id: qradar
name: IBM QRadar
version: 1.0.0
description: "IBM QRadar (REST API) — SIEM investigation and response: list and read offenses, update/close an offense, list reference sets and add/remove values (block/allow lists used by rules), and list assets. SEC-token authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get offenses, update offense, list reference sets, add/remove reference-set value, list assets."
category: siem

# Per-instance configuration. The API token is sent as the 'SEC' header.
config_schema:
  properties:
    base_url:
      type: string
      description: "QRadar console URL (e.g. https://qradar.example.com)"
    api_token:
      type: string
      description: "QRadar authorized service (SEC) token"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - base_url
    - api_token

commands:
  - id: list_offenses
    name: qradar-list-offenses
    description: "List offenses (optionally filtered)."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "QRadar filter expression (e.g. status=OPEN)" }
        limit: { type: number, description: "Max offenses (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_offense
    name: qradar-get-offense
    description: "Get a single offense by ID."
    risk: read
    inputs_schema:
      properties:
        offense_id: { type: string, description: "Offense ID" }
      required: [offense_id]
    outputs_schema: { properties: {} }
  - id: update_offense
    name: qradar-update-offense
    description: "Update an offense (status, assignee, or close with a reason)."
    inputs_schema:
      properties:
        offense_id: { type: string, description: "Offense ID" }
        status: { type: string, description: "OPEN, HIDDEN, or CLOSED" }
        assigned_to: { type: string, description: "Assignee username" }
        closing_reason_id: { type: string, description: "Closing reason ID (required when status=CLOSED)" }
      required: [offense_id]
    outputs_schema: { properties: {} }
  - id: list_reference_sets
    name: qradar-list-reference-sets
    description: "List reference sets."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: add_to_reference_set
    name: qradar-add-to-reference-set
    description: "Add a value to a reference set (e.g. a block list consumed by rules)."
    inputs_schema:
      properties:
        set_name: { type: string, description: "Reference set name" }
        value: { type: string, description: "Value to add" }
      required: [set_name, value]
    outputs_schema: { properties: {} }
  - id: delete_from_reference_set
    name: qradar-delete-from-reference-set
    description: "Remove a value from a reference set."
    inputs_schema:
      properties:
        set_name: { type: string, description: "Reference set name" }
        value: { type: string, description: "Value to remove" }
      required: [set_name, value]
    outputs_schema: { properties: {} }
  - id: list_assets
    name: qradar-list-assets
    description: "List assets from the asset model."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "Optional filter expression" }
        limit: { type: number, description: "Max assets (default 50)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: qradar-test-connection
    description: "Verify connectivity and the SEC token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }