Guillaume BOURGEOIS
ac6a52cecd
4 commands: indicator lookup, scan submission, scan-result retrieval. API-key auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
54 lines
1.9 KiB
YAML
54 lines
1.9 KiB
YAML
id: pulsedive
|
|
name: Pulsedive
|
|
version: 1.0.0
|
|
description: "Pulsedive (API) — reputation and threat context for any indicator (IP, domain, URL or hash), plus on-demand scanning and scan-result retrieval. API-key authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: indicator lookup, scan submission and scan-result retrieval."
|
|
category: enrichment
|
|
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "Pulsedive API key"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_key
|
|
|
|
commands:
|
|
- id: lookup_indicator
|
|
name: pulsedive-lookup-indicator
|
|
description: "Look up the reputation and threat context of an indicator (IP, domain, URL or hash)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
indicator: { type: string, description: "Indicator value (IP, domain, URL or hash)" }
|
|
required: [indicator]
|
|
outputs_schema: { properties: {} }
|
|
- id: scan
|
|
name: pulsedive-scan
|
|
description: "Submit an indicator for an on-demand scan. Returns a qid; retrieve the report with pulsedive-scan-result once it finishes."
|
|
inputs_schema:
|
|
properties:
|
|
value: { type: string, description: "Indicator to scan (IP, domain or URL)" }
|
|
probe: { type: boolean, description: "Actively probe the indicator (default true)" }
|
|
required: [value]
|
|
outputs_schema: { properties: {} }
|
|
- id: scan_result
|
|
name: pulsedive-scan-result
|
|
description: "Retrieve the result of a scan by its qid."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
qid: { type: string, description: "Scan qid (from pulsedive-scan)" }
|
|
required: [qid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: pulsedive-test-connection
|
|
description: "Verify the API key (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|