id: recorded_future_asi
name: Recorded Future ASI
version: 1.0.0
description: "Recorded Future Attack Surface Intelligence (SecurityTrails) — fetch attack-surface risk issues for a project (ingestion), and query recent added issues globally or grouped by host."
changelog: "1.0.0 — Initial release: project issue ingestion (project_issues) with an OCSF mapper, plus recent-issues and recent-issues-by-host queries."
category: enrichment

# Per-instance configuration. The SecurityTrails ASI API is authenticated with an
# API key sent in the APIKEY header and scoped to a project.
config_schema:
  properties:
    api_key:
      type: string
      description: "SecurityTrails / ASI API key"
      x-soar-sensitive: true
    project_id:
      type: string
      description: "ASI Project ID to fetch issues from"
    min_severity:
      type: string
      description: "Minimum issue severity to fetch: Informational, Moderate or Critical (default Moderate)"
      default: Moderate
  required:
    - api_key
    - project_id

auth:
  - id: apikey
    type: api_key
    in: header
    name: APIKEY
    value_template: "{{secret}}"
    secret_field: api_key

commands:
  # ── Ingestion ───────────────────────────────────────────────────────────────
  - id: project_issues
    name: asi-project-issues
    description: "Fetch the current attack-surface risk issues for the project. Used for ingestion: results path = data. Issues below the configured minimum severity are filtered out."
    risk: read
    inputs_schema:
      properties:
        snapshot: { type: string, description: "Snapshot to read (default 'recent')" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: name

  - id: recent_issues
    name: asi-recent-issues
    description: "List risk issues added to the project since a given time, filtered by the configured minimum severity."
    risk: read
    inputs_schema:
      properties:
        start: { type: string, description: "Lower bound: a timestamp or snapshot date" }
      required: []
    outputs_schema: { properties: {} }

  - id: recent_issues_by_host
    name: asi-recent-issues-by-host
    description: "List hosts with risk issues added since a given time, with per-host risk-score changes."
    risk: read
    inputs_schema:
      properties:
        last_checked: { type: string, description: "Lower bound: a timestamp or snapshot date" }
        limit: { type: number, description: "Maximum number of hosts to return (default 200)" }
      required: []
    outputs_schema: { properties: {} }

  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: asi-test-connection
    description: "Verify connectivity, credentials and project access (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: project_issues
  mapper: project_issues
  default_incident_type: "Recorded Future ASI Issue"