id: feed_nvd
name: NVD CVE Feed
version: 1.0.0
description: "NIST National Vulnerability Database (NVD) feed connector — pull recently-published CVEs from the NVD 2.0 API and emit normalized IOCs (CVE + type, with description/CVSS/status) for import into the Threat Indicator Manager. Works without a key; an optional free NVD API key raises the rate limit. Stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: fetch recent CVEs from the NVD 2.0 API."
category: feed

# The NVD 2.0 API is free. An optional API key (sent as the apiKey header)
# raises the request rate limit.
config_schema:
  properties:
    api_key:
      type: string
      description: "Optional NVD API key (free — raises the rate limit)"
      x-soar-sensitive: true
    days:
      type: number
      description: "Look-back window in days for recently-published CVEs (default 7, max 120)"
      default: 7
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required: []

commands:
  - id: fetch_indicators
    name: feed-nvd-fetch-indicators
    description: "Fetch recently-published CVEs from NVD and return normalized indicators."
    risk: read
    inputs_schema:
      properties:
        days: { type: number, description: "Look-back window in days (overrides config, max 120)" }
        max_indicators: { type: number, description: "Max indicators to return (0 = API page size 2000, default 0)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: feed-nvd-test-connection
    description: "Verify the NVD API is reachable (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }