Skip to content

Commit 688147f

Browse files
FlyingDove2493FlyingDove2493
committed
Add Flowtriq DDoS detection and mitigation app
Adds a new Shuffle app for the Flowtriq DDoS detection and mitigation platform with four actions: list_incidents, get_incident, list_nodes, and create_mitigation_rule. Supports Bearer token auth and configurable base URL for self-hosted instances.
1 parent 576f9c7 commit 688147f

4 files changed

Lines changed: 410 additions & 0 deletions

File tree

‎flowtriq/1.0.0/Dockerfile‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Base our app image off of the Shuffle App SDK image
2+
FROM frikky/shuffle:app_sdk as base
3+
4+
# We're going to stage away all of the bloat from the build tools so lets create a builder stage
5+
FROM base as builder
6+
7+
# Install all alpine build tools needed for our pip installs
8+
RUN apk --no-cache add --update alpine-sdk libffi libffi-dev musl-dev openssl-dev
9+
10+
# Install all of our pip packages in a single directory that we can copy to our base image later
11+
RUN mkdir /install
12+
WORKDIR /install
13+
COPY requirements.txt /requirements.txt
14+
RUN pip install --prefix="/install" -r /requirements.txt
15+
16+
# Switch back to our base image and copy in all of our built packages and source code
17+
FROM base
18+
COPY --from=builder /install /usr/local
19+
COPY src /app
20+
21+
# Finally, lets run our app!
22+
WORKDIR /app
23+
CMD python app.py --log-level DEBUG

‎flowtriq/1.0.0/api.yaml‎

Lines changed: 269 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,269 @@
1+
app_version: 1.0.0
2+
name: Flowtriq
3+
description: DDoS detection and mitigation platform. Query active incidents, monitor node health, and trigger mitigation rules from SOAR playbooks.
4+
contact_info:
5+
name: "@flowtriq"
6+
url: https://flowtriq.com
7+
email: "support@flowtriq.com"
8+
tags:
9+
- DDoS
10+
- Network Security
11+
- Mitigation
12+
categories:
13+
- Network
14+
authentication:
15+
required: true
16+
parameters:
17+
- name: base_url
18+
description: The base URL of your Flowtriq instance API (e.g. https://your-instance.flowtriq.com)
19+
multiline: false
20+
example: "https://demo.flowtriq.com"
21+
required: true
22+
schema:
23+
type: string
24+
- name: api_key
25+
description: Bearer token for API authentication
26+
multiline: false
27+
example: "*****"
28+
required: true
29+
schema:
30+
type: string
31+
- name: verify_ssl
32+
description: Whether to verify TLS certificates
33+
multiline: false
34+
required: false
35+
options:
36+
- true
37+
- false
38+
example: "true"
39+
schema:
40+
type: string
41+
actions:
42+
- name: list_incidents
43+
description: List active DDoS incidents with optional filtering by status
44+
parameters:
45+
- name: base_url
46+
description: The base URL of your Flowtriq instance API
47+
multiline: false
48+
example: "https://demo.flowtriq.com"
49+
required: true
50+
schema:
51+
type: string
52+
- name: api_key
53+
description: Bearer token for API authentication
54+
multiline: false
55+
example: "*****"
56+
required: true
57+
schema:
58+
type: string
59+
- name: verify_ssl
60+
description: Whether to verify TLS certificates
61+
multiline: false
62+
required: false
63+
options:
64+
- true
65+
- false
66+
example: "true"
67+
schema:
68+
type: string
69+
- name: status
70+
description: Filter incidents by status (e.g. active, resolved). Leave empty for all.
71+
multiline: false
72+
required: false
73+
example: "active"
74+
schema:
75+
type: string
76+
returns:
77+
schema:
78+
type: string
79+
example: |
80+
{
81+
"success": true,
82+
"incidents": [
83+
{
84+
"id": "inc-001",
85+
"attack_type": "volumetric",
86+
"target": "203.0.113.50",
87+
"volume_bps": 12000000000,
88+
"source_ips": ["198.51.100.1", "198.51.100.2"],
89+
"status": "active",
90+
"started_at": "2026-06-28T14:30:00Z"
91+
}
92+
]
93+
}
94+
- name: get_incident
95+
description: Get detailed information about a specific incident including attack type, source IPs, target, and volume
96+
parameters:
97+
- name: base_url
98+
description: The base URL of your Flowtriq instance API
99+
multiline: false
100+
example: "https://demo.flowtriq.com"
101+
required: true
102+
schema:
103+
type: string
104+
- name: api_key
105+
description: Bearer token for API authentication
106+
multiline: false
107+
example: "*****"
108+
required: true
109+
schema:
110+
type: string
111+
- name: verify_ssl
112+
description: Whether to verify TLS certificates
113+
multiline: false
114+
required: false
115+
options:
116+
- true
117+
- false
118+
example: "true"
119+
schema:
120+
type: string
121+
- name: incident_id
122+
description: The ID of the incident to retrieve
123+
multiline: false
124+
example: "inc-001"
125+
required: true
126+
schema:
127+
type: string
128+
returns:
129+
schema:
130+
type: string
131+
example: |
132+
{
133+
"success": true,
134+
"incident": {
135+
"id": "inc-001",
136+
"attack_type": "volumetric",
137+
"target": "203.0.113.50",
138+
"volume_bps": 12000000000,
139+
"volume_pps": 8500000,
140+
"source_ips": ["198.51.100.1", "198.51.100.2"],
141+
"status": "active",
142+
"started_at": "2026-06-28T14:30:00Z",
143+
"node_id": "node-us-east-1"
144+
}
145+
}
146+
- name: list_nodes
147+
description: List all monitored nodes and their current status
148+
parameters:
149+
- name: base_url
150+
description: The base URL of your Flowtriq instance API
151+
multiline: false
152+
example: "https://demo.flowtriq.com"
153+
required: true
154+
schema:
155+
type: string
156+
- name: api_key
157+
description: Bearer token for API authentication
158+
multiline: false
159+
example: "*****"
160+
required: true
161+
schema:
162+
type: string
163+
- name: verify_ssl
164+
description: Whether to verify TLS certificates
165+
multiline: false
166+
required: false
167+
options:
168+
- true
169+
- false
170+
example: "true"
171+
schema:
172+
type: string
173+
returns:
174+
schema:
175+
type: string
176+
example: |
177+
{
178+
"success": true,
179+
"nodes": [
180+
{
181+
"id": "node-us-east-1",
182+
"name": "US East",
183+
"status": "online",
184+
"last_seen": "2026-06-28T15:00:00Z"
185+
}
186+
]
187+
}
188+
- name: create_mitigation_rule
189+
description: Create a mitigation rule to block or rate-limit attack traffic. Used in SOAR playbooks to enable scrubbing when a DDoS is detected.
190+
parameters:
191+
- name: base_url
192+
description: The base URL of your Flowtriq instance API
193+
multiline: false
194+
example: "https://demo.flowtriq.com"
195+
required: true
196+
schema:
197+
type: string
198+
- name: api_key
199+
description: Bearer token for API authentication
200+
multiline: false
201+
example: "*****"
202+
required: true
203+
schema:
204+
type: string
205+
- name: verify_ssl
206+
description: Whether to verify TLS certificates
207+
multiline: false
208+
required: false
209+
options:
210+
- true
211+
- false
212+
example: "true"
213+
schema:
214+
type: string
215+
- name: name
216+
description: A descriptive name for the mitigation rule
217+
multiline: false
218+
example: "Block volumetric attack on 203.0.113.50"
219+
required: true
220+
schema:
221+
type: string
222+
- name: rule_type
223+
description: The type of mitigation rule
224+
multiline: false
225+
required: true
226+
options:
227+
- block
228+
- rate_limit
229+
- scrub
230+
example: "block"
231+
schema:
232+
type: string
233+
- name: target
234+
description: The target IP or prefix to protect
235+
multiline: false
236+
example: "203.0.113.50"
237+
required: true
238+
schema:
239+
type: string
240+
- name: source_ips
241+
description: Comma-separated list of source IPs or prefixes to match against. Leave empty to match all sources.
242+
multiline: true
243+
required: false
244+
example: "198.51.100.1,198.51.100.2"
245+
schema:
246+
type: string
247+
- name: duration_minutes
248+
description: How long the rule should remain active, in minutes. Leave empty for indefinite.
249+
multiline: false
250+
required: false
251+
example: "60"
252+
schema:
253+
type: string
254+
returns:
255+
schema:
256+
type: string
257+
example: |
258+
{
259+
"success": true,
260+
"rule": {
261+
"id": "rule-abc123",
262+
"name": "Block volumetric attack on 203.0.113.50",
263+
"rule_type": "block",
264+
"target": "203.0.113.50",
265+
"status": "active",
266+
"created_at": "2026-06-28T15:05:00Z"
267+
}
268+
}
269+
large_image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGQAAABkCAYAAABw4pVUAAAACXBIWXMAAAsTAAALEwEAmpwYAAAGPElEQVR4nO2de4hUVRzHf+fuuq5r+ciyUtMyTbN8lJkvNDXLV2aZZir5yLJs00zTUjMf+cg0X/kwH5mamU/M8pGPzNRKSzN7WGlpmZWZWVlZ2Wc+c+bO7Lh3Z+/M3pl7Z+cHH/47c+ec+/ve3zn3nN85dxkjEAgEAoFAIBAIBAKBQCAQCAQCgUAgEAgEAoFAIBDEJUeBnAjkPpD7gDwE8jiQNUB2gxwDchakJgJygZwB8g2Qg0A+AHkJyFYg64FsBPIOkJeAvAVkL5ATQH4CcgXIJSC/A/kXyD+K/APkdyC/APkZyEUgPwH5Ecj3QC4A+Q7It0DOAfkayFkgZ4CcAnICyHEgx4B8BeRLIEeBfAHkCJDPgRwG8hmQT4F8AuRjIIeAHATyEZAPgRwAsh/IB0D2AdkLZA+Q3UB2AdkJZAeQ94C8C2Q7kG1AtgLZAmQzkE1ANgJ5B8gGIOuBrAOyFsgaIKuBrAKyEsgKIO8AeRvIMiBLgSwBshjIIiALgSwA8iaQ+UDmAZkLZA6QN4DMBjILyEwgM4BMBzINyFQgU4C8BmQykElAJgKZAGQ8kHFAxgIZA2Q0kFFARgIZAWQ4kGFAhgIZAmQwkFeBDAIyEMgAIP2B9APSD0hfIH2A9AbSC0hPID2A9ADSHUg3IF2BdAXSBUhnIJ2AdALSEUgHIO2BtAPSFkgbIG2AtAbyMpBWQFoCaQGkOZBmQJoCaQKkMZBGQBoCaQCkPpB6QOoCqQOkNpBaQGoCqQGkOpBqQKoCqQKkMpBKQCoCSQNJBZICZAaQJCCPAXkUyGwg/wfJLy+B7ASyA8h7QLYBeRfIViBbgGwGsgnIRiAbgKwHsg7IWiBrgKwGsgrISiArgCwHsgzIUiBLgCwGsgjIQiALgLwJZD6QeUDmApkDZDaQWUBmApkBZDqQaUCmApkC5DUgk4FMAjIRyAQg44GMAzIWyBggc4DUBPIEkCQgD/+/YP8JZB+QPUBqAakBpDqQakCqAqkCpDKQSkAqAkkDkgokBUgSkGQgyUAYEKbIPwQCgUAgEAgEAoFAIBAI/H8ZBuQ0kLNA/gJSDghkFZCpIJOBvABkEJCnQO4FchvI5Y7tlkCeB/IskAEgTwO5G+ROIG2A3AzkBiAMSCeQeSBfALkCpBIQJC1BGoLcD+RekLuA3A6kLcitQG4BcjOQm4DcCOQGINcDuQ7ItUCuAXI1kKuAXAnkCiCXA7kMyKVALgFyMZCLgFwI5AIg5wM5D8i5QM4BcjaQs4AkAuFAygCpCCQFJBnkPiD3APk/QHXl/gVkC5BlIMuBvA1kGZClQJYAWQxkEZCFQBYAeRPIfCDzgMwFMgfIG0BmA5kFZCaQGUCmA5kGZCqQKUBeAzIZyCQgE4FMADI+aMckII8CeQTIHCAcSD8grYE0B3IjkGuBXA3kCiD5Q3FKyH+MYkB+BnIJSAKQhkDqA6kLpA6Q2kBqAakJpAaQ6kCqAakKpAqQykAqAUkDkgokBUgSkGQgjwJ5GMhDQNKB/APkdyC/AfkVyC9AfgbyE5AfgfwA5Hsg3wH5FshZIGeAnAZyCsgJIMeBHAPyFZAvgRwF8gWQI0A+B3IYyGdAPgXyCZCPgRwCchDIR0A+BHIAyH4gHwDZB2QvkD1AdgPZBWQnkB1A3gOyHcg2IFuBbAGyGcgmIBuBvANkA5D1QNYBWQtkDZDVQFYBWQlkBZB3gLwNZBmQpUCWAFkMZBGQhUAWAHkTyHwg84DMBTIHyBtAZgOZBWQmkBlApgOZBmQqkClAXgMyGcgkIBOBTAAyHsg4IGOBjAEyGsgUIOlAbgFyM5AkICxYh94DpC6QmkCaArkCSGsgtwC5CUg7IO2A3ArkNiC3A+kApCOQTkA6A+kCpCuQbkC6A+kBpCeQXkB6A+kDpC+QfkD6A3kKyNNAngHyLJABQAYCGQRkMJBXgbwOZAiQoUCGARkOZASQkUBGARkNZAyQsUDGARkPZAKQiUAmAZkMZAqQ14BMBTINyHQgM4DMADITyCwgs4HMATIXyDwg84EsALIQyCIgi4EsBbIMyHIgK4CsBLIKyGoga4CsBbIOyHog7wLZAGQjkM1ANgHZAmQrkPeAbAeyA8hOILuA7AayF8g+IAeAHARyGMhRIMeAfAXkBJCTQE4DOQPkHJALQH4A8hOQy0D+A1K2wF9YKiJeVPFjNgAAAABJRU5ErkJggg==

‎flowtriq/1.0.0/requirements.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
requests==2.32.4
2+
shuffle_sdk==0.0.40

0 commit comments

Comments
 (0)