Guillaume BOURGEOIS
7e96048446
Built from the published OpenAPI spec for mock instance s1 (type: edr). Incident ingestion (list_incidents) with since/after_id paging and an OCSF mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss incident action. X-API-Key auth; the instance path segment is configurable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
79 lines
3.0 KiB
YAML
79 lines
3.0 KiB
YAML
id: mock_edr_s1
|
|
name: Mock EDR (S1)
|
|
version: 1.0.0
|
|
description: "Mock EDR API (instance s1) — incident ingestion with since/after_id pagination and incident actions (acknowledge / resolve / dismiss). Built from the published OpenAPI spec."
|
|
changelog: "1.0.0 — Initial release: incident ingestion (list_incidents) with an OCSF mapper, plus an acknowledge/resolve/dismiss action."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. The API key is sent in the X-API-Key header. The
|
|
# instance segment of the path (/api/<instance>/incidents) is configurable.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "API base URL"
|
|
default: https://mockprod.riposte-labs.com
|
|
instance:
|
|
type: string
|
|
description: "Instance name used in the path (/api/<instance>/incidents)"
|
|
default: s1
|
|
api_key:
|
|
type: string
|
|
description: "API key (X-API-Key)"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- base_url
|
|
- api_key
|
|
|
|
auth:
|
|
- id: apikey
|
|
type: api_key
|
|
in: header
|
|
name: X-API-Key
|
|
value_template: "{{secret}}"
|
|
secret_field: api_key
|
|
|
|
commands:
|
|
# ── Ingestion ───────────────────────────────────────────────────────────────
|
|
- id: list_incidents
|
|
name: mock-edr-s1-list-incidents
|
|
description: "List incidents. Used for ingestion: results path = items. Supports incremental fetch via 'since' and cursor paging via 'after_id'."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
since: { type: string, description: "Return incidents created after this ISO-8601 timestamp. Incremental fetch watermark." }
|
|
after_id: { type: number, description: "Return incidents with ID greater than this value (cursor paging)" }
|
|
limit: { type: number, description: "Maximum number of incidents (default 100, max 1000)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: items
|
|
dedup_key: id
|
|
incremental_field: since
|
|
|
|
- id: incident_action
|
|
name: mock-edr-s1-incident-action
|
|
description: "Acknowledge, resolve or dismiss an incident."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: number, description: "Incident ID" }
|
|
action: { type: string, description: "Action to apply: acknowledge, resolve or dismiss" }
|
|
required: [id, action]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Connectivity test ─────────────────────────────────────────────────────
|
|
- id: test_connection
|
|
name: mock-edr-s1-test-connection
|
|
description: "Verify connectivity and credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
ingestion:
|
|
command: list_incidents
|
|
mapper: list_incidents
|
|
default_incident_type: "Mock EDR Incident"
|