# --- Anthropic ---
ANTHROPIC_API_KEY=
# Override the triage model. Defaults to claude-sonnet-4-6.
# TRIAGE_MODEL=claude-sonnet-4-6

# --- Backend selection ---
# 'fixture' (default) or 'azure'
TRIAGE_BACKEND=fixture
TRIAGE_FIXTURES_DIR=./packages/mcp-soc-tools/fixtures

# --- Azure (required when TRIAGE_BACKEND=azure) ---
AZURE_TENANT_ID=
AZURE_LOG_ANALYTICS_WORKSPACE_ID=
# Auth: use DefaultAzureCredential. Locally run `az login`; in Azure use
# a managed identity granted Reader on the workspace + Microsoft Graph
# SecurityIncident.Read.All / SecurityAlert.Read.All / ThreatHunting.Read.All.

# --- Threat intel (optional; omitted sources are skipped, not stubbed) ---
VIRUSTOTAL_API_KEY=
GREYNOISE_API_KEY=
ABUSEIPDB_API_KEY=

# --- Infrastructure ---
DATABASE_URL=postgres://triage:triage@localhost:5432/triage
REDIS_URL=redis://localhost:6379

# --- Ingestion ---
# Shared secret expected on the X-Ingest-Secret header. Leave blank to disable
# auth (NOT recommended outside local dev).
INGEST_SECRET=