f3nris c3b15d1faf rapid7-insightidr 1.14.1: mark UBA alerts in the data, give Static a budget ...

list_investigation_alerts now marks each alert with alert_rrn, evidence_api
and next: a behaviour alert with no RRN says, in the output the agent reads,
that the Alert Triage commands answer 404 for it and that its evidence is in
the authentication logs. Static still called them when only its instructions
said so. Its sheet gets 14 calls spent in a stated order, authentication log
sets for lateral-movement alerts (never file access), and a window built from
first and last seen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ

2026-10-11 22:20:58 +00:00

..

abuseipdb

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

active-directory

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

alienvault-otx

feat(alienvault-otx): new AlienVault OTX enrichment integration

2026-07-11 22:33:10 +02:00

anomali-threatstream

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

anyrun

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

armis

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

automox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

aws

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

axonius

feat(axonius): new Axonius asset-management integration

2026-07-12 14:41:43 +02:00

azure-security

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

beyondtrust-password-safe

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

binaryedge

feat(binaryedge): new BinaryEdge exposure-intel integration

2026-07-12 14:15:54 +02:00

box

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cape

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

carbon-black-cloud

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

censys

feat(censys): new Censys enrichment integration

2026-07-11 22:39:29 +02:00

checkpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

chronicle

feat(chronicle): new Google Chronicle SIEM integration

2026-07-12 00:25:51 +02:00

circl-hashlookup

docs(ioc-sources): suggest summary lines for Riposte context enrichment rules

2026-10-09 22:53:04 +00:00

cisco-fmc

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cisco-ise

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cisco-secure-endpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cisco-umbrella-enforcement

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cloudflare

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

confluence

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cortex-xdr

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

crowdsec

feat(crowdsec): new CrowdSec CTI integration (French vendor)

2026-07-12 16:07:37 +02:00

crowdstrike

docs(mappers): MTTD is not retired, only re-anchored

2026-10-07 09:58:20 +00:00

crtsh

feat(crtsh): Cert Spotter fallback and a 60 s time budget (1.1.0)

2026-10-10 21:12:15 +00:00

cuckoo

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cybelangel

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cyberark-pas

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

cybereason

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

darktrace

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

datadog

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

delinea-secret-server

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

discord

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

domaintools

feat(domaintools): new DomainTools DNS-intel integration

2026-07-12 21:59:05 +02:00

dropbox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

duo

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

eclecticiq

feat(eclecticiq): new EclecticIQ threat-intel integration

2026-07-12 15:49:16 +02:00

efficientip

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

elasticsearch

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

emailrep

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

extrahop

feat(extrahop): new ExtraHop Reveal(x) NDR integration

2026-07-12 00:48:03 +02:00

f5-bigip

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

feed-aws-ipranges

feat(feed): add AWS IP ranges feed connector (allowlist / known infra)

2026-07-13 12:08:48 +02:00

feed-blocklist-de

feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)

2026-07-12 22:59:19 +02:00

feed-botvrij

feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)

2026-07-13 12:15:50 +02:00

feed-cins-army

feat(feed): add CINS Army feed connector (CI Army bad-guys list)

2026-07-12 22:59:20 +02:00

feed-cisa-kev

feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)

2026-07-13 12:12:34 +02:00

feed-cloudflare-ips

feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)

2026-07-13 12:08:49 +02:00

feed-csv

feat(feed-csv): new generic CSV threat-intel feed connector

2026-07-12 22:43:16 +02:00

feed-dshield

feat(feed): add DShield block list feed connector (SANS ISC)

2026-07-12 22:59:18 +02:00

feed-emergingthreats

feat(feed): add Emerging Threats feed connector (ET Open reputation lists)

2026-07-12 23:02:11 +02:00

feed-feodotracker

feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)

2026-07-12 22:49:28 +02:00

feed-first-epss

feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)

2026-07-13 12:12:35 +02:00

feed-gcp-ipranges

feat(feed): add GCP IP ranges feed connector (allowlist / known infra)

2026-07-13 12:08:49 +02:00

feed-json

feat(feed): add generic JSON feed connector (configurable field mapping)

2026-07-12 23:02:10 +02:00

feed-nvd

feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)

2026-07-13 12:12:34 +02:00

feed-office365

feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)

2026-07-13 12:15:50 +02:00

feed-openphish

feat(feed): add OpenPhish feed connector (community phishing URLs)

2026-07-12 23:02:11 +02:00

feed-plaintext

feat(feed-plaintext): new generic plain-text threat-intel feed connector

2026-07-12 22:43:17 +02:00

feed-rss

feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)

2026-07-13 12:15:49 +02:00

feed-spamhaus-drop

feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)

2026-07-12 22:49:30 +02:00

feed-sslbl

feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)

2026-07-12 22:56:36 +02:00

feed-taxii2

feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector

2026-07-12 22:43:17 +02:00

feed-threatfox

feat(feed): add ThreatFox feed connector (abuse.ch IOC export)

2026-07-12 22:56:36 +02:00

feed-tor-exit

feat(feed): add Tor exit nodes feed connector

2026-07-12 22:49:29 +02:00

feed-urlhaus

feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)

2026-07-12 22:56:35 +02:00

forcepoint-dlp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

fortigate

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

freshservice

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gatewatcher

feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)

2026-07-12 16:12:38 +02:00

gcp-security

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

github

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gitlab

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

glimps

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gmail

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

gmail-single-user

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

google-calendar

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

google-drive

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

graylog

feat(graylog): new Graylog log-search integration

2026-07-12 15:08:50 +02:00

greynoise

feat(greynoise): new GreyNoise enrichment integration

2026-07-11 22:33:09 +02:00

harfanglab

feat(harfanglab): describe an incident with the rule's message (1.7.1)

2026-10-07 19:11:35 +00:00

hibp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

hunter

feat(hunter): new Hunter.io email-OSINT integration

2026-07-12 14:15:53 +02:00

hybrid-analysis

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

imperva

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

infoblox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

intel471

feat(intel471): new Intel 471 threat-intel integration

2026-07-12 15:49:17 +02:00

intezer

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

intune

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

ipinfo

feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)

2026-08-05 21:01:43 +02:00

ipqualityscore

feat(ipqualityscore): new IPQualityScore enrichment integration

2026-07-11 22:58:17 +02:00

jira

feat(jira): pick the project, issue type and priority from the site (1.3.0)

2026-10-02 10:16:41 +00:00

joe-sandbox

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

jumpcloud

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mail-sender

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mailinblack

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

maltiverse

feat(maltiverse): new Maltiverse enrichment integration

2026-07-11 22:39:29 +02:00

malwarebazaar

feat(malwarebazaar): new MalwareBazaar sample-intel integration

2026-07-12 14:58:07 +02:00

mandiant

feat(mandiant): new Mandiant Advantage threat-intel integration

2026-07-12 00:15:12 +02:00

mattermost

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

meraki

feat(meraki): new Cisco Meraki network integration

2026-07-12 21:53:58 +02:00

microsoft-defender-endpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-defender-o365

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-entra-id

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-graph-files

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-purview

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-sentinel

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

microsoft-teams

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mimecast

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

misp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

mock-edr-s1

fix(mock-edr-s1): map the OCSF-shaped incident payload

2026-06-27 16:20:53 +02:00

netskope

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

okta

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

onelogin

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

opencti

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

openldap

feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)

2026-06-26 17:44:54 +02:00

opsgenie

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

ovhcloud

fix(ovhcloud): treat the billing-account list as advice, never as a verdict (1.2.6)

2026-09-19 19:29:09 +00:00

pagerduty

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

panos

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

pingone

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

prisma-cloud

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

proofpoint-tap

feat(proofpoint-tap): new Proofpoint TAP email-threat integration

2026-07-11 23:46:35 +02:00

pulsedive

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

qradar

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

qualys

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

ransomware-live

fix(ransomware-live): keyless — drop optional API key, no auth required

2026-07-15 19:18:49 +02:00

rapid7-insightidr

rapid7-insightidr 1.14.1: mark UBA alerts in the data, give Static a budget

2026-10-11 22:20:58 +00:00

rapid7-insightvm

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

rdap

docs(ioc-sources): suggest summary lines for Riposte context enrichment rules

2026-10-09 22:53:04 +00:00

recorded-future

feat(recorded-future): Recorded Future + ASI integrations

2026-06-27 15:19:40 +02:00

recorded-future-asi

feat(recorded-future): Recorded Future + ASI integrations

2026-06-27 15:19:40 +02:00

rocketchat

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

runzero

feat(runzero): new runZero asset-inventory integration

2026-07-12 14:41:42 +02:00

sailpoint

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

scaleway

feat(scaleway): new Scaleway cloud integration (French vendor)

2026-07-12 21:37:31 +02:00

securitytrails

feat(securitytrails): new SecurityTrails enrichment integration

2026-07-11 22:48:48 +02:00

sekoia-intelligence-center

feat(sekoia): Sekoia XDR + SEKOIA Intelligence Center integrations

2026-06-27 15:04:22 +02:00

sekoia-xdr

fix(sekoia-xdr): mapper reviewed on a real alert (1.2.0)

2026-10-07 09:13:03 +00:00

sentinelone

feat(sentinelone): list the UAM alert statuses as an enum (1.18.0)

2026-10-01 20:26:45 +00:00

sentinelone-sdl

feat: SentinelOne SDL + VirusTotal Hunting integrations

2026-06-27 15:34:42 +02:00

servicenow

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

servicenow-cmdb

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

servicenow-iam

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

shodan

chore: bump ipinfo/shodan/virustotal to regenerate form-based scripts

2026-06-26 00:18:06 +02:00

signalsciences

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

slack

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

snyk

feat(snyk): new Snyk appsec-posture integration

2026-07-12 15:18:48 +02:00

sophos-central

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

splunk

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

stormshield

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

sumologic

feat(sumologic): new Sumo Logic log-search integration

2026-07-12 15:08:51 +02:00

symantec-dlp

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

tehtris

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

telegram

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

tenable-io

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

thehive

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

thinkst-canary

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

threatconnect

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

threatfox

feat(threatfox): new ThreatFox IOC-intel integration

2026-07-12 14:58:07 +02:00

threatq

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

trend-vision-one

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

triage

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

twilio

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

urlhaus

feat(urlhaus): new URLhaus malicious-URL intel integration

2026-07-12 14:15:54 +02:00

urlscan

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

vade

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

vault

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

vectra

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

virustotal

feat(virustotal): complete v3 command coverage (script-based)

2026-06-27 15:53:22 +02:00

virustotal-hunting

feat: SentinelOne SDL + VirusTotal Hunting integrations

2026-06-27 15:34:42 +02:00

vmray

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

wallix-bastion

feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)

2026-07-12 16:07:38 +02:00

webhook

feat(webhook): outbound webhooks to any third-party solution (v1.0.0)

2026-09-18 08:25:34 +00:00

withsecure

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

wiz

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

yaraify

feat(yaraify): new YARAify file/YARA-intel integration

2026-07-12 14:58:08 +02:00

zendesk

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

zscaler

feat: declare a risk tier on every command in the catalog

2026-09-08 12:55:20 +02:00

zscaler-zpa

feat(zscaler-zpa): new Zscaler Private Access integration

2026-07-12 00:37:11 +02:00