id: anomali_threatstream
name: Anomali ThreatStream
version: 1.0.0
description: "Anomali ThreatStream (API v2/v1) — threat intelligence: reputation lookups for IPs, domains, file hashes and URLs, indicator search, passive DNS, threat-model listing, and indicator import (with or without approval). API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: ip/domain/file/url reputation, indicator search, passive DNS, threat models, import indicator."
category: threat_intel

# Per-instance configuration. Auth header 'Authorization: apikey <username>:<api_key>'.
config_schema:
  properties:
    url:
      type: string
      description: "ThreatStream API URL"
      default: "https://api.threatstream.com"
    username:
      type: string
      description: "ThreatStream username"
    api_key:
      type: string
      description: "ThreatStream API key"
      x-soar-sensitive: true
  required:
    - username
    - api_key

commands:
  - id: ip_reputation
    name: anomali-ip-reputation
    description: "Look up threat intelligence for an IP address."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address" }
      required: [ip]
    outputs_schema: { properties: {} }
  - id: domain_reputation
    name: anomali-domain-reputation
    description: "Look up threat intelligence for a domain."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: file_reputation
    name: anomali-file-reputation
    description: "Look up threat intelligence for a file hash."
    risk: read
    inputs_schema:
      properties:
        file_hash: { type: string, description: "MD5/SHA1/SHA256 hash" }
      required: [file_hash]
    outputs_schema: { properties: {} }
  - id: url_reputation
    name: anomali-url-reputation
    description: "Look up threat intelligence for a URL."
    risk: read
    inputs_schema:
      properties:
        url: { type: string, description: "URL" }
      required: [url]
    outputs_schema: { properties: {} }
  - id: get_indicators
    name: anomali-get-indicators
    description: "Search indicators with a free-text query."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "ThreatStream search query (q=)" }
        limit: { type: number, description: "Max indicators (default 20)" }
      required: []
    outputs_schema: { properties: {} }
  - id: passive_dns
    name: anomali-passive-dns
    description: "Get passive DNS records for an IP or domain."
    risk: read
    inputs_schema:
      properties:
        value: { type: string, description: "IP or domain" }
        type: { type: string, description: "ip or domain (default ip)" }
      required: [value]
    outputs_schema: { properties: {} }
  - id: get_threat_models
    name: anomali-get-threat-models
    description: "List threat models (actors, campaigns, incidents, ...)."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Optional name search" }
        limit: { type: number, description: "Max models (default 20)" }
      required: []
    outputs_schema: { properties: {} }
  - id: import_indicator
    name: anomali-import-indicator
    description: "Import an observable as an indicator (optionally requiring approval)."
    inputs_schema:
      properties:
        value: { type: string, description: "Observable value (IP, domain, hash, URL)" }
        itype: { type: string, description: "Indicator type (e.g. mal_ip, mal_domain, apt_md5)" }
        confidence: { type: number, description: "Confidence 0-100 (default 50)" }
        approve: { type: boolean, description: "Import without approval (default false = requires approval)" }
      required: [value, itype]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: anomali-test-connection
    description: "Verify connectivity and the API key (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }