id: symantec_dlp
name: Symantec DLP
version: 1.0.0
description: "Symantec DLP (Enforce Server REST API v2) — data-loss-prevention incident handling: list incidents, read an incident and its history, and update incident status/severity. OAuth2 password-grant authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get incidents, get incident history, update incident."
category: dlp

# Per-instance configuration. The username/password are exchanged (OAuth2
# password grant) for a bearer token used on the Enforce v2 REST API.
config_schema:
  properties:
    base_url:
      type: string
      description: "Enforce Server URL (e.g. https://enforce.example.com)"
    username:
      type: string
      description: "Enforce username"
    password:
      type: string
      description: "Enforce password"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - username
    - password

commands:
  - id: list_incidents
    name: symantec-dlp-list-incidents
    description: "List incidents matching a filter."
    risk: read
    inputs_schema:
      properties:
        creation_date_after: { type: string, description: "ISO-8601 lower bound on creation date (optional)" }
        limit: { type: number, description: "Max incidents (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_incident
    name: symantec-dlp-get-incident
    description: "Get a single incident by ID."
    risk: read
    inputs_schema:
      properties:
        incident_id: { type: string, description: "Incident ID" }
      required: [incident_id]
    outputs_schema: { properties: {} }
  - id: get_incident_history
    name: symantec-dlp-get-incident-history
    description: "Get an incident's history."
    risk: read
    inputs_schema:
      properties:
        incident_id: { type: string, description: "Incident ID" }
      required: [incident_id]
    outputs_schema: { properties: {} }
  - id: update_incident
    name: symantec-dlp-update-incident
    description: "Update an incident's status and/or severity."
    inputs_schema:
      properties:
        incident_id: { type: string, description: "Incident ID" }
        status: { type: string, description: "New status ID/name (optional)" }
        severity: { type: string, description: "New severity (optional)" }
      required: [incident_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: symantec-dlp-test-connection
    description: "Verify connectivity and the token exchange (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }