f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
fb560cc9379e89328e83322ed9849a26d4d81936
riposte-marketplace/integrations
T
History
f3nris fb560cc937 rapid7-insightidr 1.14.8: user_authentications counts the user's own logons 
The keyword search matches the account name anywhere in a line, so it brought
other accounts' logons: on a real run the only "new" event reported was
another user's failed password. Only events whose account/user field is the
user (DOMAIN\\user and user@domain normalized) are summarized now, with
keyword_matches and user_matches both reported. A first authentication is
recognized as Rapid7 flags it, a boolean new_authentication field, as well as
the word. The event limit cannot be set below 10000 (the agent passed 1000).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
2026-10-12 07:53:57 +00:00
..
abuseipdb
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
active-directory
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
alienvault-otx
feat(alienvault-otx): new AlienVault OTX enrichment integration
2026-07-11 22:33:10 +02:00
anomali-threatstream
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
anyrun
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
armis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
automox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
aws
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
axonius
feat(axonius): new Axonius asset-management integration
2026-07-12 14:41:43 +02:00
azure-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
beyondtrust-password-safe
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
binaryedge
feat(binaryedge): new BinaryEdge exposure-intel integration
2026-07-12 14:15:54 +02:00
box
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cape
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
carbon-black-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
censys
feat(censys): new Censys enrichment integration
2026-07-11 22:39:29 +02:00
checkpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
chronicle
feat(chronicle): new Google Chronicle SIEM integration
2026-07-12 00:25:51 +02:00
circl-hashlookup
docs(ioc-sources): suggest summary lines for Riposte context enrichment rules
2026-10-09 22:53:04 +00:00
cisco-fmc
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-ise
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-secure-endpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cisco-umbrella-enforcement
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cloudflare
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
confluence
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cortex-xdr
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
crowdsec
feat(crowdsec): new CrowdSec CTI integration (French vendor)
2026-07-12 16:07:37 +02:00
crowdstrike
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
crtsh
feat(crtsh): Cert Spotter fallback and a 60 s time budget (1.1.0)
2026-10-10 21:12:15 +00:00
cuckoo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cybelangel
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
cyberark-pas
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
cybereason
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
darktrace
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
datadog
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
delinea-secret-server
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
discord
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
domaintools
feat(domaintools): new DomainTools DNS-intel integration
2026-07-12 21:59:05 +02:00
dropbox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
duo
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
eclecticiq
feat(eclecticiq): new EclecticIQ threat-intel integration
2026-07-12 15:49:16 +02:00
efficientip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
elasticsearch
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
emailrep
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
extrahop
feat(extrahop): new ExtraHop Reveal(x) NDR integration
2026-07-12 00:48:03 +02:00
f5-bigip
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
feed-aws-ipranges
feat(feed): add AWS IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:48 +02:00
feed-blocklist-de
feat(feed): add Blocklist.de feed connector (fail2ban attacker lists)
2026-07-12 22:59:19 +02:00
feed-botvrij
feat(feed): add Botvrij.eu OSINT feed connector (IOC lists by type)
2026-07-13 12:15:50 +02:00
feed-cins-army
feat(feed): add CINS Army feed connector (CI Army bad-guys list)
2026-07-12 22:59:20 +02:00
feed-cisa-kev
feat(feed): add CISA KEV feed connector (known exploited vulnerabilities)
2026-07-13 12:12:34 +02:00
feed-cloudflare-ips
feat(feed): add Cloudflare IPs feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-csv
feat(feed-csv): new generic CSV threat-intel feed connector
2026-07-12 22:43:16 +02:00
feed-dshield
feat(feed): add DShield block list feed connector (SANS ISC)
2026-07-12 22:59:18 +02:00
feed-emergingthreats
feat(feed): add Emerging Threats feed connector (ET Open reputation lists)
2026-07-12 23:02:11 +02:00
feed-feodotracker
feat(feed): add Feodo Tracker feed connector (abuse.ch C2 IP blocklist)
2026-07-12 22:49:28 +02:00
feed-first-epss
feat(feed): add FIRST EPSS feed connector (exploit-prediction scores)
2026-07-13 12:12:35 +02:00
feed-gcp-ipranges
feat(feed): add GCP IP ranges feed connector (allowlist / known infra)
2026-07-13 12:08:49 +02:00
feed-json
feat(feed): add generic JSON feed connector (configurable field mapping)
2026-07-12 23:02:10 +02:00
feed-nvd
feat(feed): add NVD CVE feed connector (recent CVEs, NVD 2.0 API)
2026-07-13 12:12:34 +02:00
feed-office365
feat(feed): add Microsoft 365 endpoints feed connector (allowlist / known infra)
2026-07-13 12:15:50 +02:00
feed-openphish
feat(feed): add OpenPhish feed connector (community phishing URLs)
2026-07-12 23:02:11 +02:00
feed-plaintext
feat(feed-plaintext): new generic plain-text threat-intel feed connector
2026-07-12 22:43:17 +02:00
feed-rss
feat(feed): add generic RSS/Atom IOC feed connector (URL/IP/hash extraction, defang-aware)
2026-07-13 12:15:49 +02:00
feed-spamhaus-drop
feat(feed): add Spamhaus DROP feed connector (DROP/DROPv6/ASN-DROP)
2026-07-12 22:49:30 +02:00
feed-sslbl
feat(feed): add SSL Blacklist feed connector (abuse.ch C2 IP/fingerprint lists)
2026-07-12 22:56:36 +02:00
feed-taxii2
feat(feed-taxii2): new generic TAXII 2.1 / STIX feed connector
2026-07-12 22:43:17 +02:00
feed-threatfox
feat(feed): add ThreatFox feed connector (abuse.ch IOC export)
2026-07-12 22:56:36 +02:00
feed-tor-exit
feat(feed): add Tor exit nodes feed connector
2026-07-12 22:49:29 +02:00
feed-urlhaus
feat(feed): add URLhaus feed connector (abuse.ch malware URL feed)
2026-07-12 22:56:35 +02:00
forcepoint-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
fortigate
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
freshservice
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gatewatcher
feat(gatewatcher): new Gatewatcher AionIQ NDR integration (French vendor)
2026-07-12 16:12:38 +02:00
gcp-security
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
github
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gitlab
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
glimps
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
gmail-single-user
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-calendar
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
google-drive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
graylog
feat(graylog): new Graylog log-search integration
2026-07-12 15:08:50 +02:00
greynoise
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
harfanglab
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
hibp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
hunter
feat(hunter): new Hunter.io email-OSINT integration
2026-07-12 14:15:53 +02:00
hybrid-analysis
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
imperva
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
infoblox
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intel471
feat(intel471): new Intel 471 threat-intel integration
2026-07-12 15:49:17 +02:00
intezer
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
intune
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ipinfo
feat(ipinfo): support the Lite API for free/Lite plan tokens (v1.1.0)
2026-08-05 21:01:43 +02:00
ipqualityscore
feat(ipqualityscore): new IPQualityScore enrichment integration
2026-07-11 22:58:17 +02:00
jira
feat(jira): pick the project, issue type and priority from the site (1.3.0)
2026-10-02 10:16:41 +00:00
joe-sandbox
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
jumpcloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mail-sender
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mailinblack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
maltiverse
feat(maltiverse): new Maltiverse enrichment integration
2026-07-11 22:39:29 +02:00
malwarebazaar
feat(malwarebazaar): new MalwareBazaar sample-intel integration
2026-07-12 14:58:07 +02:00
mandiant
feat(mandiant): new Mandiant Advantage threat-intel integration
2026-07-12 00:15:12 +02:00
mattermost
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
meraki
feat(meraki): new Cisco Meraki network integration
2026-07-12 21:53:58 +02:00
microsoft-defender-endpoint
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
microsoft-defender-o365
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-entra-id
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
microsoft-graph-files
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-purview
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
microsoft-sentinel
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
microsoft-teams
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
mimecast
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
misp
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
mock-edr-s1
fix(mock-edr-s1): map the OCSF-shaped incident payload
2026-06-27 16:20:53 +02:00
netskope
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
okta
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
onelogin
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
opencti
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
openldap
feat(openldap): LDAP authentication integration (OpenLDAP / Active Directory)
2026-06-26 17:44:54 +02:00
opsgenie
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ovhcloud
fix(ovhcloud): treat the billing-account list as advice, never as a verdict (1.2.6)
2026-09-19 19:29:09 +00:00
pagerduty
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
panos
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
pingone
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
prisma-cloud
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
proofpoint-tap
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
pulsedive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
qradar
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
qualys
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
ransomware-live
fix(ransomware-live): keyless — drop optional API key, no auth required
2026-07-15 19:18:49 +02:00
rapid7-insightidr
rapid7-insightidr 1.14.8: user_authentications counts the user's own logons
2026-10-12 07:53:57 +00:00
rapid7-insightvm
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
rdap
docs(ioc-sources): suggest summary lines for Riposte context enrichment rules
2026-10-09 22:53:04 +00:00
recorded-future
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
recorded-future-asi
feat(recorded-future): Recorded Future + ASI integrations
2026-06-27 15:19:40 +02:00
rocketchat
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
runzero
feat(runzero): new runZero asset-inventory integration
2026-07-12 14:41:42 +02:00
sailpoint
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
scaleway
feat(scaleway): new Scaleway cloud integration (French vendor)
2026-07-12 21:37:31 +02:00
securitytrails
feat(securitytrails): new SecurityTrails enrichment integration
2026-07-11 22:48:48 +02:00
sekoia-intelligence-center
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
sekoia-xdr
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
sentinelone
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
sentinelone-sdl
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
servicenow
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-cmdb
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
servicenow-iam
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
shodan
chore: bump ipinfo/shodan/virustotal to regenerate form-based scripts
2026-06-26 00:18:06 +02:00
signalsciences
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
slack
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
snyk
feat(snyk): new Snyk appsec-posture integration
2026-07-12 15:18:48 +02:00
sophos-central
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
splunk
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
stormshield
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
sumologic
feat(sumologic): new Sumo Logic log-search integration
2026-07-12 15:08:51 +02:00
symantec-dlp
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tehtris
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
telegram
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
tenable-io
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thehive
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
thinkst-canary
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatconnect
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
threatfox
feat(threatfox): new ThreatFox IOC-intel integration
2026-07-12 14:58:07 +02:00
threatq
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
trend-vision-one
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
triage
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
twilio
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
urlhaus
feat(urlhaus): new URLhaus malicious-URL intel integration
2026-07-12 14:15:54 +02:00
urlscan
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vade
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
vault
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
vectra
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
virustotal
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
virustotal-hunting
feat: SentinelOne SDL + VirusTotal Hunting integrations
2026-06-27 15:34:42 +02:00
vmray
feat(agents): operator sheets for 33 integrations (lot 4)
2026-10-11 23:00:15 +00:00
wallix-bastion
feat(wallix-bastion): new WALLIX Bastion PAM integration (French vendor)
2026-07-12 16:07:38 +02:00
webhook
feat(webhook): outbound webhooks to any third-party solution (v1.0.0)
2026-09-18 08:25:34 +00:00
withsecure
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
wiz
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
yaraify
feat(yaraify): new YARAify file/YARA-intel integration
2026-07-12 14:58:08 +02:00
zendesk
feat: declare a risk tier on every command in the catalog
2026-09-08 12:55:20 +02:00
zscaler
zscaler 1.1.2: withdraw the Relay operator
2026-10-12 07:12:54 +00:00
zscaler-zpa
feat(zscaler-zpa): new Zscaler Private Access integration
2026-07-12 00:37:11 +02:00