parser

type AwsCliDetonatorSchemaJson struct {
	// Script corresponds to the JSON schema field "script".
	Script *string `json:"script,omitempty,omitzero" yaml:"script,omitempty" mapstructure:"script,omitempty"`
}

type DatadogSecuritySignalSchemaJson struct {
	// Name of the Datadog signal to match on (exact match)
	Name string `json:"name" yaml:"name" mapstructure:"name"`

	// Severity of the Datadog signal to match on
	Severity *string `json:"severity,omitempty,omitzero" yaml:"severity,omitempty" mapstructure:"severity,omitempty"`
}

type ElasticCollectorSchemaJson struct {
	// Additional fields to search for. Keys are field names, values can be static
	// strings or template expressions like '{{
	// indicators.terraformOutput.attacker_vm_public_ip }}'
	AdditionalFields ElasticCollectorSchemaJsonAdditionalFields `json:"additionalFields,omitempty,omitzero" yaml:"additionalFields,omitempty" mapstructure:"additionalFields,omitempty"`

	// The Elasticsearch index to search for logs
	Index string `json:"index" yaml:"index" mapstructure:"index"`
}

type ElasticCollectorSchemaJsonAdditionalFields map[string]string

type ElasticInjectorSchemaJson struct {
	// List of documents to inject into Elasticsearch
	Documents []ElasticInjectorSchemaJsonDocumentsElem `json:"documents" yaml:"documents" mapstructure:"documents"`
}

type ElasticInjectorSchemaJsonDocumentsElem struct {
	// Path to a JSON template file containing the document to inject. Supports
	// placeholder substitution
	File *string `json:"file,omitempty,omitzero" yaml:"file,omitempty" mapstructure:"file,omitempty"`

	// The name of the Elasticsearch index to inject the document into
	Index string `json:"index" yaml:"index" mapstructure:"index"`

	// Pack name providing the template (e.g., 'base'). Required when 'template' is
	// used
	Pack *string `json:"pack,omitempty,omitzero" yaml:"pack,omitempty" mapstructure:"pack,omitempty"`

	// Pack template ID (e.g., 'okta.add-group-member'). Requires 'pack' field
	Template *string `json:"template,omitempty,omitzero" yaml:"template,omitempty" mapstructure:"template,omitempty"`

	// Variables to substitute in the template file using {{variable_name}} syntax
	Vars ElasticInjectorSchemaJsonDocumentsElemVars `json:"vars,omitempty,omitzero" yaml:"vars,omitempty" mapstructure:"vars,omitempty"`
}

type ElasticInjectorSchemaJsonDocumentsElemVars map[string]string

type ElasticSecurityAlertSchemaJson struct {
	// Name of the Elastic Security Detection alert rule to match on (exact match on
	// kibana.alert.rule.name.keyword field)
	Name string `json:"name" yaml:"name" mapstructure:"name"`

	// Severity of the Elastic Security Detection alert to match on (matches
	// kibana.alert.severity field)
	Severity *ElasticSecurityAlertSchemaJsonSeverity `json:"severity,omitempty,omitzero" yaml:"severity,omitempty" mapstructure:"severity,omitempty"`
}

type ElasticSecurityAlertSchemaJsonSeverity string

type ParseOptions struct {
	Packs            []config.PackConfig
	EnvVars          map[string]string
	DataDir          string
	TerraformVersion string
	PackLogsEnabled  bool
}

type ParseResult struct {
	Scenarios []*runner.Scenario
	Targets   map[string]string // cloud type → connector name (e.g. "aws" → "prod-aws")
}

type SimrunDetonatorSchemaJson struct {
	// Name of the pack containing the simulation (must match a pack name in
	// config.yaml)
	Pack string `json:"pack" yaml:"pack" mapstructure:"pack"`

	// Parameters to pass to the simulation
	Params SimrunDetonatorSchemaJsonParams `json:"params,omitempty,omitzero" yaml:"params,omitempty" mapstructure:"params,omitempty"`

	// Simulation ID to detonate (e.g., 'test.echo', 'aws.exfil.s3')
	Simulation string `json:"simulation" yaml:"simulation" mapstructure:"simulation"`
}

type SimrunDetonatorSchemaJsonParams map[string]interface{}

type SimrunSchemaJson struct {
	// Metadata information for the scenarios set
	Metadata *SimrunSchemaJsonMetadata `json:"metadata,omitempty,omitzero" yaml:"metadata,omitempty" mapstructure:"metadata,omitempty"`

	// The display name of the vulnerability
	Scenarios []SimrunSchemaJsonScenariosElem `json:"scenarios" yaml:"scenarios" mapstructure:"scenarios"`

	// Connector targets for all scenarios in this file. Keys are connector types
	// (aws, gcp, azure, kubernetes, ssh), values are connector names.
	Targets *SimrunSchemaJsonTargets `json:"targets,omitempty,omitzero" yaml:"targets,omitempty" mapstructure:"targets,omitempty"`
}

type SimrunSchemaJsonMetadata struct {
	// Description of the scenarios set
	Description *string `json:"description,omitempty,omitzero" yaml:"description,omitempty" mapstructure:"description,omitempty"`

	// Name of the scenarios set
	Name *string `json:"name,omitempty,omitzero" yaml:"name,omitempty" mapstructure:"name,omitempty"`
}

type SimrunSchemaJsonScenariosElem struct {
	// How to collect logs produced by the attack activity
	Collect *SimrunSchemaJsonScenariosElemCollect `json:"collect,omitempty,omitzero" yaml:"collect,omitempty" mapstructure:"collect,omitempty"`

	// How to detonate the attack
	Detonate *SimrunSchemaJsonScenariosElemDetonate `json:"detonate,omitempty,omitzero" yaml:"detonate,omitempty" mapstructure:"detonate,omitempty"`

	// Whether this scenario is enabled. Disabled scenarios are skipped during
	// execution.
	Enabled bool `json:"enabled,omitempty,omitzero" yaml:"enabled,omitempty" mapstructure:"enabled,omitempty"`

	// Expectations corresponds to the JSON schema field "expectations".
	Expectations []SimrunSchemaJsonScenariosElemExpectationsElem `json:"expectations" yaml:"expectations" mapstructure:"expectations"`

	// Indicators to be extracted from the scenario
	Indicators *SimrunSchemaJsonScenariosElemIndicators `json:"indicators,omitempty,omitzero" yaml:"indicators,omitempty" mapstructure:"indicators,omitempty"`

	// How to inject data for testing detections
	Inject *SimrunSchemaJsonScenariosElemInject `json:"inject,omitempty,omitzero" yaml:"inject,omitempty" mapstructure:"inject,omitempty"`

	// Description of the scenario
	Name string `json:"name" yaml:"name" mapstructure:"name"`
}

type SimrunSchemaJsonScenariosElemCollect struct {
	// ElasticCollector corresponds to the JSON schema field "elasticCollector".
	ElasticCollector *ElasticCollectorSchemaJson `json:"elasticCollector,omitempty,omitzero" yaml:"elasticCollector,omitempty" mapstructure:"elasticCollector,omitempty"`
}

type SimrunSchemaJsonScenariosElemDetonate struct {
	// AwsCliDetonator corresponds to the JSON schema field "awsCliDetonator".
	AwsCliDetonator *AwsCliDetonatorSchemaJson `json:"awsCliDetonator,omitempty,omitzero" yaml:"awsCliDetonator,omitempty" mapstructure:"awsCliDetonator,omitempty"`

	// SimrunDetonator corresponds to the JSON schema field "simrunDetonator".
	SimrunDetonator *SimrunDetonatorSchemaJson `json:"simrunDetonator,omitempty,omitzero" yaml:"simrunDetonator,omitempty" mapstructure:"simrunDetonator,omitempty"`
}

type SimrunSchemaJsonScenariosElemExpectationsElem struct {
	// DatadogSecuritySignal corresponds to the JSON schema field
	// "datadogSecuritySignal".
	DatadogSecuritySignal *DatadogSecuritySignalSchemaJson `` /* 133-byte string literal not displayed */

	// ElasticSecurityAlert corresponds to the JSON schema field
	// "elasticSecurityAlert".
	ElasticSecurityAlert *ElasticSecurityAlertSchemaJson `` /* 130-byte string literal not displayed */

	// The maximal time to wait for the assertion, written as a Go duration (e.g. 5m)
	Timeout string `json:"timeout,omitempty,omitzero" yaml:"timeout,omitempty" mapstructure:"timeout,omitempty"`
}

type SimrunSchemaJsonScenariosElemIndicators struct {
	// List of static indicator values
	Static []string `json:"static,omitempty,omitzero" yaml:"static,omitempty" mapstructure:"static,omitempty"`

	// List of Terraform output keys to extract
	TerraformOutput []string `json:"terraformOutput,omitempty,omitzero" yaml:"terraformOutput,omitempty" mapstructure:"terraformOutput,omitempty"`
}

type SimrunSchemaJsonScenariosElemInject struct {
	// ElasticInjector corresponds to the JSON schema field "elasticInjector".
	ElasticInjector *ElasticInjectorSchemaJson `json:"elasticInjector,omitempty,omitzero" yaml:"elasticInjector,omitempty" mapstructure:"elasticInjector,omitempty"`
}

type SimrunSchemaJsonTargets struct {
	// Name of the AWS connector to use for cloud credentials
	Aws *string `json:"aws,omitempty,omitzero" yaml:"aws,omitempty" mapstructure:"aws,omitempty"`

	// Name of the Azure connector to use for cloud credentials
	Azure *string `json:"azure,omitempty,omitzero" yaml:"azure,omitempty" mapstructure:"azure,omitempty"`

	// Name of the GCP connector to use for cloud credentials
	Gcp *string `json:"gcp,omitempty,omitzero" yaml:"gcp,omitempty" mapstructure:"gcp,omitempty"`

	// Name of the Kubernetes connector to use for cluster access
	Kubernetes *string `json:"kubernetes,omitempty,omitzero" yaml:"kubernetes,omitempty" mapstructure:"kubernetes,omitempty"`

	// Name of the SSH connector to use for remote command detonation
	Ssh *string `json:"ssh,omitempty,omitzero" yaml:"ssh,omitempty" mapstructure:"ssh,omitempty"`
}