id: threatconnect
name: ThreatConnect
version: 1.0.0
description: "ThreatConnect (API v3) — threat intelligence: query and read indicators and groups (TQL), create and delete indicators, create groups, and tag indicators. HMAC-SHA256 signed authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get/create/delete indicators, list/get/create groups, add indicator tag."
category: threat_intel

# Per-instance configuration. Requests are signed with HMAC-SHA256 using the
# access ID + secret key (header 'Authorization: TC <accessId>:<signature>').
config_schema:
  properties:
    base_url:
      type: string
      description: "ThreatConnect base URL (e.g. https://app.threatconnect.com)"
    access_id:
      type: string
      description: "API access ID"
    api_secret_key:
      type: string
      description: "API secret key"
      x-soar-sensitive: true
  required:
    - base_url
    - access_id
    - api_secret_key

commands:
  - id: list_indicators
    name: tc-list-indicators
    description: "Query indicators using a TQL expression."
    risk: read
    inputs_schema:
      properties:
        tql: { type: string, description: "ThreatConnect Query Language expression (e.g. summary contains \"1.2.3.4\")" }
        limit: { type: number, description: "Max indicators (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_indicator
    name: tc-get-indicator
    description: "Get a single indicator by ID."
    risk: read
    inputs_schema:
      properties:
        indicator_id: { type: string, description: "Indicator ID" }
      required: [indicator_id]
    outputs_schema: { properties: {} }
  - id: create_indicator
    name: tc-create-indicator
    description: "Create an indicator (e.g. Address, Host, File, URL, EmailAddress)."
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: Address, Host, File, URL, or EmailAddress" }
        summary: { type: string, description: "Indicator value (IP, domain, hash, URL, email)" }
        owner_name: { type: string, description: "Owner (organization) name" }
        rating: { type: number, description: "Threat rating 0-5 (optional)" }
        confidence: { type: number, description: "Confidence 0-100 (optional)" }
      required: [type, summary]
    outputs_schema: { properties: {} }
  - id: delete_indicator
    name: tc-delete-indicator
    description: "Delete an indicator by ID."
    inputs_schema:
      properties:
        indicator_id: { type: string, description: "Indicator ID" }
      required: [indicator_id]
    outputs_schema: { properties: {} }
  - id: list_groups
    name: tc-list-groups
    description: "Query groups (incidents, threats, campaigns, ...) using a TQL expression."
    risk: read
    inputs_schema:
      properties:
        tql: { type: string, description: "TQL expression" }
        limit: { type: number, description: "Max groups (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_group
    name: tc-get-group
    description: "Get a single group by ID."
    risk: read
    inputs_schema:
      properties:
        group_id: { type: string, description: "Group ID" }
      required: [group_id]
    outputs_schema: { properties: {} }
  - id: create_group
    name: tc-create-group
    description: "Create a group (Incident, Threat, Campaign, Adversary, ...)."
    inputs_schema:
      properties:
        type: { type: string, description: "Group type: Incident, Threat, Campaign, Adversary, Document, ..." }
        name: { type: string, description: "Group name" }
        owner_name: { type: string, description: "Owner (organization) name" }
      required: [type, name]
    outputs_schema: { properties: {} }
  - id: add_indicator_tag
    name: tc-add-indicator-tag
    description: "Add a tag to an indicator."
    inputs_schema:
      properties:
        indicator_id: { type: string, description: "Indicator ID" }
        tag: { type: string, description: "Tag name" }
      required: [indicator_id, tag]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: tc-test-connection
    description: "Verify connectivity and the signed credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }