cdr

type Attributes struct {
	MfaAuthenticated string `json:"mfaAuthenticated,omitempty"`
	CreationDate     string `json:"creationDate,omitempty"`
}

type AzureActivityLogBatch struct {
	Records []AzureActivityLogEvent `json:"records"`
}

type AzureActivityLogEvent struct {
	Time            time.Time `json:"time"`
	ResourceID      string    `json:"resourceId,omitempty"`
	OperationName   string    `json:"operationName,omitempty"`
	Category        string    `json:"category,omitempty"`
	ResultType      string    `json:"resultType,omitempty"`
	ResultSignature string    `json:"resultSignature,omitempty"`
	CorrelationID   string    `json:"correlationId,omitempty"`
	CallerIPAddress string    `json:"callerIpAddress,omitempty"`
	// Caller is the identity that performed the operation (UPN or object ID).
	Caller string `json:"caller,omitempty"`
	Level  string `json:"level,omitempty"`
	// Channels is the Activity Log channel (e.g. "Operation").
	Channels string `json:"channels,omitempty"`
	// SubscriptionID / TenantID / ResourceGroupName are the account identifiers
	// (Azure's equivalents of the AWS accountId/orgId). Present on the
	// management/REST shape; on the Event Hub shape SubscriptionID may need to be
	// derived from ResourceID.
	SubscriptionID    string `json:"subscriptionId,omitempty"`
	TenantID          string `json:"tenantId,omitempty"`
	ResourceGroupName string `json:"resourceGroupName,omitempty"`
	// Authorization is the RBAC context of the operation.
	Authorization *AzureAuthorization `json:"authorization,omitempty"`
	// Claims is the caller's token claims (objectId, appid, ipaddr, tenantid, ...).
	Claims map[string]string `json:"claims,omitempty"`
	// Properties is the operation-specific bag (eventCategory, entity, message,
	// hierarchy, statusCode, responseBody, ...); shape varies by operation.
	Properties map[string]interface{} `json:"properties,omitempty"`
}

type AzureAuthorization struct {
	Scope    string                 `json:"scope,omitempty"`
	Action   string                 `json:"action,omitempty"`
	Evidence map[string]interface{} `json:"evidence,omitempty"`
}

type CdrAlert struct {
	// CloudMetadata is the metadata of the cloud
	CloudMetadata `json:"cloudMetadata,omitempty"`
	// EventData is the event data
	EventData `json:"eventData,omitempty"`
	// RuleName is the name of the rule
	RuleName string `json:"ruleName,omitempty"`
	// RuleID is the unique identifier of the rule
	RuleID string `json:"ruleID,omitempty"`
	// Description is the description of the rule
	Description string `json:"description,omitempty"`
	// Priority is the severity of the rule
	Priority string `json:"priority,omitempty"`
	// Tags is the tags of the rule
	Tags []string `json:"tags,omitempty"`
	// Message is the failure message
	Message string `json:"message,omitempty"`
	// MitreTactic is the MITRE ATT&CK tactic
	MitreTactic string `json:"mitreTactic,omitempty"`
	// MitreTechnique is the MITRE ATT&CK technique
	MitreTechnique string `json:"mitreTechnique,omitempty"`
	// UniqueID is the unique identifier of the alert
	UniqueID string `json:"uniqueID,omitempty"`
}

type CdrAlertBatch struct {
	// CustomerGUID is the unique identifier of the customer
	CustomerGUID string `json:"customerGUID,omitempty"`
	// CloudAccountID is the unique identifier of the cloud account
	CloudAccountID string `json:"cloudAccountID,omitempty"`
	// OrgID is the unique identifier of the organization
	OrgID string `json:"orgID,omitempty"`
	// Provider is the cloud provider
	Provider CloudProvider `json:"provider,omitempty"`
	// RuleFailures is the list of rule failures
	RuleFailures []CdrAlert `json:"ruleFailures,omitempty"`
}

type CloudMetadata struct {
	// Provider is the cloud provider
	Provider CloudProvider `json:"provider,omitempty"`
	// SourceService is the source service (e.g cloudtrail, cloudwatch, etc)
	SourceService CloudService `json:"sourceService,omitempty"`
}

type CloudProvider string

type CloudService string

type CloudTrailEvent struct {
	EventVersion        string                 `json:"eventVersion"`
	UserIdentity        UserIdentity           `json:"userIdentity"`
	EventTime           time.Time              `json:"eventTime"`
	EventSource         string                 `json:"eventSource"`
	EventName           string                 `json:"eventName"`
	AWSRegion           string                 `json:"awsRegion"`
	SourceIPAddress     string                 `json:"sourceIPAddress"`
	UserAgent           string                 `json:"userAgent"`
	ErrorCode           string                 `json:"errorCode,omitempty"`
	ErrorMessage        string                 `json:"errorMessage,omitempty"`
	RequestParameters   map[string]interface{} `json:"requestParameters,omitempty"`
	ResponseElements    map[string]interface{} `json:"responseElements,omitempty"`
	AdditionalEventData map[string]interface{} `json:"additionalEventData,omitempty"`
	RequestID           string                 `json:"requestId"`
	EventID             string                 `json:"eventId"`
	EventType           string                 `json:"eventType"`
	APIVersion          string                 `json:"apiVersion,omitempty"`
	ReadOnly            bool                   `json:"readOnly"`
	ManagementEvent     bool                   `json:"managementEvent"`
	Resources           []Resource             `json:"resources,omitempty"`
	RecipientAccountId  string                 `json:"recipientAccountId,omitempty"`
	SharedEventID       string                 `json:"sharedEventId,omitempty"`
	VpcEndpointId       string                 `json:"vpcEndpointId,omitempty"`
	TLSDetails          *TLSDetails            `json:"tlsDetails,omitempty"`
	ServiceEventDetails map[string]interface{} `json:"serviceEventDetails,omitempty"`
}

type CustomerDetails struct {
	// CustomerGUID is the unique identifier of the customer account
	CustomerGUID string `json:"customerGUID"`
	// AccessKey is the access key of the customer account
	AccessKey string `json:"accessKey"`
}

type EventData struct {
	// AWSCloudTrail cloudtrail event
	AWSCloudTrail *CloudTrailEvent `json:"awsCloudTrail,omitempty"`
	// AzureActivityLog azure activity log event
	AzureActivityLog *AzureActivityLogEvent `json:"azureActivityLog,omitempty"`
	// Target resource
	TargetResource string `json:"targetResource,omitempty"`
	// Identifiers of the alert
	Identifiers *common.Identifiers `json:"identifiers,omitempty"`
}

type OnBehalfOf struct {
	UserId           string `json:"userId"`
	IdentityStoreArn string `json:"identityStoreArn"`
}

type Resource struct {
	ResourceType string `json:"resourceType"`
	ResourceName string `json:"resourceName,omitempty"`
	ResourceARN  string `json:"ARN,omitempty"`
}

type SessionContext struct {
	SessionIssuer *SessionIssuer `json:"sessionIssuer,omitempty"`
	Attributes    *Attributes    `json:"attributes,omitempty"`
}

type SessionIssuer struct {
	Type        string `json:"type"`
	PrincipalID string `json:"principalId"`
	ARN         string `json:"arn"`
	AccountID   string `json:"accountId"`
	UserName    string `json:"userName"`
}

type TLSDetails struct {
	TLSVersion               string `json:"tlsVersion,omitempty"`
	CipherSuite              string `json:"cipherSuite,omitempty"`
	ClientProvidedHostHeader string `json:"clientProvidedHostHeader,omitempty"`
}

type UserIdentity struct {
	Type           string          `json:"type"`
	PrincipalID    string          `json:"principalId"`
	ARN            string          `json:"arn,omitempty"`
	AccountID      string          `json:"accountId"`
	OrgID          string          `json:"orgId,omitempty"`
	AccessKeyID    string          `json:"accessKeyId,omitempty"`
	UserName       string          `json:"userName,omitempty"`
	InvokedBy      string          `json:"invokedBy,omitempty"`
	SessionContext *SessionContext `json:"sessionContext,omitempty"`
	OnBehalfOf     *OnBehalfOf     `json:"onBehalfOf,omitempty"`
	CredentialId   string          `json:"credentialId,omitempty"`
}