f3nris
67d5e7da55
- integrations/virustotal: VirusTotal v3 (request-based: IP & domain reports) - templates/: fully-commented manifest + script-command example - README: discovery rules, manifest schema, how to publish and wire into Riposte
83 lines
3.4 KiB
YAML
83 lines
3.4 KiB
YAML
# =============================================================================
|
|
# Integration manifest template — copy to integrations/<id>/manifest.yaml
|
|
# This file is named *.example.yaml on purpose so Riposte never ingests it
|
|
# (only files named exactly "manifest.yaml" are picked up).
|
|
# =============================================================================
|
|
|
|
id: example_integration # required · unique slug · [a-z0-9_]
|
|
name: Example Integration # required · shown in the UI
|
|
version: 1.0.0 # semver · bump on every change
|
|
description: One-line description of what this integration does.
|
|
category: enrichment # free text: enrichment | containment | ticketing | ...
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# config_schema — per-instance settings the operator fills in when creating an
|
|
# instance. JSON-Schema shape: { properties: {...}, required: [...] }.
|
|
# Property fields: type (string|number|boolean), description, default,
|
|
# and x-soar-sensitive: true for secrets (encrypted in the vault, never returned).
|
|
# ---------------------------------------------------------------------------
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: API base URL
|
|
default: https://api.example.com/v1
|
|
api_key:
|
|
type: string
|
|
description: API key / token
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_key
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# auth — authentication methods, referenced from commands via auth_ref.
|
|
# value_template: {{secret}} is replaced by the value of secret_field.
|
|
# api_key in header → name is the header (e.g. x-apikey, Authorization)
|
|
# bearer → typically name: Authorization, value_template: "Bearer {{secret}}"
|
|
# ---------------------------------------------------------------------------
|
|
auth:
|
|
- id: apikey
|
|
type: api_key # api_key | bearer | basic | oauth2_client_credentials
|
|
in: header # header | query
|
|
name: Authorization
|
|
value_template: "Bearer {{secret}}"
|
|
secret_field: api_key
|
|
|
|
commands:
|
|
# --- Request-based command (recommended: declarative, no sandbox) ---------
|
|
- id: lookup
|
|
name: Lookup indicator
|
|
description: Fetches a report for an indicator over HTTP.
|
|
inputs_schema:
|
|
properties:
|
|
indicator:
|
|
type: string
|
|
description: The value to look up
|
|
required:
|
|
- indicator
|
|
outputs_schema:
|
|
properties: {}
|
|
request:
|
|
method: GET # GET | POST | PUT | PATCH | DELETE
|
|
path: /lookup/{indicator} # {indicator} is substituted from inputs
|
|
query: [] # input names to send as query params
|
|
body: [] # input names to send as JSON body fields
|
|
auth_ref: apikey
|
|
|
|
# --- Script-based command -------------------------------------------------
|
|
# No `request:` block. Provide scripts/<id>.py next to this manifest.
|
|
# The script receives inputs in the global dict __inputs__ and MUST print
|
|
# exactly one JSON object to stdout (that becomes the command output).
|
|
# See templates/scripts/example_command.py.
|
|
- id: example_command
|
|
name: Example scripted command
|
|
description: Demonstrates a Python-backed command.
|
|
inputs_schema:
|
|
properties:
|
|
indicator:
|
|
type: string
|
|
required:
|
|
- indicator
|
|
outputs_schema:
|
|
properties: {}
|