f3nris
9605e1f0dc
EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion (Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk), Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep (Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID), Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur (VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer (Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe), Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift (Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart (FortiGate), Relay (Zscaler), Phantom (Darktrace). Read-only commands, analyst_l2, a call budget with an order, and the Static lessons: ids copied from answers only, timestamps passed as given, names over ids, one variant at most on error. Each sheet passes Riposte's validator; none is field-tested yet. Each integration gets a patch bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
100 lines
3.9 KiB
YAML
100 lines
3.9 KiB
YAML
id: darktrace
|
|
name: Darktrace
|
|
version: 1.1.1
|
|
description: "Darktrace (Threat Visualizer API) — network detection and autonomous response: read model breaches, acknowledge a breach, look up devices, and read/activate Antigena network actions (containment). HMAC-SHA1 signed authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.1.0 — Declare the risk tier on the 2 commands that carried none: 1 safe_write, 1 destructive. An unset risk is read as destructive by the agent approval gate, so the 1 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: get/acknowledge model breaches, get devices, get/activate Antigena actions."
|
|
category: ndr
|
|
|
|
# Per-instance configuration. Requests are signed (HMAC-SHA1) with the public +
|
|
# private API tokens (headers DTAPI-Token / DTAPI-Date / DTAPI-Signature).
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Darktrace master URL (e.g. https://darktrace.example.com)"
|
|
public_token:
|
|
type: string
|
|
description: "Public API token"
|
|
private_token:
|
|
type: string
|
|
description: "Private API token"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- public_token
|
|
- private_token
|
|
|
|
commands:
|
|
- id: get_model_breaches
|
|
name: darktrace-get-model-breaches
|
|
description: "List model breaches (optionally since a time)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
min_score: { type: number, description: "Minimum breach score 0-1 (optional)" }
|
|
from_time: { type: string, description: "Start time YYYY-MM-DD HH:MM:SS (optional)" }
|
|
count: { type: number, description: "Max breaches (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_model_breach
|
|
name: darktrace-get-model-breach
|
|
description: "Get a single model breach by its PBID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
pbid: { type: string, description: "Policy breach ID (PBID)" }
|
|
required: [pbid]
|
|
outputs_schema: { properties: {} }
|
|
- id: acknowledge_breach
|
|
name: darktrace-acknowledge-breach
|
|
description: "Acknowledge a model breach."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
pbid: { type: string, description: "Policy breach ID (PBID)" }
|
|
required: [pbid]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_devices
|
|
name: darktrace-get-devices
|
|
description: "Look up devices (by IP or device ID)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
did: { type: string, description: "Device ID (optional)" }
|
|
ip: { type: string, description: "IP address (optional)" }
|
|
count: { type: number, description: "Max devices (default 50)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_antigena_actions
|
|
name: darktrace-get-antigena-actions
|
|
description: "List Antigena (autonomous response) actions."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
include_cleared: { type: boolean, description: "Include cleared actions (default false)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: activate_antigena
|
|
name: darktrace-activate-antigena
|
|
description: "Activate an Antigena action (containment — enforce autonomous response)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
codeid: { type: string, description: "Antigena action code ID" }
|
|
duration: { type: number, description: "Duration in seconds (optional)" }
|
|
required: [codeid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: darktrace-test-connection
|
|
description: "Verify connectivity and the signed credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|