detective

type Account struct {
	AccountID    string
	EmailAddress string
}

type DatasourcePackageIngestDetail struct {
	IngestState string
}

type FlaggedIPAddressDetail struct {
	IPAddress string
	Reason    string
}

type Graph struct {
	CreatedTime time.Time
	Tags        map[string]string
	Arn         string
}

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

type ImpossibleTravelDetail struct {
	StartingIPAddress string
	StartingLocation  string
	EndingIPAddress   string
	EndingLocation    string
	HourlyTimeDelta   int32
}

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

type Indicator struct {
	Detail        IndicatorDetail
	IndicatorType string
}

type IndicatorDetail struct {
	FlaggedIPAddress    *FlaggedIPAddressDetail
	ImpossibleTravel    *ImpossibleTravelDetail
	NewASO              *NewASODetail
	NewGeolocation      *NewGeolocationDetail
	NewUserAgent        *NewUserAgentDetail
	RelatedFinding      *RelatedFindingDetail
	RelatedFindingGroup *RelatedFindingGroupDetail
	TTPsObserved        *TTPsObservedDetail
}

type Investigation struct {
	CreatedTime     time.Time
	ScopeStartTime  time.Time
	ScopeEndTime    time.Time
	GraphARN        string
	InvestigationID string
	EntityARN       string
	EntityType      string
	Severity        string
	State           string
	Status          string
}

type InvestigationDetail struct {
	CreatedTime     time.Time
	EntityARN       string
	EntityType      string
	InvestigationID string
	Severity        string
	State           string
	Status          string
}

type MemberDetail struct {
	InvitedTime                   time.Time
	UpdatedTime                   time.Time
	DatasourcePackageIngestStates map[string]string
	AccountID                     string
	AdministratorID               string
	EmailAddress                  string
	GraphARN                      string
	InvitationType                string
	Status                        string
}

type MembershipDatasources struct {
	DatasourcePackageIngestStates map[string]string
	AccountID                     string
	GraphARN                      string
}

type NewASODetail struct {
	ASO                   string
	IsNewForEntireAccount bool
}

type NewGeolocationDetail struct {
	IPAddress             string
	Location              string
	IsNewForEntireAccount bool
}

type NewUserAgentDetail struct {
	UserAgent             string
	IsNewForEntireAccount bool
}

type OrgAdmin struct {
	DelegationTime time.Time
	AccountID      string
	GraphARN       string
}

type Provider struct{}

type RelatedFindingDetail struct {
	Arn       string
	Type      string
	IPAddress string
}

type RelatedFindingGroupDetail struct {
	ID string
}

type StorageBackend interface {
	CreateGraph(tags map[string]string) (*Graph, error)
	DeleteGraph(graphARN string) error
	ListGraphs(maxResults int32, nextToken string) ([]*Graph, string, error)

	CreateMembers(graphARN string, accounts []Account, message string) ([]*MemberDetail, []UnprocessedAccount, error)
	DeleteMembers(graphARN string, accountIDs []string) ([]string, []UnprocessedAccount, error)
	GetMembers(graphARN string, accountIDs []string) ([]*MemberDetail, []UnprocessedAccount, error)
	ListMembers(graphARN string, maxResults int32, nextToken string) ([]*MemberDetail, string, error)

	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	AcceptInvitation(graphARN string) error
	RejectInvitation(graphARN string) error
	DisassociateMembership(graphARN string) error
	ListInvitations(maxResults int32, nextToken string) ([]*MemberDetail, string, error)

	StartInvestigation(graphARN, entityARN string, scopeStart, scopeEnd time.Time) (string, error)
	GetInvestigation(graphARN, investigationID string) (*Investigation, error)
	ListInvestigations(graphARN string, maxResults int32, nextToken string) ([]*InvestigationDetail, string, error)
	UpdateInvestigationState(graphARN, investigationID, state string) error
	ListIndicators(
		graphARN, investigationID, indicatorType string,
		maxResults int32,
		nextToken string,
	) ([]*Indicator, string, error)

	ListDatasourcePackages(
		graphARN string,
		maxResults int32,
		nextToken string,
	) (map[string]DatasourcePackageIngestDetail, string, error)
	UpdateDatasourcePackages(graphARN string, packages []string) error
	BatchGetGraphMemberDatasources(
		graphARN string,
		accountIDs []string,
	) ([]MembershipDatasources, []UnprocessedAccount, error)
	BatchGetMembershipDatasources(graphARNs []string) ([]MembershipDatasources, []UnprocessedGraph, error)

	EnableOrganizationAdminAccount(accountID string) error
	DisableOrganizationAdminAccount() error
	ListOrganizationAdminAccounts(maxResults int32, nextToken string) ([]*OrgAdmin, string, error)
	DescribeOrganizationConfiguration(graphARN string) (bool, error)
	UpdateOrganizationConfiguration(graphARN string, autoEnable bool) error

	StartMonitoringMember(graphARN, accountID string) error

	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

type TTPsObservedDetail struct {
	Tactic          string
	Procedure       string
	APIName         string
	IPAddress       string
	APISuccessCount int64
	APIFailureCount int64
}

type UnprocessedAccount struct {
	AccountID string
	Reason    string
}

type UnprocessedGraph struct {
	GraphArn string
	Reason   string
}