Add censys workflows

[crestdatasystems]

Description

Adds a new Censys integration under workflows/workflows/integrations/censys/ containing six workflows that operate against the Censys Connector, using its getHost, getWebProperty, getCertificate, getHostHistory, rescan, scanStatus, and Censeye (censEyeCreateAnalysisJob, censEyeJobStatus, censEyeJobResult) actions. The workflows enrich Security alerts with Censys intelligence.

All workflows support both manual and alert triggers (except Censys Rescan, which is manual-only), write results back to the alert note and document under a dedicated censys.* namespace, and fall back to logging to the workflow console when no write-back target is available.

Workflow	Censys actions used	What it does
Censys Host Enrichment	getHost	Enriches each IP field (host.ip, source.ip, destination.ip), writing to censys.host_enrichment.<field>.*.
Censys Web Property Enrichment	getWebProperty	Enriches each (hostname/IP, port) pair, writing to censys.webproperty_enrichment.<field>.*.
Censys Certificate Enrichment	getCertificate	Enriches each TLS fingerprint (tls.server/client.hash.sha256), writing to censys.certificate_enrichment.<field>.*.
Censys Host History	getHostHistory	Retrieves the Censys scan timeline for a host over a time window (paging backwards) and attaches it as a Kibana alert note; includes a human-in-the-loop review step on alert runs.
Censys Rescan	rescan, scanStatus, getHost, getWebProperty	Submit→poll→refetch a host service or web property for a fresh scan, writing to censys.rescanned_host.* / censys.rescanned_webproperty.* (manual only).
Censys Related Infrastructure	censEyeCreateAnalysisJob, censEyeJobStatus, censEyeJobResult	Censeye submit→poll→fetch pivot hunting for a single target; writes normalized pivots to censys.related_infrastructure.* and attaches a summary note. Requires Threat Hunting access.

Depends on

• These workflows invoke the actions of the Censys connector (getHost, getWebProperty, getCertificate, getHostHistory, rescan, scanStatus, censEyeCreateAnalysisJob, censEyeJobStatus, censEyeJobResult), which are added in that PR. It must be merged/available before these workflows can run.

  [Connector][Censys] Add censys connector kibana#274568

Required Permissions / Setup

• Censys connector configured in Kibana with Censys Platform credentials (Censeye/Related Infrastructure additionally requires Threat Hunting / Adversary Investigation access on the org).
• Elasticsearch: write access to the alert indices for the elasticsearch.update write-back steps.
• When attaching any alert-triggered workflow as a rule action, enable the "Run per alert" toggle — the workflows read event.alerts[0], so without it only the first alert in a batch is processed (noted inline in each workflow).

Testing

• Tested in Kibana [version]
• YAML validates without errors / imports cleanly
• Each workflow executes successfully (manual + alert triggers)
• Write-back and alert-note rendering verified (incl. note table with control-character/pipe-containing values)
• Error handling verified when the Censys API fails

Checklist

• Descriptive name + multi-sentence description metadata on every workflow
• Section comments included
• Step comments included
• No real credentials/secrets
• Integration README added