{
  "_comment_1": "Wazuh 5.0 KVDB create payload for POST /_plugins/_content_manager/kvdbs on the Wazuh indexer (port 9200).",
  "_comment_2": "Envelope shape (integration + resource) and the metadata/enabled/content fields follow the Content Manager API specification at https://documentation.wazuh.com/5.0-beta/_static/indexer-api-spec/spec.yml",
  "_comment_3": "Replace the integration UUID with the id of YOUR integration. The KVDB is created in the draft space and the server generates its own UUID for it. Promote draft -> test -> custom before it affects live events.",
  "_comment_4": "metadata.title is the KVDB NAME that decoder helpers reference, e.g. kvdb_match('known_malicious_ips').",
  "_comment_5": "Keys are EXACT strings. There is no subnet matching: CIDR entries have no KVDB equivalent and must be written as ip_cidr_match checks in the decoder instead. See https://github.com/wazuh/wazuh/blob/main/docs/guide/migration/cdb-to-kvdb-migration.md",
  "_comment_6": "Values are arbitrary JSON, so carry provenance in the value. That is what kvdb_get retrieves, and it is what makes an indicator removable later. Addresses below are RFC 5737 documentation ranges; substitute your own export.",
  "_comment_7": "A PUT to /_plugins/_content_manager/kvdbs/{id} REPLACES content, so regenerate the whole map from your source rather than appending.",

  "integration": "9e301671-382d-4c1a-9abf-3d9d9544789c",
  "resource": {
    "metadata": {
      "title": "known_malicious_ips",
      "author": "Security Operations",
      "description": "Atomic IPv4 indicators exported from the internal MISP instance. Regenerated nightly; entries older than the configured age are dropped at generation time.",
      "documentation": "Matched by decoder/ip-blocklist-misp/0 with kvdb_match in its check stage.",
      "references": [
        "https://www.misp-project.org/"
      ]
    },
    "enabled": true,
    "content": {
      "203.0.113.10": {
        "source": "misp",
        "event_id": "1042",
        "category": "c2",
        "confidence": "high",
        "added": "2026-09-18",
        "expires": "2026-12-17"
      },
      "203.0.113.44": {
        "source": "misp",
        "event_id": "1042",
        "category": "c2",
        "confidence": "high",
        "added": "2026-09-18",
        "expires": "2026-12-17"
      },
      "198.51.100.7": {
        "source": "misp",
        "event_id": "1051",
        "category": "phishing-infrastructure",
        "confidence": "medium",
        "added": "2026-09-20",
        "expires": "2026-10-20"
      }
    }
  }
}