threat

type ActorService struct {
	// contains filtered or unexported fields
}

type CreateActorInput struct {
	TenantID         string
	Name             string
	Aliases          []string
	Description      string
	ActorType        string
	Sophistication   string
	Motivation       string
	CountryOfOrigin  string
	MitreGroupID     string
	TTPs             []threatactor.TTP
	TargetIndustries []string
	TargetRegions    []string
	Tags             []string
}

type EPSSScore struct {
	CVE   string  `json:"cve"`
	EPSS  float64 `json:"epss"`
	Model string  `json:"model"`
	Date  string  `json:"date"`
}

type EPSSStats struct {
	TotalScores       int `json:"total_scores"`
	HighRiskCount     int `json:"high_risk_count"`     // EPSS > 0.1 (10%)
	CriticalRiskCount int `json:"critical_risk_count"` // EPSS > 0.3 (30%)
}

type IntelRefresher struct {
	// contains filtered or unexported fields
}

type IntelService struct {
	// contains filtered or unexported fields
}

type IntelSyncResult struct {
	Source        string
	RecordsSynced int
	DurationMs    int64
	Error         error
}

type KEVEntry struct {
	CVEID                      string `json:"cveID"`
	VendorProject              string `json:"vendorProject"`
	Product                    string `json:"product"`
	VulnerabilityName          string `json:"vulnerabilityName"`
	DateAdded                  string `json:"dateAdded"`
	ShortDescription           string `json:"shortDescription"`
	RequiredAction             string `json:"requiredAction"`
	DueDate                    string `json:"dueDate"`
	KnownRansomwareCampaignUse string `json:"knownRansomwareCampaignUse"`
}

type KEVEscalator interface {
	// EscalateKEVFindings sets severity to 'critical' for open findings
	// whose cve_id is in the kev_catalog. Returns the number of escalated findings.
	EscalateKEVFindings(ctx context.Context) (int, error)
}

type KEVStats struct {
	TotalEntries            int `json:"total_entries"`
	PastDueCount            int `json:"past_due_count"`
	RecentlyAddedLast30Days int `json:"recently_added_last_30_days"`
	RansomwareRelatedCount  int `json:"ransomware_related_count"`
}

type ThreatIntelStats struct {
	EPSS         *EPSSStats            `json:"epss"`
	KEV          *KEVStats             `json:"kev"`
	SyncStatuses []*ThreatIntelSyncDTO `json:"sync_statuses"`
}

type ThreatIntelSyncDTO struct {
	Source         string  `json:"source"`
	Enabled        bool    `json:"enabled"`
	LastSyncAt     *string `json:"last_sync_at,omitempty"`
	LastSyncStatus string  `json:"last_sync_status"`
	RecordsSynced  int     `json:"records_synced"`
	LastError      *string `json:"last_error,omitempty"`
	NextSyncAt     *string `json:"next_sync_at,omitempty"`
}