[dicolanl]

Implements the Zero Networks app requested in splunk-soar-connectors/.github#702, built on the Splunk SOAR SDK per @athreya-splunk's guidance on that issue.

The repo was created from the connector template, which scaffolds a BaseConnector app. This PR replaces that scaffold with an SDK app (src/app.py, generated manifest) and implements the actions.

Features

• test connectivity — GET /assets/statistics, verifying reachability and authentication
• search asset (investigate, read-only) — resolves an FQDN to a Zero Networks asset ID via GET /assets/searchId. The API answers 200 with an empty body when nothing matches, so the action fails explicitly rather than returning a blank result.
• quarantine asset (contain) — cuts off an asset's network access via PUT /assets/{assetId}/actions/quarantine with {"quarantine": true}
• unquarantine asset (correct) — restores access through the same endpoint with {"quarantine": false}

Supporting changes:

• Rebuilt on splunk-soar-sdk 6.0.1, replacing zeronetworks.json / zeronetworks_connector.py. Dropped the package-app-dependencies pre-commit hook, which packages dependencies for BaseConnector apps whereas the SDK sources wheels from uv.lock.
• Replaced the template's placeholder logos (which were the Splunk logo) with vectorized Zero Networks branding, in light and dark variants.
• Set the app version to 1.0.0 for this first release, and removed release_notes/1.0.0.md and release_notes/1.0.1.md — both were written by the template setup workflow and describe its own CI churn rather than any release of this app.

Notes on a couple of implementation decisions:

• Zero Networks expects the raw API token in the Authorization header with no scheme prefix, so StaticTokenAuth is configured with an empty token_type.
• The asset ID is tagged with a zeronetworks asset id CEF type on both the search output and the quarantine inputs, so the three actions chain in a playbook and surface as contextual actions.
• The quarantine actions validate the asset ID against the pattern published in the Zero Networks OpenAPI spec before calling out, turning the common mistake of passing an FQDN into a message pointing at search asset instead of an opaque 400.

Manual Documentation

Added manual_readme_content.md covering the things that are not obvious from the action list: that the API token goes in verbatim with no Bearer prefix, that a read-only token can search but not quarantine, which base URL to use for development tenants, and that the quarantine actions take a Zero Networks asset ID rather than a hostname — so search asset has to run first.

• I have verified that manual documentation has been updated where appropriate

Other information

Testing. 34 unit tests drive each action against an httpx MockTransport, asserting on the request the app actually sends — method, path, query and JSON body — so that the quarantine/unquarantine split on a shared endpoint stays correct. They also cover the error paths that shape what an analyst sees: the empty-body search miss, malformed asset IDs rejected before any HTTP call, and the 4xx/timeout/connection failures. soarapps package build succeeds.

Two things I could not resolve from this repo, and would appreciate guidance on:

1. static-tests fails on valid_app_name_and_guid and app_package_name, because appid 85010388-bc3f-48a9-af39-0af675dcd405 is not registered in phantomcyber/dev-cicd-tools's appid_to_name.json / appid_to_package_name.json. Every other hook passes. Happy to use a different appid if one has already been allocated for this app.

2. The contribution guide asks contributors to add their name to the manifest, but SDK 6.0.1 appears to have no path for it: App() takes no contributors argument, and PyprojectAdapter.load_data does not read project.authors, so the generated manifest keeps an empty contributors list. I have recorded the name under [project].authors in pyproject.toml as the closest standard location — let me know if there is a supported mechanism I have missed.

🤖 Generated with Claude Code

[github-actions]

Thank you for your submission! We will take a look as soon as we can.

[github-actions]

Merging this PR will release 1.0.0 with the following release notes:

1.0.0 (2026-09-29)

Features

• add asset search, quarantine and unquarantine actions (6da071c)
• replace the placeholder logos with Zero Networks branding (49cf4cc), closes #08094D

Bug Fixes

• address review feedback on the Zero Networks app (eceb7f0)
• rename the app to Zero Networks for Splunk SOAR (3364c4c)
• use a proper display name for the app (3d6cf74)

Connector release changes

• Rebuilt the app on the Splunk SOAR SDK
• Added search asset to look up a Zero Networks asset ID by FQDN
• Added quarantine asset to cut off an asset's network access
• Added unquarantine asset to release an asset from quarantine
• Added test connectivity against the Zero Networks portal API

[athreya-splunk]

@dicolanl - could you pls register your app in these 2 repos? I've added an old app registration as an example
phantomcyber/dev-cicd-tools#254
splunk-soar-connectors/.github#414

[dicolanl]

Thanks @athreya-splunk — both registration PRs are up:

• feat: register zeronetworks app identity phantomcyber/dev-cicd-tools#265 — appid_to_name.json + appid_to_package_name.json
• feat: register zeronetworks app ID .github#750 — .github/data/appid_to_name.json

appid	name	package name
85010388-bc3f-48a9-af39-0af675dcd405	Zero Networks	phantom_zeronetworks

One related change I pushed here in the meantime (3d6cf74): the app's name was still the scaffold default zeronetworks, taken from the repo name. Since valid_app_name_and_guid compares the registry entry to the manifest name exactly, and registered apps use display names like Zscaler v2, I changed App(name=...) to Zero Networks and registered that. package_name is derived separately from the pyproject project name, so it is unaffected at phantom_zeronetworks. The generated README title reads # Zero Networks now too.

Once the two registry PRs merge, static-tests should go green here — it is the only remaining failing check.

[dicolanl]

Renamed the app to Zero Networks for Splunk SOAR in 3364c4c, per @athreya-splunk's review on splunk-soar-connectors/.github#750 — we already ship a Splunk TA (Splunkbase app 6539) and may add a Splunk app later, so the SOAR app is named to disambiguate.

Both registry PRs have been updated to match:

• feat: register zeronetworks app identity phantomcyber/dev-cicd-tools#265
• feat: register zeronetworks app ID .github#750

package_name is derived from the pyproject project name and is unchanged at phantom_zeronetworks.

[athreya-splunk]

This review was AI-assisted but verified before posting. Thank you for your contribution!

[dicolanl]

Thanks for the review @athreya-splunk — all four addressed in eceb7f0, with replies on each thread.

Summary of the two [ISSUE]s:

• Base URL validation. normalize_base_url now runs at the client boundary and rejects userinfo, unsupported schemes, query/fragment, control characters and bad ports as AssetMisconfiguration, returning a normalized credential-free URL. Userinfo is rejected rather than stripped, and test_connectivity logs the validated URL.
• Unreadable success responses. Only a genuinely empty body maps to {} now; non-empty non-object bodies raise ActionFailure with a trimmed snippet, so search asset can no longer turn an unreadable 200 into a confident "no asset found".

Both [NIT]s taken as suggested: summary models on the three regular actions, and the idle client logger now emits a query-free debug line.

Tests are up from 34 to 63.

Also worth noting: now that phantomcyber/dev-cicd-tools#265 and #750 have merged, static-tests passes locally — every pre-commit hook is green on this branch.

[splunk-soar-semantic-release]

🎉 This PR is included in version 1.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[athreya-splunk]

I've created an internal ticket to publish the app in splunkbase. I'll update once the app is available.

[athreya-splunk]

app released to splunkbase! https://splunkbase.splunk.com/app/9910