cdr

type Attributes struct {
	MfaAuthenticated string `json:"mfaAuthenticated,omitempty"`
	CreationDate     string `json:"creationDate,omitempty"`
}

type AzureActivityLogBatch struct {
	Records []AzureActivityLogEvent `json:"records"`
}

type AzureActivityLogEvent struct {
	Time            time.Time `json:"time"`
	ResourceID      string    `json:"resourceId,omitempty"`
	OperationName   string    `json:"operationName,omitempty"`
	Category        string    `json:"category,omitempty"`
	ResultType      string    `json:"resultType,omitempty"`
	ResultSignature string    `json:"resultSignature,omitempty"`
	CorrelationID   string    `json:"correlationId,omitempty"`
	CallerIPAddress string    `json:"callerIpAddress,omitempty"`
	// Caller is the identity that performed the operation (UPN or object ID).
	Caller string `json:"caller,omitempty"`
	Level  string `json:"level,omitempty"`
	// Location is the Azure region the operation acted in — the analog of AWS
	// awsRegion. Often "global" for control-plane operations (subscription /
	// resource-group scope), a region (e.g. "eastus") for regional resources.
	Location string `json:"location,omitempty"`
	// Channels is the Activity Log channel (e.g. "Operation").
	Channels string `json:"channels,omitempty"`
	// SubscriptionID / TenantID / ResourceGroupName are the account identifiers
	// (Azure's equivalents of the AWS accountId/orgId). Present on the
	// management/REST shape; on the Event Hub shape SubscriptionID may need to be
	// derived from ResourceID.
	SubscriptionID    string `json:"subscriptionId,omitempty"`
	TenantID          string `json:"tenantId,omitempty"`
	ResourceGroupName string `json:"resourceGroupName,omitempty"`
	// Authorization is the RBAC context of the operation, on the REST/management
	// shape. Empty on the Event Hub shape — use EffectiveAuthorization.
	Authorization *AzureAuthorization `json:"authorization,omitempty"`
	// Claims is the caller's token claims (objectId, appid, ipaddr, tenantid, ...),
	// on the REST/management shape. Empty on the Event Hub shape — use
	// EffectiveClaims.
	Claims map[string]string `json:"claims,omitempty"`
	// Identity is where the Event Hub / diagnostic-settings export nests the
	// authorization and claims. Nil on the REST/management shape.
	Identity *AzureIdentity `json:"identity,omitempty"`
	// Properties is the operation-specific bag (eventCategory, entity, message,
	// hierarchy, statusCode, responseBody, ...). Kept raw on purpose: Activity Log
	// delivers it as an object for most operations and as a STRING containing JSON
	// for some, so a map[string]any field rejects the second form and — because the
	// failure is not local — fails the WHOLE record decode, discarding a detection
	// over a field no rule references. No Go code reads it; rules are evaluated
	// against the raw record JSON, not this struct. See AzureProperties for why the
	// raw form needs its own type rather than a bare json.RawMessage.
	Properties AzureProperties `json:"properties,omitempty" bson:"properties,omitempty"`
}

type AzureAuthorization struct {
	Scope    string                 `json:"scope,omitempty"`
	Action   string                 `json:"action,omitempty"`
	Evidence map[string]interface{} `json:"evidence,omitempty"`
}

type AzureIdentity struct {
	Authorization *AzureAuthorization `json:"authorization,omitempty"`
	Claims        map[string]string   `json:"claims,omitempty"`
}

type AzureProperties json.RawMessage

type CdrAlert struct {
	// CloudMetadata is the metadata of the cloud
	CloudMetadata `json:"cloudMetadata,omitempty"`
	// EventData is the event data
	EventData `json:"eventData,omitempty"`
	// RuleName is the name of the rule
	RuleName string `json:"ruleName,omitempty"`
	// RuleID is the unique identifier of the rule
	RuleID string `json:"ruleID,omitempty"`
	// Description is the description of the rule
	Description string `json:"description,omitempty"`
	// Priority is the severity of the rule
	Priority string `json:"priority,omitempty"`
	// Tags is the tags of the rule
	Tags []string `json:"tags,omitempty"`
	// Message is the failure message
	Message string `json:"message,omitempty"`
	// MitreTactic is the MITRE ATT&CK tactic
	MitreTactic string `json:"mitreTactic,omitempty"`
	// MitreTechnique is the MITRE ATT&CK technique
	MitreTechnique string `json:"mitreTechnique,omitempty"`
	// UniqueID is the unique identifier of the alert
	UniqueID string `json:"uniqueID,omitempty"`
}

type CdrAlertBatch struct {
	// CustomerGUID is the unique identifier of the customer
	CustomerGUID string `json:"customerGUID,omitempty"`
	// CloudAccountID is the unique identifier of the cloud account
	CloudAccountID string `json:"cloudAccountID,omitempty"`
	// OrgID is the unique identifier of the organization
	OrgID string `json:"orgID,omitempty"`
	// Provider is the cloud provider
	Provider CloudProvider `json:"provider,omitempty"`
	// RuleFailures is the list of rule failures
	RuleFailures []CdrAlert `json:"ruleFailures,omitempty"`
	// IsHeartbeat marks a periodic liveness message (no RuleFailures); absent/false = a normal alert batch. See docs/features/cdr-heartbeat-contract.md.
	IsHeartbeat bool `json:"isHeartbeat,omitempty"`
	// ConnectionLevel states account- vs organization-level so the ingester routes keep-alive by intent, not by OrgID presence; empty = legacy inference. See docs/features/cdr-heartbeat-contract.md.
	ConnectionLevel ConnectionLevel `json:"connectionLevel,omitempty"`
	// LogsSeen counts audit records the collector received through its log pipe since start, so the backend can gate Pending -> Connected on evidence rather than liveness; nil = producer does not report it, 0 = reports it and has seen none. Read it with LogsSeenValue. See docs/features/cdr-heartbeat-contract.md.
	LogsSeen *uint64 `json:"logsSeen,omitempty"`
}

type CdrRule struct {
	// RuleID is the unique identifier of the rule.
	RuleID string `json:"ruleID"`
	// Name is the human-readable rule name.
	Name string `json:"name"`
	// Description is the rule description.
	Description string `json:"description,omitempty"`
	// Service is the target log stream the rule evaluates (e.g. activitylogs, cloudtrail).
	Service CloudService `json:"service"`
	// Expression is the CEL rule text the collector compiles and evaluates.
	Expression string `json:"expression"`
	// Priority is the severity of the rule (matches CdrAlert.Priority for pass-through).
	Priority string `json:"priority,omitempty"`
	// MitreTactic is the MITRE ATT&CK tactic.
	MitreTactic string `json:"mitreTactic,omitempty"`
	// MitreTechnique is the MITRE ATT&CK technique.
	MitreTechnique string `json:"mitreTechnique,omitempty"`
	// Tags is the rule tags.
	Tags []string `json:"tags,omitempty"`
	// Message is the alert-message template emitted on a match.
	Message string `json:"message,omitempty"`
	// UniqueID is the templated dedup key for a match.
	UniqueID string `json:"uniqueID,omitempty"`
	// Origin is managed (default) or custom.
	Origin CdrRuleOrigin `json:"origin,omitempty"`
}

type CdrRuleBundle struct {
	// Version is an opaque content hash of the served rule set; it changes if and only if the set
	// changes. Clients must treat it as opaque.
	Version string `json:"version"`
	// Provider is the cloud provider the bundle is scoped to.
	Provider CloudProvider `json:"provider"`
	// GeneratedAt is when the bundle was assembled (informational; not part of Version).
	GeneratedAt time.Time `json:"generatedAt"`
	// Rules is the enabled, provider-scoped CDR rule set for the tenant.
	Rules []CdrRule `json:"rules"`
}

type CdrRuleOrigin string

type CloudMetadata struct {
	// Provider is the cloud provider
	Provider CloudProvider `json:"provider,omitempty"`
	// SourceService is the source service (e.g cloudtrail, cloudwatch, etc)
	SourceService CloudService `json:"sourceService,omitempty"`
}

type CloudProvider string

type CloudService string

type CloudTrailEvent struct {
	EventVersion        string                 `json:"eventVersion"`
	UserIdentity        UserIdentity           `json:"userIdentity"`
	EventTime           time.Time              `json:"eventTime"`
	EventSource         string                 `json:"eventSource"`
	EventName           string                 `json:"eventName"`
	AWSRegion           string                 `json:"awsRegion"`
	SourceIPAddress     string                 `json:"sourceIPAddress"`
	UserAgent           string                 `json:"userAgent"`
	ErrorCode           string                 `json:"errorCode,omitempty"`
	ErrorMessage        string                 `json:"errorMessage,omitempty"`
	RequestParameters   map[string]interface{} `json:"requestParameters,omitempty"`
	ResponseElements    map[string]interface{} `json:"responseElements,omitempty"`
	AdditionalEventData map[string]interface{} `json:"additionalEventData,omitempty"`
	RequestID           string                 `json:"requestId"`
	EventID             string                 `json:"eventId"`
	EventType           string                 `json:"eventType"`
	APIVersion          string                 `json:"apiVersion,omitempty"`
	ReadOnly            bool                   `json:"readOnly"`
	ManagementEvent     bool                   `json:"managementEvent"`
	Resources           []Resource             `json:"resources,omitempty"`
	RecipientAccountId  string                 `json:"recipientAccountId,omitempty"`
	SharedEventID       string                 `json:"sharedEventId,omitempty"`
	VpcEndpointId       string                 `json:"vpcEndpointId,omitempty"`
	TLSDetails          *TLSDetails            `json:"tlsDetails,omitempty"`
	ServiceEventDetails map[string]interface{} `json:"serviceEventDetails,omitempty"`
}

type ConnectionLevel string

type CustomerDetails struct {
	// CustomerGUID is the unique identifier of the customer account
	CustomerGUID string `json:"customerGUID"`
	// AccessKey is the access key of the customer account
	AccessKey string `json:"accessKey"`
}

type EventData struct {
	// AWSCloudTrail cloudtrail event
	AWSCloudTrail *CloudTrailEvent `json:"awsCloudTrail,omitempty"`
	// AzureActivityLog azure activity log event
	AzureActivityLog *AzureActivityLogEvent `json:"azureActivityLog,omitempty"`
	// GcpAuditLog gcp cloud audit log (Admin Activity) event
	GcpAuditLog *GcpAuditLogEvent `json:"gcpAuditLog,omitempty"`
	// Target resource
	TargetResource string `json:"targetResource,omitempty"`
	// Identifiers of the alert
	Identifiers *common.Identifiers `json:"identifiers,omitempty"`
}

type GcpAuditLogEvent struct {
	// InsertID uniquely identifies the log entry; it is stable across Pub/Sub
	// redeliveries and forms half of the dedup key hash(insertId + rule_id).
	InsertID string `json:"insertId,omitempty"`
	// LogName is the fully-qualified log name, e.g.
	// projects/<project>/logs/cloudaudit.googleapis.com%2Factivity.
	LogName string `json:"logName,omitempty"`
	// Timestamp is when the logged action occurred.
	Timestamp time.Time `json:"timestamp"`
	// ReceiveTimestamp is when Cloud Logging received the entry.
	ReceiveTimestamp time.Time `json:"receiveTimestamp"`
	// Severity is the log severity (e.g. "NOTICE").
	Severity string `json:"severity,omitempty"`
	// Resource is the monitored resource the entry is about; resource.labels
	// carries the project_id used to match the alert to a GCP account.
	Resource *GcpMonitoredResource `json:"resource,omitempty"`
	// Operation ties together the entries of a single long-running operation.
	// ABSENT on synchronous events — the detection gate is
	// `!has(operation) || operation.last`.
	Operation *GcpLogEntryOperation `json:"operation,omitempty"`
	// ProtoPayload is the google.cloud.audit.AuditLog record.
	ProtoPayload *GcpAuditLogPayload `json:"protoPayload,omitempty"`
}

type GcpAuditLogPayload struct {
	// Type is the payload @type discriminator
	// ("type.googleapis.com/google.cloud.audit.AuditLog").
	Type string `json:"@type,omitempty"`
	// ServiceName is the API that produced the event (e.g. "iam.googleapis.com").
	ServiceName string `json:"serviceName,omitempty"`
	// MethodName is the API method invoked (e.g.
	// "google.iam.admin.v1.CreateServiceAccount").
	MethodName string `json:"methodName,omitempty"`
	// ResourceName is the resource the request targets. For create-style methods
	// it is the PARENT (e.g. "projects/X"), not the created resource — the real
	// target is in Response["name"]. Do NOT assume ResourceName == affected
	// resource (POC FINDINGS §1c②).
	ResourceName string `json:"resourceName,omitempty"`
	// AuthenticationInfo is the caller identity (principalEmail / principalSubject).
	AuthenticationInfo *GcpAuthenticationInfo `json:"authenticationInfo,omitempty"`
	// AuthorizationInfo is the per-permission authorization decisions for the
	// call; granted:false entries enable denied/attempted-action detection.
	AuthorizationInfo []GcpAuthorizationInfo `json:"authorizationInfo,omitempty"`
	// RequestMetadata carries the caller IP and user agent.
	RequestMetadata *GcpRequestMetadata `json:"requestMetadata,omitempty"`
	// Status is the operation status. Present but EMPTY ({}) on success, so
	// status.code is absent rather than 0 — guard with has() in CEL.
	Status *GcpStatus `json:"status,omitempty"`
	// PolicyViolationInfo carries org-policy / VPC Service Controls violation
	// details when a request is denied by policy — a detection class of its own
	// (org-policy and perimeter denials). Shape varies; kept generic.
	PolicyViolationInfo map[string]interface{} `json:"policyViolationInfo,omitempty"`
	// ResourceLocation is where the resource is/was located (current vs original),
	// e.g. for data-residency-aware rules.
	ResourceLocation *GcpResourceLocation `json:"resourceLocation,omitempty"`
	// NumResponseItems is the number of items returned by a list/query method.
	// protojson encodes int64 as a quoted JSON string ("3"), but the protobuf-JSON
	// spec also accepts a bare number (3) on parse. json.Number accepts BOTH forms;
	// a plain string would fail the whole decode on a bare number — a dropped event
	// for a field nothing depends on.
	//
	// The bson tag is REQUIRED, not decoration. Most audit events omit this field
	// (only list/query methods return items), leaving the zero json.Number — the
	// empty string. The driver encodes json.Number by parsing it, and "" parses as
	// neither int nor float, so it errors; because BSON encoding is not per-field,
	// that error fails the WHOLE document write. The json tag's omitempty does not
	// help: the driver ignores json tags unless useJSONStructTags is set, which it
	// is not by default. Without bson omitempty, no GCP CDR incident can persist.
	//
	// The tag deliberately names NO field. A bson tag sets the stored key, and
	// these types carry none, so every other field here is stored under the
	// driver's default — the lowercased Go name, "numresponseitems". Spelling the
	// name here would rename the field to "numresponseItems" casing, orphaning any
	// value already stored and making this the one camelCase key among its
	// siblings. Renaming a stored field is a migration, not a side effect of a fix.
	NumResponseItems json.Number `json:"numResponseItems,omitempty" bson:",omitempty"`
	// Request is the operation-specific request bag; shape varies by method.
	Request map[string]interface{} `json:"request,omitempty"`
	// Response is the operation-specific response bag; for create-style methods
	// Response["name"] is the created resource (the real target).
	Response map[string]interface{} `json:"response,omitempty"`
	// Metadata is where several services (GKE, BigQuery, Cloud SQL, ...) put their
	// audit detail instead of Request / Response; shape varies by service.
	Metadata map[string]interface{} `json:"metadata,omitempty"`
}

type GcpAuthenticationInfo struct {
	// PrincipalEmail is the caller's email (user or service account).
	PrincipalEmail string `json:"principalEmail,omitempty"`
	// PrincipalSubject is the prefixed principal ("user:..." / "serviceAccount:..."),
	// which cleanly distinguishes user from service-account callers for
	// common.Identifiers normalization (POC FINDINGS §1c⑤).
	PrincipalSubject string `json:"principalSubject,omitempty"`
	// ServiceAccountKeyName is the resource name of the service-account key used
	// to authenticate, when a long-lived key was used rather than short-lived
	// credentials — a standing detection / compliance signal.
	ServiceAccountKeyName string `json:"serviceAccountKeyName,omitempty"`
	// ServiceAccountDelegationInfo is the identity-delegation (impersonation)
	// chain. Service-account impersonation (iam.serviceAccounts.getAccessToken /
	// actAs) is the canonical GCP privilege-escalation path; this is what lets an
	// alert say who impersonated whom. Absent unless impersonation occurred (so
	// not seen in the human-auth POC run — its absence there is not evidence of
	// rarity in the field).
	ServiceAccountDelegationInfo []GcpServiceAccountDelegationInfo `json:"serviceAccountDelegationInfo,omitempty"`
	// OAuthInfo carries the OAuth client that made the call, when present.
	OAuthInfo *GcpOAuthInfo `json:"oauthInfo,omitempty"`
}

type GcpAuthorizationInfo struct {
	Permission     string `json:"permission,omitempty"`
	PermissionType string `json:"permissionType,omitempty"`
	Granted        bool   `json:"granted,omitempty"`
	Resource       string `json:"resource,omitempty"`
	// ResourceAttributes describes the resource the permission was checked
	// against. Its Type (e.g. "iam.googleapis.com/ServiceAccount") is the kind of
	// thing touched — the field to fall back on when ResourceName is the parent
	// rather than the target (POC FINDINGS §1c②); mirrors AWS Resource.ResourceType.
	ResourceAttributes *GcpResourceAttributes `json:"resourceAttributes,omitempty"`
}

type GcpFirstPartyPrincipal struct {
	PrincipalEmail string `json:"principalEmail,omitempty"`
}

type GcpLogEntryOperation struct {
	ID       string `json:"id,omitempty"`
	Producer string `json:"producer,omitempty"`
	First    bool   `json:"first,omitempty"`
	Last     bool   `json:"last,omitempty"`
}

type GcpMonitoredResource struct {
	Type   string            `json:"type,omitempty"`
	Labels map[string]string `json:"labels,omitempty"`
}

type GcpOAuthInfo struct {
	OAuthClientID string `json:"oauthClientId,omitempty"`
}

type GcpRequestMetadata struct {
	CallerIP                string `json:"callerIp,omitempty"`
	CallerSuppliedUserAgent string `json:"callerSuppliedUserAgent,omitempty"`
	// CallerNetwork is the VPC network the call originated from, when applicable.
	CallerNetwork string `json:"callerNetwork,omitempty"`
	// RequestAttributes is the request context (time, auth, method, ...); shape
	// varies, kept generic.
	RequestAttributes map[string]interface{} `json:"requestAttributes,omitempty"`
	// DestinationAttributes is the request destination context; shape varies,
	// kept generic.
	DestinationAttributes map[string]interface{} `json:"destinationAttributes,omitempty"`
}

type GcpResourceAttributes struct {
	Service string `json:"service,omitempty"`
	Name    string `json:"name,omitempty"`
	Type    string `json:"type,omitempty"`
}

type GcpResourceLocation struct {
	CurrentLocations  []string `json:"currentLocations,omitempty"`
	OriginalLocations []string `json:"originalLocations,omitempty"`
}

type GcpServiceAccountDelegationInfo struct {
	// PrincipalSubject is the delegated principal at this link.
	PrincipalSubject string `json:"principalSubject,omitempty"`
	// FirstPartyPrincipal is set when a first-party (Google) identity delegated.
	FirstPartyPrincipal *GcpFirstPartyPrincipal `json:"firstPartyPrincipal,omitempty"`
	// ThirdPartyPrincipal is set for third-party (external) delegation; shape
	// varies, kept generic.
	ThirdPartyPrincipal map[string]interface{} `json:"thirdPartyPrincipal,omitempty"`
}

type GcpStatus struct {
	Code    int    `json:"code,omitempty"`
	Message string `json:"message,omitempty"`
}

type OnBehalfOf struct {
	UserId           string `json:"userId"`
	IdentityStoreArn string `json:"identityStoreArn"`
}

type Resource struct {
	ResourceType string `json:"resourceType"`
	ResourceName string `json:"resourceName,omitempty"`
	ResourceARN  string `json:"ARN,omitempty"`
}

type SessionContext struct {
	SessionIssuer *SessionIssuer `json:"sessionIssuer,omitempty"`
	Attributes    *Attributes    `json:"attributes,omitempty"`
}

type SessionIssuer struct {
	Type        string `json:"type"`
	PrincipalID string `json:"principalId"`
	ARN         string `json:"arn"`
	AccountID   string `json:"accountId"`
	UserName    string `json:"userName"`
}

type TLSDetails struct {
	TLSVersion               string `json:"tlsVersion,omitempty"`
	CipherSuite              string `json:"cipherSuite,omitempty"`
	ClientProvidedHostHeader string `json:"clientProvidedHostHeader,omitempty"`
}

type UserIdentity struct {
	Type           string          `json:"type"`
	PrincipalID    string          `json:"principalId"`
	ARN            string          `json:"arn,omitempty"`
	AccountID      string          `json:"accountId"`
	OrgID          string          `json:"orgId,omitempty"`
	AccessKeyID    string          `json:"accessKeyId,omitempty"`
	UserName       string          `json:"userName,omitempty"`
	InvokedBy      string          `json:"invokedBy,omitempty"`
	SessionContext *SessionContext `json:"sessionContext,omitempty"`
	OnBehalfOf     *OnBehalfOf     `json:"onBehalfOf,omitempty"`
	CredentialId   string          `json:"credentialId,omitempty"`
}