id: sekoia_intelligence_center
name: SEKOIA Intelligence Center
version: 1.0.0
description: "SEKOIA.IO Intelligence Center (CTI) — query observables, indicators and full indicator context (STIX bundles), plus reputation lookups for IPs, URLs, domains, files and emails."
changelog: "1.0.0 — Initial release: observable/indicator/indicator-context queries and ip/url/domain/file/email reputation lookups."
category: enrichment

# Per-instance configuration. An Organization API key is sent as a Bearer token.
config_schema:
  properties:
    url:
      type: string
      description: "Sekoia API base URL, e.g. https://api.sekoia.io"
      default: https://api.sekoia.io
    api_key:
      type: string
      description: "Sekoia API key (Bearer token)"
      x-soar-sensitive: true
  required:
    - url
    - api_key

auth:
  - id: bearer
    type: api_key
    in: header
    name: Authorization
    value_template: "Bearer {{secret}}"
    secret_field: api_key

commands:
  - id: get_observable
    name: sekoia-intelligence-get-observable
    description: "Query the Intelligence Center for information about an observable (value + type)."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Observable value" }
        type: { type: string, description: "Observable type (e.g. ipv4-addr, domain-name, url, file, email-addr)" }
      required: [value, type]
    outputs_schema: { properties: {} }

  - id: get_indicator
    name: sekoia-intelligence-get-indicator
    description: "Query the Intelligence Center for information about an indicator (IoC) by value + type. Returns nothing if the value is not a known indicator."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Indicator value" }
        type: { type: string, description: "Indicator type (e.g. ipv4-addr, domain-name, url, file, email-addr)" }
      required: [value, type]
    outputs_schema: { properties: {} }

  - id: get_indicator_context
    name: sekoia-intelligence-get-indicator-context
    description: "Retrieve the full context (STIX bundle: related malware, threat actors, kill chain, etc.) for an indicator by value + type."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Indicator value" }
        type: { type: string, description: "Indicator type (e.g. ipv4-addr, domain-name, url, file, email-addr)" }
      required: [value, type]
    outputs_schema: { properties: {} }

  - id: ip
    name: sekoia-intelligence-ip
    description: "Reputation lookup for an IP address (resolves the STIX type automatically, IPv4 or IPv6)."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address" }
      required: [ip]
    outputs_schema: { properties: {} }

  - id: url
    name: sekoia-intelligence-url
    description: "Reputation lookup for a URL."
    risk: read
    inputs_schema:
      properties:
        url: { type: string, description: "URL" }
      required: [url]
    outputs_schema: { properties: {} }

  - id: domain
    name: sekoia-intelligence-domain
    description: "Reputation lookup for a domain name."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }

  - id: file
    name: sekoia-intelligence-file
    description: "Reputation lookup for a file hash."
    risk: read
    inputs_schema:
      properties:
        file: { type: string, description: "File hash (MD5, SHA1 or SHA256)" }
      required: [file]
    outputs_schema: { properties: {} }

  - id: email
    name: sekoia-intelligence-email
    description: "Reputation lookup for an email address."
    risk: read
    inputs_schema:
      properties:
        email: { type: string, description: "Email address" }
      required: [email]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: sekoia-intelligence-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }