f3nris
6b76270cc6
Riposte accepts no inbound connection, so a vendor that can only push (Rapid7 InsightIDR Essential basic detection rules) posts to the relay, and an alert rule on this integration reads one relay source back over outbound HTTPS. fetch_messages takes the rule's watermark as `since` and walks every page within the run, since the next watermark is this run's instant. A window holding more than `limit` fails the run instead of truncating, so the watermark stays put. relay_status and test_connection tell a 404 from the proxy (this Riposte's address is not listed) from a refused token. The generic mapper keeps the raw body, the sender's address and the checks the delivery passed (custom:webhook_verified). Tested against a local relay: 2503 messages over three pages, a millisecond watermark, the limit, unknown source and bad token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xa1QDbsPTYiVREv2Cvs3Zn
23 lines
841 B
Python
23 lines
841 B
Python
import json, os, sys, urllib.request, urllib.error
|
|
|
|
|
|
def run():
|
|
s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
|
|
base = str(s.get("base_url") or "").strip().rstrip("/")
|
|
if not base.startswith("https://"):
|
|
raise ValueError("base_url must be the relay's https:// address")
|
|
req = urllib.request.Request(base + "/relay/v1/status", method="GET", headers={
|
|
"Authorization": "Bearer " + str(s.get("read_token") or "").strip(), "Accept": "application/json"})
|
|
with urllib.request.urlopen(req, timeout=30) as r:
|
|
print(r.read().decode("utf-8"))
|
|
|
|
|
|
try:
|
|
run()
|
|
except urllib.error.HTTPError as e:
|
|
print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
|
|
sys.exit(1)
|
|
except Exception as e:
|
|
print(json.dumps({"error": str(e)}))
|
|
sys.exit(1)
|