id: signalsciences
name: Signal Sciences
version: 1.0.0
description: "Signal Sciences (Fastly NGWAF, API v0) — web-attack visibility and containment: list sites, read suspicious IPs and events, and add an IP to a site list (block). API-token authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list sites, get suspicious IPs, list events, add IP to list."
category: network

# Per-instance configuration. Auth headers 'x-api-user' (email) and 'x-api-token'.
config_schema:
  properties:
    email:
      type: string
      description: "API user email"
    api_token:
      type: string
      description: "API token"
      x-soar-sensitive: true
    corp_name:
      type: string
      description: "Corp (organization) short name"
  required:
    - email
    - api_token
    - corp_name

commands:
  - id: list_sites
    name: sigsci-list-sites
    description: "List sites in the corp."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: get_suspicious_ips
    name: sigsci-get-suspicious-ips
    description: "List a site's suspicious IPs."
    risk: read
    inputs_schema:
      properties:
        site_name: { type: string, description: "Site short name" }
      required: [site_name]
    outputs_schema: { properties: {} }
  - id: list_events
    name: sigsci-list-events
    description: "List a site's flagged-IP events."
    risk: read
    inputs_schema:
      properties:
        site_name: { type: string, description: "Site short name" }
        limit: { type: number, description: "Max events (default 50)" }
      required: [site_name]
    outputs_schema: { properties: {} }
  - id: add_ip_to_list
    name: sigsci-add-ip-to-list
    description: "Add an IP to a site custom list (e.g. a block list)."
    inputs_schema:
      properties:
        site_name: { type: string, description: "Site short name" }
        list_id: { type: string, description: "Custom list ID" }
        ip: { type: string, description: "IP or CIDR to add" }
      required: [site_name, list_id, ip]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: sigsci-test-connection
    description: "Verify the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }