{
    "id":"/axapi/v3/threat-intel/threat-list/{name}",
    "type":"object",
    "node-type":"list",
    "title":"threat-list",
    "partition-visibility":"shared",
    "description":"Threat Categories for malicious IPs",
    "properties":{
        "name":{
            "type":"string",
            "format":"string",
            "minLength":1,
            "maxLength":63,
            "partition-visibility":"shared",
            "description":"Threat category List name",
            "optional":false
        },
        "type":{
            "type":"string",
            "format":"enum",
            "partition-visibility":"shared",
            "description":"'webroot': Configure Webroot threat categories; ",
            "enum":[
                "webroot"
            ],
            "optional":true
        },
        "all-categories":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not-list":[ "spam-sources", "windows-exploits", "web-attacks", "botnets", "scanners", "dos-attacks", "reputation", "phishing", "proxy", "mobile-threats", "tor-proxy" ],
            "description":"Enable all categories",
            "optional":true
        },
        "spam-sources":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's tunneling spam messages through a proxy, anomalous SMTP activities, and forum spam activities",
            "optional":true
        },
        "windows-exploits":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's associated with malware, shell code, rootkits, worms or viruses",
            "optional":true
        },
        "web-attacks":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's associated with cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute fo",
            "optional":true
        },
        "botnets":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"Botnet C&C channels, and infected zombie machines controlled by Bot master",
            "optional":true
        },
        "scanners":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's associated with probes, host scan, domain scan, and password brute force attack",
            "optional":true
        },
        "dos-attacks":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's participating in DOS, DDOS, anomalous sync flood, and anomalous traffic detection",
            "optional":true
        },
        "reputation":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP addresses currently known to be infected with malware",
            "optional":true
        },
        "phishing":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP addresses hosting phishing sites, ad click fraud or gaming fraud",
            "optional":true
        },
        "proxy":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP addresses providing proxy services",
            "optional":true
        },
        "mobile-threats":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's associated with mobile threats",
            "optional":true
        },
        "tor-proxy":{
            "type":"number",
            "format":"flag",
            "default":0,
            "partition-visibility":"shared",
            "not":"all-categories",
            "description":"IP's providing tor proxy services",
            "optional":true
        },
        "uuid":{
            "type":"string",
            "format":"string",
            "minLength":1,
            "maxLength":64,
            "partition-visibility":"shared",
            "modify-not-allowed":1,
            "description":"uuid of the object",
            "optional":true
        },
        "user-tag":{
            "type":"string",
            "format":"string-rlx",
            "minLength":1,
            "maxLength":127,
            "partition-visibility":"shared",
            "description":"Customized tag",
            "optional":true
        },
        "sampling-enable":{
            "type":"array",
            "minItems":1,
            "items":{
                "type":"object"
            },
            "uniqueItems":true,
            "array":[
                {
                    "properties":{
                        "counters1":{
                            "type":"string",
                            "format":"enum",
                            "partition-visibility":"shared",
                            "description":"'all': all; 'spam-sources': Hits for spam sources; 'windows-exploits': Hits for windows exploits; 'web-attacks': Hits for web attacks; 'botnets': Hits for botnets; 'scanners': Hits for scanners; 'dos-attacks': Hits for dos attacks; 'reputation': Hits for reputation; 'phishing': Hits for phishing; 'proxy': Hits for proxy; 'mobile-threats': Hits for mobile threats; 'tor-proxy': Hits for tor-proxy; 'total-hits': Total hits for threat-list; ",
                            "enum":[
                                "all",
                                "spam-sources",
                                "windows-exploits",
                                "web-attacks",
                                "botnets",
                                "scanners",
                                "dos-attacks",
                                "reputation",
                                "phishing",
                                "proxy",
                                "mobile-threats",
                                "tor-proxy",
                                "total-hits"
                            ]
                        }
                    }
                }
            ]
        }
    },
    "object-keys":[
        "name"
    ],
    "required":[
        "name"
    ]
}