schema

type Base struct {
	// Timestamp is the date/time when an event originated. This is the date/time extracted from the event, typically
	// representing when the event was generated by the source. If the timestamp cannot be derived from the original
	// event, the date/time the event was encountered by the pipeline should be used.
	Timestamp *time.Time `json:"@timestamp,omitempty"`

	// Tags is an optional list of keywords used to tag a schema type.
	Tags string `json:"tags,omitempty"`

	// Labels is an optional collection of key/value pairs for adding metadata to a schema type.
	Labels map[string]any `json:"labels,omitempty"`

	// Message is the message from the source event, if any.
	Message string `json:"message,omitempty"`
}

type DataStream struct {
	Type      string `json:"type"`
	Dataset   string `json:"dataset"`
	Namespace string `json:"namespace"`
}

type Event struct {
	Action   string        `json:"action,omitempty"`
	Category []string      `json:"category"`
	Code     string        `json:"code,omitempty"`
	Created  *time.Time    `json:"created,omitempty"`
	Dataset  string        `json:"dataset,omitempty"`
	Duration time.Duration `json:"duration,omitempty"`
	End      *time.Time    `json:"end,omitempty"`
	Hash     string        `json:"hash,omitempty"`
	ID       string        `json:"id,omitempty"`
	Ingested *time.Time    `json:"ingested,omitempty"`
	Kind     string        `json:"kind"`
	Module   string        `json:"module,omitempty"`
	Outcome  string        `json:"outcome,omitempty"`
	Provider string        `json:"provider,omitempty"`
	Reason   string        `json:"reason,omitempty"`
	Sequence int64         `json:"sequence,omitempty"`
	Severity int64         `json:"severity,omitempty"`
	Start    *time.Time    `json:"start,omitempty"`
	Type     []string      `json:"type"`
}

type File struct {
	Accessed   *time.Time `json:"accessed,omitempty" swaggerignore:"true"`
	Attributes []string   `json:"attributes,omitempty" swaggerignore:"true"`
	CID        string     `json:"cid,omitempty"`
	Ctime      *time.Time `json:"ctime,omitempty"`
	Created    *time.Time `json:"created,omitempty"`
	Directory  string     `json:"directory,omitempty"`
	Extension  string     `json:"extension,omitempty" swaggerignore:"true"`
	GID        string     `json:"gid,omitempty" swaggerignore:"true"`
	Group      string     `json:"group,omitempty" swaggerignore:"true"`
	Hash       *Hash      `json:"hash,omitempty"`
	Inode      string     `json:"inode,omitempty" swaggerignore:"true"`
	MimeType   string     `json:"mime_type,omitempty"`
	Mode       string     `json:"mode,omitempty" swaggerignore:"true"`
	Mtime      *time.Time `json:"mtime,omitempty"`
	Name       string     `json:"name,omitempty"`
	Owner      string     `json:"owner,omitempty" swaggerignore:"true"`
	Path       string     `json:"path,omitempty"`
	Size       int64      `json:"size,omitempty"`
	Type       string     `json:"type,omitempty"`
	UID        string     `json:"uid,omitempty" swaggerignore:"true"`
	URL        string     `json:"url,omitempty" swaggerignore:"true"`
	// contains filtered or unexported fields

} // @name File

type Group struct {
	ID     string `json:"id"`
	Name   string `json:"name"`
	Domain string `json:"domain"`
}

type Hash struct {
	Adler32 string `json:"adler32,omitempty" swaggerignore:"true"`
	Md5     string `json:"md5,omitempty"`
	Sha1    string `json:"sha1,omitempty" swaggerignore:"true"`
	Sha256  string `json:"sha256,omitempty"`
	Sha512  string `json:"sha512,omitempty"`
	Ssdeep  string `json:"ssdeep,omitempty" swaggerignore:"true"`

} // @name Hash

type Log struct {
	Level              string         `json:"level,omitempty"`
	FilePath           string         `json:"file.path,omitempty"`
	Logger             string         `json:"logger,omitempty"`
	OriginFileName     string         `json:"origin.file.name,omitempty"`
	OriginFileLine     int64          `json:"origin.file.line,omitempty"`
	OriginFunction     string         `json:"origin.function,omitempty"`
	Syslog             map[string]any `json:"syslog,omitempty"`
	SyslogSeverityCode int64          `json:"syslog.severity.code,omitempty"`
	SyslogSeverityName string         `json:"syslog.severity.name,omitempty"`
	SyslogFacilityCode int64          `json:"syslog.facility.code,omitempty"`
	SyslogFacilityName string         `json:"syslog.facility.name,omitempty"`
	SyslogPriority     int64          `json:"syslog.priority,omitempty"`
}

type Network struct {
	// Application is the name given to an application level protocol. This can be arbitrarily assigned for things like
	// microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations
	// where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.
	Application string `json:"application"`

	// Bytes Total bytes transferred in both directions.
	Bytes int64 `json:"bytes"`

	// CommunityID is a hash of source and destination IPs and ports, as well as the protocol  used in a communication.
	// This is a tool-agnostic standard to identify flows. See: https://github.com/corelight/community-id-spec.
	CommunityID string `json:"community_id"`

	// Direction of the network traffic.
	//
	// Recommended values:
	//
	//   * ingress
	//   * egress
	//   * inbound
	//   * outbound
	//   * internal
	//   * external
	//   * unknown
	//
	// When mapping events from a host-based monitoring context, populate this field from the host's point of view,
	// using the values "ingress" or "egress".
	//
	// When mapping events from a network or perimeter-based monitoring context, populate this field from the point of
	// view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".
	//
	// Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two
	// hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that
	// are external to the perimeter. This could for example be useful for ISPs  or VPN service providers.
	Direction string `json:"direction"`

	// ForwardedIP is the host IP address when the source IP address is the proxy.
	ForwardedIP string `json:"forwarded_ip"`

	// IANANumber is the IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
	// This aligns well with NetFlow and sFlow  related logs which use the IANA protocol number.
	IANANumber string `json:"iana_number"`

	// Inner are the fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN
	// tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when
	// sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)
	Inner map[string]any `json:"inner"`

	// Name given by operators to sections of their network.
	Name string `json:"name"`

	// Packets is the total packets transferred in both directions.
	Packets int64 `json:"packets"`

	// Protocol is the L7 network protocol name (e.g. support, lumberjack).
	Protocol string `json:"protocol"`

	// Transport is same as Network.IANANumber, but instead using the Keyword name of the transport layer
	// (udp, tcp, ipv6-icmp, etc.)
	Transport string `json:"transport"`

	// Type is the network layer of the OSI Model (ipv4, ipv6, ipsec, pim, etc.).
	Type string `json:"type"`
}

type Organization struct {
	Active       bool           `json:"active"`
	Created      *time.Time     `json:"created"`
	BillingEmail sql.NullString `json:"billing_email,omitempty"`
	ID           uuid.UUID      `json:"id" swaggerignore:"true"`
	Name         string         `json:"name,omitempty"`
	StoragePath  []string       `json:"storage_path,omitempty"`
	Updated      *time.Time     `json:"updated"`
}

type OrganizationUser struct {
	OrgID  uuid.UUID `json:"org_id"`
	UserID uuid.UUID `json:"user_id"`
	Role   string    `json:"role"`
}

type Service struct {
	Address     string `json:"address,omitempty"`
	Environment string `json:"environment,omitempty"`
	EphemeralID string `json:"ephemeral_id,omitempty"`
	ID          string `json:"id,omitempty"`
	Name        string `json:"name,omitempty"`
	NodeName    string `json:"node.name,omitempty"`
	State       string `json:"state,omitempty"`
	Type        string `json:"type,omitempty"`
	Version     string `json:"version,omitempty"`
}

type Team struct {
	ID      uuid.UUID  `json:"id"`
	Name    string     `json:"name"`
	Creator uuid.UUID  `json:"creator"`
	Created *time.Time `json:"created"`
	Updated *time.Time `json:"updated"`
}

type TeamUser struct {
	ID      uuid.UUID  `json:"id"`
	UserID  uuid.UUID  `json:"user_id"`
	TeamID  uuid.UUID  `json:"team_id"`
	Created *time.Time `json:"created"`
	Updated *time.Time `json:"updated"`
}

type User struct {
	Active        bool           `json:"active" swaggerignore:"true"`
	Created       *time.Time     `json:"created"`
	DisplayName   sql.NullString `json:"display_name,omitempty"`
	Email         string         `json:"email"`
	EmailVerified bool           `json:"email_verified" swaggerignore:"true"`
	FullName      sql.NullString `json:"full_name,omitempty"`
	ID            uuid.UUID      `json:"id" swaggerignore:"true"`
	LastLogin     *time.Time     `json:"last_login,omitempty"`
	Updated       *time.Time     `json:"updated"`
}