{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.netify.ai/developer/agent/v5/schemas/netify-config-proc-intel.json",
  "title": "Netify Intelligence Processor Configuration",
  "description": "JSON Schema for the Netify Intelligence Processor plugin configuration.",
  "type": "object",
  "required": [
    "indicators",
    "sink_targets"
  ],
  "properties": {
    "indicator_defaults": {
      "type": "object",
      "description": "Default settings applied to all indicators unless explicitly overridden.",
      "properties": {
        "priority": {
          "type": "integer",
          "default": 65535,
          "description": "Default priority for indicators (0-65535)."
        },
        "score": {
          "type": "integer",
          "default": 0,
          "description": "Default risk/severity score for indicators."
        },
        "sink": {
          "type": "object",
          "description": "Default sink settings.",
          "properties": {
            "flow_metadata": {
              "type": "string",
              "enum": ["none", "default", "stats", "full"],
              "default": "full",
              "description": "Default flow metadata format for telemetry."
            }
          }
        },
        "event_filter": {
          "type": "array",
          "default": ["dpi_complete"],
          "description": "Default event types used for analysis.",
          "items": {
            "type": "string",
            "enum": [
              "dpi_new",
              "dpi_update",
              "dpi_complete",
              "flow_new",
              "flow_stats",
              "flow_expiring",
              "flow_expired"
            ]
          }
        },
        "criteria": {
          "$ref": "#/$defs/criteriaType"
        },
        "cache": {
          "$ref": "#/$defs/cacheType"
        }
      }
    },
    "indicators": {
      "type": "object",
      "description": "Definitions of intelligence indicators and their processing logic.",
      "additionalProperties": {
        "type": "object",
        "required": [
          "enabled",
          "indicator_driver"
        ],
        "properties": {
          "enabled": {
            "type": "boolean",
            "default": true,
            "description": "Enables or disables the indicator."
          },
          "indicator_driver": {
            "type": "string",
            "description": "Identifier for the underlying intelligence driver."
          },
          "priority": {
            "type": "integer",
            "description": "Indicator priority (0-65535). Defaults to 65535."
          },
          "score": {
            "type": "integer",
            "description": "Risk/severity score assigned to the indicator. Defaults to 0."
          },
          "criteria": {
            "$ref": "#/$defs/criteriaType"
          },
          "event_filter": {
            "type": "array",
            "items": { "type": "string" },
            "description": "Overrides the default event filter for this indicator."
          },
          "data_feeds": {
            "type": "array",
            "description": "Intelligence data sources used by the indicator.",
            "items": {
              "type": "string"
            }
          },
          "proc_targets": {
            "type": "array",
            "description": "Processor targets, typically flow actions such as proc-nfa.",
            "items": {
              "type": "string"
            }
          },
          "sink_targets": {
            "type": "array",
            "description": "Named output targets defined in the top-level sink_targets property.",
            "items": {
              "type": "string"
            }
          },
          "cache": {
            "$ref": "#/$defs/cacheType"
          }
        }
      }
    },
    "data_feeds": {
      "type": "object",
      "description": "Intelligence data feed definitions.",
      "additionalProperties": {
        "type": "object",
        "properties": {
          "type": { "type": "string" },
          "enable": { "type": "boolean", "default": true }
        },
        "required": ["type"]
      }
    },
    "sink_targets": {
      "type": "object",
      "description": "Sink target definitions.",
      "additionalProperties": {
        "type": "object",
        "description": "A specific output target such as sink-mqtt or sink-http.",
        "required": [
          "sink"
        ],
        "properties": {
          "sink": {
            "type": "string",
            "description": "Sink plugin identifier."
          },
          "channels": {
            "type": "object",
            "description": "Per-channel sink configuration.",
            "additionalProperties": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": true,
                  "description": "Enables or disables the sink channel."
                },
                "dispatch_flags": {
                  "type": "array",
                  "description": "Dispatch flags applied to the channel.",
                  "items": {
                    "type": "string",
                    "enum": ["json", "object", "msgpack", "append_lf", "prepend_len_header", "gzip"]
                  }
                },
                "flow_metadata": {
                  "type": "string",
                  "enum": ["none", "default", "stats", "full"],
                  "default": "full"
                }
              }
            }
          }
        }
      }
    }
  },
  "$defs": {
    "criteriaType": {
      "type": "object",
      "properties": {
        "flow_expr": { "type": "string" },
        "min_bytes": { "type": "integer", "default": 0 },
        "min_score": { "type": "integer", "default": 0 },
        "trigger_on_east_west": { "type": "boolean", "default": true },
        "trigger_on_wan": { "type": "boolean", "default": true }
      }
    },
    "cacheType": {
      "type": "object",
      "properties": {
        "flow_keys": {
           "type": "array",
           "items": {
             "type": "string",
             "enum": ["none", "local_mac", "other_mac", "local_ip", "other_ip", "local_port", "other_port", "src_mac", "dst_mac", "src_ip", "dst_ip", "src_port", "dst_port"]
           }
        },
        "max_size": { "type": "integer" },
        "max_age": { "type": "integer", "default": 0 },
        "filename": { "type": "string" }
      },
      "required": ["flow_keys", "max_size"]
    }
  },
  "additionalProperties": false,
  "examples": [
    {
      "indicator_defaults": {
        "sink": {
          "flow_metadata": "full"
        },
        "event_filter": [
          "dpi_complete"
        ]
      },
      "sink_targets": {
        "telemetry": {
          "sink": "sink-mqtt",
          "channels": {
            "intel": {
              "enabled": true,
              "dispatch_flags": [
                "format_json"
              ]
            }
          }
        }
      },
      "indicators": {
        "credentials_cleartext": {
          "enabled": true,
          "indicator_driver": "credentials_cleartext",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "crypto_application": {
          "enabled": true,
          "indicator_driver": "crypto_application",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "crypto_protocol": {
          "enabled": true,
          "indicator_driver": "crypto_protocol",
          "data_feeds": [ "netify_api" ],
          "criteria": {
            "min_bytes": 200,
            "flow_expr": "!detection_guessed;"
          },
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "crypto_server": {
          "enabled": true,
          "indicator_driver": "crypto_server",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "doh_scanner": {
          "enabled": true,
          "indicator_driver": "doh_scanner",
          "query": "google.com",
          "routes": [
            "/dns-query",
            "/"
          ],
          "timeout": 5,
          "cache_size_positive": 1000,
          "cache_size_negative": 1000,
          "cache_path_positive": "${path_state_persistent}/doh-positive.csv",
          "cache_path_negative": "${path_state_persistent}/doh-negative.csv",
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "dox_server": {
          "enabled": true,
          "indicator_driver": "dox_server",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "protocol_insecure": {
          "enabled": true,
          "indicator_driver": "protocol_insecure",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tls_cipher_score": {
          "enabled": true,
          "indicator_driver": "tls_cipher_score",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tls_cert_expired": {
          "enabled": true,
          "indicator_driver": "tls_cert_expired",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tls_cert_mismatch": {
          "enabled": true,
          "indicator_driver": "tls_cert_mismatch",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tls_cert_validity_too_long": {
          "enabled": true,
          "indicator_driver": "tls_cert_validity_too_long",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tls_cert_self_signed_local": {
          "enabled": true,
          "criteria": {
            "flow_expr": "other_type != other_remote;"
          },
          "indicator_driver": "tls_cert_self_signed",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tls_cert_self_signed_remote": {
          "enabled": true,
          "criteria": {
            "flow_expr": "other_type == other_remote;"
          },
          "indicator_driver": "tls_cert_self_signed",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tor_bridge": {
          "enabled": true,
          "indicator_driver": "tor_bridge",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tor_exit": {
          "enabled": true,
          "indicator_driver": "tor_exit",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "tor_relay": {
          "enabled": true,
          "indicator_driver": "tor_relay",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "vpn_application_business": {
          "enabled": true,
          "indicator_driver": "vpn_application_business",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "vpn_application_consumer": {
          "enabled": true,
          "indicator_driver": "vpn_application_consumer",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "vpn_protocol": {
          "enabled": true,
          "indicator_driver": "vpn_protocol",
          "data_feeds": [ "netify_api" ],
          "criteria": {
            "flow_expr": "application != 'netify.3gpp-network';"
          },
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        },
        "vpn_server_consumer": {
          "enabled": true,
          "indicator_driver": "vpn_server_consumer",
          "data_feeds": [ "netify_api" ],
          "proc_targets": [ "proc-nfa" ],
          "sink_targets": [ "telemetry" ]
        }
      },
      "data_feeds": {
        "netify_api": {
          "enabled": true
        }
      }
    }
  ]
}