{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://feeds.offseq.com/mirage-feed/schema/record.schema.json",
  "title": "Mirage feed record",
  "description": "One indicator per line of records-7d.ndjson.gz.",
  "type": "object",
  "$defs": {
    "timestamp": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:00:00Z$" },
    "count": { "type": "integer", "minimum": 0 },
    "strings": { "type": "array", "items": { "type": "string" }, "uniqueItems": true }
  },
  "required": ["type", "value", "first_seen", "last_seen"],
  "properties": {
    "type": { "enum": ["ipv4", "ipv6", "url", "domain", "sha256"] },
    "value": { "type": "string", "minLength": 1 },
    "first_seen": { "$ref": "#/$defs/timestamp" },
    "last_seen": { "$ref": "#/$defs/timestamp" },
    "asn": { "type": ["integer", "null"], "minimum": 0 },
    "as_org": { "type": ["string", "null"] },
    "country": { "type": ["string", "null"], "pattern": "^[A-Z]{2}$" },
    "services": { "$ref": "#/$defs/strings" },
    "tags": { "$ref": "#/$defs/strings" },
    "attack": { "type": "array", "items": { "type": "string", "pattern": "^T\\d{4}(\\.\\d{3})?$" } },
    "cves": { "type": "array", "items": { "type": "string", "pattern": "^CVE-\\d{4}-\\d{4,}$" } },
    "kev": { "type": "boolean" },
    "sensors": { "type": "integer", "minimum": 3 },
    "networks": { "type": "integer", "minimum": 2 },
    "hits": { "$ref": "#/$defs/count" },
    "confidence": { "type": "integer", "minimum": 0, "maximum": 100 },
    "window": { "enum": ["1d", "7d"] },
    "kind": { "enum": ["download", "c2"] },
    "sightings": { "$ref": "#/$defs/count" },
    "sources": { "type": "integer", "minimum": 2 }
  },
  "additionalProperties": false,
  "allOf": [
    {
      "if": { "properties": { "type": { "enum": ["ipv4", "ipv6"] } } },
      "then": {
        "required": ["asn", "country", "services", "tags", "attack", "sensors", "networks", "hits",
                     "confidence", "window"],
        "not": { "anyOf": [{ "required": ["kind"] }, { "required": ["sightings"] }, { "required": ["sources"] }] }
      },
      "else": {
        "required": ["sightings", "sources"],
        "not": { "anyOf": [{ "required": ["asn"] }, { "required": ["confidence"] }, { "required": ["window"] }] }
      }
    },
    {
      "if": { "properties": { "type": { "const": "ipv4" } } },
      "then": { "properties": { "value": { "format": "ipv4", "pattern": "^[0-9.]+$" } } }
    },
    {
      "if": { "properties": { "type": { "const": "ipv6" } } },
      "then": { "properties": { "value": { "pattern": "^[0-9a-f:]+/64$" } } }
    },
    {
      "if": { "properties": { "type": { "const": "url" } } },
      "then": { "required": ["kind"], "properties": { "value": { "pattern": "^[a-z][a-z0-9+.-]*://" } } }
    },
    {
      "if": { "properties": { "type": { "const": "sha256" } } },
      "then": { "properties": { "value": { "pattern": "^[0-9a-f]{64}$" } } }
    }
  ]
}