Guillaume BOURGEOIS
ce319c2fea
Intel 471 Titan API v1, 5 commands: search reports/indicators, get report, list CVE reports. HTTP Basic auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
71 lines
2.2 KiB
YAML
71 lines
2.2 KiB
YAML
id: intel471
|
|
name: Intel 471
|
|
version: 1.0.0
|
|
description: "Intel 471 (Titan API v1) — cyber threat intelligence: search reports and indicators, read a report, and list CVE reports. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: search reports/indicators, get report, list CVE reports."
|
|
category: threat_intel
|
|
|
|
# Per-instance configuration. HTTP Basic auth with the account email + API key.
|
|
config_schema:
|
|
properties:
|
|
email:
|
|
type: string
|
|
description: "Account email"
|
|
api_key:
|
|
type: string
|
|
description: "API key"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- email
|
|
- api_key
|
|
|
|
commands:
|
|
- id: search_reports
|
|
name: intel471-search-reports
|
|
description: "Search intelligence reports."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
text: { type: string, description: "Full-text search" }
|
|
count: { type: number, description: "Max reports (default 25)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_report
|
|
name: intel471-get-report
|
|
description: "Get a single report by UID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
report_uid: { type: string, description: "Report UID" }
|
|
required: [report_uid]
|
|
outputs_schema: { properties: {} }
|
|
- id: search_indicators
|
|
name: intel471-search-indicators
|
|
description: "Search indicators."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
indicator: { type: string, description: "Indicator value or search term" }
|
|
count: { type: number, description: "Max indicators (default 25)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_cve_reports
|
|
name: intel471-list-cve-reports
|
|
description: "List CVE reports."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
cve: { type: string, description: "Optional CVE ID filter (e.g. CVE-2024-1234)" }
|
|
count: { type: number, description: "Max reports (default 25)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: intel471-test-connection
|
|
description: "Verify the credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|