{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://ravenstrike.local/schemas/agent_input.schema.json",
  "title": "Agent Input",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "input_type": {
      "type": "string",
      "enum": ["raw_log", "alert", "scenario", "ioc", "rule", "technique_id", "coverage_request"]
    },
    "platform_hint": {
      "type": "string",
      "enum": ["QRadar", "CrowdStrike", "Sentinel", "Elastic", "Splunk", "Generic"]
    },
    "content": { "type": "string", "minLength": 1 },
    "iocs": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "type": { "type": "string", "enum": ["ip", "hash", "domain", "url", "user", "process"] },
          "value": { "type": "string", "minLength": 1 }
        },
        "required": ["type", "value"]
      }
    },
    "metadata": {
      "type": "object",
      "additionalProperties": true
    }
  },
  "required": ["input_type", "content"]
}