malware on-demand list:
  return_type: OnDemandScanListAgentResponse
  help: Show the list of on-demand scans
  type: dict
  cli:
    users:
      - root
  schema:
    since:
      type: integer
      coerce: int
      default: 0
      help: Show scans started after this unix timestamp.
    to:
      type: integer
      coerce: int
      default_setter: now
      help: Show scans started before this unix timestamp.
    limit:
      type: integer
      coerce: int
      default: 50
      help: Page size
    offset:
      type: integer
      coerce: int
      default: 0
      help: Page offset 
    order_by:
      type: list
      schema:
        type: order_by
        coerce: order_by
      nullable: true
      help: |
        List of fields to order by, each followed by a `+` (ascending) or `-` (descending).
        E.g. `["total_malicious-","started-"]` would order by `total_malicious` and `started` descending.

malware on-demand start:
  return_type: NullAgentResponse
  help: |
    DEPRECATED - use `malware on-demand queue put` instead.
    Start an on-demand scan.
  type: dict
  cli:
    users:
      - root
  schema:
    path:
      type: string
      required: true
      help: Path to scan

    file_mask:
      type: string
      nullable: true
      dependencies:
        scan_file: true
      help: |
        Several patterns can be added with ", " delimiter.
        Example: `*.js, *.php`

    ignore_mask:
      type: string
      nullable: true
      dependencies:
        scan_file: true
      help: |
        Several patterns can be added with ", " delimiter.
        Example: `*.log, *.tmp`

    intensity:
      type: string
      nullable: true
      allowed:
        - low
        - moderate
        - high
      help: |
        Scan intensity, simplified.
        Overrides `intensity_cpu`, `intensity_io` and `intensity_ram`.

    intensity_cpu:
      type: integer
      coerce: int
      nullable: true
      min: 1
      max: 7
      help: |
        CPU usage allowed for the scan - from minimal, to 1 cpu core.
        The method depends on the system: lve, cgroups, nice.
        The default value can be configured in `MALWARE_SCAN_INTENSITY.cpu` config option.

    intensity_io:
      type: integer
      coerce: int
      nullable: true
      min: 1
      max: 7
      help: |
        Disk usage allowed for the scan.
        The default value can be configured in `MALWARE_SCAN_INTENSITY.io` config option.

    intensity_ram:
      type: integer
      coerce: int
      nullable: true
      min: 1024
      help: |
        RAM usage allowed for the scan, in MB.
        The default value can be configured in `MALWARE_SCAN_INTENSITY.ram` config option.

    follow_symlinks:
      type: boolean
      dependencies:
        scan_file: true
      help: If true, the scanner may traverse outside of the initial directory.

    scan_file:
      type: boolean
      default: true
      help: Scan files in set path.

    scan_db:
      type: boolean
      default: null
      coerce: scan_db
      help: Scan databases of applications found in set path.

malware on-demand stop:
  return_type: NullAgentResponse
  help: Stop the last on-demand scan
  cli:
    users:
      - root
  schema:
    all:
      type: boolean
      default: false
      help: Stop all the scans

malware on-demand status:
  return_type: OnDemandScanStatusAgentResponse
  help: Show the status of the running on-demand scan
  cli:
    users:
      - root

malware on-demand check-detached:
  return_type: NullAgentResponse
  help: (internal) Check for failed on-demand scans
  cli:
    users:
      - root
    require_rpc: stopped