{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.niftibot.com/services/us-cti-threats/demo/samples/sample-schema.json",
  "title": "Niftibot US CTI vulnerability sample",
  "type": "object",
  "required": ["schema", "is_sample", "captured_at", "query", "tool", "data", "provenance", "licence", "caveats"],
  "properties": {
    "schema": { "const": "niftibot-us-cti-sample/v1" },
    "is_sample": { "const": true },
    "captured_at": { "type": "string", "format": "date-time" },
    "query": { "type": "string" },
    "tool": { "enum": ["cti_search_events", "cti_get_vulnerability", "cti_screen", "cti_get_evidence"] },
    "data": {
      "type": "object",
      "required": ["cve_id", "in_kev", "watched", "kev", "nvd", "threat", "events", "iocs", "sources"],
      "properties": {
        "cve_id": { "type": "string", "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$" },
        "in_kev": { "type": "boolean" },
        "watched": { "type": "boolean" },
        "kev": { "type": ["object", "null"] },
        "nvd": { "type": "object" },
        "threat": { "type": "object" },
        "events": { "type": "array", "items": { "type": "object" } },
        "iocs": { "type": "array", "items": { "type": "object" } },
        "sources": { "type": "array", "items": { "type": "object" } }
      },
      "additionalProperties": false
    },
    "provenance": {
      "type": "object",
      "required": ["source", "uri", "retrieved_at", "sha256"],
      "properties": {
        "source": { "type": "string" },
        "uri": { "type": "string", "format": "uri" },
        "retrieved_at": { "type": "string", "format": "date-time" },
        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
      },
      "additionalProperties": false
    },
    "licence": { "type": "string" },
    "caveats": { "type": "array", "items": { "type": "string" } }
  },
  "additionalProperties": false
}