f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
e19530d3f369412486a6ebe59401c4dc00d8a186
riposte-marketplace/integrations
T
History
f3nris e19530d3f3 fix(rapid7-insightidr): read the evidence in both of its shapes (v1.9.2) 
evidence_fields came back {} on a live run. The evidence was fetched, the run
was clean — one call, 1.3s, no error — and the parser found nothing in it.

`data` does not have one shape. The parser was written against an unparsed
Fortigate source and looked only for {source_data, custom_data}. A PARSED
source has no such wrapper: the event is the object.

  {user, account, source_ip, geoip_country_code, geoip_organization,
   result, service, user_agent, source_json{…}, r7_context{…},
   detection_context{…}}

Every one of those is what the incident was missing, sitting one json.loads
away, and the parser walked past all of it and returned an empty dict. No error
— which is how it survived a run that reported success.

Now both are read as a union rather than one or the other: scalars at the top
level are always taken, so a third shape still yields its plain fields instead
of nothing, and the wrapped keys are overlaid when present. source_json is
skipped — several kilobytes of vendor payload that stay in the raw line —
while r7_context and detection_context are flattened one level, being Rapid7's
own annotations and the same across parsed sources. They carry the account age
in minutes, which is exactly what says whether a sign-in is from a new account.

The Azure AD sign-in now maps to src_endpoint.ip, .isp_org and
.location.country, actor.user.name/.uid/.account.name, http_request.user_agent
and metadata.product.feature.name, and indexes the address and the account.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-08 16:19:08 +02:00
..
abuseipdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
active-directory
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
alienvault-otx
feat(alienvault-otx): new AlienVault OTX enrichment integration
2026-07-11 22:33:10 +02:00
anomali-threatstream
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
anyrun
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
armis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
automox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
aws
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
axonius
feat(axonius): new Axonius asset-management integration
2026-07-12 14:41:43 +02:00
azure-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
beyondtrust-password-safe
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
binaryedge
feat(binaryedge): new BinaryEdge exposure-intel integration
2026-07-12 14:15:54 +02:00
box
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cape
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
carbon-black-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
censys
feat(censys): new Censys enrichment integration
2026-07-11 22:39:29 +02:00
checkpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
chronicle
feat(chronicle): new Google Chronicle SIEM integration
2026-07-12 00:25:51 +02:00
cisco-fmc
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-ise
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-secure-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-umbrella-enforcement
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cloudflare
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
confluence
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cortex-xdr
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
crowdsec
feat(crowdsec): new CrowdSec CTI integration (French vendor)
2026-07-12 16:07:37 +02:00
crowdstrike
feat(crowdstrike): fetch incrementally via a created_from watermark (v1.3.0)
2026-09-01 22:47:46 +02:00
cuckoo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybelangel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cyberark-pas
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybereason
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
darktrace
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
datadog
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
delinea-secret-server
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
discord
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
domaintools
feat(domaintools): new DomainTools DNS-intel integration
2026-07-12 21:59:05 +02:00
dropbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
duo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
eclecticiq
feat(eclecticiq): new EclecticIQ threat-intel integration
2026-07-12 15:49:16 +02:00
efficientip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
elasticsearch
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
emailrep
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
extrahop
feat(extrahop): new ExtraHop Reveal(x) NDR integration
2026-07-12 00:48:03 +02:00
f5-bigip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
feed-aws-ipranges
feat(feed): add AWS IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:48 +02:00
feed-blocklist-de
feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)
2026-07-12 22:59:19 +02:00
feed-botvrij
feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)
2026-07-13 12:15:50 +02:00
feed-cins-army
feat(feed): add CINS Army feed connector (CI Army bad-guys list)
2026-07-12 22:59:20 +02:00
feed-cisa-kev
feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)
2026-07-13 12:12:34 +02:00
feed-cloudflare-ips
feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-csv
feat(feed-csv): new generic CSV threat-intel feed connector
2026-07-12 22:43:16 +02:00
feed-dshield
feat(feed): add DShield block list feed connector (SANS ISC)
2026-07-12 22:59:18 +02:00
feed-emergingthreats
feat(feed): add Emerging Threats feed connector (ET Open reputation lists)
2026-07-12 23:02:11 +02:00
feed-feodotracker
feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)
2026-07-12 22:49:28 +02:00
feed-first-epss
feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)
2026-07-13 12:12:35 +02:00
feed-gcp-ipranges
feat(feed): add GCP IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-json
feat(feed): add generic JSON feed connector (configurable field mapping)
2026-07-12 23:02:10 +02:00
feed-nvd
feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)
2026-07-13 12:12:34 +02:00
feed-office365
feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)
2026-07-13 12:15:50 +02:00
feed-openphish
feat(feed): add OpenPhish feed connector (community phishing URLs)
2026-07-12 23:02:11 +02:00
feed-plaintext
feat(feed-plaintext): new generic plain-text threat-intel feed connector
2026-07-12 22:43:17 +02:00
feed-rss
feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)
2026-07-13 12:15:49 +02:00
feed-spamhaus-drop
feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)
2026-07-12 22:49:30 +02:00
feed-sslbl
feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)
2026-07-12 22:56:36 +02:00
feed-taxii2
feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector
2026-07-12 22:43:17 +02:00
feed-threatfox
feat(feed): add ThreatFox feed connector (abuse.ch IOC export)
2026-07-12 22:56:36 +02:00
feed-tor-exit
feat(feed): add Tor exit nodes feed connector
2026-07-12 22:49:29 +02:00
feed-urlhaus
feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)
2026-07-12 22:56:35 +02:00
forcepoint-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
fortigate
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
freshservice
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gatewatcher
feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)
2026-07-12 16:12:38 +02:00
gcp-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
github
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gitlab
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
glimps
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail-single-user
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-calendar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-drive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
graylog
feat(graylog): new Graylog log-search integration
2026-07-12 15:08:50 +02:00
greynoise
feat(greynoise): new GreyNoise enrichment integration
2026-07-11 22:33:09 +02:00
harfanglab
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
hibp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
hunter
feat(hunter): new Hunter.io email-OSINT integration
2026-07-12 14:15:53 +02:00
hybrid-analysis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
imperva
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
infoblox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intel471
feat(intel471): new Intel 471 threat-intel integration
2026-07-12 15:49:17 +02:00
intezer
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intune
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ipinfo
feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)
2026-08-05 21:01:43 +02:00
ipqualityscore
feat(ipqualityscore): new IPQualityScore enrichment integration
2026-07-11 22:58:17 +02:00
jira
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
joe-sandbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
jumpcloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mail-sender
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mailinblack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
maltiverse
feat(maltiverse): new Maltiverse enrichment integration
2026-07-11 22:39:29 +02:00
malwarebazaar
feat(malwarebazaar): new MalwareBazaar sample-intel integration
2026-07-12 14:58:07 +02:00
mandiant
feat(mandiant): new Mandiant Advantage threat-intel integration
2026-07-12 00:15:12 +02:00
mattermost
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
meraki
feat(meraki): new Cisco Meraki network integration
2026-07-12 21:53:58 +02:00
microsoft-defender-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-defender-o365
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-entra-id
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-graph-files
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-purview
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-sentinel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-teams
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mimecast
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
misp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mock-edr-s1
fix(mock-edr-s1): map the OCSF-shaped incident payload
2026-06-27 16:20:53 +02:00
netskope
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
okta
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
onelogin
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
opencti
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
openldap
feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)
2026-06-26 17:44:54 +02:00
opsgenie
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ovhcloud
feat(ovhcloud): new OVHcloud integration (French vendor)
2026-07-12 21:13:23 +02:00
pagerduty
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
panos
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
pingone
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
prisma-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
proofpoint-tap
feat(proofpoint-tap): new Proofpoint TAP email-threat integration
2026-07-11 23:46:35 +02:00
pulsedive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qradar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qualys
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ransomware-live
fix(ransomware-live): keyless — drop optional API key, no auth required
2026-07-15 19:18:49 +02:00
rapid7-insightidr
fix(rapid7-insightidr): read the evidence in both of its shapes (v1.9.2)
2026-09-08 16:19:08 +02:00
rapid7-insightvm
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
recorded-future
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
recorded-future-asi
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
rocketchat
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
runzero
feat(runzero): new runZero asset-inventory integration
2026-07-12 14:41:42 +02:00
sailpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
scaleway
feat(scaleway): new Scaleway cloud integration (French vendor)
2026-07-12 21:37:31 +02:00
securitytrails
feat(securitytrails): new SecurityTrails enrichment integration
2026-07-11 22:48:48 +02:00
sekoia-intelligence-center
feat(sekoia): Sekoia XDR + SEKOIA Intelligence Center integrations
2026-06-27 15:04:22 +02:00
sekoia-xdr
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
sentinelone
feat(sentinelone): declare a risk tier on every command (v1.9.0)
2026-09-07 16:26:05 +02:00
sentinelone-sdl
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
servicenow
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-cmdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-iam
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
shodan
chore: bump ipinfo/shodan/virustotal to regenerate form-based scripts
2026-06-26 00:18:06 +02:00
signalsciences
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
slack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
snyk
feat(snyk): new Snyk appsec-posture integration
2026-07-12 15:18:48 +02:00
sophos-central
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
splunk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
stormshield
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
sumologic
feat(sumologic): new Sumo Logic log-search integration
2026-07-12 15:08:51 +02:00
symantec-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tehtris
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
telegram
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tenable-io
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thehive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thinkst-canary
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatconnect
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatfox
feat(threatfox): new ThreatFox IOC-intel integration
2026-07-12 14:58:07 +02:00
threatq
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
trend-vision-one
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
triage
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
twilio
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
urlhaus
feat(urlhaus): new URLhaus malicious-URL intel integration
2026-07-12 14:15:54 +02:00
urlscan
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vade
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vault
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vectra
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
virustotal
feat(virustotal): complete v3 command coverage (script-based)
2026-06-27 15:53:22 +02:00
virustotal-hunting
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
vmray
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wallix-bastion
feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)
2026-07-12 16:07:38 +02:00
withsecure
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wiz
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
yaraify
feat(yaraify): new YARAify file/YARA-intel integration
2026-07-12 14:58:08 +02:00
zendesk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler-zpa
feat(zscaler-zpa): new Zscaler Private Access integration
2026-07-12 00:37:11 +02:00