diff --git a/Check Point/Reputation Service/OpenAPIs/check_point_reputation_service-1.0.0.json b/Check Point/Reputation Service/OpenAPIs/check_point_reputation_service-1.0.0.json new file mode 100644 index 0000000..249f239 --- /dev/null +++ b/Check Point/Reputation Service/OpenAPIs/check_point_reputation_service-1.0.0.json @@ -0,0 +1,353 @@ +{ + "openapi": "3.0.1", + "info": { + "title": "Check Point Reputation Service API", + "description": "## Introduction\nLeverage the Check Point’s threat intelligence to enrich your SIEM and SOAR solutions and secure your business applications and websites using simple RESTful APIs. \n\n| **Input** | **Output** |\n|-------|--------|\n| **URL, IP, File digest (md5/sha1/sha256)** | Reputation, Risk and Context |\n\n## Getting Started with the Reputation Service API\n### 1. Get your API Key \n[Contact us](mailto:TCAPI_SUPPORT@checkpoint.com) to get an API key\n\n
\n### 2. Request a session token\n* Use the provided client key to get a session token\n* The session token is **valid for 30min**. \n\nRequest example: \n```linux\ncurl -X GET \"https://rep.checkpoint.com/rep-auth/service/v1.0/request\" -H \"Client-Key: XXXXXXXXXXXXX\"\n```\n Response example: \n```\nexp=XXXXXXX~acl=XXXX/*~hmac=XXXXXXXXX\n```\n
\n\n### 3. Reputation Service Query\n* With your API Key and the generated session token you can query Reputation Service\n* Fill in the required service [url-rep / file-rep / ip-rep]\n* Fill in the requested resource\n* **Important**: The resource should be inserted in 2 places:\n * **Paylod** [Json / Request Body] \n * **Request parameter** [after ?resource=]. \n\nRequest example: \n```linux\ncurl -X POST \"https://rep.checkpoint.com/url-rep/service/v3.0/query?resource=ynet.co.il\" -H \"accept: application/json\" -H \"Client-Key: XXXXXXX\" -H \"token: exp=XXXXXXX~acl=XXXX/*~hmac=XXXXXXXXX -H \"Content-Type: application/json\" -d \"{\\\"request\\\":[{\\\"resource\\\":\\\"ynet.co.il\\\"}]}\"\n```\n\n Response example: \n```json\n{\n \"response\": [\n {\n \"status\": {\n \"code\": 2001,\n \"label\": \"SUCCESS\",\n \"message\": \"Succeeded to generate reputation\"\n },\n \"resource\": \"ynet.co.il\",\n \"reputation\": {\n \"classification\": \"Benign\",\n \"confidence\": \"High\",\n \"severity\": \"N/A\"\n },\n \"risk\": 0,\n \"context\": {\n \"categories\": [\n {\n \"id\": 24,\n \"name\": \"News / Media\"\n }\n ],\n \"indications\": [\n \"The URL is known benign by Check Point's Threat Cloud\",\n \"Domain is classified as News / Media\"\n ],\n \"safe\": true\n }\n }\n ]\n}\n```\n", + "version": "1.0.0" + }, + "servers": [ + { + "url": "https://rep.checkpoint.com" + } + ], + "paths": { + "/rep-auth/service/v1.0/request": { + "get": { + "summary": "Request a session token", + "tags": [ + "Authentication" + ], + "parameters": [ + { + "name": "Client-Key", + "in": "header", + "required": true, + "schema": { + "type": "string" + } + } + ], + "responses": { + "200": { + "description": "Sucess - the response is a token valild for 30 minutes" + }, + "400": { + "$ref": "#/components/responses/BadRequest" + }, + "401": { + "$ref": "#/components/responses/Unauthorized" + }, + "404": { + "$ref": "#/components/responses/NotFound" + } + } + } + }, + "/{service}-rep/service/v3.0/query": { + "post": { + "summary": "Query your resource", + "tags": [ + "Query" + ], + "parameters": [ + { + "name": "Client-Key", + "in": "header", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "token", + "in": "header", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "service", + "in": "path", + "description": "The service you want to query", + "required": true, + "schema": { + "type": "string", + "enum": [ + "url", + "ip", + "file" + ] + } + }, + { + "name": "resource", + "in": "query", + "description": "The resource you want to query", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ReputationRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ReputationResponse" + } + } + } + }, + "400": { + "$ref": "#/components/responses/BadRequest" + }, + "401": { + "$ref": "#/components/responses/Unauthorized" + }, + "403": { + "$ref": "#/components/responses/Forbidden" + }, + "404": { + "$ref": "#/components/responses/NotFound" + }, + "429": { + "$ref": "#/components/responses/TooManyRequests" + } + } + } + } + }, + "components": { + "responses": { + "Unauthorized": { + "description": "Invalid Client-Key header" + }, + "BadRequest": { + "description": "Bad Request - Check the request paremters" + }, + "Forbidden": { + "description": "Invalid token header" + }, + "TooManyRequests": { + "description": "Quota exceeded" + }, + "NotFound": { + "description": "The requested URL was not found" + } + }, + "schemas": { + "ReputationSingleRequest": { + "properties": { + "resource": { + "type": "string" + } + } + }, + "ReputationRequest": { + "properties": { + "request": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ReputationSingleRequest" + } + } + }, + "required": [ + "request" + ] + }, + "ReputationResponse": { + "properties": { + "risk": { + "type": "number", + "example": 0 + }, + "resource": { + "type": "string", + "example": "http://google.com" + }, + "reputation": { + "$ref": "#/components/schemas/ReputationClassification" + }, + "status": { + "$ref": "#/components/schemas/ReputationStatus" + }, + "context": { + "$ref": "#/components/schemas/ReputationResponseContext" + } + } + }, + "ReputationClassification": { + "properties": { + "classification": { + "type": "string", + "example": "Benign" + }, + "severity": { + "type": "string", + "enum": [ + "N/A", + "Low", + "Medium", + "High", + "Critical" + ] + }, + "Confidence": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High" + ] + } + } + }, + "ReputationStatus": { + "properties": { + "code": { + "type": "integer", + "enum": [ + 2001, + 2002 + ] + }, + "label": { + "type": "string", + "enum": [ + "SUCCESS", + "PARTIAL_SUCCESS" + ] + }, + "message": { + "type": "string", + "enum": [ + "Succeeded to generate reputation", + "Some vendors are unavailable" + ] + } + } + }, + "ReputationResponseContext": { + "type": "object", + "properties": { + "asn": { + "type": "number", + "description": "ASN of the IP (IP)" + }, + "as_owner": { + "type": "string", + "description": "ASN owner of the IP (IP)" + }, + "safe": { + "type": "boolean", + "description": "exists and true if certified safe (URL)" + }, + "malware_family": { + "type": "string", + "description": "the malware family associated with the resource (URL/FILE/IP)" + }, + "protection_name": { + "type": "string", + "description": "The protection name returned from Malware Service / AntiVirus (URL/FILE)" + }, + "redirections": { + "type": "array", + "description": "The redirections of the resource (URL)", + "items": { + "type": "string" + } + }, + "malware_types": { + "type": "array", + "description": "The malware types (FILE)", + "items": { + "type": "string" + } + }, + "categories": { + "type": "array", + "description": "URLF categories (URL)", + "items": { + "type": "string" + } + }, + "location": { + "type": "object", + "description": "geo location information (IP)", + "properties": { + "region": { + "type": "string" + }, + "city": { + "type": "string" + }, + "postalCode": { + "type": "string" + }, + "latitude": { + "type": "number" + }, + "longitude": { + "type": "number" + }, + "dma_code": { + "type": "integer" + }, + "area_code": { + "type": "integer" + }, + "metro_code": { + "type": "integer" + } + } + }, + "related_resources": { + "type": "object", + "description": "(FILE)", + "properties": { + "similar_files_found": { + "description": "How many similar files found", + "type": "number" + }, + "similar_files_details": { + "description": "Information about the similar file", + "type": "object", + "properties": { + "md5": { + "type": "string" + }, + "file_type": { + "type": "string" + }, + "classification": { + "type": "string" + }, + "malware_family": { + "type": "string" + }, + "confidence": { + "type": "string" + } + } + } + } + } + } + } + } + } +} diff --git a/Check Point/Reputation Service/OpenAPIs/check_point_reputation_service-latest.json b/Check Point/Reputation Service/OpenAPIs/check_point_reputation_service-latest.json new file mode 100644 index 0000000..3ad2574 --- /dev/null +++ b/Check Point/Reputation Service/OpenAPIs/check_point_reputation_service-latest.json @@ -0,0 +1,346 @@ +{ + "openapi": "3.0.1", + "info": { + "title": "Check Point Reputation Service", + "description": "Check Point's ThreatCloud reputation lookup service for URLs, IP addresses, and file hashes (md5/sha1/sha256), returning classification, risk score, and contextual threat data for SIEM/SOAR enrichment. Authentication: API key exchanged for a short-lived session token (see Connection Properties in the README).", + "version": "latest", + "x-vendor-api-version": "1.0.0", + "x-itential-curated": "Reviewed against the repo's common-CRUD-for-automation policy: the upstream spec has only two operations total. The session-token endpoint is modeled via dynamic-retrieval auth rather than as a callable operation, leaving 1 of 1 remaining upstream operations in scope: the resource reputation query. See the repo README for detail and the full spec." + }, + "servers": [ + { + "url": "https://rep.checkpoint.com" + } + ], + "security": [ + { + "token": [] + } + ], + "paths": { + "/{service}-rep/service/v3.0/query": { + "post": { + "summary": "Query your resource", + "tags": [ + "Query" + ], + "parameters": [ + { + "name": "Client-Key", + "in": "header", + "required": true, + "schema": { + "type": "string" + } + }, + { + "name": "service", + "in": "path", + "description": "The service you want to query", + "required": true, + "schema": { + "type": "string", + "enum": [ + "url", + "ip", + "file" + ] + } + }, + { + "name": "resource", + "in": "query", + "description": "The resource you want to query", + "required": true, + "schema": { + "type": "string" + } + } + ], + "requestBody": { + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ReputationRequest" + } + } + }, + "required": true + }, + "responses": { + "200": { + "description": "OK", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/ReputationResponse" + } + } + } + }, + "400": { + "$ref": "#/components/responses/BadRequest" + }, + "401": { + "$ref": "#/components/responses/Unauthorized" + }, + "403": { + "$ref": "#/components/responses/Forbidden" + }, + "404": { + "$ref": "#/components/responses/NotFound" + }, + "429": { + "$ref": "#/components/responses/TooManyRequests" + } + } + } + } + }, + "components": { + "responses": { + "Unauthorized": { + "description": "Invalid Client-Key header" + }, + "BadRequest": { + "description": "Bad Request - Check the request paremters" + }, + "Forbidden": { + "description": "Invalid token header" + }, + "TooManyRequests": { + "description": "Quota exceeded" + }, + "NotFound": { + "description": "The requested URL was not found" + } + }, + "schemas": { + "ReputationSingleRequest": { + "properties": { + "resource": { + "type": "string" + } + } + }, + "ReputationRequest": { + "properties": { + "request": { + "type": "array", + "items": { + "$ref": "#/components/schemas/ReputationSingleRequest" + } + } + }, + "required": [ + "request" + ] + }, + "ReputationResponse": { + "properties": { + "risk": { + "type": "number", + "example": 0 + }, + "resource": { + "type": "string", + "example": "http://google.com" + }, + "reputation": { + "$ref": "#/components/schemas/ReputationClassification" + }, + "status": { + "$ref": "#/components/schemas/ReputationStatus" + }, + "context": { + "$ref": "#/components/schemas/ReputationResponseContext" + } + } + }, + "ReputationClassification": { + "properties": { + "classification": { + "type": "string", + "example": "Benign" + }, + "severity": { + "type": "string", + "enum": [ + "N/A", + "Low", + "Medium", + "High", + "Critical" + ] + }, + "Confidence": { + "type": "string", + "enum": [ + "Low", + "Medium", + "High" + ] + } + } + }, + "ReputationStatus": { + "properties": { + "code": { + "type": "integer", + "enum": [ + 2001, + 2002 + ] + }, + "label": { + "type": "string", + "enum": [ + "SUCCESS", + "PARTIAL_SUCCESS" + ] + }, + "message": { + "type": "string", + "enum": [ + "Succeeded to generate reputation", + "Some vendors are unavailable" + ] + } + } + }, + "ReputationResponseContext": { + "type": "object", + "properties": { + "asn": { + "type": "number", + "description": "ASN of the IP (IP)" + }, + "as_owner": { + "type": "string", + "description": "ASN owner of the IP (IP)" + }, + "safe": { + "type": "boolean", + "description": "exists and true if certified safe (URL)" + }, + "malware_family": { + "type": "string", + "description": "the malware family associated with the resource (URL/FILE/IP)" + }, + "protection_name": { + "type": "string", + "description": "The protection name returned from Malware Service / AntiVirus (URL/FILE)" + }, + "redirections": { + "type": "array", + "description": "The redirections of the resource (URL)", + "items": { + "type": "string" + } + }, + "malware_types": { + "type": "array", + "description": "The malware types (FILE)", + "items": { + "type": "string" + } + }, + "categories": { + "type": "array", + "description": "URLF categories (URL)", + "items": { + "type": "string" + } + }, + "location": { + "type": "object", + "description": "geo location information (IP)", + "properties": { + "region": { + "type": "string" + }, + "city": { + "type": "string" + }, + "postalCode": { + "type": "string" + }, + "latitude": { + "type": "number" + }, + "longitude": { + "type": "number" + }, + "dma_code": { + "type": "integer" + }, + "area_code": { + "type": "integer" + }, + "metro_code": { + "type": "integer" + } + } + }, + "related_resources": { + "type": "object", + "description": "(FILE)", + "properties": { + "similar_files_found": { + "description": "How many similar files found", + "type": "number" + }, + "similar_files_details": { + "description": "Information about the similar file", + "type": "object", + "properties": { + "md5": { + "type": "string" + }, + "file_type": { + "type": "string" + }, + "classification": { + "type": "string" + }, + "malware_family": { + "type": "string" + }, + "confidence": { + "type": "string" + } + } + } + } + } + } + } + }, + "securitySchemes": { + "token": { + "type": "apiKey", + "in": "header", + "name": "token", + "description": "Session token retrieved dynamically via GET /rep-auth/service/v1.0/request using the Client-Key header, and replayed on the token header of every subsequent request. The response is a raw token string (format exp=...~acl=...~hmac=...), not a JSON envelope, so responsePointer is intentionally blank -- Itential Platform treats an empty JSON Pointer as 'use the whole raw response body'. The token is valid for 30 minutes; Itential Platform re-retrieves it automatically before each request. The Client-Key header itself must also be supplied on every query call (see the Client-Key parameter on the query operation) since Itential Platform's dynamic-retrieval only auto-injects a single header.", + "x-itential-dynamic-retrieval": { + "method": "GET", + "url": "https://rep.checkpoint.com/rep-auth/service/v1.0/request", + "responsePointer": "" + }, + "x-itential-parameters": [ + { + "name": "Client-Key", + "in": "header", + "x-itential-use-in": [ + "key" + ], + "schema": { + "type": "string" + }, + "description": "Check Point Reputation Service trial/production API key, sent as the Client-Key header on the token-retrieval call." + } + ] + } + } + } +} diff --git a/Check Point/Reputation Service/README.md b/Check Point/Reputation Service/README.md new file mode 100644 index 0000000..8532da6 --- /dev/null +++ b/Check Point/Reputation Service/README.md @@ -0,0 +1,100 @@ +# Reputation Service + +Check Point's ThreatCloud reputation lookup service. Given a URL, IP address, or file hash (md5/sha1/sha256), it returns a classification, risk score, and contextual threat data (categories, malware family, geo location, related files) for SIEM/SOAR enrichment. + +## Table of Contents + +- [Table of Contents](#table-of-contents) +- [Contents](#contents) +- [Requirements](#requirements) +- [Integration Configuration](#integration-configuration) + - [Connection Properties](#connection-properties) +- [OpenAPIs](#openapis) + - [`check_point_reputation_service-latest.json`](#check_point_reputation_service-latestjson) + - [`check_point_reputation_service-1.0.0.json`](#check_point_reputation_service-100json) +- [Studio Projects](#studio-projects) + - [Check Point Reputation Service Project](#check-point-reputation-service-project) + - [Folder Structure](#folder-structure) + - [Dependencies](#dependencies) + +## Contents + +| Asset | Description | +|---|---| +| [OpenAPIs/](./OpenAPIs/) | Check Point Reputation Service OpenAPI specs | +| [Studio Projects/Check Point Reputation Service](./Studio%20Projects/Check%20Point%20Reputation%20Service.project.json) | 1 workflow for the resource reputation query | + +## Requirements + +| Requirement | Version | +|---|---| +| Itential Platform | 6.x | +| Check Point Reputation Service API key | Contact Check Point (TCAPI_SUPPORT@checkpoint.com) to request one | +| `Check Point Reputation Service` Integration Model | Required to build automation against the OpenAPI spec | + +## Integration Configuration + +Import the OpenAPI spec from `OpenAPIs/` as an Integration Model in **Admin > Integrations**, then create an integration instance using your Reputation Service API key. + +Authentication is a session token, retrieved dynamically via `GET /rep-auth/service/v1.0/request` using the `Client-Key` header and replayed on the `token` header of every subsequent request; the token is valid for 30 minutes and Itential Platform re-retrieves it automatically. The API also requires the `Client-Key` header on every actual query call, not just the token-retrieval call — since dynamic retrieval only auto-injects a single header, `Client-Key` is modeled as a required parameter on the query operation itself rather than in the authentication config, so it must be supplied as a workflow input on every task call (see the Studio Project below). + +### Connection Properties + +```json +{ + "server": { + "protocol": "https", + "host": "rep.checkpoint.com", + "base_path": "" + }, + "authentication": { + "token": { + "dynamicRetrieval": { + "method": "GET", + "url": "https://rep.checkpoint.com/rep-auth/service/v1.0/request", + "responsePointer": "" + }, + "parameters": { + "Client-Key": "" + } + } + } +} +``` + +## OpenAPIs + +| Spec | Version | Operations | Description | +|---|---|---|---| +| [`check_point_reputation_service-latest.json`](./OpenAPIs/check_point_reputation_service-latest.json) | latest (curated) | 1 | Resource reputation query — see breakdown below | +| [`check_point_reputation_service-1.0.0.json`](./OpenAPIs/check_point_reputation_service-1.0.0.json) | 1.0.0 (full) | 2 | Full upstream spec, including the session-token endpoint | + +### `check_point_reputation_service-latest.json` + +The upstream spec has only two operations total: the session-token endpoint and the resource reputation query. The token endpoint is modeled as dynamic-retrieval auth rather than as a callable operation (see Integration Configuration above), leaving the single query operation in `-latest`: + +- **Query**: query a URL, IP address, or file hash's reputation, risk score, and context — the resource type is selected via the `service` path parameter (`url` / `ip` / `file`) + +### `check_point_reputation_service-1.0.0.json` + +The full spec as published on SwaggerHub, including the session-token endpoint. + +## Studio Projects + +### Check Point Reputation Service Project + +Backed by the **`Check Point Reputation Service:latest`** Integration Model (see [`check_point_reputation_service-latest.json`](./OpenAPIs/check_point_reputation_service-latest.json) above). The project contains **1 workflow** in **1 folder**. + +#### Folder Structure + +| Folder | Workflows | Scope | +|---|---|---| +| Query | Query Resource Reputation | Reputation, risk, and context lookup for a URL, IP address, or file hash | + +#### Dependencies + +| Dependency | Notes | +|---|---| +| `Check Point Reputation Service:latest` Integration Model | Import from [`check_point_reputation_service-latest.json`](./OpenAPIs/check_point_reputation_service-latest.json) before importing the project | +| `Check Point Reputation Service` integration instance | Create in **Admin > Integrations** with the connection properties above. Workflows are wired to an integration instance named `Check Point Reputation Service` — update the `adapter_id` value in the workflow task if yours is named differently | +| `clientKey` workflow input | Every run of the query workflow takes the API key as a `clientKey` input, sent on the `Client-Key` header alongside the dynamically-retrieved `token` header | diff --git a/Check Point/Reputation Service/Studio Projects/Check Point Reputation Service.project.json b/Check Point/Reputation Service/Studio Projects/Check Point Reputation Service.project.json new file mode 100644 index 0000000..6fab84e --- /dev/null +++ b/Check Point/Reputation Service/Studio Projects/Check Point Reputation Service.project.json @@ -0,0 +1,257 @@ +{ + "_id": "6b1c2d3e4f5a6b7c8d9e0f10", + "name": "Check Point Reputation Service", + "description": "Workflows for the Check Point Reputation Service ThreatCloud reputation lookup", + "components": [ + { + "iid": 0, + "reference": "2278d810-7b3d-41c9-a21a-02f68142907c", + "type": "workflow", + "folder": "/Query", + "document": { + "name": "Query Resource Reputation", + "description": "Query Reputation Service for a URL, IP address, or file hash", + "type": "automation", + "font_size": 12, + "tasks": { + "workflow_start": { + "name": "workflow_start", + "groups": [], + "nodeLocation": { + "x": 264, + "y": 0 + } + }, + "1a2b": { + "name": "merge", + "canvasName": "merge", + "summary": "Merge Resource", + "description": "Merge data into a single object", + "location": "Application", + "locationType": null, + "app": "WorkFlowEngine", + "type": "operation", + "displayName": "WorkFlowEngine", + "variables": { + "incoming": { + "data_to_merge": [ + { + "key": "resource", + "value": { + "task": "job", + "variable": "resource" + } + } + ] + }, + "outgoing": { + "merged_object": "" + } + }, + "actor": "Pronghorn", + "groups": [], + "nodeLocation": { + "x": 264, + "y": 150 + } + }, + "3c4d": { + "name": "renderJinja2ContextWithCast", + "canvasName": "renderJinja2ContextWithCast", + "summary": "Render Reputation Request Body", + "description": "Renders jinja2 Context output with data cast.", + "location": "Application", + "locationType": null, + "app": "TemplateBuilder", + "type": "automatic", + "displayName": "TemplateBuilder", + "variables": { + "incoming": { + "template": "{\n \"request\": [\n {\n \"resource\": \"{{resource}}\"\n }\n ]\n}", + "variables": "$var.1a2b.merged_object", + "castDataType": "object" + }, + "outgoing": { + "renderedTemplate": "" + } + }, + "actor": "Pronghorn", + "groups": [], + "nodeLocation": { + "x": 264, + "y": 300 + } + }, + "5e6f": { + "name": "query", + "canvasName": "query", + "summary": "Query Resource Reputation", + "description": "POST /{service}-rep/service/v3.0/query", + "location": "Adapter", + "locationType": "Check Point Reputation Service:latest", + "app": "Check Point Reputation Service:latest", + "type": "automatic", + "displayName": "Check Point Reputation Service", + "variables": { + "incoming": { + "adapter_id": "Check Point Reputation Service", + "service": "$var.job.service", + "resource": "$var.job.resource", + "Client-Key": "$var.job.clientKey", + "bodyContentType": "application/json", + "requestBodyPayload": "$var.3c4d.renderedTemplate" + }, + "outgoing": { + "response": null + }, + "error": "", + "decorators": [] + }, + "groups": [], + "actor": "Pronghorn", + "scheduled": false, + "nodeLocation": { + "x": 264, + "y": 450 + } + }, + "workflow_end": { + "name": "workflow_end", + "groups": [], + "nodeLocation": { + "x": 264, + "y": 600 + } + } + }, + "transitions": { + "workflow_start": { + "1a2b": { + "type": "standard", + "state": "success" + } + }, + "1a2b": { + "3c4d": { + "type": "standard", + "state": "success" + } + }, + "3c4d": { + "5e6f": { + "type": "standard", + "state": "success" + } + }, + "5e6f": { + "workflow_end": { + "type": "standard", + "state": "success" + } + }, + "workflow_end": {} + }, + "inputSchema": { + "type": "object", + "properties": { + "service": { + "type": "string", + "enum": [ + "url", + "ip", + "file" + ] + }, + "resource": { + "type": "string" + }, + "clientKey": { + "type": "string" + } + }, + "required": [ + "service", + "resource", + "clientKey" + ] + }, + "outputSchema": { + "type": "object", + "properties": { + "service": { + "type": "string", + "enum": [ + "url", + "ip", + "file" + ] + }, + "resource": { + "type": "string" + }, + "clientKey": { + "type": "string" + }, + "_id": { + "type": "string", + "pattern": "^[0-9a-f]{24}$" + }, + "initiator": { + "type": "string" + } + } + }, + "last_updated": "2026-09-24T00:00:00.000Z", + "last_updated_by": { + "provenance": "LDAP", + "username": "admin@itential", + "firstname": "admin@itential", + "inactive": false + }, + "lastUpdatedVersion": "5.55.2", + "uuid": "704f425c-b5ef-4d46-a18b-3cd12f2b5e25", + "created": "2026-09-24T00:00:00.000Z", + "created_by": { + "provenance": "LDAP", + "username": "admin@itential", + "firstname": "admin@itential", + "inactive": false + }, + "createdVersion": "5.55.2", + "scenarios": [], + "canvasVersion": 3, + "tags": [], + "groups": [], + "migrationVersion": 8 + } + } + ], + "folders": [ + { + "nodeType": "folder", + "name": "Query", + "children": [ + { + "iid": 0, + "nodeType": "component" + } + ] + } + ], + "createdBy": { + "_id": "699f3e2b85569c9f5d8e1f38", + "provenance": "LDAP", + "username": "admin@itential" + }, + "lastUpdatedBy": { + "_id": "699f3e2b85569c9f5d8e1f38", + "provenance": "LDAP", + "username": "admin@itential" + }, + "created": "2026-09-24T00:00:00.000Z", + "lastUpdated": "2026-09-24T00:00:00.000Z", + "iid": 1, + "thumbnail": "", + "backgroundColor": "", + "referencedComponentHashes": [] +} diff --git a/README.md b/README.md index 0a78015..dbe1d3f 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,7 @@ Assets are organized by vendor and product. Each folder may contain one or more | **BlueCat** | Address Manager | | **Broadcom** | DX NetOps Spectrum | | **Centreon** | IT and network monitoring | +| **Check Point** | Reputation Service (ThreatCloud) | | **Cisco** | ASA · Catalyst Center · Crosswork Assurance · Crosswork Network Controller · DCNM · IOS · ISE · Meraki · NDFC · NSO · NX-OS · PSIRT Open Vulnerability · Support · ThousandEyes · Umbrella · Webex | | **Cloudflare** | CDN & edge platform APIs | | **Cloudify** | TOSCA-based multi-cloud orchestration |