{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://izikipizi.github.io/nizlo-security-indicators/indicators.schema.json",
  "title": "Nizlo security indicators dataset",
  "type": "object",
  "additionalProperties": false,
  "required": ["$schema", "schema_version", "dataset_version", "title", "vendor", "product", "platform", "last_reviewed", "source", "notice", "expected_network_behavior", "artifacts"],
  "properties": {
    "$schema": { "type": "string" },
    "schema_version": { "const": "1.0" },
    "dataset_version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
    "title": { "type": "string", "minLength": 1 },
    "vendor": { "const": "Nizlo" },
    "product": { "const": "Nizlo RMM" },
    "platform": { "const": "Windows" },
    "last_reviewed": { "type": "string", "format": "date" },
    "source": { "type": "string", "format": "uri" },
    "notice": { "type": "string", "minLength": 40 },
    "expected_network_behavior": {
      "type": "object",
      "additionalProperties": false,
      "required": ["destination", "direction", "transport", "port", "protocols", "inbound_port_required"],
      "properties": {
        "destination": { "const": "app.nizlo.com" },
        "direction": { "const": "outbound" },
        "transport": { "const": "TCP" },
        "port": { "const": 443 },
        "protocols": { "type": "array", "items": { "type": "string" }, "minItems": 2, "uniqueItems": true },
        "inbound_port_required": { "const": false }
      }
    },
    "artifacts": {
      "type": "array",
      "minItems": 12,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["type", "value", "context", "source", "last_reviewed"],
        "properties": {
          "type": { "enum": ["executable", "path", "service", "registry", "protocol", "network"] },
          "value": { "type": "string", "minLength": 1 },
          "context": { "type": "string", "minLength": 10 },
          "source": { "type": "string", "format": "uri" },
          "last_reviewed": { "type": "string", "format": "date" }
        }
      }
    }
  }
}