v2026.7.8

.flocks/flockshub/index.json

@@ -14544,6 +14544,208 @@
       "trust": "community",
       "riskLevel": "medium",
       "manifestPath": "plugins/skills/Anthropic-Cybersecurity-Skills/validating-backup-integrity-for-recovery/manifest.json"
+    },
+    {
+      "id": "chaitin_muyun_api_v3",
+      "type": "device",
+      "name": "Chaitin Muyun",
+      "description": "Chaitin Muyun host security platform JSON-RPC API 3.0 integration.",
+      "version": "3.0",
+      "category": "integration",
+      "tags": [
+        "edr",
+        "hids",
+        "vulnerability",
+        "integration"
+      ],
+      "useCases": [
+        "integration",
+        "incident-response",
+        "vulnerability-management"
+      ],
+      "trust": "official",
+      "riskLevel": "low",
+      "manifestPath": "plugins/tools/device/chaitin_muyun_api_v3/manifest.json",
+      "descriptionCn": "长亭牧云主机安全平台 API 3.0 接入。"
+    },
+    {
+      "id": "chaitin_safeline_waf_v1_0_0",
+      "type": "device",
+      "name": "Chaitin SafeLine WAF",
+      "description": "Chaitin SafeLine WAF OpenAPI integration.",
+      "version": "1.0.0",
+      "category": "integration",
+      "tags": [
+        "waf",
+        "web-security",
+        "integration"
+      ],
+      "useCases": [
+        "integration",
+        "threat-detection",
+        "log-analysis"
+      ],
+      "trust": "official",
+      "riskLevel": "low",
+      "manifestPath": "plugins/tools/device/chaitin_safeline_waf_v1_0_0/manifest.json",
+      "descriptionCn": "长亭雷池 WAF OpenAPI 接入。"
+    },
+    {
+      "id": "chaitin_dongjian_v2_8",
+      "type": "device",
+      "name": "Chaitin Dongjian",
+      "description": "Chaitin Dongjian (X-Ray) security assessment system OpenAPI V2.8 integration.",
+      "version": "2.8",
+      "category": "integration",
+      "tags": [
+        "vulnerability",
+        "web-security",
+        "integration"
+      ],
+      "useCases": [
+        "integration",
+        "vulnerability-management",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "low",
+      "manifestPath": "plugins/tools/device/chaitin_dongjian_v2_8/manifest.json",
+      "descriptionCn": "长亭洞鉴（X-Ray）安全评估系统 OpenAPI V2.8 接入。"
+    },
+    {
+      "id": "sangfor_atrust_v3",
+      "type": "device",
+      "name": "Sangfor aTrust Zero Trust",
+      "description": "Sangfor aTrust Zero Trust Access Control OpenAPI V3 integration.",
+      "version": "3.0",
+      "category": "integration",
+      "tags": [
+        "iam",
+        "network",
+        "integration"
+      ],
+      "useCases": [
+        "integration",
+        "incident-response",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "low",
+      "manifestPath": "plugins/tools/device/sangfor_atrust_v3/manifest.json",
+      "descriptionCn": "深信服 aTrust 零信任访问控制系统 OpenAPI V3 接入。"
+    },
+    {
+      "id": "soc_ui",
+      "type": "webui",
+      "name": "SOC Workspace WebUI",
+      "description": "SOC workspace pages for posture, overview, and alert investigation.",
+      "descriptionCn": "SOC 工作区页面，包含态势、SOC 总览和告警调查。",
+      "version": "1.0.0",
+      "category": "workflow-automation",
+      "tags": [
+        "siem",
+        "ndr",
+        "integration"
+      ],
+      "useCases": [
+        "alert-triage",
+        "log-analysis",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "low",
+      "manifestPath": "plugins/webuis/soc_ui/manifest.json"
+    },
+    {
+      "id": "soc_workspace_query",
+      "type": "tool",
+      "name": "Flocks SOC Workspace Query",
+      "description": "Query information from Flocks own SOC workspace pages, including dashboard, overview, alert lists, alert details, triage reports, and workflow status.",
+      "descriptionCn": "查询 Flocks 自身 SOC 工作区里的信息，包括 dashboard、overview、告警调查列表、告警详情、研判报告和工作流状态。",
+      "version": "1.0.0",
+      "category": "integration",
+      "tags": [
+        "siem",
+        "ndr",
+        "integration"
+      ],
+      "useCases": [
+        "alert-triage",
+        "log-analysis",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "low",
+      "manifestPath": "plugins/tools/python/soc_workspace_query/manifest.json"
+    },
+    {
+      "id": "stream_alert_denoise",
+      "type": "workflow",
+      "name": "Stream Alert Denoise",
+      "nameCn": "流式HTTP降噪工作流",
+      "description": "Streaming alert denoise and deduplication pipeline with Syslog/API input.",
+      "descriptionCn": "流式告警降噪与去重工作流，支持 Syslog 和 API 输入。",
+      "version": "1.0.0",
+      "category": "workflow-automation",
+      "tags": [
+        "siem",
+        "ndr",
+        "web-security"
+      ],
+      "useCases": [
+        "alert-triage",
+        "log-analysis",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "medium",
+      "manifestPath": "plugins/workflows/stream_alert_denoise/manifest.json"
+    },
+    {
+      "id": "stream_alert_triage",
+      "type": "workflow",
+      "name": "Stream Alert Triage",
+      "nameCn": "HTTP研判工作流",
+      "description": "Downstream alert triage workflow that writes triage results to SOC DB by default with optional JSONL output.",
+      "descriptionCn": "下游告警研判工作流，默认写入 SOC DB，并保留 JSONL 输出配置。",
+      "version": "1.0.0",
+      "category": "workflow-automation",
+      "tags": [
+        "siem",
+        "ndr",
+        "web-security"
+      ],
+      "useCases": [
+        "alert-triage",
+        "log-analysis",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "medium",
+      "manifestPath": "plugins/workflows/stream_alert_triage/manifest.json"
+    },
+    {
+      "id": "soc-workspace",
+      "type": "component",
+      "name": "SOC Workspace Component",
+      "nameCn": "SOC 工作区场景套件",
+      "description": "Composite installer for the Flocks SOC workspace: pages, tools, denoise workflow, and triage workflow.",
+      "descriptionCn": "Flocks SOC 工作区组件安装器：包含页面、工具、降噪工作流和研判工作流。",
+      "version": "1.0.0",
+      "category": "workflow-automation",
+      "tags": [
+        "siem",
+        "ndr",
+        "integration"
+      ],
+      "useCases": [
+        "alert-triage",
+        "log-analysis",
+        "security-reporting"
+      ],
+      "trust": "official",
+      "riskLevel": "medium",
+      "manifestPath": "plugins/components/soc-workspace/manifest.json"
     }
   ]
 }

.flocks/flockshub/plugins/components/soc-workspace/component.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "hub.component.v1",
+  "id": "soc-workspace",
+  "name": "SOC Workspace",
+  "nameCn": "SOC 工作区",
+  "description": "Composite package for the Flocks SOC workspace WebUI, query tool, and denoise/triage workflows.",
+  "descriptionCn": "Flocks SOC 工作区组件包，包含 WebUI 页面、查询工具、降噪工作流和研判工作流。",
+  "components": [
+    {
+      "type": "webui",
+      "id": "soc_ui"
+    },
+    {
+      "type": "tool",
+      "id": "soc_workspace_query"
+    },
+    {
+      "type": "workflow",
+      "id": "stream_alert_denoise"
+    },
+    {
+      "type": "workflow",
+      "id": "stream_alert_triage"
+    }
+  ]
+}

.flocks/flockshub/plugins/components/soc-workspace/manifest.json

@@ -0,0 +1,84 @@
+{
+  "schemaVersion": "hub.plugin.v1",
+  "id": "soc-workspace",
+  "type": "component",
+  "name": "SOC Workspace Component",
+  "nameCn": "SOC 工作区场景套件",
+  "description": "Composite installer for the Flocks SOC workspace: pages, tools, denoise workflow, and triage workflow.",
+  "descriptionCn": "Flocks SOC 工作区组件安装器：包含页面、工具、降噪工作流和研判工作流。",
+  "version": "1.0.0",
+  "author": "Flocks Team",
+  "license": "MIT",
+  "homepage": "",
+  "category": "workflow-automation",
+  "tags": [
+    "siem",
+    "ndr",
+    "integration"
+  ],
+  "useCases": [
+    "alert-triage",
+    "log-analysis",
+    "security-reporting"
+  ],
+  "domains": [
+    "security-ops"
+  ],
+  "capabilities": [
+    "workflow"
+  ],
+  "trust": "official",
+  "source": {
+    "kind": "bundled",
+    "path": "plugins/components/soc-workspace"
+  },
+  "compatibility": {
+    "flocks": ">=0.8.0",
+    "os": [
+      "darwin",
+      "linux",
+      "windows"
+    ]
+  },
+  "dependencies": {
+    "skills": [],
+    "tools": [],
+    "python": [],
+    "external": []
+  },
+  "permissions": {
+    "tools": [
+      "soc_workspace_query"
+    ],
+    "network": false,
+    "shell": false,
+    "filesystem": "read-write"
+  },
+  "risk": {
+    "level": "medium",
+    "reasons": []
+  },
+  "entrypoints": [
+    "component.json"
+  ],
+  "components": [
+    {
+      "type": "webui",
+      "id": "soc_ui"
+    },
+    {
+      "type": "tool",
+      "id": "soc_workspace_query",
+      "adoptExisting": true
+    },
+    {
+      "type": "workflow",
+      "id": "stream_alert_denoise"
+    },
+    {
+      "type": "workflow",
+      "id": "stream_alert_triage"
+    }
+  ],
+  "checksums": {}
+}

.flocks/flockshub/plugins/tools/device/chaitin_dongjian_v2_8/_provider.yaml

@@ -0,0 +1,40 @@
+name: chaitin_dongjian
+vendor: chaitin
+service_id: chaitin_dongjian_api
+version: "2.8"
+integration_type: device
+description: >
+  Chaitin Dongjian (X-Ray) security assessment system OpenAPI V2.8
+  integration. Configure the device URL and API Token. The handler normalizes
+  the base URL to /api/v2.
+description_cn: >
+  长亭洞鉴（X-Ray）安全评估系统 OpenAPI V2.8 接入。配置设备地址和 API Token；
+  handler 会将地址归一化到 /api/v2。
+auth:
+  type: custom
+  secret: chaitin_dongjian_token
+credential_fields:
+  - key: base_url
+    label: 设备地址
+    storage: config
+    config_key: base_url
+    input_type: url
+    required: true
+    placeholder: "https://dongjian.example.com"
+  - key: token
+    label: API Token
+    storage: secret
+    config_key: token
+    secret_id: chaitin_dongjian_token
+    input_type: password
+    required: true
+defaults:
+  timeout: 30
+  category: custom
+  product_version: "OpenAPI V2.8"
+  verify_ssl: false
+notes: |
+  认证规则来自《洞鉴（X-Ray）安全评估系统OpenAPI接口文档（标准版）V2.8》：
+    - 所有 API 请求需要在请求头 token 中携带认证信息。
+    - 接口路径基于 /api/v2，例如 GET /api/v2/project/?limit=1&offset=0。
+    - GET 用于获取指定数据；POST /filter/ 用于批量筛选查询。