id: graylog
name: Graylog
version: 1.0.0
description: "Graylog (REST API) — log search and investigation: run a relative message search, list and read streams, and fetch a single message. API-token (Basic) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search messages, list/get streams, get message."
category: siem

# Per-instance configuration. Auth is HTTP Basic using the API token as the
# username and the literal 'token' as the password.
config_schema:
  properties:
    base_url:
      type: string
      description: "Graylog URL (e.g. https://graylog.example.com)"
    token:
      type: string
      description: "Graylog API token"
      x-soar-sensitive: true
  required:
    - base_url
    - token

commands:
  - id: search_messages
    name: graylog-search-messages
    description: "Run a relative message search (last N seconds)."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Search query (e.g. 'source:web01 AND level:3')" }
        range: { type: number, description: "Relative range in seconds (default 3600)" }
        limit: { type: number, description: "Max messages (default 50)" }
      required: [query]
    outputs_schema: { properties: {} }
  - id: list_streams
    name: graylog-list-streams
    description: "List streams."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: get_stream
    name: graylog-get-stream
    description: "Get a single stream by ID."
    risk: read
    inputs_schema:
      properties:
        stream_id: { type: string, description: "Stream ID" }
      required: [stream_id]
    outputs_schema: { properties: {} }
  - id: get_message
    name: graylog-get-message
    description: "Get a single message by index and ID."
    risk: read
    inputs_schema:
      properties:
        index: { type: string, description: "Elasticsearch index name" }
        message_id: { type: string, description: "Message ID" }
      required: [index, message_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: graylog-test-connection
    description: "Verify connectivity and the token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }