f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
da2fcbba6cbfe0132252d99535ef7f07045db100
riposte-marketplace/integrations
T
History
f3nris da2fcbba6c fix(sentinelone): map the unified alert as a real one is shaped (v1.14.0) 
Checked against a live STAR alert, three of the details mappings were wrong
about where the data actually sits.

Its alert-level observables list is empty while all twelve observables sit
under the indicators, so the mapper saw none. The two lists are appended now
rather than reading the alert level alone.

The same alert has process.username null while its indicators name the user
(src.process.user), and names its parent process without hashing it anywhere
else. actor.user.name and the parent process path and hashes are read from the
indicator observables, with the alert's own field winning where it is filled
in, so nothing regresses on an alert that does populate it.

attacks and relatedAlerts are guarded on $count rather than $exists: that
alert carries "attacks": null, and null exists in JSONata — the entry would
have written an empty array onto every alert without an ATT&CK mapping.

Verified by running the whole mapper through the scheduler's own jsonata-go
build on that payload, with and without with_details: 95 entries, no empty
arrays, and the plain list fetch still falls back to the fileName/fileHash
observable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Rk9N6vNtp3q7YvLpjcc
2026-09-09 12:38:21 +00:00
..
abuseipdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
active-directory
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
alienvault-otx
feat(alienvault-otx): new AlienVault OTX enrichment integration
2026-07-11 22:33:10 +02:00
anomali-threatstream
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
anyrun
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
armis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
automox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
aws
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
axonius
feat(axonius): new Axonius asset-management integration
2026-07-12 14:41:43 +02:00
azure-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
beyondtrust-password-safe
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
binaryedge
feat(binaryedge): new BinaryEdge exposure-intel integration
2026-07-12 14:15:54 +02:00
box
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cape
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
carbon-black-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
censys
feat(censys): new Censys enrichment integration
2026-07-11 22:39:29 +02:00
checkpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
chronicle
feat(chronicle): new Google Chronicle SIEM integration
2026-07-12 00:25:51 +02:00
cisco-fmc
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-ise
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-secure-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-umbrella-enforcement
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cloudflare
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
confluence
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cortex-xdr
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
crowdsec
feat(crowdsec): new CrowdSec CTI integration (French vendor)
2026-07-12 16:07:37 +02:00
crowdstrike
feat(crowdstrike): fetch incrementally via a created_from watermark (v1.3.0)
2026-09-01 22:47:46 +02:00
cuckoo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybelangel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cyberark-pas
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybereason
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
darktrace
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
datadog
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
delinea-secret-server
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
discord
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
domaintools
feat(domaintools): new DomainTools DNS-intel integration
2026-07-12 21:59:05 +02:00
dropbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
duo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
eclecticiq
feat(eclecticiq): new EclecticIQ threat-intel integration
2026-07-12 15:49:16 +02:00
efficientip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
elasticsearch
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
emailrep
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
extrahop
feat(extrahop): new ExtraHop Reveal(x) NDR integration
2026-07-12 00:48:03 +02:00
f5-bigip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
feed-aws-ipranges
feat(feed): add AWS IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:48 +02:00
feed-blocklist-de
feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)
2026-07-12 22:59:19 +02:00
feed-botvrij
feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)
2026-07-13 12:15:50 +02:00
feed-cins-army
feat(feed): add CINS Army feed connector (CI Army bad-guys list)
2026-07-12 22:59:20 +02:00
feed-cisa-kev
feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)
2026-07-13 12:12:34 +02:00
feed-cloudflare-ips
feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-csv
feat(feed-csv): new generic CSV threat-intel feed connector
2026-07-12 22:43:16 +02:00
feed-dshield
feat(feed): add DShield block list feed connector (SANS ISC)
2026-07-12 22:59:18 +02:00
feed-emergingthreats
feat(feed): add Emerging Threats feed connector (ET Open reputation lists)
2026-07-12 23:02:11 +02:00
feed-feodotracker
feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)
2026-07-12 22:49:28 +02:00
feed-first-epss
feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)
2026-07-13 12:12:35 +02:00
feed-gcp-ipranges
feat(feed): add GCP IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-json
feat(feed): add generic JSON feed connector (configurable field mapping)
2026-07-12 23:02:10 +02:00
feed-nvd
feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)
2026-07-13 12:12:34 +02:00
feed-office365
feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)
2026-07-13 12:15:50 +02:00
feed-openphish
feat(feed): add OpenPhish feed connector (community phishing URLs)
2026-07-12 23:02:11 +02:00
feed-plaintext
feat(feed-plaintext): new generic plain-text threat-intel feed connector
2026-07-12 22:43:17 +02:00
feed-rss
feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)
2026-07-13 12:15:49 +02:00
feed-spamhaus-drop
feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)
2026-07-12 22:49:30 +02:00
feed-sslbl
feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)
2026-07-12 22:56:36 +02:00
feed-taxii2
feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector
2026-07-12 22:43:17 +02:00
feed-threatfox
feat(feed): add ThreatFox feed connector (abuse.ch IOC export)
2026-07-12 22:56:36 +02:00
feed-tor-exit
feat(feed): add Tor exit nodes feed connector
2026-07-12 22:49:29 +02:00
feed-urlhaus
feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)
2026-07-12 22:56:35 +02:00
forcepoint-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
fortigate
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
freshservice
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gatewatcher
feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)
2026-07-12 16:12:38 +02:00
gcp-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
github
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gitlab
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
glimps
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail-single-user
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-calendar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-drive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
graylog
feat(graylog): new Graylog log-search integration
2026-07-12 15:08:50 +02:00
greynoise
feat(greynoise): new GreyNoise enrichment integration
2026-07-11 22:33:09 +02:00
harfanglab
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
hibp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
hunter
feat(hunter): new Hunter.io email-OSINT integration
2026-07-12 14:15:53 +02:00
hybrid-analysis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
imperva
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
infoblox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intel471
feat(intel471): new Intel 471 threat-intel integration
2026-07-12 15:49:17 +02:00
intezer
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intune
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ipinfo
feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)
2026-08-05 21:01:43 +02:00
ipqualityscore
feat(ipqualityscore): new IPQualityScore enrichment integration
2026-07-11 22:58:17 +02:00
jira
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
joe-sandbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
jumpcloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mail-sender
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mailinblack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
maltiverse
feat(maltiverse): new Maltiverse enrichment integration
2026-07-11 22:39:29 +02:00
malwarebazaar
feat(malwarebazaar): new MalwareBazaar sample-intel integration
2026-07-12 14:58:07 +02:00
mandiant
feat(mandiant): new Mandiant Advantage threat-intel integration
2026-07-12 00:15:12 +02:00
mattermost
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
meraki
feat(meraki): new Cisco Meraki network integration
2026-07-12 21:53:58 +02:00
microsoft-defender-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-defender-o365
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-entra-id
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-graph-files
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-purview
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-sentinel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-teams
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mimecast
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
misp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mock-edr-s1
fix(mock-edr-s1): map the OCSF-shaped incident payload
2026-06-27 16:20:53 +02:00
netskope
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
okta
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
onelogin
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
opencti
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
openldap
feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)
2026-06-26 17:44:54 +02:00
opsgenie
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ovhcloud
feat(ovhcloud): new OVHcloud integration (French vendor)
2026-07-12 21:13:23 +02:00
pagerduty
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
panos
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
pingone
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
prisma-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
proofpoint-tap
feat(proofpoint-tap): new Proofpoint TAP email-threat integration
2026-07-11 23:46:35 +02:00
pulsedive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qradar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qualys
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ransomware-live
fix(ransomware-live): keyless — drop optional API key, no auth required
2026-07-15 19:18:49 +02:00
rapid7-insightidr
feat(rapid7-insightidr): evidence rows for the table field (v1.11.0)
2026-09-09 11:57:10 +02:00
rapid7-insightvm
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
recorded-future
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
recorded-future-asi
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
rocketchat
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
runzero
feat(runzero): new runZero asset-inventory integration
2026-07-12 14:41:42 +02:00
sailpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
scaleway
feat(scaleway): new Scaleway cloud integration (French vendor)
2026-07-12 21:37:31 +02:00
securitytrails
feat(securitytrails): new SecurityTrails enrichment integration
2026-07-11 22:48:48 +02:00
sekoia-intelligence-center
feat(sekoia): Sekoia XDR + SEKOIA Intelligence Center integrations
2026-06-27 15:04:22 +02:00
sekoia-xdr
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
sentinelone
fix(sentinelone): map the unified alert as a real one is shaped (v1.14.0)
2026-09-09 12:38:21 +00:00
sentinelone-sdl
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
servicenow
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-cmdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-iam
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
shodan
chore: bump ipinfo/shodan/virustotal to regenerate form-based scripts
2026-06-26 00:18:06 +02:00
signalsciences
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
slack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
snyk
feat(snyk): new Snyk appsec-posture integration
2026-07-12 15:18:48 +02:00
sophos-central
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
splunk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
stormshield
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
sumologic
feat(sumologic): new Sumo Logic log-search integration
2026-07-12 15:08:51 +02:00
symantec-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tehtris
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
telegram
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tenable-io
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thehive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thinkst-canary
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatconnect
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatfox
feat(threatfox): new ThreatFox IOC-intel integration
2026-07-12 14:58:07 +02:00
threatq
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
trend-vision-one
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
triage
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
twilio
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
urlhaus
feat(urlhaus): new URLhaus malicious-URL intel integration
2026-07-12 14:15:54 +02:00
urlscan
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vade
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vault
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vectra
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
virustotal
feat(virustotal): complete v3 command coverage (script-based)
2026-06-27 15:53:22 +02:00
virustotal-hunting
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
vmray
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wallix-bastion
feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)
2026-07-12 16:07:38 +02:00
withsecure
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wiz
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
yaraify
feat(yaraify): new YARAify file/YARA-intel integration
2026-07-12 14:58:08 +02:00
zendesk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler-zpa
feat(zscaler-zpa): new Zscaler Private Access integration
2026-07-12 00:37:11 +02:00