id: withsecure
name: WithSecure Elements
version: 1.0.0
description: "WithSecure Elements (Connect API) — endpoint containment: list and read devices, isolate/release a device, trigger a malware scan, and list incidents. OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get devices, isolate/release device, scan, list incidents."
category: endpoint

# Per-instance configuration. Client credentials are exchanged for a bearer token.
# organization_id scopes the device and incident queries.
config_schema:
  properties:
    client_id:
      type: string
      description: "API client ID"
    client_secret:
      type: string
      description: "API client secret"
      x-soar-sensitive: true
    organization_id:
      type: string
      description: "Organization ID"
  required:
    - client_id
    - client_secret
    - organization_id

commands:
  - id: list_devices
    name: withsecure-list-devices
    description: "List devices."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max devices (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_device
    name: withsecure-get-device
    description: "Get a single device by ID."
    risk: read
    inputs_schema:
      properties:
        device_id: { type: string, description: "Device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: isolate_device
    name: withsecure-isolate-device
    description: "Isolate a device from the network (containment)."
    inputs_schema:
      properties:
        device_id: { type: string, description: "Device ID" }
        message: { type: string, description: "Optional message shown to the user" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: release_device
    name: withsecure-release-device
    description: "Release a device from network isolation."
    inputs_schema:
      properties:
        device_id: { type: string, description: "Device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: scan_device
    name: withsecure-scan-device
    description: "Trigger a malware scan on a device."
    inputs_schema:
      properties:
        device_id: { type: string, description: "Device ID" }
      required: [device_id]
    outputs_schema: { properties: {} }
  - id: list_incidents
    name: withsecure-list-incidents
    description: "List incidents (detections). Used for ingestion: results path = items."
    risk: read
    inputs_schema:
      properties:
        limit: { type: number, description: "Max incidents (default 50)" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: items
      dedup_key: incidentId

  - id: test_connection
    name: withsecure-test-connection
    description: "Verify the credentials via the token exchange (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: list_incidents
  mapper: list_incidents
  default_incident_type: "WithSecure Elements Incident"