{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.netify.ai/developer/agent/v5/schemas/netify-proc-intel.json",
  "title": "Netify Intelligence Processor Configuration",
  "description": "JSON Schema for the Netify Intelligence Processor plugin configuration.",
  "type": "object",
  "required": [
    "indicator_defaults",
    "indicators",
    "sink_targets"
  ],
  "properties": {
    "indicator_defaults": {
      "type": "object",
      "description": "Default settings applied to all indicators unless explicitly overridden.",
      "properties": {
        "sink": {
          "type": "object",
          "description": "Default sink settings.",
          "properties": {
            "flow_metadata": {
              "type": "string",
              "description": "Default flow metadata format for telemetry."
            }
          }
        },
        "event_filter": {
          "type": "array",
          "description": "Default event types used for analysis.",
          "items": {
            "type": "string",
            "enum": [
              "dpi_new",
              "dpi_update",
              "dpi_complete",
              "flow_new",
              "flow_stats",
              "flow_expiring",
              "flow_expired"
            ]
          }
        }
      }
    },
    "indicators": {
      "type": "object",
      "description": "Definitions of intelligence indicators and their processing logic.",
      "additionalProperties": {
        "type": "object",
        "required": [
          "enabled",
          "indicator_driver"
        ],
        "properties": {
          "enabled": {
            "type": "boolean",
            "default": true,
            "description": "Enables or disables the indicator."
          },
          "indicator_driver": {
            "type": "string",
            "description": "Identifier for the underlying intelligence driver."
          },
          "criteria": {
            "type": "object",
            "description": "Flow criteria required to trigger the indicator."
          },
          "data_feeds": {
            "type": "array",
            "description": "Intelligence data sources used by the indicator.",
            "items": {
              "type": "string"
            }
          },
          "proc_targets": {
            "type": "array",
            "description": "Processor targets, typically flow actions such as proc-nfa.",
            "items": {
              "type": "string"
            }
          },
          "sink_targets": {
            "type": "array",
            "description": "Named output targets defined in the top-level sink_targets property.",
            "items": {
              "type": "string"
            }
          }
        }
      }
    },
    "sink_targets": {
      "type": "object",
      "description": "Sink target definitions.",
      "additionalProperties": {
        "type": "object",
        "description": "A specific output target such as sink-mqtt or sink-http.",
        "required": [
          "sink"
        ],
        "properties": {
          "sink": {
            "type": "string",
            "description": "Sink plugin identifier."
          },
          "channels": {
            "type": "object",
            "description": "Per-channel sink configuration.",
            "additionalProperties": {
              "type": "object",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "default": true,
                  "description": "Enables or disables the sink channel."
                },
                "dispatch_flags": {
                  "type": "array",
                  "description": "Dispatch flags applied to the channel.",
                  "items": {
                    "type": "string"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "additionalProperties": false
}