f3nris
45e9cbd269
467 of the 1592 commands carried no `risk:`. An unset risk is read as
destructive by the agent approval gate, so half the catalog's write side sat
behind the same prompt — and, in HarfangLab's case, 39 pure lookups did too.
A gate that stops everything stops being read as a signal, which is the
argument already made for the toolkit and for sentinelone (df27876).
The catalog is now 1027 read, 261 safe_write, 304 destructive, with nothing
defaulted. The line follows the one sentinelone drew: impact on the estate,
not reversibility — isolate-agent is reversible and is the canonical
destructive example.
read only queries; changes nothing outside Riposte
safe_write additive or reversible inside the tool's own case/enrichment
plane: comments, tickets, tags, alert statuses, threat-intel
records, sandbox submissions, collection jobs, outbound messages
destructive changes the estate or weakens a control: containment, blocklists
and allowlists, exclusions and detection rules, every delete,
identity and credential operations, code on a host, generic
API escape hatches
Three calls that were not obvious, and are now applied throughout:
- Undoing a containment is tiered like the containment it lifts. Un-isolating
a host or un-banning an IP mid-incident is its own decision, not a return to
a neutral state. The catalog contradicted itself here — crowdstrike's
lift_containment was destructive while harfanglab's deisolate_from_threat
was safe_write — so deisolate_from_threat and unquarantine_file are
re-tiered to destructive, the only two existing tiers this pass changes.
- Retrieving a live secret is destructive: cyberark get_password, delinea
get_secret, vault read_secret, beyondtrust get_credential. It is a GET, but
the tier describes the stake, not the HTTP verb.
- Sending outward to humans stays safe_write — slack, teams, twilio, telegram,
mail. Irreversible, but it is the collaboration plane, not the estate.
An object created but not yet referenced by a rule is safe_write; editing one
a rule already reads is destructive. That is why fortigate create_address and
panos create_custom_url_category are safe_write while update_address_group and
edit_custom_url_category are not.
The template and README never documented the field, which is how 467 commands
came to omit it. Both now carry the tier table and these rules, so the next
integration declares a tier instead of inheriting one.
111 packages get a MINOR bump and a changelog entry: an instance compares
versions to offer an update, so an unbumped manifest would leave the tiers
sitting in the catalog and never reaching the estates that need them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
64 lines
3.6 KiB
YAML
64 lines
3.6 KiB
YAML
id: google_calendar
|
|
name: Google Calendar
|
|
version: 1.1.0
|
|
description: "Google Calendar (Calendar API v3) — manage calendar access control lists: grant a role on a calendar to a user, group, domain or the public, and list the existing ACL rules. Service-account authentication with domain-wide delegation. Runs on a remote engine. Requires the Python 'PyJWT' and 'cryptography' libraries on the engine host (pip install pyjwt cryptography)."
|
|
changelog: "1.1.0 — Declare the risk tier on the 1 command that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: ACL rule creation and listing on user calendars."
|
|
category: productivity
|
|
|
|
# Per-instance configuration. Create a Google Cloud service account with
|
|
# domain-wide delegation, authorize the https://www.googleapis.com/auth/calendar
|
|
# scope in the Workspace admin console, and paste the service account JSON key.
|
|
# The scripts sign a JWT (RS256) with the key and exchange it for an access
|
|
# token that impersonates user_id (or a per-command user override).
|
|
config_schema:
|
|
properties:
|
|
service_account_json:
|
|
type: string
|
|
description: "Service account key JSON (full file contents) with domain-wide delegation"
|
|
x-soar-sensitive: true
|
|
user_id:
|
|
type: string
|
|
description: "Default user to impersonate (primary email address)"
|
|
required:
|
|
- service_account_json
|
|
- user_id
|
|
|
|
commands:
|
|
- id: acl_add
|
|
name: google-calendar-acl-add
|
|
description: "Create an access control rule on a calendar (grant a role to a user, group, domain or the public)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
calendar_id: { type: string, description: "Calendar identifier — use 'primary' for the impersonated user's main calendar" }
|
|
role: { type: string, description: "Role: none, freeBusyReader, reader, writer or owner" }
|
|
scope_type: { type: string, description: "Grantee type: default (public), user, group or domain" }
|
|
scope_value: { type: string, description: "Email of the user/group or domain name (omit for scope_type=default)" }
|
|
send_notifications: { type: boolean, description: "Send notifications about the sharing change (default true)" }
|
|
user_id: { type: string, description: "Override the impersonated user" }
|
|
required: [calendar_id, role, scope_type]
|
|
outputs_schema: { properties: {} }
|
|
- id: acl_list
|
|
name: google-calendar-acl-list
|
|
description: "List the access control rules of a calendar."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
calendar_id: { type: string, description: "Calendar identifier — use 'primary' for the impersonated user's main calendar" }
|
|
max_results: { type: number, description: "Maximum entries per page (default 100, max 250)" }
|
|
page_token: { type: string, description: "Token of the results page to return" }
|
|
show_deleted: { type: boolean, description: "Include deleted ACL rules (role 'none')" }
|
|
sync_token: { type: string, description: "nextSyncToken from a previous listing — returns only entries changed since" }
|
|
user_id: { type: string, description: "Override the impersonated user" }
|
|
required: [calendar_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: google-calendar-test-connection
|
|
description: "Verify the service account key and delegation (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|