{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://raw.githubusercontent.com/Agent-Threat-Rule/agent-threat-rules/main/spec/stix-extension/x-atr-rule-schema.json",
  "title": "x-atr-rule",
  "description": "STIX 2.1 custom SDO for an Agent Threat Rules detection rule. v1.1 (2026-05-28) adds method/profile fields for the five-plane detection model defined in spec/atr-method-v1.1.md, and compliance crosswalks for NIST CSF 2.0, ETSI TS 104 223, and OSCAL.",
  "type": "object",
  "required": [
    "type",
    "id",
    "spec_version",
    "created",
    "modified",
    "atr_id",
    "atr_category",
    "name",
    "severity",
    "extensions"
  ],
  "properties": {
    "type": {
      "type": "string",
      "const": "x-atr-rule",
      "description": "Always 'x-atr-rule'."
    },
    "id": {
      "type": "string",
      "pattern": "^x-atr-rule--[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
      "description": "STIX UUID-typed identifier. Recommended: deterministic UUID5 derived from atr_id under a stable namespace so the same rule ID always produces the same STIX id."
    },
    "spec_version": {
      "type": "string",
      "const": "2.1"
    },
    "created_by_ref": {
      "type": "string",
      "pattern": "^identity--[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "created": { "type": "string", "format": "date-time" },
    "modified": { "type": "string", "format": "date-time" },
    "revoked": { "type": "boolean" },
    "labels": {
      "type": "array",
      "items": { "type": "string" }
    },
    "confidence": { "type": "integer", "minimum": 0, "maximum": 100 },
    "lang": { "type": "string" },
    "external_references": { "type": "array" },
    "object_marking_refs": { "type": "array" },
    "granular_markings": { "type": "array" },

    "atr_id": {
      "type": "string",
      "pattern": "^ATR-[0-9]{4}-[0-9]{5}$",
      "description": "Canonical ATR rule identifier (e.g. ATR-2026-00548)."
    },
    "atr_category": {
      "type": "string",
      "enum": [
        "prompt-injection",
        "tool-poisoning",
        "context-exfiltration",
        "agent-manipulation",
        "privilege-escalation",
        "excessive-autonomy",
        "data-poisoning",
        "model-abuse",
        "model-security",
        "skill-compromise"
      ],
      "description": "One of ten canonical ATR attack-class categories (SPEC.md §8). v1.1 added 'model-security'."
    },
    "atr_subcategory": {
      "type": "string",
      "description": "Optional finer-grained subcategory (e.g. 'cross-agent-context-drift', 'missing-human-approval')."
    },
    "atr_method": {
      "type": "string",
      "enum": ["pattern", "signature", "semantic", "behavioral", "trace"],
      "description": "Detection method (atr-method-v1.1.md §4). 'pattern' is the v1.0 default; other methods opt into method-specific payload fields. v1.1 addition."
    },
    "atr_runtime_profile": {
      "type": "string",
      "enum": ["deterministic", "assisted"],
      "description": "Deployment profile (atr-method-v1.1.md §4.1). 'deterministic' = signature + pattern, sub-5ms hot path. 'assisted' = semantic + behavioral + trace, sidecar / async path. v1.1 addition."
    },
    "name": {
      "type": "string",
      "description": "Human-readable rule title."
    },
    "description": { "type": "string" },
    "severity": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low", "informational"]
    },
    "maturity": {
      "type": "string",
      "enum": ["experimental", "test", "stable", "deprecated", "draft"],
      "description": "Maturity tier. v1.1 added 'draft' to align with the on-disk rule status vocabulary."
    },
    "agent_source_type": {
      "type": "string",
      "enum": [
        "llm_io",
        "tool_call",
        "mcp_exchange",
        "agent_behavior",
        "multi_agent_comm",
        "context_window",
        "memory_access",
        "skill_lifecycle",
        "skill_permission",
        "skill_chain",
        "agent_trace"
      ],
      "description": "v1.1 added 'agent_trace' for trace-method rules ingesting OpenInference / OTel GenAI span DAGs."
    },
    "detection_patterns": {
      "type": "array",
      "description": "Regex patterns extracted from the ATR rule's detection.conditions (method=pattern only).",
      "items": {
        "type": "object",
        "required": ["field", "pattern"],
        "properties": {
          "field": { "type": "string" },
          "pattern": { "type": "string" },
          "operator": { "type": "string", "default": "regex" },
          "description": { "type": "string" }
        }
      }
    },
    "signature_indicators": {
      "type": "array",
      "description": "v1.1: For method=signature rules. Mirrors detection.signature.indicators in atr-method-v1.1.md §5.",
      "items": {
        "type": "object",
        "required": ["type", "value", "target_field"],
        "properties": {
          "type": {
            "type": "string",
            "enum": ["sha256", "sha512", "blake2b-256", "package_name", "registry_url", "skill_id"]
          },
          "value": { "type": "string" },
          "target_field": { "type": "string" },
          "provenance": { "type": "object" }
        }
      }
    },
    "semantic_judge": {
      "type": "object",
      "description": "v1.1: For method=semantic rules. Mirrors detection.semantic in atr-method-v1.1.md §6.",
      "properties": {
        "judge_model_class": { "type": "string" },
        "prompt_template": { "type": "string" },
        "threshold": { "type": "number", "minimum": 0.0, "maximum": 1.0 },
        "judge_prompt_hash": { "type": "string" },
        "fallback_method": { "type": "string", "enum": ["pattern", "none"] }
      }
    },
    "trace_detection": {
      "type": "object",
      "description": "v1.1: For method=trace rules. Mirrors detection.trace in atr-method-v1.1.md §8.",
      "properties": {
        "ingest_format": { "type": "string", "enum": ["openinference", "otel_gen_ai"] },
        "primitives": {
          "type": "object",
          "properties": {
            "forbid": { "type": "array" },
            "require": { "type": "array" },
            "invariant": { "type": "array" }
          }
        }
      }
    },
    "response_actions": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "block_input",
          "block_output",
          "block_tool",
          "block_request",
          "quarantine_session",
          "quarantine_artifact",
          "reset_context",
          "alert",
          "log_alert",
          "snapshot",
          "escalate",
          "require_human_review",
          "redact_match",
          "rate_limit_source",
          "revoke_credential",
          "notify_operator",
          "reduce_permissions",
          "kill_agent"
        ]
      },
      "description": "v1.1: extended to include actions from SPEC.md Appendix A canonical action vocabulary."
    },
    "owasp_llm_refs": {
      "type": "array",
      "items": { "type": "string" }
    },
    "owasp_agentic_refs": {
      "type": "array",
      "items": { "type": "string" }
    },
    "owasp_ast_refs": {
      "type": "array",
      "items": { "type": "string" },
      "description": "OWASP Agentic Skills Top 10 references (v1.1)."
    },
    "mitre_atlas_refs": {
      "type": "array",
      "items": { "type": "string" }
    },
    "mitre_attack_refs": {
      "type": "array",
      "items": { "type": "string" }
    },
    "cve_refs": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]+$"
      }
    },
    "safe_mcp_refs": {
      "type": "array",
      "items": { "type": "string" },
      "description": "SAFE-MCP technique IDs (v1.1)."
    },
    "probe_id_refs": {
      "type": "array",
      "items": { "type": "string" },
      "description": "v1.1: Adversarial probe identifiers (format <framework>:<probe-name>, e.g. 'pyrit:indirect_pi_v2' or 'garak:promptinject.HijackHateHumans'). Lets STIX consumers measure detection coverage against red-team probe outputs."
    },
    "compliance_refs": {
      "type": "object",
      "description": "Mappings to compliance frameworks. v1.1 added nist_csf, etsi_ts_104223, oscal_assessment_objective.",
      "properties": {
        "eu_ai_act": { "type": "array" },
        "nist_ai_rmf": { "type": "array" },
        "iso_42001": { "type": "array" },
        "nist_csf": {
          "type": "array",
          "items": { "type": "string" },
          "description": "NIST CSF 2.0 subcategory IDs (e.g., DE.CM-09, PR.IR-01). v1.1."
        },
        "etsi_ts_104223": {
          "type": "array",
          "items": { "type": "string" },
          "description": "ETSI TS 104 223 principle / sub-principle IDs (e.g., P4.3). v1.1."
        },
        "oscal_assessment_objective": {
          "type": "array",
          "items": { "type": "string" },
          "description": "OSCAL Assessment Plan / Result objective IDs this rule supplies evidence for. v1.1."
        }
      },
      "additionalProperties": false
    },
    "extensions": {
      "type": "object",
      "description": "STIX 2.1 extensions object, must contain the ATR extension-definition reference.",
      "patternProperties": {
        "^extension-definition--93370194-c964-570f-9802-9d1154e5525d$": {
          "type": "object",
          "required": ["extension_type"],
          "properties": {
            "extension_type": { "const": "new-sdo" }
          }
        }
      },
      "minProperties": 1
    }
  },
  "additionalProperties": true
}