Guillaume BOURGEOIS
0775500b15
Darktrace Threat Visualizer API, 7 commands: get/acknowledge model breaches, get devices, get/activate Antigena actions (autonomous-response containment). HMAC-SHA1 signed auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
98 lines
3.6 KiB
YAML
98 lines
3.6 KiB
YAML
id: darktrace
|
|
name: Darktrace
|
|
version: 1.0.0
|
|
description: "Darktrace (Threat Visualizer API) — network detection and autonomous response: read model breaches, acknowledge a breach, look up devices, and read/activate Antigena network actions (containment). HMAC-SHA1 signed authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: get/acknowledge model breaches, get devices, get/activate Antigena actions."
|
|
category: ndr
|
|
|
|
# Per-instance configuration. Requests are signed (HMAC-SHA1) with the public +
|
|
# private API tokens (headers DTAPI-Token / DTAPI-Date / DTAPI-Signature).
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Darktrace master URL (e.g. https://darktrace.example.com)"
|
|
public_token:
|
|
type: string
|
|
description: "Public API token"
|
|
private_token:
|
|
type: string
|
|
description: "Private API token"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- public_token
|
|
- private_token
|
|
|
|
commands:
|
|
- id: get_model_breaches
|
|
name: darktrace-get-model-breaches
|
|
description: "List model breaches (optionally since a time)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
min_score: { type: number, description: "Minimum breach score 0-1 (optional)" }
|
|
from_time: { type: string, description: "Start time YYYY-MM-DD HH:MM:SS (optional)" }
|
|
count: { type: number, description: "Max breaches (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_model_breach
|
|
name: darktrace-get-model-breach
|
|
description: "Get a single model breach by its PBID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
pbid: { type: string, description: "Policy breach ID (PBID)" }
|
|
required: [pbid]
|
|
outputs_schema: { properties: {} }
|
|
- id: acknowledge_breach
|
|
name: darktrace-acknowledge-breach
|
|
description: "Acknowledge a model breach."
|
|
inputs_schema:
|
|
properties:
|
|
pbid: { type: string, description: "Policy breach ID (PBID)" }
|
|
required: [pbid]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_devices
|
|
name: darktrace-get-devices
|
|
description: "Look up devices (by IP or device ID)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
did: { type: string, description: "Device ID (optional)" }
|
|
ip: { type: string, description: "IP address (optional)" }
|
|
count: { type: number, description: "Max devices (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_antigena_actions
|
|
name: darktrace-get-antigena-actions
|
|
description: "List Antigena (autonomous response) actions."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
include_cleared: { type: boolean, description: "Include cleared actions (default false)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: activate_antigena
|
|
name: darktrace-activate-antigena
|
|
description: "Activate an Antigena action (containment — enforce autonomous response)."
|
|
inputs_schema:
|
|
properties:
|
|
codeid: { type: string, description: "Antigena action code ID" }
|
|
duration: { type: number, description: "Duration in seconds (optional)" }
|
|
required: [codeid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: darktrace-test-connection
|
|
description: "Verify connectivity and the signed credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|