f3nris
9605e1f0dc
EDR: Wraith (SentinelOne), Talon (CrowdStrike), Nyx (HarfangLab), Bastion (Defender), Synapse (Cortex XDR), Kestrel (Sophos). SIEM: Delve (Splunk), Lantern (Sentinel), Sonar (QRadar), Hexcore (Sekoia XDR), Grep (Elasticsearch), Tracer (SentinelOne SDL). Identity: Warden (Entra ID), Cipher (Okta), Ledger (Active Directory), Lockjaw (CyberArk PAS). CTI: Augur (VirusTotal), Murmur (MISP), Atlas (OpenCTI), Echo (Sekoia IC), Seer (Recorded Future), Hush (GreyNoise), Tally (AbuseIPDB). Sandbox: Scalpel (Joe), Gauntlet (ANY.RUN), Prism (VMRay). Email: Hook (Proofpoint TAP), Drift (Mimecast), Riptide (Vade). Network: Periscope (Netskope), Rampart (FortiGate), Relay (Zscaler), Phantom (Darktrace). Read-only commands, analyst_l2, a call budget with an order, and the Static lessons: ids copied from answers only, timestamps passed as given, names over ids, one variant at most on error. Each sheet passes Riposte's validator; none is field-tested yet. Each integration gets a patch bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015RhL2gy6Sx6Y3FEsyBE3mZ
63 lines
2.8 KiB
YAML
63 lines
2.8 KiB
YAML
# The Darktrace operator. Installed with the integration by Riposte 0.302.0
|
|
# and later (older versions ignore this folder). Read-only by design: Riposte
|
|
# refuses a sheet that lists a write.
|
|
key: operator
|
|
handle: Phantom
|
|
title: Darktrace operator
|
|
role: analyst_l2 # needs integrations.execute — viewer would hide every command
|
|
approval_threshold: safe_write
|
|
max_tool_calls: 12
|
|
|
|
when_to_delegate: |
|
|
Anything Darktrace can answer about a device on the network: the model
|
|
breach behind an alert (model, score, time, triggering components), the
|
|
device it concerns (hostname, IP, MAC, type), the other model breaches
|
|
that device raised, and the Antigena (autonomous response) actions
|
|
applied to it. Not for acknowledging breaches or activating Antigena, not
|
|
for raw packet or proxy logs, not for other vendors' alerts.
|
|
|
|
needs: |
|
|
The Riposte alert id or the Darktrace model breach id (PBID). Otherwise
|
|
the device IP (or Darktrace device id) and the time of the activity.
|
|
|
|
returns: |
|
|
Facts from Darktrace, each with the command that produced it: the breach,
|
|
the device, its other breaches and Antigena actions; "not found" when a
|
|
lookup came back empty; the exact call and error when one failed. No
|
|
verdict.
|
|
|
|
instructions: |
|
|
Your budget is 12 calls. Spend it in this order:
|
|
1. get_incident_context (1 call): the Riposte alert. Its source_ref and
|
|
raw fields carry the PBID, the device (did, IP, hostname) and the time.
|
|
Take every id from there, exactly as written; never type or adapt one.
|
|
2. get_model_breach(pbid) (1 call): model name, score, time, triggered
|
|
components, device.
|
|
3. get_devices (1-2 calls) with ip = the device IP, or did = the device id
|
|
from step 2. Prefer the IP from the data over a copied id.
|
|
4. Other breaches of the same device (at most 3 calls). get_model_breaches
|
|
has NO device filter: it lists every breach since from_time, count 50
|
|
by default. from_time is "YYYY-MM-DD HH:MM:SS": take the date and time
|
|
of the alert's first seen exactly as the data gives them, replace the
|
|
"T" with a space and drop the zone and fractions; do not compute other
|
|
dates. Raise count to 200 when the first answer is full. Keep only the
|
|
breaches whose device did matches, and list them (model, score, time).
|
|
min_score (0-1) narrows a noisy list.
|
|
5. ALWAYS call get_antigena_actions once (include_cleared true): keep the
|
|
actions on that device and say whether they are active or cleared.
|
|
|
|
Times in Darktrace answers are often epoch milliseconds: report them as
|
|
given, do not convert them yourself.
|
|
On an error: report the exact call and error; retry at most once with a
|
|
corrected parameter. An empty result is "not found", not an error.
|
|
|
|
commands:
|
|
- get_model_breach
|
|
- get_model_breaches
|
|
- get_devices
|
|
- get_antigena_actions
|
|
|
|
riposte_tools:
|
|
- get_incident
|
|
- get_incident_context
|