{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {
                            "urls": {
                                "type": "array"
                            },
                            "ips": {
                                "type": "array"
                            },
                            "fileHashes": {
                                "type": "array"
                            }
                        }
                    }
                }
            }
        },
        "actions": {
            "Initialize_URLScanResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_URLScanTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_URLScanDomainResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanDomainResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_URLScanDomainTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanDomainTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_URLScanIPResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanIPResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_URLScanIPTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanIPTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_URLScanHashResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanHashResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_URLScanHashTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanHashTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_URLScanASNResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanASNResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_URLScanASNTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "URLScanASNTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Condition_ValidateKey": {
                "actions": {
                    "For_each_URL_URLScan": {
                        "foreach": "@triggerBody()?['urls']",
                        "actions": {
                            "URLScan_Search_Existing": {
                                "type": "Http",
                                "inputs": {
                                    "uri": "@concat('https://urlscan.io/api/v1/search/?q=page.url:%22', encodeUriComponent(item()?['Url']), '%22&size=1')",
                                    "method": "GET",
                                    "headers": {
                                        "api-key": "@parameters('URLScanApiKey')",
                                        "Accept": "application/json"
                                    }
                                },
                                "runtimeConfiguration": {
                                    "contentTransfer": {
                                        "transferMode": "Chunked"
                                    }
                                }
                            },
                            "Compose_Existing_UUID": {
                                "runAfter": {
                                    "URLScan_Search_Existing": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@coalesce(body('URLScan_Search_Existing')?['results']?[0]?['task']?['uuid'], '')"
                            },
                            "Compose_Existing_Age_Hours": {
                                "runAfter": {
                                    "Compose_Existing_UUID": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@if(equals(outputs('Compose_Existing_UUID'), ''), 9999, div(sub(ticks(utcNow()), ticks(coalesce(body('URLScan_Search_Existing')?['results']?[0]?['task']?['time'], '1970-01-01T00:00:00Z'))), 36000000000))"
                            },
                            "Condition_Need_Fresh_Scan": {
                                "actions": {
                                    "URLScan_Submit_URL": {
                                        "type": "Http",
                                        "inputs": {
                                            "uri": "https://urlscan.io/api/v1/scan/",
                                            "method": "POST",
                                            "headers": {
                                                "api-key": "@parameters('URLScanApiKey')",
                                                "Content-Type": "application/json",
                                                "Accept": "application/json"
                                            },
                                            "body": {
                                                "url": "@{item()?['Url']}",
                                                "visibility": "private",
                                                "tags": [
                                                    "sentinel-incident",
                                                    "automated-triage"
                                                ]
                                            }
                                        },
                                        "runtimeConfiguration": {
                                            "contentTransfer": {
                                                "transferMode": "Chunked"
                                            }
                                        }
                                    },
                                    "Compose_New_Scan_UUID": {
                                        "runAfter": {
                                            "URLScan_Submit_URL": [
                                                "Succeeded",
                                                "Failed",
                                                "TimedOut"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@coalesce(body('URLScan_Submit_URL')?['uuid'], '')"
                                    },
                                    "Delay_URLScan_Poll": {
                                        "runAfter": {
                                            "Compose_New_Scan_UUID": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "Wait",
                                        "inputs": {
                                            "interval": {
                                                "count": 15,
                                                "unit": "Second"
                                            }
                                        }
                                    },
                                    "URLScan_Get_Result_Fresh": {
                                        "runAfter": {
                                            "Delay_URLScan_Poll": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "Http",
                                        "inputs": {
                                            "uri": "@concat('https://urlscan.io/api/v1/result/', outputs('Compose_New_Scan_UUID'), '/')",
                                            "method": "GET",
                                            "headers": {
                                                "api-key": "@parameters('URLScanApiKey')",
                                                "Accept": "application/json"
                                            }
                                        },
                                        "runtimeConfiguration": {
                                            "contentTransfer": {
                                                "transferMode": "Chunked"
                                            }
                                        }
                                    },
                                    "Delay_URLScan_Poll_Retry": {
                                        "runAfter": {
                                            "URLScan_Get_Result_Fresh": [
                                                "Failed",
                                                "TimedOut"
                                            ]
                                        },
                                        "type": "Wait",
                                        "inputs": {
                                            "interval": {
                                                "count": 10,
                                                "unit": "Second"
                                            }
                                        }
                                    },
                                    "URLScan_Get_Result_Fresh_Retry": {
                                        "runAfter": {
                                            "Delay_URLScan_Poll_Retry": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "Http",
                                        "inputs": {
                                            "uri": "@concat('https://urlscan.io/api/v1/result/', outputs('Compose_New_Scan_UUID'), '/')",
                                            "method": "GET",
                                            "headers": {
                                                "api-key": "@parameters('URLScanApiKey')",
                                                "Accept": "application/json"
                                            }
                                        },
                                        "runtimeConfiguration": {
                                            "contentTransfer": {
                                                "transferMode": "Chunked"
                                            }
                                        }
                                    },
                                    "Compose_Fresh_Result_Body": {
                                        "runAfter": {
                                            "URLScan_Get_Result_Fresh": [
                                                "Succeeded"
                                            ],
                                            "URLScan_Get_Result_Fresh_Retry": [
                                                "Succeeded",
                                                "Failed",
                                                "TimedOut",
                                                "Skipped"
                                            ]
                                        },
                                        "type": "Compose",
                                        "inputs": "@coalesce(body('URLScan_Get_Result_Fresh'), body('URLScan_Get_Result_Fresh_Retry'), json('{}'))"
                                    },
                                    "Append_URLScan_Fresh_Result": {
                                        "runAfter": {
                                            "Compose_Fresh_Result_Body": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToArrayVariable",
                                        "inputs": {
                                            "name": "URLScanResults",
                                            "value": {
                                                "url": "@item()?['Url']",
                                                "scanUUID": "@outputs('Compose_New_Scan_UUID')",
                                                "scanSource": "fresh",
                                                "scanTime": "@body('URLScan_Submit_URL')?['task']?['time']",
                                                "pageUrl": "@outputs('Compose_Fresh_Result_Body')?['page']?['url']",
                                                "pageDomain": "@outputs('Compose_Fresh_Result_Body')?['page']?['domain']",
                                                "pageCountry": "@outputs('Compose_Fresh_Result_Body')?['page']?['country']",
                                                "pageServer": "@outputs('Compose_Fresh_Result_Body')?['page']?['server']",
                                                "pageIP": "@outputs('Compose_Fresh_Result_Body')?['page']?['ip']",
                                                "pageASN": "@outputs('Compose_Fresh_Result_Body')?['page']?['asn']",
                                                "pageASNName": "@outputs('Compose_Fresh_Result_Body')?['page']?['asnname']",
                                                "overallMalicious": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['malicious'], false)",
                                                "overallScore": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['score'], 0)",
                                                "overallCategories": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['categories'], json('[]'))",
                                                "urlscanMalicious": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['urlscan']?['malicious'], false)",
                                                "urlscanScore": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['urlscan']?['score'], 0)",
                                                "communityScore": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['community']?['score'], 0)",
                                                "communityVotes": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['community']?['votes']?['malicious'], 0)",
                                                "enginesTotal": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['engines']?['detections'], 0)",
                                                "enginesPositive": "@coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['engines']?['malicious'], 0)",
                                                "tlsIssuer": "@coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['tlsIssuer'], 'N/A')",
                                                "tlsValidFrom": "@coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['tlsValidFrom'], 'N/A')",
                                                "tlsAgeDays": "@coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['tlsAgeDays'], 'N/A')",
                                                "uniqueDomains": "@coalesce(length(outputs('Compose_Fresh_Result_Body')?['lists']?['domains']), 0)",
                                                "uniqueIPs": "@coalesce(length(outputs('Compose_Fresh_Result_Body')?['lists']?['ips']), 0)",
                                                "maliciousResourceCount": "@coalesce(outputs('Compose_Fresh_Result_Body')?['stats']?['malicious'], 0)",
                                                "securePercentage": "@coalesce(outputs('Compose_Fresh_Result_Body')?['stats']?['securePercentage'], 0)",
                                                "screenshotURL": "@concat('https://urlscan.io/screenshots/', outputs('Compose_New_Scan_UUID'), '.png')",
                                                "reportURL": "@concat('https://urlscan.io/result/', outputs('Compose_New_Scan_UUID'), '/')"
                                            }
                                        }
                                    },
                                    "Append_URLScan_Fresh_HTML_Row": {
                                        "runAfter": {
                                            "Append_URLScan_Fresh_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToStringVariable",
                                        "inputs": {
                                            "name": "URLScanTableHTML",
                                            "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:220px;font-size:11px\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-size:10px;color:#888\">Fresh</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;font-size:14px;color:', if(equals(string(coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['malicious'], false)), 'true'), '#c0392b', '#27ae60'), '\">', if(equals(string(coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['malicious'], false)), 'true'), '⚠ MALICIOUS', '✔ Clean'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['score'], 0), 50), '#c0392b', if(greater(coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['score'], 0), 25), '#e67e22', '#27ae60')), '\">', string(coalesce(outputs('Compose_Fresh_Result_Body')?['verdicts']?['overall']?['score'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['domain'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-size:11px\">', coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['ip'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['country'], '?'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['asnname'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(outputs('Compose_Fresh_Result_Body')?['page']?['server'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(outputs('Compose_Fresh_Result_Body')?['stats']?['malicious'], 0), 0), '#c0392b', '#27ae60'), '\">', string(coalesce(outputs('Compose_Fresh_Result_Body')?['stats']?['malicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(outputs('Compose_Fresh_Result_Body')?['stats']?['securePercentage'], 0)), '%</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://urlscan.io/result/', outputs('Compose_New_Scan_UUID'), '/'), '\" target=\"_blank\">Report</a> | <a href=\"', concat('https://urlscan.io/screenshots/', outputs('Compose_New_Scan_UUID'), '.png'), '\" target=\"_blank\">Screenshot</a></td></tr>')"
                                        }
                                    }
                                },
                                "runAfter": {
                                    "Compose_Existing_Age_Hours": [
                                        "Succeeded"
                                    ]
                                },
                                "else": {
                                    "actions": {
                                        "URLScan_Get_Existing_Result": {
                                            "type": "Http",
                                            "inputs": {
                                                "uri": "@concat('https://urlscan.io/api/v1/result/', outputs('Compose_Existing_UUID'), '/')",
                                                "method": "GET",
                                                "headers": {
                                                    "api-key": "@parameters('URLScanApiKey')",
                                                    "Accept": "application/json"
                                                }
                                            },
                                            "runtimeConfiguration": {
                                                "contentTransfer": {
                                                    "transferMode": "Chunked"
                                                }
                                            }
                                        },
                                        "Append_URLScan_Existing_Result": {
                                            "runAfter": {
                                                "URLScan_Get_Existing_Result": [
                                                    "Succeeded",
                                                    "Failed",
                                                    "TimedOut"
                                                ]
                                            },
                                            "type": "AppendToArrayVariable",
                                            "inputs": {
                                                "name": "URLScanResults",
                                                "value": {
                                                    "url": "@item()?['Url']",
                                                    "scanUUID": "@outputs('Compose_Existing_UUID')",
                                                    "scanSource": "cached",
                                                    "scanTime": "@body('URLScan_Search_Existing')?['results']?[0]?['task']?['time']",
                                                    "pageUrl": "@body('URLScan_Get_Existing_Result')?['page']?['url']",
                                                    "pageDomain": "@body('URLScan_Get_Existing_Result')?['page']?['domain']",
                                                    "pageCountry": "@body('URLScan_Get_Existing_Result')?['page']?['country']",
                                                    "pageServer": "@body('URLScan_Get_Existing_Result')?['page']?['server']",
                                                    "pageIP": "@body('URLScan_Get_Existing_Result')?['page']?['ip']",
                                                    "pageASN": "@body('URLScan_Get_Existing_Result')?['page']?['asn']",
                                                    "pageASNName": "@body('URLScan_Get_Existing_Result')?['page']?['asnname']",
                                                    "overallMalicious": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['malicious'], false)",
                                                    "overallScore": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['score'], 0)",
                                                    "overallCategories": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['categories'], json('[]'))",
                                                    "urlscanMalicious": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['urlscan']?['malicious'], false)",
                                                    "urlscanScore": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['urlscan']?['score'], 0)",
                                                    "communityScore": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['community']?['score'], 0)",
                                                    "communityVotes": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['community']?['votes']?['malicious'], 0)",
                                                    "enginesTotal": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['engines']?['detections'], 0)",
                                                    "enginesPositive": "@coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['engines']?['malicious'], 0)",
                                                    "tlsIssuer": "@coalesce(body('URLScan_Get_Existing_Result')?['page']?['tlsIssuer'], 'N/A')",
                                                    "tlsValidFrom": "@coalesce(body('URLScan_Get_Existing_Result')?['page']?['tlsValidFrom'], 'N/A')",
                                                    "tlsAgeDays": "@coalesce(body('URLScan_Get_Existing_Result')?['page']?['tlsAgeDays'], 'N/A')",
                                                    "uniqueDomains": "@coalesce(length(body('URLScan_Get_Existing_Result')?['lists']?['domains']), 0)",
                                                    "uniqueIPs": "@coalesce(length(body('URLScan_Get_Existing_Result')?['lists']?['ips']), 0)",
                                                    "maliciousResourceCount": "@coalesce(body('URLScan_Get_Existing_Result')?['stats']?['malicious'], 0)",
                                                    "securePercentage": "@coalesce(body('URLScan_Get_Existing_Result')?['stats']?['securePercentage'], 0)",
                                                    "screenshotURL": "@concat('https://urlscan.io/screenshots/', outputs('Compose_Existing_UUID'), '.png')",
                                                    "reportURL": "@concat('https://urlscan.io/result/', outputs('Compose_Existing_UUID'), '/')"
                                                }
                                            }
                                        },
                                        "Append_URLScan_Existing_HTML_Row": {
                                            "runAfter": {
                                                "Append_URLScan_Existing_Result": [
                                                    "Succeeded"
                                                ]
                                            },
                                            "type": "AppendToStringVariable",
                                            "inputs": {
                                                "name": "URLScanTableHTML",
                                                "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:220px;font-size:11px\">', item()?['Url'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-size:10px;color:#888\">Cached</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;font-size:14px;color:', if(equals(string(coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['malicious'], false)), 'true'), '#c0392b', '#27ae60'), '\">', if(equals(string(coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['malicious'], false)), 'true'), '⚠ MALICIOUS', '✔ Clean'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['score'], 0), 50), '#c0392b', if(greater(coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['score'], 0), 25), '#e67e22', '#27ae60')), '\">', string(coalesce(body('URLScan_Get_Existing_Result')?['verdicts']?['overall']?['score'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', coalesce(body('URLScan_Get_Existing_Result')?['page']?['domain'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-size:11px\">', coalesce(body('URLScan_Get_Existing_Result')?['page']?['ip'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('URLScan_Get_Existing_Result')?['page']?['country'], '?'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_Get_Existing_Result')?['page']?['asnname'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('URLScan_Get_Existing_Result')?['page']?['server'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(body('URLScan_Get_Existing_Result')?['stats']?['malicious'], 0), 0), '#c0392b', '#27ae60'), '\">', string(coalesce(body('URLScan_Get_Existing_Result')?['stats']?['malicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('URLScan_Get_Existing_Result')?['stats']?['securePercentage'], 0)), '%</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://urlscan.io/result/', outputs('Compose_Existing_UUID'), '/'), '\" target=\"_blank\">Report</a> | <a href=\"', concat('https://urlscan.io/screenshots/', outputs('Compose_Existing_UUID'), '.png'), '\" target=\"_blank\">Screenshot</a></td></tr>')"
                                            }
                                        }
                                    }
                                },
                                "expression": {
                                    "or": [
                                        {
                                            "equals": [
                                                "@outputs('Compose_Existing_UUID')",
                                                ""
                                            ]
                                        },
                                        {
                                            "greaterOrEquals": [
                                                "@outputs('Compose_Existing_Age_Hours')",
                                                24
                                            ]
                                        }
                                    ]
                                },
                                "type": "If"
                            },
                            "Compose_URL_Domain": {
                                "runAfter": {
                                    "Condition_Need_Fresh_Scan": [
                                        "Succeeded",
                                        "Failed",
                                        "Skipped"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@{uriHost(if(or(startsWith(item()?['Url'], 'http://'), startsWith(item()?['Url'], 'https://')), item()?['Url'], concat('https://', item()?['Url'])))}"
                            },
                            "URLScan_Domain_Search": {
                                "runAfter": {
                                    "Compose_URL_Domain": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Http",
                                "inputs": {
                                    "uri": "@concat('https://urlscan.io/api/v1/search/?q=domain:', outputs('Compose_URL_Domain'), '&size=5')",
                                    "method": "GET",
                                    "headers": {
                                        "api-key": "@parameters('URLScanApiKey')",
                                        "Accept": "application/json"
                                    }
                                },
                                "runtimeConfiguration": {
                                    "contentTransfer": {
                                        "transferMode": "Chunked"
                                    }
                                }
                            },
                            "Append_URLScan_Domain_Result": {
                                "runAfter": {
                                    "URLScan_Domain_Search": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "URLScanDomainResults",
                                    "value": {
                                        "sourceUrl": "@item()?['Url']",
                                        "domain": "@outputs('Compose_URL_Domain')",
                                        "totalResults": "@coalesce(body('URLScan_Domain_Search')?['total'], 0)",
                                        "results": "@coalesce(body('URLScan_Domain_Search')?['results'], json('[]'))"
                                    }
                                }
                            },
                            "Append_URLScan_Domain_HTML_Row": {
                                "runAfter": {
                                    "Append_URLScan_Domain_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "URLScanDomainTableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-weight:bold\">', outputs('Compose_URL_Domain'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(body('URLScan_Domain_Search')?['total'], 0), 0), '#27ae60', '#888'), '\">', string(coalesce(body('URLScan_Domain_Search')?['total'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_Domain_Search')?['results']?[0]?['page']?['ip'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('URLScan_Domain_Search')?['results']?[0]?['page']?['country'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_Domain_Search')?['results']?[0]?['page']?['asnname'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;font-weight:bold;color:', if(equals(string(coalesce(body('URLScan_Domain_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '#c0392b', '#27ae60'), '\">', if(equals(string(coalesce(body('URLScan_Domain_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '⚠ MALICIOUS', '✔ Clean'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://urlscan.io/search/#domain:', outputs('Compose_URL_Domain')), '\" target=\"_blank\">Search</a></td></tr>')"
                                }
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_IP_URLScan": {
                        "foreach": "@triggerBody()?['ips']",
                        "actions": {
                            "URLScan_IP_Search": {
                                "type": "Http",
                                "inputs": {
                                    "uri": "@concat('https://urlscan.io/api/v1/search/?q=ip:', item()?['Address'], '&size=5')",
                                    "method": "GET",
                                    "headers": {
                                        "api-key": "@parameters('URLScanApiKey')",
                                        "Accept": "application/json"
                                    }
                                },
                                "runtimeConfiguration": {
                                    "contentTransfer": {
                                        "transferMode": "Chunked"
                                    }
                                }
                            },
                            "Append_URLScan_IP_Result": {
                                "runAfter": {
                                    "URLScan_IP_Search": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "URLScanIPResults",
                                    "value": {
                                        "ipAddress": "@item()?['Address']",
                                        "totalResults": "@coalesce(body('URLScan_IP_Search')?['total'], 0)",
                                        "results": "@coalesce(body('URLScan_IP_Search')?['results'], json('[]'))"
                                    }
                                }
                            },
                            "Append_URLScan_IP_HTML_Row": {
                                "runAfter": {
                                    "Append_URLScan_IP_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "URLScanIPTableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-weight:bold\">', item()?['Address'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(body('URLScan_IP_Search')?['total'], 0), 0), '#27ae60', '#888'), '\">', string(coalesce(body('URLScan_IP_Search')?['total'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_IP_Search')?['results']?[0]?['page']?['domain'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('URLScan_IP_Search')?['results']?[0]?['page']?['country'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_IP_Search')?['results']?[0]?['page']?['asnname'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(equals(string(coalesce(body('URLScan_IP_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '#c0392b', '#27ae60'), '\">', if(equals(string(coalesce(body('URLScan_IP_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '⚠ MALICIOUS', '✔ Clean'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://urlscan.io/search/#ip:', item()?['Address']), '\" target=\"_blank\">Search</a></td></tr>')"
                                }
                            },
                            "Get_IP_ASN_For_URLScan": {
                                "runAfter": {
                                    "Append_URLScan_IP_HTML_Row": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Http",
                                "inputs": {
                                    "uri": "https://www.virustotal.com/api/v3/ip_addresses/@{item()?['Address']}",
                                    "method": "GET",
                                    "headers": {
                                        "x-apikey": "@parameters('VTApiKey')",
                                        "Accept": "application/json"
                                    }
                                },
                                "runtimeConfiguration": {
                                    "contentTransfer": {
                                        "transferMode": "Chunked"
                                    }
                                }
                            },
                            "Compose_IP_ASN": {
                                "runAfter": {
                                    "Get_IP_ASN_For_URLScan": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@{coalesce(body('Get_IP_ASN_For_URLScan')?['data']?['attributes']?['asn'], '')}"
                            },
                            "Condition_Has_ASN": {
                                "actions": {
                                    "URLScan_ASN_Search": {
                                        "type": "Http",
                                        "inputs": {
                                            "uri": "@concat('https://urlscan.io/api/v1/search/?q=asn:AS', outputs('Compose_IP_ASN'), '&size=5')",
                                            "method": "GET",
                                            "headers": {
                                                "api-key": "@parameters('URLScanApiKey')",
                                                "Accept": "application/json"
                                            }
                                        },
                                        "runtimeConfiguration": {
                                            "contentTransfer": {
                                                "transferMode": "Chunked"
                                            }
                                        }
                                    },
                                    "Append_URLScan_ASN_Result": {
                                        "runAfter": {
                                            "URLScan_ASN_Search": [
                                                "Succeeded",
                                                "Failed",
                                                "TimedOut"
                                            ]
                                        },
                                        "type": "AppendToArrayVariable",
                                        "inputs": {
                                            "name": "URLScanASNResults",
                                            "value": {
                                                "ipAddress": "@item()?['Address']",
                                                "asn": "@outputs('Compose_IP_ASN')",
                                                "asOwner": "@coalesce(body('Get_IP_ASN_For_URLScan')?['data']?['attributes']?['as_owner'], 'Unknown')",
                                                "totalResults": "@coalesce(body('URLScan_ASN_Search')?['total'], 0)",
                                                "results": "@coalesce(body('URLScan_ASN_Search')?['results'], json('[]'))"
                                            }
                                        }
                                    },
                                    "Append_URLScan_ASN_HTML_Row": {
                                        "runAfter": {
                                            "Append_URLScan_ASN_Result": [
                                                "Succeeded"
                                            ]
                                        },
                                        "type": "AppendToStringVariable",
                                        "inputs": {
                                            "name": "URLScanASNTableHTML",
                                            "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace\">', item()?['Address'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace\">AS', outputs('Compose_IP_ASN'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('Get_IP_ASN_For_URLScan')?['data']?['attributes']?['as_owner'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(body('URLScan_ASN_Search')?['total'], 0), 0), '#27ae60', '#888'), '\">', string(coalesce(body('URLScan_ASN_Search')?['total'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_ASN_Search')?['results']?[0]?['page']?['domain'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('URLScan_ASN_Search')?['results']?[0]?['page']?['country'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(equals(string(coalesce(body('URLScan_ASN_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '#c0392b', '#27ae60'), '\">', if(equals(string(coalesce(body('URLScan_ASN_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '⚠ MALICIOUS', '✔ Clean'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://urlscan.io/search/#asn:AS', outputs('Compose_IP_ASN')), '\" target=\"_blank\">Search</a></td></tr>')"
                                        }
                                    }
                                },
                                "runAfter": {
                                    "Compose_IP_ASN": [
                                        "Succeeded"
                                    ]
                                },
                                "else": {
                                    "actions": {}
                                },
                                "expression": {
                                    "and": [
                                        {
                                            "not": {
                                                "equals": [
                                                    "@outputs('Compose_IP_ASN')",
                                                    ""
                                                ]
                                            }
                                        }
                                    ]
                                },
                                "type": "If"
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_Hash_URLScan": {
                        "foreach": "@triggerBody()?['fileHashes']",
                        "actions": {
                            "URLScan_Hash_Search": {
                                "type": "Http",
                                "inputs": {
                                    "uri": "@concat('https://urlscan.io/api/v1/search/?q=hash:', item()?['Value'], '&size=5')",
                                    "method": "GET",
                                    "headers": {
                                        "api-key": "@parameters('URLScanApiKey')",
                                        "Accept": "application/json"
                                    }
                                },
                                "runtimeConfiguration": {
                                    "contentTransfer": {
                                        "transferMode": "Chunked"
                                    }
                                }
                            },
                            "Append_URLScan_Hash_Result": {
                                "runAfter": {
                                    "URLScan_Hash_Search": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "URLScanHashResults",
                                    "value": {
                                        "hashValue": "@item()?['Value']",
                                        "hashAlgorithm": "@item()?['Algorithm']",
                                        "totalResults": "@coalesce(body('URLScan_Hash_Search')?['total'], 0)",
                                        "results": "@coalesce(body('URLScan_Hash_Search')?['results'], json('[]'))"
                                    }
                                }
                            },
                            "Append_URLScan_Hash_HTML_Row": {
                                "runAfter": {
                                    "Append_URLScan_Hash_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "URLScanHashTableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-size:11px;word-break:break-all;max-width:200px\">', item()?['Value'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', item()?['Algorithm'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(coalesce(body('URLScan_Hash_Search')?['total'], 0), 0), '#27ae60', '#888'), '\">', string(coalesce(body('URLScan_Hash_Search')?['total'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_Hash_Search')?['results']?[0]?['page']?['url'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_Hash_Search')?['results']?[0]?['page']?['domain'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('URLScan_Hash_Search')?['results']?[0]?['page']?['country'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('URLScan_Hash_Search')?['results']?[0]?['page']?['asnname'], 'N/A'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(equals(string(coalesce(body('URLScan_Hash_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '#c0392b', '#27ae60'), '\">', if(equals(string(coalesce(body('URLScan_Hash_Search')?['results']?[0]?['verdicts']?['overall']?['malicious'], false)), 'true'), '⚠ MALICIOUS', '✔ Clean'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://urlscan.io/search/#hash:', item()?['Value']), '\" target=\"_blank\">Search</a></td></tr>')"
                                }
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "Response_Success": {
                        "runAfter": {
                            "For_each_URL_URLScan": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ],
                            "For_each_IP_URLScan": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ],
                            "For_each_Hash_URLScan": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ]
                        },
                        "type": "Response",
                        "kind": "Http",
                        "inputs": {
                            "statusCode": 200,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "urlscanTableHTML": "@variables('URLScanTableHTML')",
                                "urlscanDomainTableHTML": "@variables('URLScanDomainTableHTML')",
                                "urlscanIPTableHTML": "@variables('URLScanIPTableHTML')",
                                "urlscanHashTableHTML": "@variables('URLScanHashTableHTML')",
                                "urlscanASNTableHTML": "@variables('URLScanASNTableHTML')",
                                "urlscanResults": "@variables('URLScanResults')",
                                "urlscanDomainResults": "@variables('URLScanDomainResults')",
                                "urlscanIPResults": "@variables('URLScanIPResults')",
                                "urlscanHashResults": "@variables('URLScanHashResults')",
                                "urlscanASNResults": "@variables('URLScanASNResults')"
                            }
                        }
                    }
                },
                "runAfter": {
                    "Initialize_URLScanResults": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanDomainResults": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanDomainTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanIPResults": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanIPTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanHashResults": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanHashTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanASNResults": [
                        "Succeeded"
                    ],
                    "Initialize_URLScanASNTableHTML": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Response_Unauthorized": {
                            "type": "Response",
                            "kind": "Http",
                            "inputs": {
                                "statusCode": 401,
                                "body": {
                                    "error": "Unauthorized - invalid worker key"
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            }
        },
        "outputs": {},
        "parameters": {
            "URLScanApiKey": {
                "defaultValue": "<URLSCAN-API-KEY>",
                "type": "String"
            },
            "VTApiKey": {
                "defaultValue": "<VIRUSTOTAL-API-KEY>",
                "type": "String"
            },
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "String"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {}
        }
    }
}