{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://ravenstrike.local/schemas/soar_handoff.schema.json",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "incident_id": { "type": "string", "pattern": "^(RAVENSTRIKE|SENTINEL)-\\d{8}-[A-Z0-9]{4}$" },
    "generated_at": { "type": "string", "format": "date-time" },
    "priority": { "type": "string", "enum": ["P1", "P2", "P3", "P4"] },
    "verdict": { "type": "string", "enum": ["TP", "FP", "UNKNOWN"] },
    "title": { "type": "string", "minLength": 1 },
    "mitre_mapping": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "tactic": { "type": "string" },
        "technique_id": { "type": "string", "pattern": "^T\\d{4}(\\.\\d{3})?$" },
        "technique_name": { "type": "string" }
      },
      "required": ["tactic", "technique_id", "technique_name"]
    },
    "affected_assets": { "type": "array", "items": { "type": "object" } },
    "observables": { "type": "array", "items": { "type": "object" } },
    "evidence_summary": { "type": "string" },
    "recommended_playbook": { "type": "string" },
    "analyst_notes": { "type": "string" },
    "detection_source": { "type": "object" }
  },
  "required": ["incident_id", "generated_at", "priority", "verdict", "title", "mitre_mapping", "affected_assets", "observables", "evidence_summary", "recommended_playbook", "analyst_notes", "detection_source"]
}