limacharlie

type ArtifactRule struct {
	By          string `json:"by"`
	LastUpdated uint64 `json:"updated"`

	IsIgnoreCert   bool               `json:"is_ignore_cert"`
	IsDeleteAfter  bool               `json:"is_delete_after"`
	DaysRetentions uint               `json:"days_retention"`
	Patterns       []string           `json:"patterns"`
	Filters        ArtifactRuleFilter `json:"filters"`
}

type ArtifactRuleFilter struct {
	Tags      []string `json:"tags"`
	Platforms []string `json:"platforms"`
}

type ArtifactRuleName = string

type ArtifactRulesByName = map[ArtifactRuleName]ArtifactRule

type Client struct {
	// contains filtered or unexported fields
}

type ClientOptionLoader interface {
	Load(inOpt ClientOptions) (ClientOptions, error)
}

type ClientOptions struct {
	OID           string
	APIKey        string
	UID           string
	JWT           string
	Environment   string
	Permissions   []string
	JWTExpiryTime time.Duration
}

type ConfigEnvironment struct {
	OID    string `yaml:"oid"`
	UID    string `yaml:"uid"`
	APIKey string `yaml:"api_key"`
}

type ConfigFile struct {
	ConfigEnvironment
	Environments map[string]ConfigEnvironment `yaml:"env"`
}

type CoreDRRule struct {
	Name      string `json:"name,omitempty" yaml:"name,omitempty"`
	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
	Detect    Dict   `json:"detect" yaml:"detect"`
	Response  List   `json:"respond" yaml:"respond"`
	IsEnabled *bool  `json:"is_enabled,omitempty" yaml:"is_enabled,omitempty"`
}

type DRRuleFilter func(map[string]string)

type DRRuleName = string

type DetStats struct {
	Totals map[string]map[string]int `json:"totals"`
}

type Detect struct {
	Author    string  `json:"author"`
	Cat       string  `json:"cat"`
	Detect    Dict    `json:"detect"`
	DetectID  string  `json:"detect_id"`
	DetectMtd Dict    `json:"detect_mtd"`
	Link      string  `json:"link"`
	Namespace string  `json:"namespace"`
	Routing   Routing `json:"routing"`
	Source    string  `json:"source"`
	Ts        int64   `json:"ts"`
}

type Device struct {
	DID          string
	Organization *Organization
}

type Dict map[string]interface{}

type EnvironmentClientOptionLoader struct{}

type Event struct {
	Event     interface{} `json:"event"`
	Routing   Routing     `json:"routing"`
	TimeStamp string      `json:"ts"`
}

type EventContainer struct {
	Event Event `json:"event"`
}

type ExfilEventFilters struct {
	Tags      []string `json:"tags" yaml:"tags"`
	Platforms []string `json:"platforms" yaml:"platforms"`
}

type ExfilRuleEvent struct {
	LastUpdated uint64 `json:"updated,omitempty" yaml:"updated,omitempty"`
	CreatedBy   string `json:"by,omitempty" yaml:"by,omitempty"`

	Events  []string          `json:"events" yaml:"events"`
	Filters ExfilEventFilters `json:"filters" yaml:"filters"`
}

type ExfilRuleName = string

type ExfilRuleWatch struct {
	LastUpdated uint64 `json:"updated,omitempty" yaml:"updated,omitempty"`
	CreatedBy   string `json:"by,omitempty" yaml:"by,omitempty"`

	Event    string            `json:"event" yaml:"event"`
	Value    string            `json:"value" yaml:"value"`
	Path     []string          `json:"path" yaml:"path"`
	Operator string            `json:"operator" yaml:"operator"`
	Filters  ExfilEventFilters `json:"filters" yaml:"filters"`
}

type ExfilRulesType struct {
	Performance Dict                             `json:"perf,omitempty" yaml:"perf,omitempty"`
	Events      map[ExfilRuleName]ExfilRuleEvent `json:"list,omitempty" yaml:"list,omitempty"`
	Watches     map[ExfilRuleName]ExfilRuleWatch `json:"watch,omitempty" yaml:"watch,omitempty"`
}

type ExtensionName = string

type FPRule struct {
	Detection Dict       `json:"data" yaml:"data"`
	OID       string     `json:"oid" yaml:"oid"`
	Name      FPRuleName `json:"name,omitempty" yaml:"name,omitempty"`
}

type FPRuleName = string

type FPRuleOptions struct {
	// Replace rule if it already exists with this name.
	IsReplace bool
}

type FileClientOptionLoader struct {
	// contains filtered or unexported fields
}

type Firehose struct {
	// Organization linked to this firehose
	Organization *Organization

	// Channel to receive the message from
	Messages chan FirehoseMessage

	// Channel to receive messages that could not be parsed
	// It will only be used if the supplied FirehoseOptions require message to be parsed
	ErrorMessages chan FirehoseMessage
	// contains filtered or unexported fields
}

type FirehoseMessage struct {
	// Message content
	RawContent string
	Content    map[string]interface{}
}

type FirehoseOptions struct {
	// IP to listen on
	ListenOnPort uint16

	// Port to listen on
	ListenOnIP net.IP

	// IP that LC should use to connect to this object
	ConnectToPort uint16

	// Port that LC should use to connect to this object
	ConnectTo string

	// Path to the SSL cert file (PEM) to use to receive from the cloud
	// Optional
	// If not set, generates self-signed certificate
	SSLCertPath string

	// Path to the SSL key file (PEM) to use to receive from the cloud
	// Optional
	// If not set, generates self-signed certificate
	SSLCertKeyPath string

	// Maximum number of message to buffer in the queue
	// Once the queue is full, messages will be considered as dropped
	MaxMessageCount int

	// Maximum number of dropped message to buffer
	// Once the queue is full, dropped count will continue to raise but will not be sent to the queue
	MaxErrorMessageCount int

	// If set to true, the data received will be parsed to json
	ParseMessage bool
}

type FirehoseOutputOptions struct {
	// Name to register as an Output
	UniqueName string

	// Type of data received from the cloud as specified in Output
	Type OutputDataType

	// Only receive events from this SensorID.
	SensorID string

	// Only receive events marked with this investigation ID
	// Optional
	InvestigationID string

	// Only receive events from sensor with this tag
	// Optional
	Tag string

	// Only receive detections of this category
	// Optional
	Category string

	// If set to true, delete the firehose output on failure (in LC cloud)
	// Optional
	IsDeleteOnFailure bool

	// If set to true, do not validate certs, useful for self-signed certs.
	IsNotStrictSSL bool
}

type GenericJSON = map[string]interface{}

type HistoricalDetectionsRequest struct {
	// Cat is the category of the detections to fetch
	Cat string `json:"cat"`
	// Cursor is optional for paginated access, set to '-' for first query
	Cursor string `json:"cursor"`
	// Start is the required timestamp in seconds where to stop fetching detections
	Start int `json:"start"`
	// End is the required timestamp in seconds where to stop fetching detections
	End int `json:"end"`
	// Limit maximum number of detections to return
	Limit int `json:"limit"`
}

type HistoricalDetectionsResponse struct {
	Detects    []Detect `json:"detects"`
	NextCursor string   `json:"next_cursor"`
}

type HiveArgs struct {
	HiveName     string
	PartitionKey string
	Key          string
	Data         Dict
	Expiry       *int64
	Enabled      *bool
	Tags         []string
	ETag         *string
}

type HiveClient struct {
	Organization *Organization
}

type HiveConfigData map[string]HiveData

type HiveData struct {
	Data   map[string]interface{} `json:"data" yaml:"data,omitempty"`
	SysMtd SysMtd                 `json:"sys_mtd" yaml:"sys_mtd"`
	UsrMtd UsrMtd                 `json:"usr_mtd" yaml:"usr_mtd"`
}

type HiveInfo struct {
	Name      string `json:"name"`
	Partition string `json:"partition"`
}

type HiveKey = string

type HiveName = string

type HiveResp struct {
	Guid string   `json:"guid"`
	Hive HiveInfo `json:"hive"`
	Name string   `json:"name"`
}

type IncludeLoaderCB = func(parentFilePath string, filePathToInclude string) ([]byte, error)

type InsightObjectBatchResponse struct {
	FromCache   bool `json:"from_cache"`
	Last1Day    Dict `json:"last_1_days"`
	Last7Days   Dict `json:"last_7_days"`
	Last30Days  Dict `json:"last_30_days"`
	Last365Days Dict `json:"last_365_days"`
}

type InsightObjectType string

type InsightObjectTypeInfoType string

type InsightObjectsBatchRequest struct {
	Objects         map[InsightObjectType][]string
	IsCaseSensitive bool
}

type InsightObjectsPerObjectResponse struct {
	ObjectType    InsightObjectType `json:"type"`
	IndicatorName string            `json:"name"`
	FromCache     bool              `json:"from_cache"`
	Last1Day      Dict              `json:"last_1_days"`
	Last7Days     Dict              `json:"last_7_days"`
	Last30Days    Dict              `json:"last_30_days"`
	Last365Days   Dict              `json:"last_365_days"`
}

type InsightObjectsRequest struct {
	IndicatorName   string
	ObjectType      InsightObjectType
	ObjectTypeInfo  InsightObjectTypeInfoType
	IsCaseSensitive bool
	AllowWildcards  bool
	SearchInLogs    bool
}

type InsightObjectsResponse struct {
	ObjectType    InsightObjectType `json:"type"`
	IndicatorName string            `json:"name"`
	FromCache     bool              `json:"from_cache"`
	Last1Day      int64             `json:"last_1_days"`
	Last7Days     int64             `json:"last_7_days"`
	Last30Days    int64             `json:"last_30_days"`
	Last365Days   int64             `json:"last_365_days"`
}

type InstallationKey struct {
	CreatedAt   uint64   `json:"created,omitempty" yaml:"created,omitempty"`
	Description string   `json:"desc,omitempty" yaml:"desc,omitempty"`
	ID          string   `json:"iid,omitempty" yaml:"iid,omitempty"`
	Key         string   `json:"key,omitempty" yaml:"key,omitempty"`
	JsonKey     string   `json:"json_key,omitempty" yaml:"json_key,omitempty"`
	Tags        []string `json:"tags,omitempty" yaml:"tags,omitempty"`
	UsePublicCA bool     `json:"use_public_root_ca,omitempty" yaml:"use_public_root_ca,omitempty"`
}

type InstallationKeyName = string

type IntegrityRule struct {
	Patterns []string            `json:"patterns"`
	Filters  IntegrityRuleFilter `json:"filters"`

	CreatedBy   string `json:"by,omitempty"`
	LastUpdated uint64 `json:"updated,omitempty"`
}

type IntegrityRuleFilter struct {
	Tags      []string `json:"tags" yaml:"tags"`
	Platforms []string `json:"platforms" yaml:"platforms"`
}

type IntegrityRuleName = string

type IntegrityRulesByName = map[IntegrityRuleName]IntegrityRule

type InvalidClientOptionsError struct {
	// contains filtered or unexported fields
}

type LCLogger interface {
	Fatal(msg string)
	Error(msg string)
	Warn(msg string)
	Info(msg string)
	Debug(msg string)
	Trace(msg string)
}

type LCLoggerEmpty struct{}

type LCLoggerGCP struct {
	// contains filtered or unexported fields
}

type LCLoggerZerolog struct {
	// contains filtered or unexported fields
}

type List []interface{}

type NewDRRuleOptions struct {
	// Replace rule if it already exists with this name.
	IsReplace bool
	// Rule namespace, defaults to "general".
	Namespace string
	// Rule is enabled.
	IsEnabled bool
	// Number of seconds before rule auto-deletes.
	TTL int64
}

type NewOrganizationDataResponse struct {
	Oid string `json:"oid,omitempty"`
}

type NewOrganizationResponse struct {
	Data    NewOrganizationDataResponse `json:"data,omitempty"`
	Success bool                        `json:"success,omitempty"`
}

type NoopClientOptionLoader struct{}

type OnlineCount struct {
	Count int64 `json:"count,omitempty"`
}

type OrgConfig struct {
	Version          int                     `json:"version" yaml:"version"`
	Includes         []string                `json:"-" yaml:"-"`
	Resources        orgSyncResources        `json:"resources,omitempty" yaml:"resources,omitempty"`
	Extensions       orgSyncExtensions       `json:"extensions,omitempty" yaml:"extensions,omitempty"`
	DRRules          orgSyncDRRules          `json:"rules,omitempty" yaml:"rules,omitempty"`
	FPRules          orgSyncFPRules          `json:"fps,omitempty" yaml:"fps,omitempty"`
	Outputs          orgSyncOutputs          `json:"outputs,omitempty" yaml:"outputs,omitempty"`
	Integrity        orgSyncIntegrityRules   `json:"integrity,omitempty" yaml:"integrity,omitempty"`
	Exfil            *orgSyncExfilRules      `json:"exfil,omitempty" yaml:"exfil,omitempty"`
	Artifacts        orgSyncArtifacts        `json:"artifact,omitempty" yaml:"artifact,omitempty"`
	OrgValues        orgSyncOrgValues        `json:"org-value,omitempty" yaml:"org-value,omitempty"`
	Hives            orgSyncHives            `json:"hives,omitempty" yaml:"hives,omitempty"`
	InstallationKeys orgSyncInstallationKeys `json:"installation_keys,omitempty" yaml:"installation_keys,omitempty"`
	Yara             *orgSyncYara            `json:"yara,omitempty" yaml:"yara,omitempty"`
}

type OrgSyncArtifactRule struct {
	IsIgnoreCert   bool     `json:"is_ignore_cert" yaml:"is_ignore_cert"`
	IsDeleteAfter  bool     `json:"is_delete_after" yaml:"is_delete_after"`
	DaysRetentions uint     `json:"days_retention" yaml:"days_retention"`
	Patterns       []string `json:"patterns" yaml:"patterns"`
	Tags           []string `json:"tags" yaml:"tags"`
	Platforms      []string `json:"platforms" yaml:"platforms"`
}

type OrgSyncFPRule struct {
	Detection Dict `json:"data" yaml:"data"`
}

type OrgSyncIntegrityRule struct {
	Patterns  []string `json:"patterns" yaml:"patterns"`
	Tags      []string `json:"tags" yaml:"tags"`
	Platforms []string `json:"platforms" yaml:"platforms"`
}

type OrgSyncOperation struct {
	ElementType string `json:"type"`
	ElementName string `json:"name"`
	IsAdded     bool   `json:"is_added"`
	IsRemoved   bool   `json:"is_removed"`
}

type OrgValue = string

type OrgValueInfo struct {
	Name  OrgValueName `json:"config"`
	Value OrgValue     `json:"value"`
}

type OrgValueName = string

type Organization struct {
	// contains filtered or unexported fields
}

type OrganizationInformation struct {
	OID            string            `json:"oid,omitempty"`
	SensorVersion  string            `json:"sensor_version,omitempty"`
	LatestVersions map[string]string `json:"latest_versions,omitempty"`
	NumberOutputs  int64             `json:"n_outputs,omitempty"`
	NumberInstKeys int64             `json:"n_installation_keys,omitempty"`
	NumberRules    int64             `json:"n_rules,omitempty"`
	Name           string            `json:"name,omitempty"`
	SensorQuota    int64             `json:"sensor_quota,omitempty"`
}

type OutputConfig struct {
	Name   string           `json:"name,omitempty"`
	Module OutputModuleType `json:"module"`
	Type   OutputDataType   `json:"type"`

	PrefixData        bool   `json:"is_prefix_data,omitempty,string" yaml:"is_prefix_data,omitempty"`
	DeleteOnFailure   bool   `json:"is_delete_on_failure,omitempty,string" yaml:"is_delete_on_failure,omitempty"`
	NoRouting         bool   `json:"is_no_routing,omitempty,string" yaml:"is_no_routing,omitempty"`
	NoSharding        bool   `json:"is_no_sharding,omitempty,string" yaml:"is_no_sharding,omitempty"`
	PayloadAsString   bool   `json:"is_payload_as_string,omitempty,string" yaml:"is_payload_as_string,omitempty"`
	InvestigationID   string `json:"inv_id,omitempty" yaml:"inv_id,omitempty"`
	Tag               string `json:"tag,omitempty" yaml:"tag,omitempty"`
	Category          string `json:"cat,omitempty" yaml:"cat,omitempty"`
	SensorID          string `json:"sid,omitempty" yaml:"sid,omitempty"`
	Flat              bool   `json:"is_flat,omitempty,string" yaml:"is_flat,omitempty"`
	Directory         string `json:"dir,omitempty" yaml:"dir,omitempty"`
	DestinationHost   string `json:"dest_host,omitempty" yaml:"dest_host,omitempty"`
	SlackToken        string `json:"slack_api_token,omitempty" yaml:"slack_api_token,omitempty"`
	SlackChannel      string `json:"slack_channel,omitempty" yaml:"slack_channel,omitempty"`
	Bucket            string `json:"bucket,omitempty" yaml:"bucket,omitempty"`
	UserName          string `json:"username,omitempty" yaml:"username,omitempty"`
	Password          string `json:"password,omitempty" yaml:"password,omitempty"`
	TLS               bool   `json:"is_tls,omitempty,string" yaml:"is_tls,omitempty"`
	StrictTLS         bool   `json:"is_strict_tls,omitempty,string" yaml:"is_strict_tls,omitempty"`
	NoHeader          bool   `json:"is_no_header,omitempty,string" yaml:"is_no_header,omitempty"`
	StructuredData    string `json:"structured_data,omitempty" yaml:"structured_data,omitempty"`
	SecretKey         string `json:"secret_key,omitempty" yaml:"secret_key,omitempty"`
	EventWhiteList    string `json:"event_white_list,omitempty" yaml:"event_white_list,omitempty"`
	EventBlackList    string `json:"event_black_list,omitempty" yaml:"event_black_list,omitempty"`
	SecondsPerFile    int    `json:"sec_per_file,omitempty,string" yaml:"sec_per_file,omitempty"`
	SampleRate        int    `json:"sample_rate,omitempty,string" yaml:"sample_rate,omitempty"`
	DestinationEmail  string `json:"dest_email,omitempty" yaml:"dest_email,omitempty"`
	FromEmail         string `json:"from_email,omitempty" yaml:"from_email,omitempty"`
	Readable          bool   `json:"is_readable,omitempty,string" yaml:"is_readable,omitempty"`
	Subject           string `json:"subject,omitempty" yaml:"subject,omitempty"`
	StartTLS          bool   `json:"is_starttls,omitempty,string" yaml:"is_starttls,omitempty"`
	AuthLogin         bool   `json:"is_authlogin,omitempty,string" yaml:"is_authlogin,omitempty"`
	Indexing          bool   `json:"is_indexing,omitempty,string" yaml:"is_indexing,omitempty"`
	Compressing       bool   `json:"is_compression,omitempty,string" yaml:"is_compression,omitempty"`
	CategoryBlackList string `json:"cat_black_list,omitempty" yaml:"cat_black_list,omitempty"`
	CategoryWhiteList string `json:"cat_white_list,omitempty" yaml:"cat_white_list,omitempty"`
	RegionName        string `json:"region_name,omitempty" yaml:"region_name,omitempty"`
	EndpointURL       string `json:"endpoint_url,omitempty" yaml:"endpoint_url,omitempty"`
	AuthHeaderName    string `json:"auth_header_name,omitempty" yaml:"auth_header_name,omitempty"`
	AuthHeaderValue   string `json:"auth_header_value,omitempty" yaml:"auth_header_value,omitempty"`
	RoutingTopic      string `json:"routing_topic,omitempty" yaml:"routing_topic,omitempty"`
	LiteralTopic      string `json:"literal_topic,omitempty" yaml:"literal_topic,omitempty"`
	Topic             string `json:"topic,omitempty" yaml:"topic,omitempty"`
	Project           string `json:"project,omitempty" yaml:"project,omitempty"`
	Dataset           string `json:"dataset,omitempty" yaml:"dataset,omitempty"`
	Table             string `json:"table,omitempty" yaml:"table,omitempty"`
	HumioRepo         string `json:"humio_repo,omitempty" yaml:"humio_repo,omitempty"`
	HumioToken        string `json:"humio_api_token,omitempty" yaml:"humio_api_token,omitempty"`
	CustomTransform   string `json:"custom_transform,omitempty" yaml:"custom_transform,omitempty"`
	KeyID             string `json:"key_id,omitempty" yaml:"key_id,omitempty"`
	AttachmentText    string `json:"attachment_text,omitempty" yaml:"attachment_text,omitempty"`
	Message           string `json:"message,omitempty" yaml:"message,omitempty"`
	Color             string `json:"color,omitempty" yaml:"color,omitempty"`
	CloudID           string `json:"cloud_id,omitempty" yaml:"cloud_id,omitempty"`
	Index             string `json:"index,omitempty" yaml:"index,omitempty"`
	Addresses         string `json:"addresses,omitempty" yaml:"addresses,omitempty"`
	APIKey            string `json:"api_key,omitempty" yaml:"api_key,omitempty"`
	Schema            string `json:"schema,omitempty" yaml:"schema,omitempty"`
}

type OutputDataType = string

type OutputModuleType = string

type OutputName = string

type OutputsByName = map[OutputName]OutputConfig

type Payload struct {
	Name      string `json:"name"`
	Oid       string `json:"oid"`
	Size      uint64 `json:"size"`
	By        string `json:"by"`
	CreatedOn uint64 `json:"created"`
}

type PayloadName = string

type Permission struct {
	Name string
}

type RESTError struct {
	// contains filtered or unexported fields
}

type ResourceCategory = string

type ResourceName = string

type ResourcesByCategory map[ResourceCategory]map[ResourceName]struct{}

type Routing struct {
	Arch      int      `json:"arch"`
	DID       string   `json:"did"`
	EventID   string   `json:"event_id"`
	EventTime int64    `json:"event_time"`
	EventType string   `json:"event_type"`
	ExtIP     string   `json:"ext_ip"`
	Hostname  string   `json:"hostname"`
	IID       string   `json:"iid"`
	IntIP     string   `json:"int_ip"`
	ModuleID  int      `json:"moduleid"`
	OID       string   `json:"oid"`
	Parent    string   `json:"parent"`
	Plat      int      `json:"plat"`
	SID       string   `json:"sid"`
	Tags      []string `json:"tags"`
	This      string   `json:"this"`
}

type Sensor struct {
	OID          string `json:"oid"`
	IID          string `json:"iid"`
	SID          string `json:"sid"`
	DID          string `json:"did,omitempty"`
	Platform     uint32 `json:"plat"`
	Architecture uint32 `json:"arch"`

	EnrollTS string `json:"enroll"`
	AliveTS  string `json:"alive"`

	InternalIP string `json:"int_ip"`
	ExternalIP string `json:"ext_ip"`

	Hostname string `json:"hostname"`

	IsIsolated        bool `json:"isolated"`
	ShouldIsolate     bool `json:"should_isolate"`
	IsKernelAvailable bool `json:"kernel"`

	Organization *Organization `json:"-"`

	Device *Device `json:"-"`

	LastError error `json:"-"`

	InvestigationID string `json:"-"`
}

type SiteConnectivityInfo struct {
	URLs  map[string]string `json:"url"`
	Certs map[string]string `json:"certs"`
}

type Stats struct {
	Totals map[string]uint `json:"totals"`
}

type SyncHiveConfigData map[string]SyncHiveData

type SyncHiveData struct {
	Data   map[string]interface{} `json:"data" yaml:"data,omitempty"`
	UsrMtd UsrMtd                 `json:"usr_mtd" yaml:"usr_mtd"`
}

type SyncOptions struct {
	// Force makes the remove Org an exact mirror of the
	// configuration provided, adding and removing.
	// Otherwise elements will only be added, not removed.
	IsForce bool `json:"is_force"`

	// IgnoreInaccessible ignores elements that are
	// locked and cannot be modified by the credentials
	// currently in use.
	IsIgnoreInaccessible bool `json:"ignore_inaccessible"`

	// Only simulate changes to the Org.
	IsDryRun bool `json:"is_dry_run"`

	// Tags used with isForce if tags set force delete will only delete rules with matched tags
	Tags []string `json:"tags"`

	SyncDRRules          bool            `json:"sync_dr"`
	SyncOutputs          bool            `json:"sync_outputs"`
	SyncResources        bool            `json:"sync_resources"`
	SyncExtensions       bool            `json:"sync_extensions"`
	SyncIntegrity        bool            `json:"sync_integrity"`
	SyncFPRules          bool            `json:"sync_fp"`
	SyncExfil            bool            `json:"sync_exfil"`
	SyncArtifacts        bool            `json:"sync_artifacts"`
	SyncOrgValues        bool            `json:"sync_org_values"`
	SyncHives            map[string]bool `json:"sync_hives"`
	SyncInstallationKeys bool            `json:"sync_installation_keys"`
	SyncYara             bool            `json:"sync_yara"`

	IncludeLoader IncludeLoaderCB `json:"-"`
}

type SysMtd struct {
	CreatedBy   string `json:"created_by" yaml:"created_by"`
	Etag        string `json:"etag" yaml:"etag"`
	GUID        string `json:"guid" yaml:"guid"`
	LastAuthor  string `json:"last_author" yaml:"last_author"`
	LastError   string `json:"last_error" yaml:"last_error"`
	LastErrorTs int64  `json:"last_error_ts" yaml:"last_error_ts"`
	LastMod     int64  `json:"last_mod" yaml:"last_mod"`
}

type TagInfo struct {
	Tag     string
	By      string
	AddedTS string
}

type TaskingOptions struct {
	InvestigationID      string
	InvestigationContext string
}

type UsrMtd struct {
	Enabled bool     `json:"enabled" yaml:"enabled"`
	Expiry  int64    `json:"expiry" yaml:"expiry"`
	Tags    []string `json:"tags" yaml:"tags"`
}

type WebhookSender struct {
	// contains filtered or unexported fields
}

type WhoAmIJsonResponse struct {
	UserPermissions *map[string][]string `json:"user_perms:omitempty"`
	Organizations   *[]string            `json:"orgs"`
	Permissions     *[]string            `json:"perms"`
	Identity        *string              `json:"ident"`
}

type YaraRule struct {
	Author      string         `json:"by,omitempty" yaml:"by,omitempty"`
	Filters     YaraRuleFilter `json:"filters,omitempty" yaml:"filters,omitempty"`
	Sources     []string       `json:"sources,omitempty" yaml:"sources,omitempty"`
	LastUpdated int64          `json:"updated,omitempty" yaml:"updated,omitempty"`
}

type YaraRuleFilter struct {
	Tags      []string `json:"tags" yaml:"tags"`
	Platforms []string `json:"platforms" yaml:"platforms"`
}

type YaraRuleName = string

type YaraRules map[YaraRuleName]YaraRule

type YaraSource struct {
	Author      string `json:"by,omitempty" yaml:"by,omitempty"`
	Source      string `json:"source,omitempty" yaml:"source,omitempty"`
	Content     string `json:"content,omitempty" yaml:"content,omitempty"`
	LastUpdated int64  `json:"updated,omitempty" yaml:"updated,omitempty"`
}

type YaraSourceName = string

type YaraSources map[YaraSourceName]YaraSource