{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Device",
  "description": "Device schema from Palo Alto Networks IoT Security API",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-schema/iot-security-api-device-schema.json",
  "type": "object",
  "properties": {
    "deviceid": {
      "type": "string",
      "description": "Unique device identifier."
    },
    "ip": {
      "type": "string",
      "format": "ipv4",
      "description": "IPv4 address of the device."
    },
    "mac": {
      "type": "string",
      "description": "MAC address of the device."
    },
    "hostname": {
      "type": "string",
      "description": "Hostname or NetBIOS name of the device."
    },
    "profile": {
      "type": "string",
      "description": "Device profile classification (e.g., IP Camera, Infusion Pump)."
    },
    "category": {
      "type": "string",
      "description": "Device category (e.g., IoT, OT, IT)."
    },
    "risk_score": {
      "type": "integer",
      "minimum": 0,
      "maximum": 100,
      "description": "Aggregate risk score from 0 (lowest) to 100 (highest)."
    },
    "os": {
      "type": "string",
      "description": "Detected operating system."
    },
    "os_version": {
      "type": "string",
      "description": "Detected operating system version."
    },
    "vendor": {
      "type": "string",
      "description": "Device manufacturer or vendor."
    },
    "model": {
      "type": "string",
      "description": "Device model identifier."
    },
    "site": {
      "type": "string",
      "description": "Network site where the device was discovered."
    },
    "subnet": {
      "type": "string",
      "description": "Subnet the device belongs to."
    },
    "first_seen": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the device was first discovered."
    },
    "last_seen": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the device was last active."
    },
    "monitored": {
      "type": "string",
      "enum": [
        "yes",
        "no"
      ],
      "description": "Whether the device is currently monitored."
    },
    "confidence_score": {
      "type": "integer",
      "description": "Confidence level of the device profile classification."
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "User-defined or system-assigned tags."
    }
  }
}