id: mandiant
name: Mandiant Advantage
version: 1.0.0
description: "Mandiant Advantage Threat Intelligence (API v4) — threat intelligence: look up indicators, threat actors, malware families, and vulnerabilities, and list/read intelligence reports. Key + secret authentication (OAuth2 token exchange); stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search/get indicator, get actor/malware/vulnerability, list/get reports."
category: threat_intel

# Per-instance configuration. The key + secret are exchanged (HTTP Basic against
# /token) for a bearer token used on the v4 API.
config_schema:
  properties:
    api_key:
      type: string
      description: "Mandiant API key (public key)"
    secret_key:
      type: string
      description: "Mandiant secret key"
      x-soar-sensitive: true
  required:
    - api_key
    - secret_key

commands:
  - id: search_indicator
    name: mandiant-search-indicator
    description: "Look up threat intelligence for an indicator value (IP, domain, URL, or hash)."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Indicator value" }
      required: [value]
    outputs_schema: { properties: {} }
  - id: get_indicator
    name: mandiant-get-indicator
    description: "Get a single indicator by its Mandiant ID."
    risk: read
    inputs_schema:
      properties:
        indicator_id: { type: string, description: "Mandiant indicator ID" }
      required: [indicator_id]
    outputs_schema: { properties: {} }
  - id: get_actor
    name: mandiant-get-actor
    description: "Get a threat actor by ID or name."
    risk: read
    inputs_schema:
      properties:
        actor_id: { type: string, description: "Threat actor ID or name" }
      required: [actor_id]
    outputs_schema: { properties: {} }
  - id: get_malware
    name: mandiant-get-malware
    description: "Get a malware family by ID or name."
    risk: read
    inputs_schema:
      properties:
        malware_id: { type: string, description: "Malware family ID or name" }
      required: [malware_id]
    outputs_schema: { properties: {} }
  - id: get_vulnerability
    name: mandiant-get-vulnerability
    description: "Get vulnerability intelligence by CVE ID."
    risk: read
    inputs_schema:
      properties:
        cve_id: { type: string, description: "CVE ID (e.g. CVE-2024-1234)" }
      required: [cve_id]
    outputs_schema: { properties: {} }
  - id: list_reports
    name: mandiant-list-reports
    description: "List intelligence reports."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max reports (default 25)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_report
    name: mandiant-get-report
    description: "Get a single intelligence report by ID."
    risk: read
    inputs_schema:
      properties:
        report_id: { type: string, description: "Report ID" }
      required: [report_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: mandiant-test-connection
    description: "Verify connectivity and the token exchange (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }