# Panther custom log schema for Willow (mcp-s) audit logs.
#
# Willow POSTs each audit log to a Panther HTTP log source as a single JSON
# object. Attach this schema to that source so the events land as typed, named
# columns (instead of an inferred best-guess schema) and so identity fields are
# extracted as searchable indicators.
#
# Set up: Panther Console > Log Sources > (your HTTP source) > Attach or Infer
# Schemas, or upload it via the Panther Analytics Tool (PAT) / Terraform.
# Reference: https://docs.panther.com/data-onboarding/custom-log-types/reference
#
# Notes
# - `data` is stored as `json` because its shape depends on `action`
#   (tool_call, guard_check, webhook, ...). The flat analytics columns below
#   mirror the fields Willow denormalizes, so most detections can avoid digging
#   into `data`.
# - In Anonymous Mode, Willow omits `user` and `data`; every field here is
#   optional except the always-present envelope (`id`, `org_id`, `action`,
#   `created_at`), so anonymous events still validate against this schema.
schema: Custom.WillowAuditLog
description: Willow (mcp-s) audit logs delivered via a Panther HTTP log source.
referenceURL: https://docs.withwillow.ai/admin/settings/logs/panther
fields:
  - name: id
    type: string
    required: true
    description: Unique audit log id (UUID).
  - name: org_id
    type: string
    required: true
    description: Willow organization id.
  - name: action
    type: string
    required: true
    description: >-
      Event type: init, connect, tool_call, add_skill, add_command,
      connector_auth, webhook, guard_check, agent_tool_call, agent_event.
  - name: created_at
    type: timestamp
    timeFormats:
      - rfc3339
    isEventTime: true
    required: true
    description: When the event occurred (used as the Panther event time).
  - name: updated_at
    type: timestamp
    timeFormats:
      - rfc3339
    description: Last update time of the record.
  - name: user
    type: object
    description: Actor. Omitted in Anonymous Mode.
    fields:
      - name: id
        type: string
      - name: name
        type: string
      - name: email
        type: string
        indicators:
          - email
  - name: mcp_client
    type: string
    description: MCP client that issued the request (e.g. cursor, claude).
  - name: toolkit_slug
    type: string
  - name: transport
    type: string
    description: stdio or http.
  - name: data
    type: json
    description: Action-specific payload. Omitted in Anonymous Mode.
  # Flattened analytics columns denormalized by Willow.
  - name: init_tools
    type: array
    element:
      type: string
  - name: tool_call_mcp
    type: string
  - name: tool_call_tool
    type: string
  - name: tool_call_success
    type: boolean
  - name: guardrails_logs_action
    type: string
    description: block, allow, transform, or warn.
  - name: guardrails_logs_code
    type: string
  - name: guard_check_scope
    type: string
    description: buildtime or runtime.
  - name: add_skill_name
    type: string
  - name: add_skill_agent_type
    type: string
  - name: performance_total_time
    type: float
    description: Total time in milliseconds (tool_call / init).
  - name: token_count
    type: bigint
  - name: token_count_request
    type: bigint
  - name: token_count_response
    type: bigint
  - name: token_count_raw_response
    type: bigint
  - name: arguments_length
    type: bigint
  - name: response_length
    type: bigint
  # OTLP-originated fields (agent_tool_call / agent_event).
  - name: session_id
    type: string
  - name: event_name
    type: string
  - name: otel_source
    type: string
    description: claude_code or codex.
  - name: redirect_uri
    type: string
  - name: oauth_client_id
    type: string
