id: microsoft_purview
name: Microsoft Purview
version: 1.0.0
description: "Microsoft Purview DLP alerts (via Microsoft Graph Security API) — data-loss-prevention triage: list and read DLP security alerts, update alert status/assignment, and list/read security incidents. Azure AD OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get DLP alerts, update alert, list/get incidents."
category: dlp

# Per-instance configuration. Application (client-credentials) OAuth2. Needs Graph
# application permissions SecurityAlert.ReadWrite.All and SecurityIncident.Read.All.
config_schema:
  properties:
    tenant_id:
      type: string
      description: "Azure AD tenant ID"
    client_id:
      type: string
      description: "App registration (client) ID"
    client_secret:
      type: string
      description: "App registration client secret"
      x-soar-sensitive: true
  required:
    - tenant_id
    - client_id
    - client_secret

commands:
  - id: list_dlp_alerts
    name: purview-list-dlp-alerts
    description: "List Data Loss Prevention alerts."
    risk: read
    inputs_schema:
      properties:
        status: { type: string, description: "Filter by status (new, inProgress, resolved)" }
        limit: { type: number, description: "Max alerts (default 25)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_alert
    name: purview-get-alert
    description: "Get a single security alert by ID."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  - id: update_alert
    name: purview-update-alert
    description: "Update an alert's status and/or assignee."
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
        status: { type: string, description: "new, inProgress, or resolved" }
        assigned_to: { type: string, description: "Assignee (UPN)" }
        determination: { type: string, description: "Optional determination (e.g. truePositive, falsePositive)" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  - id: list_incidents
    name: purview-list-incidents
    description: "List security incidents."
    risk: read
    inputs_schema:
      properties:
        status: { type: string, description: "Filter by status (active, resolved, redirected)" }
        limit: { type: number, description: "Max incidents (default 25)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_incident
    name: purview-get-incident
    description: "Get a single security incident by ID."
    risk: read
    inputs_schema:
      properties:
        incident_id: { type: string, description: "Incident ID" }
      required: [incident_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: purview-test-connection
    description: "Verify connectivity and the app credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }