slacklogs

type Actor struct {
	Type string `json:"type" validate:"required,eq=user" description:"The type of actor (always user)"`
	User User   `json:"user" description:"Information about the user"`
}

type App struct {
	ID                string   `json:"id" validate:"required" description:"The id of the app"`
	Name              string   `json:"name,omitempty" description:"The name of the app"`
	Distributed       bool     `json:"is_distributed,omitempty" description:"Whether the app is distributed"`
	DirectoryApproved bool     `json:"is_directory_approved,omitempty" description:"Whether the app is in the approved apps directory"`
	Scopes            []string `json:"scopes,omitempty" description:"The OAuth2 scopes the app requires"`
}

type AuditLog struct {
	ID         string               `json:"id" validate:"required" description:"The event id"`
	DateCreate timestamp.UnixFloat  `json:"date_create" validate:"required" description:"Creation timestamp for the event"`
	Action     string               `` /* 136-byte string literal not displayed */
	Actor      Actor                `` /* 152-byte string literal not displayed */
	Entity     Entity               `` /* 153-byte string literal not displayed */
	Context    Context              `` /* 198-byte string literal not displayed */
	Details    *jsoniter.RawMessage `json:"details" description:"Additional details about the audit log event"`

	parsers.PantherLog
}

type AuditParser struct{}

type Channel struct {
	ID          string   `json:"id" validate:"required" description:"The id of the channel"`
	Name        string   `json:"name,omitempty" description:"The name of the channel"`
	Privacy     string   `json:"privacy,omitempty" description:"The privacy mode of the channel"`
	Shared      bool     `json:"is_shared,omitempty" description:"Whether the channel is shared"`
	OrgShared   bool     `json:"is_org_shared,omitempty" description:"Whether the channel is shared in the organisation"`
	SharedTeams []string `json:"teams_shared_with,omitempty" description:"The teams the channel is shared with"`
}

type Context struct {
	UserAgent string   `json:"ua,omitempty" description:"The user agent used for the action"`
	IPAddress string   `json:"ip_address,omitempty" description:"The ip address the action was performed from"`
	Location  Location `json:"location" description:"The location that the actor took the action on the entity."`
}

type Enterprise struct {
	ID     string `json:"id" validate:"required" description:"The id of the enterprise"`
	Name   string `json:"name,omitempty" description:"The name of the enterprise"`
	Domain string `json:"domain,omitempty" description:"The enterprise domain"`
}

type Entity struct {
	Type       string      `` /* 156-byte string literal not displayed */
	User       *User       `json:"user,omitempty" description:"Information about the affected user"`
	Channel    *Channel    `json:"channel,omitempty" description:"Information about the affected channel"`
	File       *File       `json:"file,omitempty" description:"Information about the affected file"`
	App        *App        `json:"app,omitempty" description:"Information about the affected app"`
	Workspace  *Workspace  `json:"workspace,omitempty" description:"Information about the affected workspace"`
	Enterprise *Enterprise `json:"enterprise,omitempty" description:"Information about the affected enterprise"`
	Workflow   *Workflow   `json:"workflow,omitempty" description:"Information about the affected workflow"`
	Message    *Message    `json:"message,omitempty" description:"Information about the affected message"`
}

type File struct {
	ID       string `json:"id" validate:"required" description:"The id of the file"`
	Name     string `json:"name,omitempty" description:"The filename"`
	Title    string `json:"title,omitempty" description:"The file title"`
	Filetype string `json:"filetype,omitempty" description:"The filetype"`
}

type Location struct {
	Type   string `json:"type" validate:"required" description:"The location type. It will always be either a Workspace or an Enterprise"`
	ID     string `json:"id" validate:"required" description:"The location id"`
	Domain string `json:"domain,omitempty" description:"The location domain"`
	Name   string `json:"name,omitempty" description:"The location name"`
}

type Message struct {
	Team    string `json:"team,omitempty" description:"The team the message was posted in"`
	Channel string `json:"channel,omitempty" description:"The channel the message was posted on"`
	// TODO: Get samples to find the format
	Timestamp string `json:"timestamp,omitempty" description:"The timestamp of the message"`
}

type User struct {
	ID    string `json:"id" validate:"required" description:"The id of the user ('USLACKUSER' if no user performed the action)"`
	Name  string `json:"name,omitempty" description:"The user's display name"`
	Email string `json:"email,omitempty" description:"The user's email"`
	Team  string `json:"team,omitempty" description:"The user's team"`
}

type Workflow struct {
	ID   string `json:"id" validate:"required" description:"The id of the workflow"`
	Name string `json:"name,omitempty" description:"The name of the workflow"`
}

type Workspace struct {
	ID     string `json:"id" validate:"required" description:"The id of the workspace"`
	Name   string `json:"name,omitempty" description:"The name of the workspace"`
	Domain string `json:"domain,omitempty" description:"The workspace domain"`
}