id: intel471
name: Intel 471
version: 1.0.0
description: "Intel 471 (Titan API v1) — cyber threat intelligence: search reports and indicators, read a report, and list CVE reports. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search reports/indicators, get report, list CVE reports."
category: threat_intel

# Per-instance configuration. HTTP Basic auth with the account email + API key.
config_schema:
  properties:
    email:
      type: string
      description: "Account email"
    api_key:
      type: string
      description: "API key"
      x-soar-sensitive: true
  required:
    - email
    - api_key

commands:
  - id: search_reports
    name: intel471-search-reports
    description: "Search intelligence reports."
    risk: read
    inputs_schema:
      properties:
        text: { type: string, description: "Full-text search" }
        count: { type: number, description: "Max reports (default 25)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_report
    name: intel471-get-report
    description: "Get a single report by UID."
    risk: read
    inputs_schema:
      properties:
        report_uid: { type: string, description: "Report UID" }
      required: [report_uid]
    outputs_schema: { properties: {} }
  - id: search_indicators
    name: intel471-search-indicators
    description: "Search indicators."
    risk: read
    inputs_schema:
      properties:
        indicator: { type: string, description: "Indicator value or search term" }
        count: { type: number, description: "Max indicators (default 25)" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_cve_reports
    name: intel471-list-cve-reports
    description: "List CVE reports."
    risk: read
    inputs_schema:
      properties:
        cve: { type: string, description: "Optional CVE ID filter (e.g. CVE-2024-1234)" }
        count: { type: number, description: "Max reports (default 25)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: intel471-test-connection
    description: "Verify the credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }