security_detection_rule

type ActionFrequencyModel struct {
	NotifyWhen types.String `tfsdk:"notify_when"`
	Summary    types.Bool   `tfsdk:"summary"`
	Throttle   types.String `tfsdk:"throttle"`
}

type ActionModel struct {
	ActionTypeId types.String `tfsdk:"action_type_id"`
	Id           types.String `tfsdk:"id"`
	Params       types.Map    `tfsdk:"params"`
	Group        types.String `tfsdk:"group"`
	Uuid         types.String `tfsdk:"uuid"`
	AlertsFilter types.Map    `tfsdk:"alerts_filter"`
	Frequency    types.Object `tfsdk:"frequency"`
}

type AlertSuppressionModel struct {
	GroupBy               types.List           `tfsdk:"group_by"`
	Duration              customtypes.Duration `tfsdk:"duration"`
	MissingFieldsStrategy types.String         `tfsdk:"missing_fields_strategy"`
}

type CardinalityModel struct {
	Field types.String `tfsdk:"field"`
	Value types.Int64  `tfsdk:"value"`
}

type CommonCreateProps struct {
	Actions                           **[]kbapi.SecurityDetectionsAPIRuleAction
	ResponseActions                   **[]kbapi.SecurityDetectionsAPIResponseAction
	RuleId                            **kbapi.SecurityDetectionsAPIRuleSignatureId
	Enabled                           **kbapi.SecurityDetectionsAPIIsRuleEnabled
	From                              **kbapi.SecurityDetectionsAPIRuleIntervalFrom
	To                                **kbapi.SecurityDetectionsAPIRuleIntervalTo
	Interval                          **kbapi.SecurityDetectionsAPIRuleInterval
	Index                             **[]string
	Author                            **[]string
	Tags                              **[]string
	FalsePositives                    **[]string
	References                        **[]string
	License                           **kbapi.SecurityDetectionsAPIRuleLicense
	Note                              **kbapi.SecurityDetectionsAPIInvestigationGuide
	Setup                             **kbapi.SecurityDetectionsAPISetupGuide
	MaxSignals                        **kbapi.SecurityDetectionsAPIMaxSignals
	Version                           **kbapi.SecurityDetectionsAPIRuleVersion
	ExceptionsList                    **[]kbapi.SecurityDetectionsAPIRuleExceptionList
	AlertSuppression                  **kbapi.SecurityDetectionsAPIAlertSuppression
	RiskScoreMapping                  **kbapi.SecurityDetectionsAPIRiskScoreMapping
	SeverityMapping                   **kbapi.SecurityDetectionsAPISeverityMapping
	RelatedIntegrations               **kbapi.SecurityDetectionsAPIRelatedIntegrationArray
	RequiredFields                    **[]kbapi.SecurityDetectionsAPIRequiredFieldInput
	BuildingBlockType                 **kbapi.SecurityDetectionsAPIBuildingBlockType
	DataViewId                        **kbapi.SecurityDetectionsAPIDataViewId
	Namespace                         **kbapi.SecurityDetectionsAPIAlertsIndexNamespace
	RuleNameOverride                  **kbapi.SecurityDetectionsAPIRuleNameOverride
	TimestampOverride                 **kbapi.SecurityDetectionsAPITimestampOverride
	TimestampOverrideFallbackDisabled **kbapi.SecurityDetectionsAPITimestampOverrideFallbackDisabled
	InvestigationFields               **kbapi.SecurityDetectionsAPIInvestigationFields
	Filters                           **kbapi.SecurityDetectionsAPIRuleFilterArray
	Threat                            **kbapi.SecurityDetectionsAPIThreatArray
	TimelineId                        **kbapi.SecurityDetectionsAPITimelineTemplateId
	TimelineTitle                     **kbapi.SecurityDetectionsAPITimelineTemplateTitle
}

type CommonUpdateProps struct {
	Actions                           **[]kbapi.SecurityDetectionsAPIRuleAction
	ResponseActions                   **[]kbapi.SecurityDetectionsAPIResponseAction
	RuleId                            **kbapi.SecurityDetectionsAPIRuleSignatureId
	Enabled                           **kbapi.SecurityDetectionsAPIIsRuleEnabled
	From                              **kbapi.SecurityDetectionsAPIRuleIntervalFrom
	To                                **kbapi.SecurityDetectionsAPIRuleIntervalTo
	Interval                          **kbapi.SecurityDetectionsAPIRuleInterval
	Index                             **[]string
	Author                            **[]string
	Tags                              **[]string
	FalsePositives                    **[]string
	References                        **[]string
	License                           **kbapi.SecurityDetectionsAPIRuleLicense
	Note                              **kbapi.SecurityDetectionsAPIInvestigationGuide
	Setup                             **kbapi.SecurityDetectionsAPISetupGuide
	MaxSignals                        **kbapi.SecurityDetectionsAPIMaxSignals
	Version                           **kbapi.SecurityDetectionsAPIRuleVersion
	ExceptionsList                    **[]kbapi.SecurityDetectionsAPIRuleExceptionList
	AlertSuppression                  **kbapi.SecurityDetectionsAPIAlertSuppression
	RiskScoreMapping                  **kbapi.SecurityDetectionsAPIRiskScoreMapping
	SeverityMapping                   **kbapi.SecurityDetectionsAPISeverityMapping
	RelatedIntegrations               **kbapi.SecurityDetectionsAPIRelatedIntegrationArray
	RequiredFields                    **[]kbapi.SecurityDetectionsAPIRequiredFieldInput
	BuildingBlockType                 **kbapi.SecurityDetectionsAPIBuildingBlockType
	DataViewId                        **kbapi.SecurityDetectionsAPIDataViewId
	Namespace                         **kbapi.SecurityDetectionsAPIAlertsIndexNamespace
	RuleNameOverride                  **kbapi.SecurityDetectionsAPIRuleNameOverride
	TimestampOverride                 **kbapi.SecurityDetectionsAPITimestampOverride
	TimestampOverrideFallbackDisabled **kbapi.SecurityDetectionsAPITimestampOverrideFallbackDisabled
	InvestigationFields               **kbapi.SecurityDetectionsAPIInvestigationFields
	Filters                           **kbapi.SecurityDetectionsAPIRuleFilterArray
	Threat                            **kbapi.SecurityDetectionsAPIThreatArray
	TimelineId                        **kbapi.SecurityDetectionsAPITimelineTemplateId
	TimelineTitle                     **kbapi.SecurityDetectionsAPITimelineTemplateTitle
}

type EndpointProcessConfigModel struct {
	Field     types.String `tfsdk:"field"`
	Overwrite types.Bool   `tfsdk:"overwrite"`
}

type EqlRuleProcessor struct{}

type EsqlRuleProcessor struct{}

type ExceptionsListModel struct {
	Id            types.String `tfsdk:"id"`
	ListId        types.String `tfsdk:"list_id"`
	NamespaceType types.String `tfsdk:"namespace_type"`
	Type          types.String `tfsdk:"type"`
}

type MachineLearningRuleProcessor struct{}

type NewTermsRuleProcessor struct{}

type OsqueryQueryModel struct {
	Id         types.String `tfsdk:"id"`
	Query      types.String `tfsdk:"query"`
	Platform   types.String `tfsdk:"platform"`
	Version    types.String `tfsdk:"version"`
	Removed    types.Bool   `tfsdk:"removed"`
	Snapshot   types.Bool   `tfsdk:"snapshot"`
	EcsMapping types.Map    `tfsdk:"ecs_mapping"`
}

type QueryRuleProcessor struct{}

type RelatedIntegrationModel struct {
	Package     types.String `tfsdk:"package"`
	Version     types.String `tfsdk:"version"`
	Integration types.String `tfsdk:"integration"`
}

type RequiredFieldModel struct {
	Name types.String `tfsdk:"name"`
	Type types.String `tfsdk:"type"`
	Ecs  types.Bool   `tfsdk:"ecs"`
}

type ResponseActionModel struct {
	ActionTypeId types.String `tfsdk:"action_type_id"`
	Params       types.Object `tfsdk:"params"`
}

type ResponseActionParamsModel struct {
	// Osquery params
	Query        types.String `tfsdk:"query"`
	PackId       types.String `tfsdk:"pack_id"`
	SavedQueryId types.String `tfsdk:"saved_query_id"`
	Timeout      types.Int64  `tfsdk:"timeout"`
	EcsMapping   types.Map    `tfsdk:"ecs_mapping"`
	Queries      types.List   `tfsdk:"queries"`

	// Endpoint params
	Command types.String `tfsdk:"command"`
	Comment types.String `tfsdk:"comment"`
	Config  types.Object `tfsdk:"config"`
}

type RiskScoreMappingModel struct {
	Field     types.String `tfsdk:"field"`
	Operator  types.String `tfsdk:"operator"`
	Value     types.String `tfsdk:"value"`
	RiskScore types.Int64  `tfsdk:"risk_score"`
}

type SavedQueryRuleProcessor struct{}

type SecurityDetectionRuleData struct {
	Id       types.String `tfsdk:"id"`
	SpaceId  types.String `tfsdk:"space_id"`
	RuleId   types.String `tfsdk:"rule_id"`
	Name     types.String `tfsdk:"name"`
	Type     types.String `tfsdk:"type"`
	Query    types.String `tfsdk:"query"`
	Language types.String `tfsdk:"language"`
	Index    types.List   `tfsdk:"index"`
	Enabled  types.Bool   `tfsdk:"enabled"`
	From     types.String `tfsdk:"from"`
	To       types.String `tfsdk:"to"`
	Interval types.String `tfsdk:"interval"`

	// Rule content
	Description         types.String `tfsdk:"description"`
	RiskScore           types.Int64  `tfsdk:"risk_score"`
	RiskScoreMapping    types.List   `tfsdk:"risk_score_mapping"`
	Severity            types.String `tfsdk:"severity"`
	SeverityMapping     types.List   `tfsdk:"severity_mapping"`
	Author              types.List   `tfsdk:"author"`
	Tags                types.List   `tfsdk:"tags"`
	License             types.String `tfsdk:"license"`
	RelatedIntegrations types.List   `tfsdk:"related_integrations"`
	RequiredFields      types.List   `tfsdk:"required_fields"`

	// Optional fields
	FalsePositives types.List   `tfsdk:"false_positives"`
	References     types.List   `tfsdk:"references"`
	Note           types.String `tfsdk:"note"`
	Setup          types.String `tfsdk:"setup"`
	MaxSignals     types.Int64  `tfsdk:"max_signals"`
	Version        types.Int64  `tfsdk:"version"`

	// Read-only fields
	CreatedAt types.String `tfsdk:"created_at"`
	CreatedBy types.String `tfsdk:"created_by"`
	UpdatedAt types.String `tfsdk:"updated_at"`
	UpdatedBy types.String `tfsdk:"updated_by"`
	Revision  types.Int64  `tfsdk:"revision"`

	// EQL-specific fields
	TiebreakerField types.String `tfsdk:"tiebreaker_field"`

	// Machine Learning-specific fields
	AnomalyThreshold     types.Int64 `tfsdk:"anomaly_threshold"`
	MachineLearningJobId types.List  `tfsdk:"machine_learning_job_id"`

	// New Terms-specific fields
	NewTermsFields     types.List   `tfsdk:"new_terms_fields"`
	HistoryWindowStart types.String `tfsdk:"history_window_start"`

	// Saved Query-specific fields
	SavedId types.String `tfsdk:"saved_id"`

	// Threat Match-specific fields
	ThreatIndex         types.List   `tfsdk:"threat_index"`
	ThreatQuery         types.String `tfsdk:"threat_query"`
	ThreatMapping       types.List   `tfsdk:"threat_mapping"`
	ThreatFilters       types.List   `tfsdk:"threat_filters"`
	ThreatIndicatorPath types.String `tfsdk:"threat_indicator_path"`
	ConcurrentSearches  types.Int64  `tfsdk:"concurrent_searches"`
	ItemsPerSearch      types.Int64  `tfsdk:"items_per_search"`

	// Threshold-specific fields
	Threshold types.Object `tfsdk:"threshold"`

	// Optional timeline fields (common across multiple rule types)
	TimelineId    types.String `tfsdk:"timeline_id"`
	TimelineTitle types.String `tfsdk:"timeline_title"`

	// Threat field (common across multiple rule types)
	Threat types.List `tfsdk:"threat"`

	// Actions field (common across all rule types)
	Actions types.List `tfsdk:"actions"`

	// Response actions field (common across all rule types)
	ResponseActions types.List `tfsdk:"response_actions"`

	// Exceptions list field (common across all rule types)
	ExceptionsList types.List `tfsdk:"exceptions_list"`

	// Alert suppression field (common across all rule types)
	AlertSuppression types.Object `tfsdk:"alert_suppression"`

	// Building block type field (common across all rule types)
	BuildingBlockType types.String `tfsdk:"building_block_type"`

	// Data view ID field (common across all rule types)
	DataViewId types.String `tfsdk:"data_view_id"`

	// Namespace field (common across all rule types)
	Namespace types.String `tfsdk:"namespace"`

	// Rule name override field (common across all rule types)
	RuleNameOverride types.String `tfsdk:"rule_name_override"`

	// Timestamp override fields (common across all rule types)
	TimestampOverride                 types.String `tfsdk:"timestamp_override"`
	TimestampOverrideFallbackDisabled types.Bool   `tfsdk:"timestamp_override_fallback_disabled"`

	// Investigation fields (common across all rule types)
	InvestigationFields types.List `tfsdk:"investigation_fields"`

	// Filters field (common across all rule types) - Query and filter context array to define alert conditions
	Filters jsontypes.Normalized `tfsdk:"filters"`
}

type SecurityDetectionRuleTfData struct {
	ThreatMapping types.List `tfsdk:"threat_mapping"`
}

type SecurityDetectionRuleTfDataItem struct {
	Entries types.List `tfsdk:"entries"`
}

type SecurityDetectionRuleTfDataItemEntry struct {
	Field types.String `tfsdk:"field"`
	Type  types.String `tfsdk:"type"`
	Value types.String `tfsdk:"value"`
}

type SeverityMappingModel struct {
	Field    types.String `tfsdk:"field"`
	Operator types.String `tfsdk:"operator"`
	Value    types.String `tfsdk:"value"`
	Severity types.String `tfsdk:"severity"`
}

type ThreatMatchRuleProcessor struct{}

type ThreatModel struct {
	Framework types.String `tfsdk:"framework"`
	Tactic    types.Object `tfsdk:"tactic"`
	Technique types.List   `tfsdk:"technique"`
}

type ThreatSubtechniqueModel struct {
	Id        types.String `tfsdk:"id"`
	Name      types.String `tfsdk:"name"`
	Reference types.String `tfsdk:"reference"`
}

type ThreatTacticModel struct {
	Id        types.String `tfsdk:"id"`
	Name      types.String `tfsdk:"name"`
	Reference types.String `tfsdk:"reference"`
}

type ThreatTechniqueModel struct {
	Id           types.String `tfsdk:"id"`
	Name         types.String `tfsdk:"name"`
	Reference    types.String `tfsdk:"reference"`
	Subtechnique types.List   `tfsdk:"subtechnique"`
}

type ThresholdModel struct {
	Field       types.List  `tfsdk:"field"`
	Value       types.Int64 `tfsdk:"value"`
	Cardinality types.List  `tfsdk:"cardinality"`
}

type ThresholdRuleProcessor struct{}