Guillaume BOURGEOIS
70c66f7386
Forcepoint DLP REST API v1, 4 commands: list incidents, get incident, update incident (status/severity/assignee). Token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
71 lines
2.6 KiB
YAML
71 lines
2.6 KiB
YAML
id: forcepoint_dlp
|
|
name: Forcepoint DLP
|
|
version: 1.0.0
|
|
description: "Forcepoint DLP (Security Manager REST API v1) — data-loss-prevention incident handling: list incidents in a time window, read an incident, and update incident status/severity/assignment. Token authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: list incidents, get incident, update incident."
|
|
category: dlp
|
|
|
|
# Per-instance configuration. Credentials are exchanged for an access token
|
|
# (Bearer) used on the DLP REST API.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Forcepoint Security Manager URL (e.g. https://fsm.example.com:9443)"
|
|
username:
|
|
type: string
|
|
description: "API username"
|
|
password:
|
|
type: string
|
|
description: "API password"
|
|
x-soar-sensitive: true
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- username
|
|
- password
|
|
|
|
commands:
|
|
- id: list_incidents
|
|
name: forcepoint-list-incidents
|
|
description: "List DLP incidents in a time window."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
action: { type: string, description: "Optional action filter (e.g. Blocked, Permitted)" }
|
|
required: [from_date, to_date]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_incident
|
|
name: forcepoint-get-incident
|
|
description: "Get a single DLP incident by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: update_incident
|
|
name: forcepoint-update-incident
|
|
description: "Update DLP incidents (status, severity, or assignee)."
|
|
inputs_schema:
|
|
properties:
|
|
incident_ids: { type: string, description: "Comma-separated incident IDs" }
|
|
action_type: { type: string, description: "Field to update: STATUS, SEVERITY, or ASSIGNED_TO" }
|
|
value: { type: string, description: "New value for the field" }
|
|
required: [incident_ids, action_type, value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: forcepoint-test-connection
|
|
description: "Verify connectivity and credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|