id: glimps
name: GLIMPS Detect
version: 1.0.0
description: "GLIMPS Detect (GDetect API lite v2) — deep malware analysis: submit a file for analysis, poll the result by UUID, and look up a file by SHA-256. Token authentication; stdlib-only, no extra Python dependencies. (French vendor.)"
changelog: "1.0.0 — Initial release: submit file, get result, search by hash."
category: enrichment

# Per-instance configuration. Auth header 'X-Auth-Token: <api_token>'.
config_schema:
  properties:
    base_url:
      type: string
      description: "GLIMPS Detect appliance URL (e.g. https://gdetect.example.com)"
    api_token:
      type: string
      description: "GDetect API token"
      x-soar-sensitive: true
  required:
    - base_url
    - api_token

commands:
  - id: submit_file
    name: glimps-submit-file
    description: "Submit a file (base64) for analysis. Returns an analysis UUID."
    inputs_schema:
      properties:
        file_name: { type: string, description: "File name" }
        content_base64: { type: string, description: "File content, base64-encoded" }
      required: [file_name, content_base64]
    outputs_schema: { properties: {} }
  - id: get_result
    name: glimps-get-result
    description: "Get an analysis result by UUID."
    risk: read
    inputs_schema:
      properties:
        uuid: { type: string, description: "Analysis UUID" }
      required: [uuid]
    outputs_schema: { properties: {} }
  - id: search_hash
    name: glimps-search-hash
    description: "Look up a previously analyzed file by SHA-256."
    risk: read
    inputs_schema:
      properties:
        sha256: { type: string, description: "SHA-256 hash" }
      required: [sha256]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: glimps-test-connection
    description: "Verify the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }