Binalyze AIR MCP Server 12.4.1

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The case ID to associate the baseline acquisition with"
    },
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term"
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name"
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address"
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID"
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path"
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])"
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])"
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])"
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue"
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])"
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by tags"
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version"
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy"
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to include for baseline acquisition"
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude"
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "type": "number"
          },
          "description": "Organization IDs filter. Defaults to [0]"
        }
      },
      "description": "Filter object to specify which assets to acquire baseline from"
    }
  },
  "required": [
    "caseId",
    "filter"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case to add a note to (e.g., \"C-2022-0002\")"
    },
    "note": {
      "type": "string",
      "description": "The content of the note to add to the case"
    }
  },
  "required": [
    "caseId",
    "note"
  ]
}

{
  "type": "object",
  "properties": {
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term."
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name."
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address."
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID."
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path."
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])."
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])."
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])."
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue."
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])."
        },
        "tagId": {
          "type": "string",
          "description": "Filter by existing tag ID."
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version."
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy."
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "REQUIRED: Array of endpoint IDs to add tags to."
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude."
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          },
          "description": "Organization IDs filter. Defaults to [0]."
        }
      },
      "required": [
        "includedEndpointIds"
      ],
      "description": "Filter object to specify which assets to add tags to."
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "minItems": 1,
      "description": "REQUIRED: Array of tags to add to the selected assets."
    }
  },
  "required": [
    "filter",
    "tags"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "ID of the organization to add tags to"
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of tags to add to the organization"
    }
  },
  "required": [
    "id",
    "tags"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to archive"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The case ID to associate the acquisition with"
    },
    "acquisitionProfileId": {
      "type": "string",
      "description": "The acquisition profile ID to use for the task"
    },
    "endpointIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of endpoint IDs to collect evidence from"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Array of organization IDs to filter by. Defaults to [0]"
    },
    "analyzers": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of analyzer IDs to use (e.g. [\"bha\", \"wsa\"])"
    },
    "keywords": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of keywords to search for"
    },
    "cpuLimit": {
      "type": "number",
      "description": "CPU usage limit percentage (1-100). Defaults to 80"
    },
    "enableCompression": {
      "type": "boolean",
      "description": "Whether to enable compression. Defaults to true"
    },
    "enableEncryption": {
      "type": "boolean",
      "description": "Whether to enable encryption. Defaults to false"
    },
    "encryptionPassword": {
      "type": "string",
      "description": "Password for encryption if enabled"
    }
  },
  "required": [
    "caseId",
    "acquisitionProfileId",
    "endpointIds"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": [
        "string",
        "null"
      ],
      "description": "The case ID to associate the acquisition with (optional)"
    },
    "repositoryId": {
      "type": "string",
      "description": "The repository ID where the image will be saved"
    },
    "endpoints": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "endpointId": {
            "type": "string"
          },
          "volumes": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        },
        "required": [
          "endpointId",
          "volumes"
        ]
      },
      "description": "Array of endpoints and volumes to image (e.g., [{\"endpointId\": \"uuid\", \"volumes\": [\"/dev/sda1\"]}]). At least one endpoint and one volume per endpoint required."
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Array of organization IDs. Defaults to [0]"
    },
    "bandwidthLimit": {
      "type": "number",
      "description": "Bandwidth limit in KB/s. Defaults to 100000"
    },
    "enableCompression": {
      "type": "boolean",
      "description": "Whether to enable compression. Defaults to true"
    },
    "enableEncryption": {
      "type": "boolean",
      "description": "Whether to enable encryption. Defaults to false"
    },
    "encryptionPassword": {
      "type": "string",
      "description": "Password for encryption if enabled"
    },
    "chunkSize": {
      "type": "number",
      "description": "Chunk size in bytes. Defaults to 1048576"
    },
    "chunkCount": {
      "type": "number",
      "description": "Number of chunks to acquire. Defaults to 0 (acquire until end)."
    },
    "startOffset": {
      "type": "number",
      "description": "Offset in bytes to start acquisition from. Defaults to 0."
    }
  },
  "required": [
    "repositoryId",
    "endpoints"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointIds": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "Endpoint ID(s) to isolate or unisolate. Can be a single ID or an array of IDs."
    },
    "enabled": {
      "type": "boolean",
      "description": "Whether to enable (isolate) or disable (unisolate) isolation. Defaults to true."
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "number"
        },
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          }
        }
      ],
      "description": "Organization ID(s) to filter endpoints by. Defaults to 0."
    },
    "managedStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter endpoints by managed status. Default is [\"managed\"]."
    }
  },
  "required": [
    "endpointIds"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointIds": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "Endpoint ID(s) to retrieve logs from. Can be a single ID or an array of IDs."
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "number"
        },
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          }
        }
      ],
      "description": "Organization ID(s) to filter endpoints by. This is REQUIRED to identify the correct endpoints. Examples: 0, \"123\", [0], [\"123\", \"456\"]"
    },
    "managedStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter endpoints by managed status. Default is [\"managed\"]."
    }
  },
  "required": [
    "endpointIds",
    "organizationIds"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointIds": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "Endpoint ID(s) to reboot. Can be a single ID or an array of IDs."
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "number"
        },
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          }
        }
      ],
      "description": "Organization ID(s) to filter endpoints by. Defaults to 0."
    },
    "managedStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter endpoints by managed status. Default is [\"managed\"]."
    }
  },
  "required": [
    "endpointIds"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointIds": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "Endpoint ID(s) to shutdown. Can be a single ID or an array of IDs."
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "number"
        },
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          }
        }
      ],
      "description": "Organization ID(s) to filter endpoints by. Defaults to 0."
    },
    "managedStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter endpoints by managed status. Default is [\"managed\"]."
    }
  },
  "required": [
    "endpointIds"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "Case ID for the triage task"
    },
    "triageRuleIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of triage rule IDs to apply"
    },
    "taskConfig": {
      "type": "object",
      "properties": {
        "choice": {
          "type": "string",
          "description": "Configuration choice, e.g., \"use-custom-options\""
        }
      },
      "required": [
        "choice"
      ],
      "description": "Task configuration options"
    },
    "mitreAttack": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Whether to enable MITRE ATT&CK framework"
        }
      },
      "required": [
        "enabled"
      ],
      "description": "MITRE ATT&CK configuration"
    },
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term"
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name"
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address"
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID"
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path"
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])"
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status"
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])"
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue"
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status"
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by tags"
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version"
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy"
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to include"
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude"
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          },
          "description": "Organization IDs filter"
        }
      },
      "description": "Filter criteria for selecting endpoints"
    }
  },
  "required": [
    "caseId",
    "triageRuleIds",
    "taskConfig",
    "mitreAttack",
    "filter"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the organization to assign users to"
    },
    "userIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of user IDs to assign to the organization"
    }
  },
  "required": [
    "id",
    "userIds"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointIds": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      ],
      "description": "Endpoint ID(s) to update version. Can be a single ID or an array of IDs."
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "number"
        },
        {
          "type": "string"
        },
        {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          }
        }
      ],
      "description": "Organization ID(s) to filter endpoints by. Defaults to 0."
    },
    "managedStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter endpoints by managed status. Default is [\"managed\"]."
    }
  },
  "required": [
    "endpointIds"
  ]
}

{
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "The webhook slug (e.g., \"air-generic-url-webhook\")"
    },
    "data": {
      "type": "string",
      "description": "The data parameter for the webhook (e.g., IP address like \"192.168.1.100\")"
    },
    "token": {
      "type": "string",
      "description": "The webhook token for authentication"
    }
  },
  "required": [
    "slug",
    "data",
    "token"
  ]
}

{
  "type": "object",
  "properties": {
    "assignmentId": {
      "type": "string",
      "description": "The ID of the task assignment to cancel"
    }
  },
  "required": [
    "assignmentId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the task to cancel"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the case to change owner for"
    },
    "newOwnerId": {
      "type": "string",
      "description": "User ID of the new owner"
    }
  },
  "required": [
    "id",
    "newOwnerId"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "The case name to check for availability"
    }
  },
  "required": [
    "name"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name of the organization to check"
    }
  },
  "required": [
    "name"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to close"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointId": {
      "type": "string",
      "description": "The endpoint ID to compare baselines for"
    },
    "taskIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of baseline task IDs to compare (minimum 2)"
    }
  },
  "required": [
    "endpointId",
    "taskIds"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the new acquisition profile"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Organization IDs to associate the profile with. Defaults to empty array."
    },
    "windows": {
      "type": "object",
      "description": "Windows specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), `customContentProfiles` (array), and `networkCapture` (object). Example: { \"evidenceList\": [\"evt\"], \"artifactList\": [], \"customContentProfiles\": [], \"networkCapture\": { \"enabled\": false, \"duration\": 600, \"pcap\": { \"enabled\": false }, \"networkFlow\": { \"enabled\": false } } }"
    },
    "linux": {
      "type": "object",
      "description": "Linux specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), `customContentProfiles` (array), and `networkCapture` (object). Example: { \"evidenceList\": [\"logs\"], ... }"
    },
    "macos": {
      "type": "object",
      "description": "macOS specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), `customContentProfiles` (array), and `networkCapture` (object). Example: { \"evidenceList\": [\"logs\"], ... }"
    },
    "aix": {
      "type": "object",
      "description": "AIX specific configuration. Must include keys like `evidenceList` (array of strings), `artifactList` (array of strings, optional), and `customContentProfiles` (array). Example: { \"evidenceList\": [\"logs\"], ... }"
    },
    "eDiscovery": {
      "type": "object",
      "description": "eDiscovery configuration. Must include the key `patterns` (array of objects with `pattern` and `category` strings). Example: { \"patterns\": [] }"
    }
  },
  "required": [
    "name",
    "windows",
    "linux",
    "macos",
    "aix",
    "eDiscovery"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the Amazon S3 repository"
    },
    "region": {
      "type": "string",
      "description": "AWS region (e.g. eu-west-1)"
    },
    "bucket": {
      "type": "string",
      "description": "S3 bucket name"
    },
    "accessKeyId": {
      "type": "string",
      "description": "AWS access key ID"
    },
    "secretAccessKey": {
      "type": "string",
      "description": "AWS secret access key"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Organization IDs to associate the repository with. Defaults to empty array."
    }
  },
  "required": [
    "name",
    "region",
    "bucket",
    "accessKeyId",
    "secretAccessKey"
  ]
}

{
  "type": "object",
  "properties": {
    "tag": {
      "type": "string",
      "description": "The tag name to be applied automatically."
    },
    "linuxConditions": {
      "$ref": "#/definitions/ConditionGroup",
      "description": "Conditions for Linux assets."
    },
    "windowsConditions": {
      "$ref": "#/definitions/ConditionGroup",
      "description": "Conditions for Windows assets."
    },
    "macosConditions": {
      "$ref": "#/definitions/ConditionGroup",
      "description": "Conditions for macOS assets."
    }
  },
  "required": [
    "tag",
    "linuxConditions",
    "windowsConditions",
    "macosConditions"
  ],
  "definitions": {
    "ConditionGroup": {
      "type": "object",
      "properties": {
        "operator": {
          "type": "string",
          "enum": [
            "and",
            "or"
          ],
          "description": "Logical operator for combining conditions."
        },
        "conditions": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "$ref": "#/definitions/Condition"
              },
              {
                "$ref": "#/definitions/ConditionGroup"
              }
            ]
          },
          "minItems": 1,
          "description": "Array of conditions or nested groups."
        }
      },
      "required": [
        "operator",
        "conditions"
      ]
    },
    "Condition": {
      "type": "object",
      "properties": {
        "field": {
          "type": "string",
          "description": "Field to check (e.g., \"process\")"
        },
        "operator": {
          "type": "string",
          "description": "Comparison operator (e.g., \"running\")"
        },
        "value": {
          "type": "string",
          "description": "Value to compare against"
        }
      },
      "required": [
        "field",
        "operator",
        "value"
      ]
    }
  }
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the Azure Storage repository"
    },
    "SASUrl": {
      "type": "string",
      "description": "SAS URL for Azure Storage access"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Organization IDs to associate the repository with. Defaults to empty array."
    }
  },
  "required": [
    "name",
    "SASUrl"
  ]
}

{
  "type": "object",
  "properties": {
    "organizationId": {
      "type": "number",
      "description": "Organization ID to create the case in. Defaults to 0."
    },
    "name": {
      "type": "string",
      "description": "Name of the case"
    },
    "ownerUserId": {
      "type": "string",
      "description": "User ID of the case owner"
    },
    "visibility": {
      "type": "string",
      "description": "Visibility of the case. Defaults to \"public-to-organization\""
    },
    "assignedUserIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of user IDs to assign to the case. Defaults to empty array."
    }
  },
  "required": [
    "name",
    "ownerUserId"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the FTPS repository"
    },
    "host": {
      "type": "string",
      "description": "FTPS server hostname or IP address"
    },
    "port": {
      "type": "number",
      "description": "FTPS server port (default: 22)"
    },
    "path": {
      "type": "string",
      "description": "Path on the FTPS server (e.g. /)"
    },
    "username": {
      "type": "string",
      "description": "Username for FTPS authentication"
    },
    "password": {
      "type": "string",
      "description": "Password for FTPS authentication"
    },
    "allowSelfSignedSSL": {
      "type": "boolean",
      "description": "Whether to allow self-signed SSL certificates"
    },
    "publicKey": {
      "type": "string",
      "description": "Public key for FTPS authentication (optional)"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Organization IDs to associate the repository with"
    }
  },
  "required": [
    "name",
    "host",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name of the organization"
    },
    "shareableDeploymentEnabled": {
      "type": "boolean",
      "description": "Whether shareable deployment is enabled. Defaults to false."
    },
    "contact": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Contact name"
        },
        "title": {
          "type": "string",
          "description": "Contact title (optional)"
        },
        "phone": {
          "type": "string",
          "description": "Contact phone number (optional)"
        },
        "mobile": {
          "type": "string",
          "description": "Contact mobile number (optional)"
        },
        "email": {
          "type": "string",
          "description": "Contact email address"
        }
      },
      "required": [
        "name",
        "email"
      ],
      "description": "Contact information for the organization"
    },
    "note": {
      "type": "string",
      "description": "Additional notes about the organization (optional)"
    }
  },
  "required": [
    "name",
    "contact"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the new policy"
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "array",
          "items": {
            "type": "number"
          }
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        {
          "type": "number"
        },
        {
          "type": "string"
        }
      ],
      "description": "Organization IDs to associate with policy. Defaults to [0]."
    },
    "saveTo": {
      "type": "object",
      "properties": {
        "windows": {
          "type": "object",
          "properties": {
            "location": {
              "type": "string",
              "description": "Storage location for Windows (e.g., \"local\")"
            },
            "path": {
              "type": "string",
              "description": "Path for evidence storage on Windows"
            },
            "useMostFreeVolume": {
              "type": "boolean",
              "description": "Whether to use volume with most free space"
            },
            "volume": {
              "type": "string",
              "description": "Volume to use for Windows (e.g., \"C:\")"
            },
            "tmp": {
              "type": "string",
              "description": "Temporary folder path for Windows"
            }
          },
          "required": [
            "location",
            "path",
            "useMostFreeVolume",
            "volume"
          ]
        },
        "linux": {
          "type": "object",
          "properties": {
            "location": {
              "type": "string",
              "description": "Storage location for Linux (e.g., \"local\")"
            },
            "path": {
              "type": "string",
              "description": "Path for evidence storage on Linux"
            },
            "useMostFreeVolume": {
              "type": "boolean",
              "description": "Whether to use volume with most free space"
            },
            "volume": {
              "type": "string",
              "description": "Volume to use for Linux (e.g., \"/\")"
            },
            "tmp": {
              "type": "string",
              "description": "Temporary folder path for Linux"
            }
          },
          "required": [
            "location",
            "path",
            "useMostFreeVolume",
            "volume"
          ]
        },
        "macos": {
          "type": "object",
          "properties": {
            "location": {
              "type": "string",
              "description": "Storage location for macOS (e.g., \"local\")"
            },
            "path": {
              "type": "string",
              "description": "Path for evidence storage on macOS"
            },
            "useMostFreeVolume": {
              "type": "boolean",
              "description": "Whether to use volume with most free space"
            },
            "volume": {
              "type": "string",
              "description": "Volume to use for macOS (e.g., \"/\")"
            },
            "tmp": {
              "type": "string",
              "description": "Temporary folder path for macOS"
            }
          },
          "required": [
            "location",
            "path",
            "useMostFreeVolume",
            "volume"
          ]
        }
      },
      "required": [
        "windows",
        "linux",
        "macos"
      ],
      "description": "Configuration for where to save evidence"
    },
    "compression": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Whether compression is enabled"
        },
        "encryption": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Whether encryption is enabled"
            },
            "password": {
              "type": "string",
              "description": "Password for encryption when enabled"
            }
          },
          "required": [
            "enabled"
          ]
        }
      },
      "required": [
        "enabled",
        "encryption"
      ],
      "description": "Compression and encryption settings"
    },
    "sendTo": {
      "type": "object",
      "properties": {
        "location": {
          "type": "string",
          "description": "Location to send evidence to (e.g., \"user-local\")"
        }
      },
      "required": [
        "location"
      ],
      "description": "Configuration for where to send evidence"
    },
    "cpu": {
      "type": "object",
      "properties": {
        "limit": {
          "type": "number",
          "description": "CPU usage limit percentage (1-100)"
        }
      },
      "description": "CPU usage limits"
    }
  },
  "required": [
    "name",
    "saveTo",
    "compression",
    "sendTo"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the SFTP repository"
    },
    "host": {
      "type": "string",
      "description": "SFTP server hostname or IP address"
    },
    "port": {
      "type": "number",
      "description": "SFTP server port (default: 22)"
    },
    "path": {
      "type": "string",
      "description": "Path on the SFTP server (e.g. /)"
    },
    "username": {
      "type": "string",
      "description": "Username for SFTP authentication"
    },
    "password": {
      "type": "string",
      "description": "Password for SFTP authentication"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Organization IDs to associate the repository with"
    }
  },
  "required": [
    "name",
    "host",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the SMB repository"
    },
    "path": {
      "type": "string",
      "description": "Network share path (e.g. \\\\Network\\Share)"
    },
    "username": {
      "type": "string",
      "description": "Username for SMB authentication"
    },
    "password": {
      "type": "string",
      "description": "Password for SMB authentication"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Organization IDs to associate the repository with. Defaults to empty array."
    }
  },
  "required": [
    "name",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "description": {
      "type": "string",
      "description": "A descriptive name for the triage rule"
    },
    "rule": {
      "type": "string",
      "description": "The YARA rule content"
    },
    "searchIn": {
      "type": "string",
      "description": "Where to search, e.g., \"filesystem\""
    },
    "engine": {
      "type": "string",
      "description": "Rule engine to use, e.g., \"yara\""
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "oneOf": [
          {
            "type": "string"
          },
          {
            "type": "number"
          }
        ]
      },
      "description": "Organization IDs to associate with this rule. Defaults to [0]"
    }
  },
  "required": [
    "description",
    "rule",
    "searchIn",
    "engine"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name of the tag to create"
    },
    "organizationId": {
      "oneOf": [
        {
          "type": "string"
        },
        {
          "type": "number"
        }
      ],
      "description": "Organization ID to associate the tag with. Defaults to 0."
    }
  },
  "required": [
    "name"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the auto asset tag to delete"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case containing the note (e.g., \"C-2022-0002\")"
    },
    "noteId": {
      "type": "string",
      "description": "The ID of the note to delete (e.g., \"8d9baa16-9aa3-4e4f-a08e-a74341ce2f90\")"
    }
  },
  "required": [
    "caseId",
    "noteId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "The ID of the organization to delete"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the policy to delete"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the repository to delete"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "ID of the organization to delete tags from"
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of tags to delete from the organization"
    }
  },
  "required": [
    "id",
    "tags"
  ]
}

{
  "type": "object",
  "properties": {
    "assignmentId": {
      "type": "string",
      "description": "The ID of the task assignment to delete"
    }
  },
  "required": [
    "assignmentId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the task to delete"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the triage rule to delete"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointId": {
      "type": "string",
      "description": "The ID of the endpoint to download the PPC file for"
    },
    "taskId": {
      "type": "string",
      "description": "The ID of the task to download the PPC file for"
    }
  },
  "required": [
    "endpointId",
    "taskId"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointId": {
      "type": "string",
      "description": "The ID of the endpoint to download the task report for"
    },
    "taskId": {
      "type": "string",
      "description": "The ID of the task to download the task report for"
    }
  },
  "required": [
    "endpointId",
    "taskId"
  ]
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter audit logs by. Defaults to \"0\" or specific IDs like \"123\" or \"123,456\"."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case to export activities for"
    }
  },
  "required": [
    "caseId"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case to export endpoints for"
    },
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter by. Defaults to \"0\"."
    }
  },
  "required": [
    "caseId"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case to export notes for"
    }
  },
  "required": [
    "caseId"
  ]
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter cases by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "profileId": {
      "type": "string",
      "description": "The ID of the acquisition profile to retrieve (e.g., \"full\")"
    }
  },
  "required": [
    "profileId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the asset to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the asset to retrieve tasks for"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the auto asset tag to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to retrieve activities for"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to retrieve endpoints for"
    },
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter endpoints by. Defaults to 0."
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to retrieve tasks for"
    },
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter tasks by. Leave empty to use default (0)."
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to retrieve users for (e.g., C-2022-0001)"
    },
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter users by. Leave empty to use default (0)."
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "endpointId": {
      "type": "string",
      "description": "The endpoint ID associated with the comparison task"
    },
    "taskId": {
      "type": "string",
      "description": "The ID of the comparison task to get the report for"
    }
  },
  "required": [
    "endpointId",
    "taskId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "The ID of the organization to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the organization to retrieve users for"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the policy to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Filter assets by name"
    },
    "searchTerm": {
      "type": "string",
      "description": "General search term for filtering assets"
    },
    "ipAddress": {
      "type": "string",
      "description": "Filter assets by IP address"
    },
    "groupId": {
      "type": "string",
      "description": "Filter assets by group ID"
    },
    "groupFullPath": {
      "type": "string",
      "description": "Filter assets by full group path"
    },
    "managedStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter assets by managed status (e.g., [\"managed\"])"
    },
    "isolationStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter assets by isolation status (e.g., [\"isolated\"])"
    },
    "platform": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter assets by platform (e.g., [\"windows\"])"
    },
    "issue": {
      "type": "string",
      "description": "Filter assets by issue"
    },
    "onlineStatus": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter assets by online status (e.g., [\"online\"])"
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Filter assets by tags"
    },
    "version": {
      "type": "string",
      "description": "Filter assets by agent version"
    },
    "policy": {
      "type": "string",
      "description": "Filter assets by policy name"
    },
    "includedEndpointIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Include only these endpoint IDs"
    },
    "excludedEndpointIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Exclude these endpoint IDs"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "oneOf": [
          {
            "type": "number"
          },
          {
            "type": "string"
          }
        ]
      },
      "description": "Organization IDs to filter by. Defaults to [0]."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "endpointId": {
      "type": "string",
      "description": "The ID of the endpoint to get report file information for"
    },
    "taskId": {
      "type": "string",
      "description": "The ID of the task to get report file information for"
    }
  },
  "required": [
    "endpointId",
    "taskId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the repository to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "deploymentToken": {
      "type": "string",
      "description": "The deployment token to retrieve information for"
    }
  },
  "required": [
    "deploymentToken"
  ]
}

{
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "The webhook slug (e.g., \"air-generic-url-webhook\")"
    },
    "taskId": {
      "type": "string",
      "description": "The ID of the task to retrieve assignments for"
    },
    "token": {
      "type": "string",
      "description": "The webhook token for authentication"
    }
  },
  "required": [
    "slug",
    "taskId",
    "token"
  ]
}

{
  "type": "object",
  "properties": {
    "taskId": {
      "type": "string",
      "description": "The ID of the task to retrieve assignments for"
    }
  },
  "required": [
    "taskId"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the task to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the triage rule to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the user to retrieve"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "ID of the case to import task assignments to"
    },
    "taskAssignmentIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Array of task assignment IDs to import to the case"
    }
  },
  "required": [
    "caseId",
    "taskAssignmentIds"
  ]
}

{
  "type": "object",
  "properties": {
    "random_string": {
      "type": "string",
      "description": "Dummy parameter for no-parameter tools"
    }
  },
  "required": [
    "random_string"
  ]
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter acquisition profiles by. Leave empty to use default (0)."
    },
    "allOrganizations": {
      "type": "boolean",
      "description": "Whether to include profiles from all organizations. Defaults to true."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter assets by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter audit logs by. Defaults to \"0\" or specific IDs like \"123\" or \"123,456\"."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {},
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter cases by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {},
  "required": []
}

{
  "type": "object",
  "properties": {
    "random_string": {
      "type": "string",
      "description": "Dummy parameter for no-parameter tools"
    }
  },
  "required": [
    "random_string"
  ]
}

{
  "type": "object",
  "properties": {},
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter policies by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter repositories by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter tasks by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter triage rules by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter triage tags by. Leave empty to use default (0)."
    },
    "withCount": {
      "type": "boolean",
      "description": "Whether to include count of rules for each tag. Defaults to true."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "organizationIds": {
      "type": "string",
      "description": "Organization IDs to filter users by. Leave empty to use default (0)."
    }
  },
  "required": []
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the case to open"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "slug": {
      "type": "string",
      "description": "The webhook slug (e.g., \"air-generic-url-webhook\")"
    },
    "data": {
      "type": "object",
      "description": "The data to be sent in the request body"
    },
    "token": {
      "type": "string",
      "description": "The webhook token for authentication"
    }
  },
  "required": [
    "slug",
    "data",
    "token"
  ]
}

{
  "type": "object",
  "properties": {
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term."
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name."
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address."
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID."
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path."
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])."
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])."
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])."
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue."
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])."
        },
        "tagId": {
          "type": "string",
          "description": "Filter by tag ID."
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version."
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy."
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "REQUIRED: Array of endpoint IDs to purge and uninstall."
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude."
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          },
          "description": "Organization IDs filter. Defaults to [0]."
        }
      },
      "required": [
        "includedEndpointIds"
      ],
      "description": "Filter object to specify which assets to purge and uninstall."
    }
  },
  "required": [
    "filter"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the case to remove endpoints from"
    },
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term"
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name"
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address"
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID"
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path"
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])"
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])"
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])"
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue"
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])"
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by tags"
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version"
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy"
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to remove"
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude"
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          },
          "description": "Organization IDs filter. Defaults to [0]"
        }
      },
      "required": [],
      "description": "Filter object to specify which endpoints to remove"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term."
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name."
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address."
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID."
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path."
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])."
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])."
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])."
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue."
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])."
        },
        "tagId": {
          "type": "string",
          "description": "Filter by existing tag ID."
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version."
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy."
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "REQUIRED: Array of endpoint IDs to remove tags from."
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude."
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          },
          "description": "Organization IDs filter. Defaults to [0]."
        }
      },
      "required": [
        "includedEndpointIds"
      ],
      "description": "Filter object to specify which assets to remove tags from."
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "minItems": 1,
      "description": "REQUIRED: Array of tags to remove from the selected assets."
    }
  },
  "required": [
    "filter",
    "tags"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case to remove the task assignment from"
    },
    "taskAssignmentId": {
      "type": "string",
      "description": "The ID of the task assignment to remove"
    }
  },
  "required": [
    "caseId",
    "taskAssignmentId"
  ]
}

{
  "type": "object",
  "properties": {
    "organizationId": {
      "type": "string",
      "description": "The ID of the organization to remove the user from"
    },
    "userId": {
      "type": "string",
      "description": "The ID of the user to remove from the organization"
    }
  },
  "required": [
    "organizationId",
    "userId"
  ]
}

{
  "type": "object",
  "properties": {
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term."
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name."
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address."
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID."
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path."
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])."
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])."
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])."
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue."
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])."
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by tags."
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version."
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy."
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to include."
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude."
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "type": "number"
          },
          "description": "Organization IDs filter. Defaults to [0]."
        }
      },
      "description": "Filter object to specify which assets to apply auto tagging to."
    }
  },
  "required": [
    "filter"
  ]
}

{
  "type": "object",
  "properties": {
    "filter": {
      "type": "object",
      "properties": {
        "searchTerm": {
          "type": "string",
          "description": "Optional search term."
        },
        "name": {
          "type": "string",
          "description": "Filter by asset name."
        },
        "ipAddress": {
          "type": "string",
          "description": "Filter by IP address."
        },
        "groupId": {
          "type": "string",
          "description": "Filter by group ID."
        },
        "groupFullPath": {
          "type": "string",
          "description": "Filter by full group path."
        },
        "managedStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by managed status (e.g., [\"managed\"])."
        },
        "isolationStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by isolation status (e.g., [\"isolated\"])."
        },
        "platform": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by platform (e.g., [\"windows\"])."
        },
        "issue": {
          "type": "string",
          "description": "Filter by issue."
        },
        "onlineStatus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Filter by online status (e.g., [\"online\"])."
        },
        "tagId": {
          "type": "string",
          "description": "Filter by tag ID."
        },
        "version": {
          "type": "string",
          "description": "Filter by agent version."
        },
        "policy": {
          "type": "string",
          "description": "Filter by policy."
        },
        "includedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "REQUIRED: Array of endpoint IDs to uninstall."
        },
        "excludedEndpointIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Array of endpoint IDs to exclude."
        },
        "organizationIds": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "type": "number"
              },
              {
                "type": "string"
              }
            ]
          },
          "description": "Organization IDs filter. Defaults to [0]."
        }
      },
      "required": [],
      "description": "Filter object to specify which assets to uninstall."
    }
  },
  "required": [
    "filter"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the Amazon S3 repository to update"
    },
    "name": {
      "type": "string",
      "description": "Updated name for the Amazon S3 repository"
    },
    "region": {
      "type": "string",
      "description": "Updated AWS region (e.g. eu-west-1)"
    },
    "bucket": {
      "type": "string",
      "description": "Updated S3 bucket name"
    },
    "accessKeyId": {
      "type": "string",
      "description": "Updated AWS access key ID"
    },
    "secretAccessKey": {
      "type": "string",
      "description": "Updated AWS secret access key"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Updated organization IDs to associate the repository with. Defaults to empty array."
    }
  },
  "required": [
    "id",
    "name",
    "region",
    "bucket",
    "accessKeyId",
    "secretAccessKey"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the auto asset tag to update."
    },
    "tag": {
      "type": "string",
      "description": "The tag name to be applied automatically."
    },
    "linuxConditions": {
      "$ref": "#/definitions/ConditionGroup",
      "description": "Conditions for Linux assets."
    },
    "windowsConditions": {
      "$ref": "#/definitions/ConditionGroup",
      "description": "Conditions for Windows assets."
    },
    "macosConditions": {
      "$ref": "#/definitions/ConditionGroup",
      "description": "Conditions for macOS assets."
    }
  },
  "required": [
    "id",
    "tag"
  ],
  "definitions": {
    "ConditionGroup": {
      "type": "object",
      "properties": {
        "operator": {
          "type": "string",
          "enum": [
            "and",
            "or"
          ],
          "description": "Logical operator for combining conditions."
        },
        "conditions": {
          "type": "array",
          "items": {
            "oneOf": [
              {
                "$ref": "#/definitions/Condition"
              },
              {
                "$ref": "#/definitions/ConditionGroup"
              }
            ]
          },
          "minItems": 1,
          "description": "Array of conditions or nested groups."
        }
      },
      "required": [
        "operator",
        "conditions"
      ]
    },
    "Condition": {
      "type": "object",
      "properties": {
        "field": {
          "type": "string",
          "description": "Field to check (e.g., \"process\")"
        },
        "operator": {
          "type": "string",
          "description": "Comparison operator (e.g., \"running\")"
        },
        "value": {
          "type": "string",
          "description": "Value to compare against"
        }
      },
      "required": [
        "field",
        "operator",
        "value"
      ]
    }
  }
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the Azure Storage repository to update"
    },
    "name": {
      "type": "string",
      "description": "Updated name for the Azure Storage repository"
    },
    "SASUrl": {
      "type": "string",
      "description": "Updated SAS URL for Azure Storage access"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Updated organization IDs to associate the repository with. Defaults to empty array."
    }
  },
  "required": [
    "id",
    "name",
    "SASUrl"
  ]
}

{
  "type": "object",
  "properties": {
    "enabled": {
      "type": "boolean",
      "description": "Whether the banner message is enabled or disabled"
    }
  },
  "required": [
    "enabled"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the case to update"
    },
    "name": {
      "type": "string",
      "description": "New name for the case"
    },
    "ownerUserId": {
      "type": "string",
      "description": "New owner user ID for the case"
    },
    "visibility": {
      "type": "string",
      "description": "New visibility setting for the case"
    },
    "assignedUserIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "New array of user IDs to assign to the case"
    },
    "status": {
      "type": "string",
      "enum": [
        "open",
        "closed",
        "archived"
      ],
      "description": "New status for the case"
    },
    "notes": {
      "type": "array",
      "items": {
        "type": "object"
      },
      "description": "New notes for the case"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the FTPS repository to update"
    },
    "name": {
      "type": "string",
      "description": "Updated name for the FTPS repository"
    },
    "host": {
      "type": "string",
      "description": "Updated FTPS server hostname or IP address"
    },
    "port": {
      "type": "number",
      "description": "Updated FTPS server port (default: 22)"
    },
    "path": {
      "type": "string",
      "description": "Updated path on the FTPS server (e.g. /)"
    },
    "username": {
      "type": "string",
      "description": "Updated username for FTPS authentication"
    },
    "password": {
      "type": "string",
      "description": "Updated password for FTPS authentication"
    },
    "allowSelfSignedSSL": {
      "type": "boolean",
      "description": "Whether to allow self-signed SSL certificates"
    },
    "publicKey": {
      "type": "string",
      "description": "Public key for FTPS authentication (optional)"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Updated organization IDs to associate the repository with"
    }
  },
  "required": [
    "id",
    "name",
    "host",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "The ID of the case containing the note (e.g., \"C-2022-0002\")"
    },
    "noteId": {
      "type": "string",
      "description": "The ID of the note to update (e.g., \"8d9baa16-9aa3-4e4f-a08e-a74341ce2f90\")"
    },
    "note": {
      "type": "string",
      "description": "The new content for the note"
    }
  },
  "required": [
    "caseId",
    "noteId",
    "note"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "The ID of the organization to update"
    },
    "name": {
      "type": "string",
      "description": "Updated name of the organization"
    },
    "shareableDeploymentEnabled": {
      "type": "boolean",
      "description": "Whether shareable deployment is enabled"
    },
    "contact": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Contact name"
        },
        "title": {
          "type": "string",
          "description": "Contact title"
        },
        "phone": {
          "type": "string",
          "description": "Contact phone number"
        },
        "mobile": {
          "type": "string",
          "description": "Contact mobile number"
        },
        "email": {
          "type": "string",
          "description": "Contact email address"
        }
      },
      "description": "Updated contact information for the organization"
    },
    "note": {
      "type": "string",
      "description": "Additional notes about the organization"
    }
  },
  "required": [
    "id"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "The ID of the organization to update"
    },
    "deploymentToken": {
      "type": "string",
      "description": "New deployment token for the organization"
    }
  },
  "required": [
    "id",
    "deploymentToken"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "number",
      "description": "The ID of the organization to update"
    },
    "status": {
      "type": "boolean",
      "description": "Whether shareable deployment should be enabled (true) or disabled (false)"
    }
  },
  "required": [
    "id",
    "status"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "The ID of the policy to update"
    },
    "name": {
      "type": "string",
      "description": "Name for the policy"
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "array",
          "items": {
            "type": "number"
          }
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        {
          "type": "number"
        },
        {
          "type": "string"
        }
      ],
      "description": "Organization IDs to associate with policy. Defaults to [0]."
    },
    "filter": {
      "type": "object",
      "properties": {
        "operator": {
          "type": "string",
          "description": "Logical operator for combining conditions (e.g., \"and\", \"or\")"
        },
        "conditions": {
          "type": "array",
          "items": {
            "type": "object"
          },
          "description": "Array of conditions for policy filtering"
        }
      },
      "description": "Filter conditions to determine which endpoints the policy applies to"
    },
    "saveTo": {
      "type": "object",
      "properties": {
        "windows": {
          "type": "object",
          "properties": {
            "location": {
              "type": "string",
              "description": "Storage location for Windows (e.g., \"local\")"
            },
            "path": {
              "type": "string",
              "description": "Path for evidence storage on Windows"
            },
            "useMostFreeVolume": {
              "type": "boolean",
              "description": "Whether to use volume with most free space"
            },
            "volume": {
              "type": "string",
              "description": "Volume to use for Windows (e.g., \"C:\")"
            },
            "tmp": {
              "type": "string",
              "description": "Temporary folder path for Windows"
            }
          },
          "required": [
            "location",
            "path",
            "useMostFreeVolume",
            "volume"
          ]
        },
        "linux": {
          "type": "object",
          "properties": {
            "location": {
              "type": "string",
              "description": "Storage location for Linux (e.g., \"local\")"
            },
            "path": {
              "type": "string",
              "description": "Path for evidence storage on Linux"
            },
            "useMostFreeVolume": {
              "type": "boolean",
              "description": "Whether to use volume with most free space"
            },
            "volume": {
              "type": "string",
              "description": "Volume to use for Linux (e.g., \"/\")"
            },
            "tmp": {
              "type": "string",
              "description": "Temporary folder path for Linux"
            }
          },
          "required": [
            "location",
            "path",
            "useMostFreeVolume",
            "volume"
          ]
        },
        "macos": {
          "type": "object",
          "properties": {
            "location": {
              "type": "string",
              "description": "Storage location for macOS (e.g., \"local\")"
            },
            "path": {
              "type": "string",
              "description": "Path for evidence storage on macOS"
            },
            "useMostFreeVolume": {
              "type": "boolean",
              "description": "Whether to use volume with most free space"
            },
            "volume": {
              "type": "string",
              "description": "Volume to use for macOS (e.g., \"/\")"
            },
            "tmp": {
              "type": "string",
              "description": "Temporary folder path for macOS"
            }
          },
          "required": [
            "location",
            "path",
            "useMostFreeVolume",
            "volume"
          ]
        }
      },
      "required": [
        "windows",
        "linux",
        "macos"
      ],
      "description": "Configuration for where to save evidence"
    },
    "compression": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Whether compression is enabled"
        },
        "encryption": {
          "type": "object",
          "properties": {
            "enabled": {
              "type": "boolean",
              "description": "Whether encryption is enabled"
            },
            "password": {
              "type": "string",
              "description": "Password for encryption when enabled"
            }
          },
          "required": [
            "enabled"
          ]
        }
      },
      "required": [
        "enabled",
        "encryption"
      ],
      "description": "Compression and encryption settings"
    },
    "sendTo": {
      "type": "object",
      "properties": {
        "location": {
          "type": "string",
          "description": "Location to send evidence to (e.g., \"user-local\")"
        }
      },
      "required": [
        "location"
      ],
      "description": "Configuration for where to send evidence"
    },
    "cpu": {
      "type": "object",
      "properties": {
        "limit": {
          "type": "number",
          "description": "CPU usage limit percentage (1-100)"
        }
      },
      "description": "CPU usage limits"
    }
  },
  "required": [
    "id",
    "name",
    "saveTo",
    "compression",
    "sendTo"
  ]
}

{
  "type": "object",
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Ordered list of policy IDs that defines their priority (first has highest priority)"
    },
    "organizationIds": {
      "oneOf": [
        {
          "type": "array",
          "items": {
            "type": "number"
          }
        },
        {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        {
          "type": "number"
        },
        {
          "type": "string"
        }
      ],
      "description": "Organization IDs to associate with priority update. Defaults to [0]."
    }
  },
  "required": [
    "ids"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the SFTP repository to update"
    },
    "name": {
      "type": "string",
      "description": "Updated name for the SFTP repository"
    },
    "host": {
      "type": "string",
      "description": "Updated SFTP server hostname or IP address"
    },
    "port": {
      "type": "number",
      "description": "Updated SFTP server port (default: 22)"
    },
    "path": {
      "type": "string",
      "description": "Updated path on the SFTP server (e.g. /)"
    },
    "username": {
      "type": "string",
      "description": "Updated username for SFTP authentication"
    },
    "password": {
      "type": "string",
      "description": "Updated password for SFTP authentication"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Updated organization IDs to associate the repository with"
    }
  },
  "required": [
    "id",
    "name",
    "host",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the SMB repository to update"
    },
    "name": {
      "type": "string",
      "description": "Updated name for the SMB repository"
    },
    "path": {
      "type": "string",
      "description": "Updated network share path (e.g. \\\\Network\\Share)"
    },
    "username": {
      "type": "string",
      "description": "Updated username for SMB authentication"
    },
    "password": {
      "type": "string",
      "description": "Updated password for SMB authentication"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Updated organization IDs to associate the repository with"
    }
  },
  "required": [
    "id",
    "name",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "ID of the triage rule to update"
    },
    "description": {
      "type": "string",
      "description": "A descriptive name for the triage rule"
    },
    "rule": {
      "type": "string",
      "description": "The YARA rule content"
    },
    "searchIn": {
      "type": "string",
      "description": "Where to search, e.g., \"filesystem\""
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "oneOf": [
          {
            "type": "number"
          },
          {
            "type": "string"
          }
        ]
      },
      "description": "Organization IDs to associate with this rule. Defaults to [0]"
    }
  },
  "required": [
    "id",
    "description",
    "rule",
    "searchIn"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the Amazon S3 repository"
    },
    "region": {
      "type": "string",
      "description": "AWS region (e.g. eu-west-1)"
    },
    "bucket": {
      "type": "string",
      "description": "S3 bucket name"
    },
    "accessKeyId": {
      "type": "string",
      "description": "AWS access key ID"
    },
    "secretAccessKey": {
      "type": "string",
      "description": "AWS secret access key"
    },
    "organizationIds": {
      "type": "array",
      "items": {
        "type": "number"
      },
      "description": "Organization IDs to associate the repository with. Defaults to empty array."
    }
  },
  "required": [
    "name",
    "region",
    "bucket",
    "accessKeyId",
    "secretAccessKey"
  ]
}

{
  "type": "object",
  "properties": {
    "SASUrl": {
      "type": "string",
      "description": "SAS URL for Azure Storage access"
    }
  },
  "required": [
    "SASUrl"
  ]
}

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name for the FTPS repository"
    },
    "host": {
      "type": "string",
      "description": "FTPS server hostname or IP address"
    },
    "port": {
      "type": "number",
      "description": "FTPS server port (default: 22)"
    },
    "path": {
      "type": "string",
      "description": "Path on the FTPS server (e.g. /)"
    },
    "username": {
      "type": "string",
      "description": "Username for FTPS authentication"
    },
    "password": {
      "type": "string",
      "description": "Password for FTPS authentication"
    },
    "allowSelfSignedSSL": {
      "type": "boolean",
      "description": "Whether to allow self-signed SSL certificates"
    },
    "publicKey": {
      "type": "string",
      "description": "Public key for FTPS authentication (optional)"
    }
  },
  "required": [
    "name",
    "host",
    "path",
    "username",
    "password"
  ]
}

{
  "type": "object",
  "properties": {
    "rule": {
      "type": "string",
      "description": "The YARA rule content to validate"
    }
  },
  "required": [
    "rule"
  ]
}