#%RAML 1.0 Library

uses:
  cti: ../../../../.ramlx/cti.raml
  base: ../../am/types.raml

(base.Categories):
- name: cti.a.p.am.category.v1.0~example.security.alerts.v1.0
  description: Category for security related alerts.

types:
  FileError:
    (cti.cti): cti.a.p.am.alert.v1.0~example.security.file_issue.detected.error.v1.0
    type: base.Alert
    description: An alert that is raised if the application detected malicious content in a file.

    cti-traits: 
      category: cti.a.p.am.category.v1.0~example.security.alerts.v1.0
      severity: error

    properties:
      details: 
        additionalProperties: false
        properties:
          resource:
            description: machine name
            type: string
          file_path: string
          detection_category:
            description: issue
            type: string
            enum: [Malware, Ransomware, Phishing, Exploits, Suspicious]
          scan_result:
            description: scan result provides more details about the raised error
            type: string

  SystemError:
    (cti.cti): cti.a.p.am.alert.v1.0~example.security.system_issue.detected.error.v1.0
    type: base.Alert
    description: An alert that is raised if the application1 detects system issue. e.g. security misconfigurations

    cti-traits: 
      category: cti.a.p.am.category.v1.0~example.security.alerts.v1.0
      severity: warning

    properties:
      details: 
        additionalProperties: false
        properties:
          resource:
            description: machine name
            type: string
          detection_category:
            description: issue
            type: string
            enum: [WeakPassword, ImproperAccessControl, InsecureNetwork]
          scan_result: 
            description: scan result provides more details about the raised error
            type: string
