{
  "_comment_1": "Wazuh 5.0 SOAR intake: message body for an OpenSearch Alerting trigger ACTION.",
  "_comment_2": "Paste the contents of this file (minus the _comment_* keys) into the Message field of a notification action on a per-document monitor targeting wazuh-findings-v5-*. Set the channel Content-Type header to application/json.",
  "_comment_3": "The body is a Mustache template. Wazuh's migration guide (docs/guide/migration/integratord-notifications.md) uses the ctx.alerts.0.sample_documents.0._source.<field> form to reach fields on the triggering finding. ctx.monitor.name, ctx.trigger.name, ctx.trigger.severity, ctx.periodStart and ctx.periodEnd come from the OpenSearch alerting actions reference.",
  "_comment_4": "Every _source path below is a scalar field present on the enriched finding document shown in the official 5.0-beta detection-workflow walkthrough. Scalars only: array fields such as wazuh.agent.groups and free-text fields such as event.original are deliberately NOT templated here. A missing Mustache value renders as an empty string rather than raising an error, and untrusted free text inside a JSON template is a quoting hazard, so the playbook fetches those from the finding document itself using doc_id and doc_index.",
  "_comment_5": "Bump contract_version on any change to this file and make the receiving playbook reject versions it does not know.",

  "contract_version": "1.0.0",
  "source": "wazuh",

  "monitor": {
    "name": "{{ctx.monitor.name}}",
    "trigger": "{{ctx.trigger.name}}",
    "trigger_severity": "{{ctx.trigger.severity}}",
    "period_start": "{{ctx.periodStart}}",
    "period_end": "{{ctx.periodEnd}}"
  },

  "finding": {
    "event_id": "{{ctx.alerts.0.sample_documents.0._source.wazuh.event.id}}",
    "observed_at": "{{ctx.alerts.0.sample_documents.0._source.@timestamp}}",
    "doc_id": "{{ctx.alerts.0.sample_documents.0._source.event.doc_id}}",
    "doc_index": "{{ctx.alerts.0.sample_documents.0._source.event.index}}",
    "space": "{{ctx.alerts.0.sample_documents.0._source.wazuh.space.name}}"
  },

  "rule": {
    "id": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.id}}",
    "title": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.title}}",
    "level": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.level}}",
    "status": "{{ctx.alerts.0.sample_documents.0._source.wazuh.rule.status}}"
  },

  "agent": {
    "id": "{{ctx.alerts.0.sample_documents.0._source.wazuh.agent.id}}",
    "name": "{{ctx.alerts.0.sample_documents.0._source.wazuh.agent.name}}",
    "version": "{{ctx.alerts.0.sample_documents.0._source.wazuh.agent.version}}"
  },

  "integration": {
    "name": "{{ctx.alerts.0.sample_documents.0._source.wazuh.integration.name}}",
    "category": "{{ctx.alerts.0.sample_documents.0._source.wazuh.integration.category}}"
  },

  "cluster": {
    "name": "{{ctx.alerts.0.sample_documents.0._source.wazuh.cluster.name}}",
    "node": "{{ctx.alerts.0.sample_documents.0._source.wazuh.cluster.node}}"
  },

  "network": {
    "source_ip": "{{ctx.alerts.0.sample_documents.0._source.source.ip}}"
  }
}