id: alienvault_otx
name: AlienVault OTX
version: 1.0.0
description: "AlienVault OTX (Open Threat Exchange, API v1) — reputation and threat context for IPs, domains, URLs and file hashes, pulse details and search, and passive DNS / related-URL pivots. API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: IP/domain/URL/file reputation, pulse details and search, passive DNS and related URLs."
category: enrichment

config_schema:
  properties:
    api_key:
      type: string
      description: "AlienVault OTX API key (from your OTX account settings)"
      x-soar-sensitive: true
  required:
    - api_key

commands:
  - id: ip_reputation
    name: alienvault-otx-ip
    description: "Threat context for an IP address (IPv4 or IPv6)."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address" }
      required: [ip]
    outputs_schema: { properties: {} }
  - id: domain_reputation
    name: alienvault-otx-domain
    description: "Threat context for a domain."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain name" }
      required: [domain]
    outputs_schema: { properties: {} }
  - id: url_reputation
    name: alienvault-otx-url
    description: "Threat context for a URL."
    risk: read
    inputs_schema:
      properties:
        url: { type: string, description: "URL" }
      required: [url]
    outputs_schema: { properties: {} }
  - id: file_reputation
    name: alienvault-otx-file
    description: "Threat context for a file hash (MD5, SHA1 or SHA256)."
    risk: read
    inputs_schema:
      properties:
        file: { type: string, description: "File hash" }
      required: [file]
    outputs_schema: { properties: {} }
  - id: get_pulse
    name: alienvault-otx-get-pulse
    description: "Get the details of a pulse (threat report) by ID."
    risk: read
    inputs_schema:
      properties:
        pulse_id: { type: string, description: "Pulse ID" }
      required: [pulse_id]
    outputs_schema: { properties: {} }
  - id: search_pulses
    name: alienvault-otx-search-pulses
    description: "Search pulses by keyword."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Search string" }
        limit: { type: number, description: "Maximum pulses (default 20)" }
      required: [query]
    outputs_schema: { properties: {} }
  - id: passive_dns
    name: alienvault-otx-passive-dns
    description: "Passive DNS records for an IP or domain indicator."
    risk: read
    inputs_schema:
      properties:
        indicator: { type: string, description: "IP or domain" }
        indicator_type: { type: string, description: "IPv4, IPv6 or domain (default auto-detected)" }
      required: [indicator]
    outputs_schema: { properties: {} }
  - id: related_urls
    name: alienvault-otx-related-urls
    description: "URLs associated with an IP or domain indicator."
    risk: read
    inputs_schema:
      properties:
        indicator: { type: string, description: "IP or domain" }
        indicator_type: { type: string, description: "IPv4, IPv6 or domain (default auto-detected)" }
      required: [indicator]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: alienvault-otx-test-connection
    description: "Verify the API key (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }