shadow_ai

type AIServiceInfo struct {
	Name     string   `json:"name"`     // "ChatGPT", "Claude", "Gemini"
	Vendor   string   `json:"vendor"`   // "OpenAI", "Anthropic", "Google"
	Domains  []string `json:"domains"`  // ["*.openai.com", "chat.openai.com"]
	Category string   `json:"category"` // "llm", "image_gen", "code_assist"
}

type AISignatureDB struct {
	// contains filtered or unexported fields
}

type APIKeyPattern struct {
	Name    string         `json:"name"`
	Pattern *regexp.Regexp `json:"-"`
	Entropy float64        `json:"min_entropy"`
}

type ApprovalEngine struct {
	// contains filtered or unexported fields
}

type ApprovalRequest struct {
	ID         string             `json:"id"`
	DocID      string             `json:"doc_id"`
	UserID     string             `json:"user_id"`
	Tier       string             `json:"tier"`
	DataClass  DataClassification `json:"data_class"`
	Status     string             `json:"status"` // "pending", "approved", "denied", "expired"
	ApprovedBy string             `json:"approved_by,omitempty"`
	DeniedBy   string             `json:"denied_by,omitempty"`
	Reason     string             `json:"reason,omitempty"`
	CreatedAt  time.Time          `json:"created_at"`
	ExpiresAt  time.Time          `json:"expires_at"`
	ResolvedAt time.Time          `json:"resolved_at,omitempty"`
}

type ApprovalStatus string

type ApprovalTier struct {
	Name           string             `yaml:"name" json:"name"`
	DataClass      DataClassification `yaml:"data_class" json:"data_class"`
	ApprovalNeeded []string           `yaml:"approval_needed" json:"approval_needed"` // ["manager"], ["manager", "soc"], ["ciso"]
	SLA            time.Duration      `yaml:"sla" json:"sla"`
	AutoApprove    bool               `yaml:"auto_approve" json:"auto_approve"`
}

type BehavioralAlert struct {
	UserID      string  `json:"user_id"`
	AnomalyType string  `json:"anomaly_type"` // "access_spike", "new_destination", "data_volume_spike"
	Current     float64 `json:"current"`
	Baseline    float64 `json:"baseline"`
	ZScore      float64 `json:"z_score"`
	Destination string  `json:"destination,omitempty"`
	Severity    string  `json:"severity"`
}

type BehavioralDetector struct {
	// contains filtered or unexported fields
}

type BlockRequest struct {
	TargetType string        `json:"target_type"` // "ip", "domain", "user"
	Target     string        `json:"target"`
	Duration   time.Duration `json:"duration"`
	Reason     string        `json:"reason"`
	BlockedBy  string        `json:"blocked_by"` // RBAC user
}

type CheckPointEnforcer struct {
	// contains filtered or unexported fields
}

type ComplianceReport struct {
	GeneratedAt       time.Time `json:"generated_at"`
	Period            string    `json:"period"` // "monthly", "quarterly"
	TotalInteractions int       `json:"total_interactions"`
	BlockedAttempts   int       `json:"blocked_attempts"`
	ApprovedReviews   int       `json:"approved_reviews"`
	PIIDetected       int       `json:"pii_detected"`
	SecretsDetected   int       `json:"secrets_detected"`
	AuditComplete     bool      `json:"audit_complete"`
	Regulations       []string  `json:"regulations"` // ["GDPR", "SOC2", "EU AI Act"]
}

type CrowdStrikeController struct {
	// contains filtered or unexported fields
}

type DataClassification string

type DetectionMethod string

type DocBridge struct {
	// contains filtered or unexported fields
}

type DocReviewStatus string

type EndpointController interface {
	// IsolateHost quarantines a host from the network.
	IsolateHost(ctx context.Context, hostname string) error

	// ReleaseHost removes host isolation.
	ReleaseHost(ctx context.Context, hostname string) error

	// KillProcess terminates a process on a remote host.
	KillProcess(ctx context.Context, hostname string, pid int) error

	// QuarantineFile moves a file to quarantine on a remote host.
	QuarantineFile(ctx context.Context, hostname string, path string) error

	// HealthCheck verifies the EDR API is reachable.
	HealthCheck(ctx context.Context) error

	// Vendor returns the vendor identifier (e.g., "crowdstrike", "sentinelone", "defender").
	Vendor() string
}

type FallbackManager struct {
	// contains filtered or unexported fields
}

type HealthChecker struct {
	// contains filtered or unexported fields
}

type Initializer interface {
	Initialize(config map[string]interface{}) error
}

type IntegrationConfig struct {
	Plugins             []PluginConfig `yaml:"plugins" json:"plugins"`
	FallbackStrategy    string         `yaml:"fallback_strategy" json:"fallback_strategy"`         // "detect_only" | "alert_only"
	HealthCheckInterval time.Duration  `yaml:"health_check_interval" json:"health_check_interval"` // default: 30s
}

type NetworkDetector struct {
	// contains filtered or unexported fields
}

type NetworkEnforcer interface {
	// BlockIP blocks an IP address for the given duration.
	BlockIP(ctx context.Context, ip string, duration time.Duration, reason string) error

	// BlockDomain blocks a domain name.
	BlockDomain(ctx context.Context, domain string, reason string) error

	// UnblockIP removes an IP block.
	UnblockIP(ctx context.Context, ip string) error

	// UnblockDomain removes a domain block.
	UnblockDomain(ctx context.Context, domain string) error

	// HealthCheck verifies the firewall API is reachable.
	HealthCheck(ctx context.Context) error

	// Vendor returns the vendor identifier (e.g., "checkpoint", "cisco", "paloalto").
	Vendor() string
}

type NetworkEvent struct {
	User        string            `json:"user"`
	Hostname    string            `json:"hostname"`
	Destination string            `json:"destination"` // Domain or IP
	Port        int               `json:"port"`
	HTTPHeaders map[string]string `json:"http_headers,omitempty"`
	TLSJA3      string            `json:"tls_ja3,omitempty"`
	DataSize    int64             `json:"data_size"`
	Timestamp   time.Time         `json:"timestamp"`
}

type PIIMatch struct {
	Type     string `json:"type"`     // "email", "phone", "ssn", "credit_card", "passport"
	Location int    `json:"location"` // Character offset
	Length   int    `json:"length"`
	Masked   string `json:"masked"` // Redacted value, e.g., "j***@example.com"
}

type PluginConfig struct {
	Type    PluginType             `yaml:"type" json:"type"`
	Vendor  string                 `yaml:"vendor" json:"vendor"`
	Enabled bool                   `yaml:"enabled" json:"enabled"`
	Config  map[string]interface{} `yaml:"config" json:"config"`
}

type PluginFactory func() interface{}

type PluginHealth struct {
	Vendor      string        `json:"vendor"`
	Type        PluginType    `json:"type"`
	Status      PluginStatus  `json:"status"`
	LastCheck   time.Time     `json:"last_check"`
	Consecutive int           `json:"consecutive_failures"`
	Latency     time.Duration `json:"latency"`
	LastError   string        `json:"last_error,omitempty"`
}

type PluginRegistry struct {
	// contains filtered or unexported fields
}

type PluginStatus string

type PluginType string

type ScanResult struct {
	DocumentID   string             `json:"document_id"`
	Status       DocReviewStatus    `json:"status"`
	PIIFound     []PIIMatch         `json:"pii_found,omitempty"`
	SecretsFound []SecretMatch      `json:"secrets_found,omitempty"`
	DataClass    DataClassification `json:"data_classification"`
	ContentHash  string             `json:"content_hash"`
	ScannedAt    time.Time          `json:"scanned_at"`
	SizeBytes    int                `json:"size_bytes"`
}

type SecretMatch struct {
	Type     string `json:"type"` // "api_key", "password", "token", "private_key"
	Location int    `json:"location"`
	Length   int    `json:"length"`
	Provider string `json:"provider"` // "OpenAI", "AWS", "GitHub", etc.
}

type ShadowAIController struct {
	// contains filtered or unexported fields
}

type ShadowAIEvent struct {
	ID              string            `json:"id"`
	UserID          string            `json:"user_id"`
	Hostname        string            `json:"hostname"`
	Destination     string            `json:"destination"` // Target AI service domain/IP
	AIService       string            `json:"ai_service"`  // "chatgpt", "claude", "gemini", etc.
	DetectionMethod DetectionMethod   `json:"detection_method"`
	Action          string            `json:"action"`      // "blocked", "allowed", "pending"
	EnforcedBy      string            `json:"enforced_by"` // Plugin vendor that enforced
	DataSize        int64             `json:"data_size"`   // Bytes sent to AI
	Timestamp       time.Time         `json:"timestamp"`
	Metadata        map[string]string `json:"metadata,omitempty"`
}

type ShadowAIStats struct {
	TimeRange    string         `json:"time_range"` // "24h", "7d", "30d"
	Total        int            `json:"total_attempts"`
	Blocked      int            `json:"blocked"`
	Approved     int            `json:"approved"`
	Pending      int            `json:"pending"`
	ByService    map[string]int `json:"by_service"`
	ByDepartment map[string]int `json:"by_department"`
	TopViolators []Violator     `json:"top_violators"`
}

type UserBehaviorProfile struct {
	UserID            string    `json:"user_id"`
	AccessFrequency   float64   `json:"access_frequency"`     // Requests per hour
	DataVolumePerHour float64   `json:"data_volume_per_hour"` // Bytes per hour
	KnownDestinations []string  `json:"known_destinations"`
	UpdatedAt         time.Time `json:"updated_at"`
}

type Violator struct {
	UserID   string `json:"user_id"`
	Attempts int    `json:"attempts"`
}

type WebGateway interface {
	// BlockURL adds a URL to the blocklist.
	BlockURL(ctx context.Context, url string, reason string) error

	// UnblockURL removes a URL from the blocklist.
	UnblockURL(ctx context.Context, url string) error

	// BlockCategory blocks an entire URL category (e.g., "Artificial Intelligence").
	BlockCategory(ctx context.Context, category string) error

	// HealthCheck verifies the gateway API is reachable.
	HealthCheck(ctx context.Context) error

	// Vendor returns the vendor identifier (e.g., "zscaler", "netskope", "squid").
	Vendor() string
}

type ZscalerGateway struct {
	// contains filtered or unexported fields
}