id: ransomware_live
name: Ransomware.live
version: 1.0.0
description: "Ransomware.live (API v2) — OSINT tracking of ransomware & extortion groups and their claimed victims. Query recent victims, list and profile threat groups, pull a group's victims, and search victims by keyword, country, or date. Ideal for third-party/supply-chain exposure checks (is a partner or domain listed as a victim?). Free and keyless — no authentication required. Stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: recent victims, groups, group profile, group victims, search victims (keyword/country/date), recent cyberattacks."
category: threat_intel

# Ransomware.live's v2 API is free and requires no authentication. The only
# configuration is an optional base URL override.
config_schema:
  properties:
    base_url:
      type: string
      description: "API base URL"
      default: "https://api.ransomware.live/v2"
  required: []

commands:
  - id: recent_victims
    name: ransomware-live-recent-victims
    description: "Most recently disclosed ransomware victims across all groups."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
      required: []
    outputs_schema: { properties: {} }

  - id: list_groups
    name: ransomware-live-list-groups
    description: "List all tracked ransomware / extortion groups."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: get_group
    name: ransomware-live-get-group
    description: "Profile of a specific group (description, leak-site locations, profiles/TTP links)."
    risk: read
    inputs_schema:
      properties:
        group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" }
      required: [group]
    outputs_schema: { properties: {} }

  - id: group_victims
    name: ransomware-live-group-victims
    description: "All victims claimed by a specific group."
    risk: read
    inputs_schema:
      properties:
        group: { type: string, description: "Group name/slug (e.g. lockbit3, akira, play)" }
        limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
      required: [group]
    outputs_schema: { properties: {} }

  - id: search_victims
    name: ransomware-live-search-victims
    description: "Search claimed victims by keyword (company name or domain) — supply-chain / brand exposure checks."
    risk: read
    inputs_schema:
      properties:
        keyword: { type: string, description: "Company name or domain to search (e.g. acme, acme.com)" }
        limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
      required: [keyword]
    outputs_schema: { properties: {} }

  - id: country_victims
    name: ransomware-live-country-victims
    description: "Victims located in a given country."
    risk: read
    inputs_schema:
      properties:
        country: { type: string, description: "ISO 3166-1 alpha-2 country code (e.g. FR, US, DE)" }
        limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
      required: [country]
    outputs_schema: { properties: {} }

  - id: victims_by_date
    name: ransomware-live-victims-by-date
    description: "Victims disclosed in a given year, optionally narrowed to a month."
    risk: read
    inputs_schema:
      properties:
        year: { type: number, description: "Year, e.g. 2025" }
        month: { type: number, description: "Month 1-12 (optional)" }
        limit: { type: number, description: "Max victims to return (0 = all, default 0)" }
      required: [year]
    outputs_schema: { properties: {} }

  - id: recent_cyberattacks
    name: ransomware-live-recent-cyberattacks
    description: "Recently reported cyberattacks (press / OSINT), beyond leak-site claims."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max entries to return (0 = all, default 0)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: ransomware-live-test-connection
    description: "Verify the ransomware.live API is reachable (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }