RelayShield: add new plugin

[nzdsf2-gif]

🧩 Type of Change

• Feature
• Bug fix
• Other

🧠 Background & Motivation

RelayShield (relayshield.net) is an identity and crypto-asset security platform. It detects attack
signals while an attack is still forming — credential breaches, SIM-swap fraud, lookalike/typosquat
domains, and wallet/token risk — rather than surfacing them only after an account has already been
taken over. This PR adds RelayShield as a new InsightConnect plugin so SOC teams can pull that
signal directly into playbooks/workflows.

✨ What Changed

New plugin relayshield with four actions, each backed by a live RelayShield REST endpoint:

• check_breach — check an email address against known credential breach databases
• check_sim_swap — check a phone number for active/recent SIM-swap fraud at the carrier level
• check_domain — check a domain for lookalike/typosquat registrations
• check_crypto_intel — check an EVM wallet address (and optional token contract) for composite risk

Connection takes a single RelayShield API key (obtained at api.relayshield.net/developers).

🧪 Testing

• insight-plugin validate run against the finished plugin — full pass, including a real Docker
  image build (output below).
• Unit tests written for all four actions (8 total test cases, both a risk-found and a clean-result
  case per action) and run directly with pytest — 8/8 passing.
• Not done: a live insight-plugin run connection/action test against a real RelayShield API
  key — I don't have a live key available in this environment to test against, so I'm not pasting
  fabricated output for that section. Happy to run it if a reviewer can point me to how contributors
  typically get a test credential, or I can arrange one before merge.

✅ Checklist

• Unit tests added/updated
• Manually tested in InsightConnect (no access to a live instance)

🔍 Plugin Validation

Plugin Validation Output (insight-plugin validate)

[*] Running Integration Validators...
[*] Executing validator HelpValidator
[*] Executing validator ChangelogValidator
[*] Executing validator CloudReadyConnectionCredentialTokenValidator
[*] Executing validator RequiredKeysValidator
[*] Executing validator UseCaseValidator
[*] Executing validator SpecPropertiesValidator
[*] Executing validator SpecVersionValidator
[*] Executing validator FilesValidator
[*] Executing validator TagValidator
[*] Executing validator DescriptionValidator
[*] Executing validator TitleValidator
[*] Executing validator VendorValidator
[*] Executing validator DefaultValueValidator
[*] Executing validator IconValidator
[*] Executing validator RequiredValidator
[*] Executing validator VersionValidator
[*] Executing validator DockerfileParentValidator
[*] Executing validator ProfanityValidator
[*] Executing validator AcronymValidator
[*] Executing validator JSONValidator
[*] Executing validator OutputValidator
[*] Executing validator RegenerationValidator
[*] Executing validator HelpInputOutputValidator
[*] Executing validator SupportValidator
[*] Executing validator RuntimeValidator
[*] Executing validator VersionPinValidator
[*] Executing validator EncodingValidator
[*] Executing validator ExampleInputValidator
[*] Executing validator CloudReadyValidator
[*] Executing validator SupportedVersionValidator
[*] Executing validator UnapprovedKeywordsValidator
[*] Executing validator HelpExampleValidator
[*] Executing validator Version Increment Validator
[*] Executing validator NameValidator
[*] Executing validator ExceptionValidator
[*] Executing validator CredentialsValidator
[*] Executing validator PasswordValidator
[*] Executing validator PrintValidator
[*] Executing validator ConfidentialValidator
[*] Executing validator DockerValidator
[*] Executing validator URLValidator
[*] Plugin successfully validated!

Unit Test Results (pytest)

collected 8 items

test_check_breach.py::TestCheckBreach::test_check_breach_clean PASSED
test_check_breach.py::TestCheckBreach::test_check_breach_found PASSED
test_check_crypto_intel.py::TestCheckCryptoIntel::test_check_crypto_intel_clean PASSED
test_check_crypto_intel.py::TestCheckCryptoIntel::test_check_crypto_intel_critical PASSED
test_check_domain.py::TestCheckDomain::test_check_domain_clean PASSED
test_check_domain.py::TestCheckDomain::test_check_domain_lookalikes_found PASSED
test_check_sim_swap.py::TestCheckSimSwap::test_check_sim_swap_clean PASSED
test_check_sim_swap.py::TestCheckSimSwap::test_check_sim_swap_detected PASSED

8 passed

🖼️ In-Product Verification (if applicable)

No access to a live InsightConnect instance — not able to provide these screenshots.

✅ Code Quality Checklist

• Dependencies pinned in Dockerfile and requirements.txt
• USER nobody set in Dockerfile
• Uses slim SDK image (rapid7/insightconnect-python-3-slim-plugin:6.6.0)
• Uses PluginException / ConnectionTestException for errors
• Uses self.logger for logging
• Changelog updated (version_history in plugin.spec.yaml)
• Work fully completed and functional (pending the live-credential test noted above)

💬 Additional Notes

This is a first-time contribution from RelayShield. Happy to adjust scope, naming, or output shape
to match reviewer conventions — I kept this first PR to 4 actions covering our most SOC-relevant
signals rather than our full API surface, per the "one plugin per PR" / incremental-contribution
guidance in CONTRIBUTING.md.

---

Thanks for the review!

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[nzdsf2-gif]

Hi — checking in on this one.

Since it was opened, everything on the RelayShield side has moved forward and the plugin is
current with it:

• All four checks are green and Snyk is clean.
• The API surface the plugin calls now has a full published reference at
  https://api.relayshield.net/docs, with an OpenAPI 3.1 spec at
  https://api.relayshield.net/openapi.json — useful if it helps review the actions against the
  documented request and response shapes.

Happy to rebase, split it into smaller commits, or make any changes that would make this easier to
review. If there is a queue or a preferred process for new plugin submissions, just point me at it
and I will follow that instead.

Thanks for taking a look.