaults to the instance base_dn)" }
required: [attributename, attributevalue]
outputs_schema: { properties: {} }
- id: ad_delete_group
name: ad-delete-group
description: "Delete a security or distribution group by its DN."
risk: destructive
inputs_schema:
properties:
dn: { type: string, description: "DN of the group" }
required: [dn]
outputs_schema: { properties: {} }
# ── Credentials ───────────────────────────────────────────────────────────
- id: ad_test_credentials
name: ad-test-credentials
description: "Test whether a username/password can bind to the Domain Controller."
risk: read
inputs_schema:
properties:
username: { type: string, description: "Username to test (user or SERVER\\\\user)" }
password: { type: string, description: "Password to test", x-soar-sensitive: true }
required: [username, password]
outputs_schema: { properties: {} }
Reference in New Issue View Git Blame Copy Permalink