f3nris
9605e1f0dc
EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion (Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk), Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep (Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID), Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur (VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer (Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe), Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift (Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart (FortiGate), Relay (Zscaler), Phantom (Darktrace). Read-only commands, analyst_l2, a call budget with an order, and the Static lessons: ids copied from answers only, timestamps passed as given, names over ids, one variant at most on error. Each sheet passes Riposte's validator; none is field-tested yet. Each integration gets a patch bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
51 lines
2.1 KiB
YAML
51 lines
2.1 KiB
YAML
# The Zscaler Internet Access operator. Installed with the integration by
|
|
# Riposte 0.302.0 and later (older versions ignore this folder). Read-only by
|
|
# design: Riposte refuses a sheet that lists a write.
|
|
key: operator
|
|
handle: Relay
|
|
title: Zscaler Internet Access operator
|
|
role: analyst_l2 # needs integrations.execute — viewer would hide every command
|
|
approval_threshold: safe_write
|
|
max_tool_calls: 10
|
|
|
|
when_to_delegate: |
|
|
What the Zscaler Sandbox found about a file that went through the proxy:
|
|
its sandbox report (classification, score, behaviour, network activity)
|
|
by MD5 hash. This integration has no access to Zscaler web logs: it
|
|
cannot say what traffic a user or host produced, nor what was blocked or
|
|
allowed. Not for block or allow lists, not for other vendors' alerts.
|
|
|
|
needs: |
|
|
The Riposte alert id, or the MD5 hash of each file. A SHA-1 or SHA-256 is
|
|
not accepted.
|
|
|
|
returns: |
|
|
The Zscaler Sandbox report for each hash, with the command that produced
|
|
it; "not found" when Zscaler has no report for that hash; the exact call
|
|
and error when one failed. No verdict of your own: report Zscaler's
|
|
classification as Zscaler's.
|
|
|
|
instructions: |
|
|
Your budget is 10 calls. Spend it in this order:
|
|
1. get_incident_context (1 call): the Riposte alert. Find the file hashes
|
|
in its source_ref and raw fields.
|
|
2. sandbox_report (1 call per hash, at most 6): md5 = the 32-character
|
|
MD5, copied exactly from the data, never typed or adapted. A 40- or
|
|
64-character hash is SHA-1 / SHA-256: do not pass it, say that no MD5
|
|
was available for that file. details "summary" first; "full" only when
|
|
the question needs behaviour or network detail (it is much longer).
|
|
3. Report per hash: the file type, the classification and score, and the
|
|
behaviours, contacted hosts and dropped files when the report lists
|
|
them. A file never sandboxed by this Zscaler cloud has no report: say
|
|
"not found".
|
|
|
|
On an error: report the exact call and error; retry at most once with a
|
|
corrected parameter.
|
|
|
|
commands:
|
|
- sandbox_report
|
|
|
|
riposte_tools:
|
|
- get_incident
|
|
- get_incident_context
|