id: eclecticiq
name: EclecticIQ
version: 1.0.0
description: "EclecticIQ Intelligence Center (API v2) — threat intelligence: search entities and observables, and read an entity by ID. Bearer-token authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: search entities, get entity, search observables."
category: threat_intel

# Per-instance configuration. Auth header 'Authorization: Bearer <api_token>'.
config_schema:
  properties:
    base_url:
      type: string
      description: "Intelligence Center URL (e.g. https://eiq.example.com)"
    api_token:
      type: string
      description: "API token"
      x-soar-sensitive: true
  required:
    - base_url
    - api_token

commands:
  - id: search_entities
    name: eclecticiq-search-entities
    description: "Search entities (indicators, reports, TTPs, ...) by text."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Text to match in entity data" }
        limit: { type: number, description: "Max entities (default 25)" }
      required: [query]
    outputs_schema: { properties: {} }
  - id: get_entity
    name: eclecticiq-get-entity
    description: "Get a single entity by ID."
    risk: read
    inputs_schema:
      properties:
        entity_id: { type: string, description: "Entity ID" }
      required: [entity_id]
    outputs_schema: { properties: {} }
  - id: search_observables
    name: eclecticiq-search-observables
    description: "Search observables by value (IP, domain, hash, ...)."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "Observable value" }
        limit: { type: number, description: "Max observables (default 25)" }
      required: [value]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: eclecticiq-test-connection
    description: "Verify the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }