{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://maheshtata.com/wazuh/wazuh-soar/payload-contract.schema.json",
  "title": "Wazuh 5.0 SOAR webhook payload contract",
  "description": "Validate every inbound webhook from a Wazuh indexer alerting action against this schema before a playbook acts on it. Fail closed on contract_version values the playbook does not know.",
  "type": "object",
  "required": ["contract_version", "source", "monitor", "finding", "rule", "agent"],
  "additionalProperties": false,
  "properties": {
    "contract_version": {
      "type": "string",
      "pattern": "^\\d+\\.\\d+\\.\\d+$",
      "description": "Semantic version of this contract. Bump the major on any removal or rename."
    },
    "source": {
      "const": "wazuh"
    },
    "monitor": {
      "type": "object",
      "required": ["name", "trigger"],
      "additionalProperties": false,
      "properties": {
        "name": { "type": "string", "minLength": 1 },
        "trigger": { "type": "string", "minLength": 1 },
        "trigger_severity": { "type": "string" },
        "period_start": { "type": "string" },
        "period_end": { "type": "string" }
      }
    },
    "finding": {
      "type": "object",
      "required": ["event_id", "observed_at", "doc_id", "doc_index"],
      "additionalProperties": false,
      "properties": {
        "event_id": {
          "type": "string",
          "minLength": 1,
          "description": "wazuh.event.id. Use as the idempotency key for exactly-once processing of one finding."
        },
        "observed_at": { "type": "string" },
        "doc_id": {
          "type": "string",
          "description": "event.doc_id: document id of the originating event. Use with doc_index to fetch the full document."
        },
        "doc_index": {
          "type": "string",
          "description": "event.index: source index of the originating event."
        },
        "space": {
          "type": "string",
          "enum": ["standard", "custom", "test", "draft", ""],
          "description": "wazuh.space.name. Standard is Wazuh CTI content; custom is your own."
        }
      }
    },
    "rule": {
      "type": "object",
      "required": ["id", "title", "level"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string", "minLength": 1 },
        "title": { "type": "string" },
        "level": {
          "type": "string",
          "enum": ["informational", "low", "medium", "high", "critical"],
          "description": "wazuh.rule.level. String severity in 5.0; there is no numeric level."
        },
        "status": {
          "type": "string",
          "enum": ["experimental", "test", "stable", ""]
        }
      }
    },
    "agent": {
      "type": "object",
      "required": ["id"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string", "minLength": 1 },
        "name": { "type": "string" },
        "version": { "type": "string" }
      }
    },
    "integration": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "name": { "type": "string" },
        "category": {
          "type": "string",
          "enum": [
            "access-management",
            "applications",
            "cloud-services",
            "network-activity",
            "security",
            "system-activity",
            "other",
            "unclassified",
            ""
          ]
        }
      }
    },
    "cluster": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "name": { "type": "string" },
        "node": { "type": "string" }
      }
    },
    "network": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "source_ip": {
          "type": "string",
          "description": "source.ip. May be an empty string when the finding has no network context."
        }
      }
    }
  }
}