syntax = "proto3";

package worldmonitor.cyber.v1;

import "sebuf/http/annotations.proto";
import "worldmonitor/core/v1/pagination.proto";
import "worldmonitor/core/v1/severity.proto";
import "worldmonitor/cyber/v1/cyber_threat.proto";

// ListCyberThreatsRequest specifies filters for retrieving cyber threat indicators.
message ListCyberThreatsRequest {
  // Start of time range (inclusive), Unix epoch milliseconds.
  int64 start = 1 [(sebuf.http.int64_encoding) = INT64_ENCODING_NUMBER, (sebuf.http.query) = { name: "start" }];
  // End of time range (inclusive), Unix epoch milliseconds.
  int64 end = 2 [(sebuf.http.int64_encoding) = INT64_ENCODING_NUMBER, (sebuf.http.query) = { name: "end" }];
  // Maximum items per page (1-100).
  int32 page_size = 3 [(sebuf.http.query) = { name: "page_size" }];
  // Cursor for next page.
  string cursor = 4 [(sebuf.http.query) = { name: "cursor" }];
  // Optional threat type filter.
  CyberThreatType type = 5 [(sebuf.http.query) = { name: "type" }];
  // Optional source filter.
  CyberThreatSource source = 6 [(sebuf.http.query) = { name: "source" }];
  // Optional minimum criticality filter.
  worldmonitor.core.v1.CriticalityLevel min_severity = 7 [(sebuf.http.query) = { name: "min_severity" }];
}

// ListCyberThreatsResponse contains cyber threats matching the request.
message ListCyberThreatsResponse {
  // The list of cyber threats.
  repeated CyberThreat threats = 1;
  // Pagination metadata.
  worldmonitor.core.v1.PaginationResponse pagination = 2;
}
