{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "cmpc-indicators/1",
  "title": "CMPC Research indicator export, version 1",
  "description": "Indicators exactly as shown on one published page. Network indicators are defanged ([.] for dots, hxxp for http) and must not be re-fanged outside an isolated analysis environment.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schema",
    "publication",
    "defanged",
    "items"
  ],
  "properties": {
    "schema": {
      "const": "cmpc-indicators/1"
    },
    "publication": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "slug",
        "title",
        "version",
        "publishedAt",
        "url"
      ],
      "properties": {
        "slug": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "publishedAt": {
          "type": "string",
          "format": "date"
        },
        "updatedAt": {
          "type": "string",
          "format": "date"
        },
        "url": {
          "type": "string",
          "format": "uri"
        }
      }
    },
    "defanged": {
      "const": true
    },
    "items": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "type",
          "value"
        ],
        "properties": {
          "type": {
            "enum": [
              "sha256",
              "sha1",
              "md5",
              "domain",
              "url",
              "ip",
              "email",
              "file",
              "repository",
              "other"
            ]
          },
          "value": {
            "type": "string",
            "minLength": 1
          },
          "context": {
            "type": "string"
          },
          "confidence": {
            "type": "string"
          },
          "provenance": {
            "type": "string"
          },
          "section": {
            "type": "string",
            "description": "Heading id of the page section that lists it"
          },
          "references": {
            "type": "array",
            "items": {
              "type": "string",
              "format": "uri"
            },
            "description": "Public entries for this indicator (ThreatFox, URLhaus, MalwareBazaar, VirusTotal)"
          }
        }
      }
    }
  }
}