<?xml version="1.0" encoding="UTF-8" ?>
<Workflow name="AppSentinels Alerts" version="1.0"
    xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/Workflow/V2">

    <!-- Collect configurations from workflow parameter file -->
    <Parameters>
        <Parameter name="host" label="AppSentinels Cloud Platform" required="true"/>
        <Parameter name="apiKey" label="API Key for accessing the Public API" required="true"/>
        <Parameter name="orgName" label="Org Name" required="true"/>
        <Parameter name="appName" label="Application Name" required="true" />
        <Parameter name="include_runtime_scan" label="Runtime scan events (only applicable to type vulnerability)"  default="false"/>
        <Parameter name="type" label="Runtime scan events (only applicable to type vulnerability)" default="security_events"/>
        <Parameter name="aggregation" label="aggregate the events" default="false"/>
    </Parameters>

    <Actions>
        <!-- Initialize the Bookmark -->
        <Initialize path="/bookmark" value="0" />
		<Set path="/last_event_id" value="${/bookmark}" />

		<!-- Request Events  -->
        <DoWhile condition="/get_events/body/more_records = true">
		
            <!-- Fetch the current events -->
            <CallEndpoint url="https://${/host}/api/v1/${/orgName}/${/appName}/events" method="POST" savePath="/get_events" >
				<RequestHeader name="Content-type" value="application/json" />
                <RequestHeader name="apikey" value="${/apiKey}"/>
                <RequestHeader name="Accept" value="application/json" />
                <RequestBody type="application/json" encoding="UTF-8">{"include_runtime_scan": ${/include_runtime_scan},"last_event_id": ${/last_event_id}, "severity": ["critical","major"],"type": "${/type}", "aggregation": ${/aggregation}}</RequestBody>
            </CallEndpoint>

            <!-- Handle Errors -->
            <If condition="/get_events/status_code != 200">
                <Abort reason="${/get_events/status_code} ${/get_events/status_message}"/>
            </If>

			<!-- Check events available and udpate the data /> -->
			<If condition="${count(/get_events/body/data)} > 0" >
				<Set path="/last_event_id" value="${/get_events/body/last_event_id}" />
				<PostEvents path="/get_events/body/data" source="${/host}"/>
			</If>

			<!-- Check the flag to continue to fetch events/> -->
			<If condition="/get_events/body/more_records != true" >
				<Log type="DEBUG" message="AppSentinels ORG: ${/orgName}, App: ${/appName}, Count: ${count(/get_events/body/data)}, MoreEvents: ${/get_events/body/more_records}, LastEvent: ${/last_event_id}" />
			</If>
			
        </DoWhile> 

		<Set path="/bookmark" value="${/last_event_id}" />
		
    </Actions>

    <!-- Performing some connectivity tests -->
    <Tests>
	    <DNSResolutionTest host="${/host}" />
        <TCPConnectionTest host="${/host}" />
        <SSLHandshakeTest host="${/host}" />
        <HTTPConnectionThroughProxyTest url="https://${/host}" />
    </Tests>

</Workflow>