id: darktrace
name: Darktrace
version: 1.0.0
description: "Darktrace (Threat Visualizer API) — network detection and autonomous response: read model breaches, acknowledge a breach, look up devices, and read/activate Antigena network actions (containment). HMAC-SHA1 signed authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: get/acknowledge model breaches, get devices, get/activate Antigena actions."
category: ndr

# Per-instance configuration. Requests are signed (HMAC-SHA1) with the public +
# private API tokens (headers DTAPI-Token / DTAPI-Date / DTAPI-Signature).
config_schema:
  properties:
    base_url:
      type: string
      description: "Darktrace master URL (e.g. https://darktrace.example.com)"
    public_token:
      type: string
      description: "Public API token"
    private_token:
      type: string
      description: "Private API token"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - public_token
    - private_token

commands:
  - id: get_model_breaches
    name: darktrace-get-model-breaches
    description: "List model breaches (optionally since a time)."
    risk: read
    inputs_schema:
      properties:
        min_score: { type: number, description: "Minimum breach score 0-1 (optional)" }
        from_time: { type: string, description: "Start time YYYY-MM-DD HH:MM:SS (optional)" }
        count: { type: number, description: "Max breaches (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_model_breach
    name: darktrace-get-model-breach
    description: "Get a single model breach by its PBID."
    risk: read
    inputs_schema:
      properties:
        pbid: { type: string, description: "Policy breach ID (PBID)" }
      required: [pbid]
    outputs_schema: { properties: {} }
  - id: acknowledge_breach
    name: darktrace-acknowledge-breach
    description: "Acknowledge a model breach."
    inputs_schema:
      properties:
        pbid: { type: string, description: "Policy breach ID (PBID)" }
      required: [pbid]
    outputs_schema: { properties: {} }
  - id: get_devices
    name: darktrace-get-devices
    description: "Look up devices (by IP or device ID)."
    risk: read
    inputs_schema:
      properties:
        did: { type: string, description: "Device ID (optional)" }
        ip: { type: string, description: "IP address (optional)" }
        count: { type: number, description: "Max devices (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_antigena_actions
    name: darktrace-get-antigena-actions
    description: "List Antigena (autonomous response) actions."
    risk: read
    inputs_schema:
      properties:
        include_cleared: { type: boolean, description: "Include cleared actions (default false)" }
      required: []
    outputs_schema: { properties: {} }
  - id: activate_antigena
    name: darktrace-activate-antigena
    description: "Activate an Antigena action (containment — enforce autonomous response)."
    inputs_schema:
      properties:
        codeid: { type: string, description: "Antigena action code ID" }
        duration: { type: number, description: "Duration in seconds (optional)" }
      required: [codeid]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: darktrace-test-connection
    description: "Verify connectivity and the signed credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }