{
  "_comment": [
    "Context envelope template for AI-assisted triage of a Wazuh 5.x finding.",
    "This is a SKELETON with placeholders, not captured output. Every value is a",
    "<PLACEHOLDER>. Field names under 'finding' are Wazuh Common Schema names from the",
    "5.0-beta documentation; the exact set present on a real finding varies by",
    "integration category, so treat the list below as the shape to fill, not a",
    "guarantee of what every document carries.",
    "",
    "Assemble this in your automation platform AFTER enrichment and BEFORE the model",
    "call. Everything under 'finding' is untrusted data written, in part, by whoever",
    "generated the log. Deliver it to the model inside a clearly delimited data block",
    "and never as instruction.",
    "",
    "Companion to https://maheshtata.com/wazuh/wazuh-ai-triage/"
  ],

  "envelope_version": "1",

  "finding_ref": {
    "_comment": "Echoed back by the model in its verdict so a response can never be applied to the wrong finding.",
    "doc_id": "<FINDING_DOCUMENT_ID>",
    "index": "<wazuh-findings-v5-CATEGORY>"
  },

  "finding": {
    "_comment": "Trimmed. Send the fields that carry meaning, not the whole document.",
    "@timestamp": "<ISO8601_TIMESTAMP>",
    "wazuh.rule.title": "<RULE_TITLE>",
    "wazuh.rule.id": "<RULE_UUID>",
    "wazuh.rule.level": "<informational|low|medium|high|critical>",
    "wazuh.integration.name": "<INTEGRATION_NAME>",
    "wazuh.agent.id": "<AGENT_ID>",
    "wazuh.agent.name": "<AGENT_NAME>",
    "wazuh.agent.groups": ["<GROUP>"],
    "event.category": "<EVENT_CATEGORY>",
    "event.action": "<EVENT_ACTION>",
    "source.ip": "<SOURCE_IP_OR_NULL>",
    "destination.ip": "<DESTINATION_IP_OR_NULL>",
    "user.name": "<USERNAME_OR_NULL>",
    "process.name": "<PROCESS_NAME_OR_NULL>",
    "file.path": "<FILE_PATH_OR_NULL>",
    "event.original": "<RAW_LOG_LINE_UNTRUSTED>",
    "mitre": {
      "_comment": "Structured on 5.x rules. Omit the whole object if the rule carries no mapping.",
      "tactic": ["<TACTIC_ID>"],
      "technique": ["<TECHNIQUE_ID>"],
      "subtechnique": ["<SUBTECHNIQUE_ID>"]
    },
    "enrichment": {
      "_comment": "Present only when the normalization engine enriched the event. Omit if absent rather than sending nulls.",
      "source.geo.country_iso_code": "<CC_OR_OMIT>",
      "source.as.organization.name": "<ASN_ORG_OR_OMIT>",
      "wazuh.threat": "<THREAT_INTEL_MATCH_OR_OMIT>"
    }
  },

  "rule_intent": {
    "_comment": "The highest-value field in this envelope and the one nobody maintains. Written by whoever authored the rule, stored beside the rule in your content repository, and made a required step when content is promoted from Draft to Custom.",
    "what_it_catches": "<ONE_PARAGRAPH_WRITTEN_BY_THE_RULE_AUTHOR>",
    "what_a_true_positive_looks_like": "<ONE_OR_TWO_SENTENCES>",
    "known_benign_causes": ["<KNOWN_BENIGN_CAUSE>"],
    "owner": "<TEAM_OR_ROLE>",
    "last_reviewed": "<YYYY-MM-DD>"
  },

  "asset": {
    "_comment": "Prefer agent groups and labels, which arrive on every document as wazuh.agent.groups and wazuh.agent.labels.*, over a separate CMDB lookup. Fewer moving parts and the data is already correct.",
    "hostname": "<HOSTNAME>",
    "role": "<ROLE_FROM_GROUP_OR_LABEL>",
    "environment": "<production|staging|development>",
    "internet_facing": "<true|false|unknown>",
    "owner": "<TEAM_OR_ROLE>",
    "criticality": "<high|medium|low|unknown>",
    "notes": "<FREE_TEXT_FROM_YOUR_ASSET_SOURCE>"
  },

  "history": {
    "_comment": "Aggregated, not listed. Bounded windows. This is what turns 'a failed login' into 'the twentieth this hour'. Populate from an indexer aggregation, not by pasting documents.",
    "same_rule_same_agent_24h": "<COUNT>",
    "same_rule_same_agent_7d": "<COUNT>",
    "same_rule_other_agents_24h": "<COUNT>",
    "first_seen_this_rule_on_this_agent": "<ISO8601_OR_NULL>",
    "last_seen_before_this_one": "<ISO8601_OR_NULL>",
    "related_finding_ids": ["<FINDING_DOCUMENT_ID>"]
  },

  "prior_decisions": {
    "_comment": "Where the compounding value is, and it needs no model to produce. Read from your case system for this rule and agent combination.",
    "entries": [
      {
        "date": "<YYYY-MM-DD>",
        "decision": "<true_positive|benign|tuned>",
        "reason": "<SHORT_REASON_RECORDED_BY_THE_ANALYST>",
        "decided_by": "<ANALYST_OR_ROLE>",
        "expires": "<YYYY-MM-DD_OR_NULL>"
      }
    ]
  },

  "policy_context": {
    "_comment": "Read by the platform, not by the model, but kept in the envelope so the case record shows what policy applied at the time of the verdict.",
    "severity_band": "<informational|low|medium|high|critical>",
    "actions_permitted_at_this_band": ["enrich_only", "escalate_to_analyst"],
    "auto_close_permitted": false
  }
}