id: cisco_secure_endpoint
name: Cisco Secure Endpoint
version: 1.0.0
description: "Cisco Secure Endpoint (AMP for Endpoints API v1) — endpoint containment: list and read computers, isolate/unisolate a host, list events, and read a computer's trajectory. HTTP Basic authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get computers, isolate/stop-isolation, list events, get trajectory."
category: endpoint

# Per-instance configuration. HTTP Basic auth with the API client ID + key.
config_schema:
  properties:
    base_url:
      type: string
      description: "AMP API host (region-specific)"
      default: "https://api.amp.cisco.com"
    client_id:
      type: string
      description: "API client ID"
    api_key:
      type: string
      description: "API key"
      x-soar-sensitive: true
  required:
    - client_id
    - api_key

commands:
  - id: list_computers
    name: cisco-amp-list-computers
    description: "List computers (endpoints)."
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Optional hostname filter" }
        limit: { type: number, description: "Max computers (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_computer
    name: cisco-amp-get-computer
    description: "Get a single computer by connector GUID."
    risk: read
    inputs_schema:
      properties:
        connector_guid: { type: string, description: "Connector GUID" }
      required: [connector_guid]
    outputs_schema: { properties: {} }
  - id: isolate_computer
    name: cisco-amp-isolate-computer
    description: "Isolate a computer from the network (containment)."
    inputs_schema:
      properties:
        connector_guid: { type: string, description: "Connector GUID" }
        comment: { type: string, description: "Optional isolation comment" }
      required: [connector_guid]
    outputs_schema: { properties: {} }
  - id: stop_isolation
    name: cisco-amp-stop-isolation
    description: "Stop isolation on a computer."
    inputs_schema:
      properties:
        connector_guid: { type: string, description: "Connector GUID" }
      required: [connector_guid]
    outputs_schema: { properties: {} }
  - id: list_events
    name: cisco-amp-list-events
    description: "List events. Used for ingestion: results path = data."
    risk: read
    inputs_schema:
      properties:
        connector_guid: { type: string, description: "Optional connector GUID filter" }
        limit: { type: number, description: "Max events (default 50)" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: data
      dedup_key: id
  - id: get_trajectory
    name: cisco-amp-get-trajectory
    description: "Get a computer's device trajectory."
    risk: read
    inputs_schema:
      properties:
        connector_guid: { type: string, description: "Connector GUID" }
      required: [connector_guid]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: cisco-amp-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: list_events
  mapper: list_events
  default_incident_type: "Cisco Secure Endpoint Event"