{
  "properties": {
    "apiVersion": {
      "type": "string"
    },
    "kind": {
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "properties": {
        "rules": {
          "items": {
            "properties": {
              "agentVersionRequirement": {
                "description": "Agent version requirement to evaluate this rule (supports semver ranges like ~1.0, >=1.2.0, etc.)",
                "type": "string"
              },
              "description": {
                "description": "Description of the rule",
                "type": "string"
              },
              "enabled": {
                "description": "Whether the rule is enabled",
                "type": "boolean"
              },
              "expressions": {
                "properties": {
                  "message": {
                    "description": "Message expression",
                    "type": "string"
                  },
                  "ruleExpression": {
                    "items": {
                      "properties": {
                        "eventType": {
                          "description": "Type of event this expression handles",
                          "type": "string"
                        },
                        "expression": {
                          "description": "The rule expression string",
                          "type": "string"
                        }
                      },
                      "required": [
                        "eventType",
                        "expression"
                      ],
                      "type": "object",
                      "additionalProperties": false
                    },
                    "type": "array"
                  },
                  "uniqueId": {
                    "description": "Unique identifier expression",
                    "type": "string"
                  }
                },
                "required": [
                  "message",
                  "uniqueId",
                  "ruleExpression"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "id": {
                "description": "Unique identifier for the rule",
                "type": "string"
              },
              "isTriggerAlert": {
                "default": true,
                "description": "Whether the rule is a trigger alert",
                "type": "boolean"
              },
              "mitreTactic": {
                "description": "MITRE tactic associated with the rule",
                "type": "string"
              },
              "mitreTechnique": {
                "description": "MITRE technique associated with the rule",
                "type": "string"
              },
              "name": {
                "description": "Name of the rule",
                "type": "string"
              },
              "profileDependency": {
                "description": "Profile dependency level (0=Required, 1=Optional, 2=NotRequired)",
                "enum": [
                  0,
                  1,
                  2
                ],
                "type": "integer"
              },
              "severity": {
                "description": "Severity level of the rule",
                "type": "integer"
              },
              "state": {
                "additionalProperties": true,
                "description": "State information for the rule",
                "type": "object"
              },
              "supportPolicy": {
                "default": false,
                "description": "Whether the rule supports rule policy enforcement",
                "type": "boolean"
              },
              "tags": {
                "description": "Tags associated with the rule",
                "items": {
                  "type": "string"
                },
                "type": "array"
              }
            },
            "required": [
              "enabled",
              "id",
              "name",
              "description",
              "expressions",
              "profileDependency",
              "severity",
              "supportPolicy",
              "isTriggerAlert",
              "mitreTechnique",
              "mitreTactic"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        }
      },
      "required": [
        "rules"
      ],
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}