id: threatq
name: ThreatQ
version: 1.0.0
description: "ThreatQuotient ThreatQ (REST API) — threat intelligence: search and read indicators, create an indicator, and list events. OAuth2 password-grant authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search/get indicators, create indicator, list events."
category: threat_intel

# Per-instance configuration. Credentials are exchanged for a bearer token at
# /api/token; API calls go to /api.
config_schema:
  properties:
    base_url:
      type: string
      description: "ThreatQ URL (e.g. https://threatq.example.com)"
    client_id:
      type: string
      description: "OAuth client ID"
    email:
      type: string
      description: "ThreatQ user email"
    password:
      type: string
      description: "ThreatQ password"
      x-soar-sensitive: true
  required:
    - base_url
    - client_id
    - email
    - password

commands:
  - id: search_indicators
    name: threatq-search-indicators
    description: "Search indicators by value."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Indicator value to search" }
        limit: { type: number, description: "Max indicators (default 25)" }
      required: [value]
    outputs_schema: { properties: {} }
  - id: get_indicator
    name: threatq-get-indicator
    description: "Get a single indicator by ID."
    risk: read
    inputs_schema:
      properties:
        indicator_id: { type: string, description: "Indicator ID" }
      required: [indicator_id]
    outputs_schema: { properties: {} }
  - id: create_indicator
    name: threatq-create-indicator
    description: "Create an indicator."
    inputs_schema:
      properties:
        value: { type: string, description: "Indicator value" }
        type: { type: string, description: "Indicator type (e.g. IP Address, FQDN, MD5)" }
        status: { type: string, description: "Status (e.g. Active, Review) — default Review" }
      required: [value, type]
    outputs_schema: { properties: {} }
  - id: list_events
    name: threatq-list-events
    description: "List events."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max events (default 25)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: threatq-test-connection
    description: "Verify credentials via the token exchange (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }