@binalyze/air-sdk 5.23.0 → 5.24.3

package/dist/sdk/typescript-axios/types.gen.d.ts

@@ -119,6 +119,10 @@ export type FilterEndpointDto = {
      * Endpoint issue list
      */
     issue?: Array<Array<unknown>>;
+    /**
+     * Responder update version status list
+     */
+    versionStatus?: Array<'unsupported-os' | 'updating' | 'waiting' | 'failed' | 'scheduled' | 'excluded' | 'update-required' | 'update-available' | 'up-to-date'>;
     /**
      * Online status list
      */
@@ -281,6 +285,44 @@ export type BaseFilterDto = {
      */
     sortBy?: string;
 };
+export type FilterEndpointByExpressionDto = {
+    /**
+     * Number of items per page
+     */
+    pageSize?: number;
+    /**
+     * Page number to retrieve
+     */
+    pageNumber?: number;
+    /**
+     * Sort direction
+     */
+    sortType?: 'ASC' | 'DESC';
+    /**
+     * Field name to sort by
+     */
+    sortBy?: string;
+    /**
+     * Recursive filter expression: [field, operator, value] leaves joined by and/or
+     */
+    filter: Array<unknown>;
+    /**
+     * Organization IDs (required for tenant isolation)
+     */
+    organizationIds: Array<number>;
+    /**
+     * Free-text multi-column search
+     */
+    searchTerm?: string;
+    /**
+     * Case scoping
+     */
+    caseId?: string;
+    /**
+     * Timezone offset (minutes) for task scheduling
+     */
+    timezoneOffset?: number;
+};
 export type FilterEndpointWithTaskCountDto = {
     /**
      * Search text
@@ -338,6 +380,10 @@ export type FilterEndpointWithTaskCountDto = {
      * Endpoint issue list
      */
     issue?: Array<Array<unknown>>;
+    /**
+     * Responder update version status list
+     */
+    versionStatus?: Array<'unsupported-os' | 'updating' | 'waiting' | 'failed' | 'scheduled' | 'excluded' | 'update-required' | 'update-available' | 'up-to-date'>;
     /**
      * Online status list
      */
@@ -466,11 +512,185 @@ export type DeleteEndpointsByFilterApiDto = {
      */
     assertions?: TaskAssertions;
 };
+export type EndpointFilterWithExpressionDto = {
+    /**
+     * Search text
+     */
+    searchTerm?: string;
+    /**
+     * Filter by endpoint/asset name
+     */
+    name?: string;
+    /**
+     * Filter by IP address
+     */
+    ipAddress?: string;
+    /**
+     * Filter by group id
+     */
+    groupId?: string;
+    /**
+     * Filter by full group path
+     */
+    groupFullPath?: string;
+    /**
+     * Filter by label
+     */
+    label?: string;
+    /**
+     * Seen after date
+     */
+    lastSeenAfter?: string;
+    /**
+     * Seen before date
+     */
+    lastSeenBefore?: string;
+    /**
+     * Seen between date range
+     */
+    lastSeenBetween?: DateRangeDto;
+    /**
+     * Registered at date range
+     */
+    registeredAt?: DateRangeDto;
+    /**
+     * Managed status list
+     */
+    managedStatus?: Array<Array<unknown>>;
+    /**
+     * Isolation status list
+     */
+    isolationStatus?: Array<Array<unknown>>;
+    /**
+     * Platform list
+     */
+    platform?: Array<Array<unknown>>;
+    /**
+     * Endpoint issue list
+     */
+    issue?: Array<Array<unknown>>;
+    /**
+     * Responder update version status list
+     */
+    versionStatus?: Array<'unsupported-os' | 'updating' | 'waiting' | 'failed' | 'scheduled' | 'excluded' | 'update-required' | 'update-available' | 'up-to-date'>;
+    /**
+     * Online status list
+     */
+    onlineStatus?: Array<Array<unknown>>;
+    /**
+     * Tags list
+     */
+    tags?: Array<Array<unknown>>;
+    /**
+     * Agent version
+     */
+    version?: string;
+    /**
+     * Policy name
+     */
+    policy?: string;
+    /**
+     * Included endpoint IDs
+     */
+    includedEndpointIds?: Array<string>;
+    /**
+     * Excluded endpoint IDs
+     */
+    excludedEndpointIds?: Array<string>;
+    /**
+     * Organization IDs (comma separated)
+     */
+    organizationIds: Array<number>;
+    /**
+     * Connection route id
+     */
+    connectionRouteId?: number;
+    /**
+     * Filter by presence of a connection route
+     */
+    hasConnectionRoute?: boolean;
+    /**
+     * Filter by case id
+     */
+    caseId?: string;
+    /**
+     * Filter by AWS regions
+     */
+    awsRegions?: Array<Array<unknown>>;
+    /**
+     * Filter by Azure regions
+     */
+    azureRegions?: Array<Array<unknown>>;
+    /**
+     * Filter by GCP regions
+     */
+    gcpRegions?: Array<Array<unknown>>;
+    /**
+     * Filter by agent installation presence
+     */
+    agentInstalled?: boolean;
+    /**
+     * Filter by server endpoints
+     */
+    isServer?: boolean;
+    /**
+     * Filter by endpoints that have evidence
+     */
+    hasEvidence?: boolean;
+    /**
+     * Filter by vendor IDs
+     */
+    vendorIds?: Array<Array<unknown>>;
+    /**
+     * Filter by vendor device IDs
+     */
+    vendorDeviceIds?: Array<Array<unknown>>;
+    /**
+     * Filter by build architecture
+     */
+    buildArch?: Array<Array<unknown>>;
+    /**
+     * Filter endpoints excluded from updates
+     */
+    excludedFromUpdates?: boolean;
+    /**
+     * Filter by serial number
+     */
+    serialNumber?: string;
+    /**
+     * Filter by asset type (endpoint or disk-image only)
+     */
+    assetType?: Array<'disk-image' | 'endpoint' | 'cloud-asset'>;
+    /**
+     * Filter by maintenance mode
+     */
+    maintenanceMode?: boolean;
+    /**
+     * Filter by asset IDs
+     */
+    assetIds?: Array<string>;
+    /**
+     * Filter by IPv4 address (searches netInterfaces ipv4Addrs)
+     */
+    ipv4Address?: string;
+    /**
+     * Filter by IPv6 address (searches netInterfaces ipv6Addrs)
+     */
+    ipv6Address?: string;
+    /**
+     * Filter by MAC address (searches netInterfaces macAddr)
+     */
+    macAddress?: string;
+    /**
+     * Filter by network interface name (searches netInterfaces name)
+     */
+    interfaceName?: string;
+};
 export type AddTagsToEndpointsByFilterDto = {
     /**
      * Filter to select assets/endpoints to tag
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
     /**
      * Tags to add to the selected assets/endpoints
      */
@@ -480,7 +700,7 @@ export type SetMitreAttackDatabaseVersionDto = {
     /**
      * Filter to select assets to update
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
     /**
      * MITRE ATT&CK database version to set as demanded for selected agents
      */
@@ -490,7 +710,7 @@ export type RemoveTagsFromEndpointsByFilterDto = {
     /**
      * Filter to select assets/endpoints to remove tags from
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
     /**
      * Tags to remove from the selected assets/endpoints
      */
@@ -517,9 +737,25 @@ export type SetMaintenanceModeDto = {
      */
     enabled: boolean;
 };
-export type FilterTagsDto = {
+export type CreateAssetTagDto = {
+    /**
+     * Organization that owns the asset tag
+     */
+    organizationId: number;
+    /**
+     * Unique asset tag name within the organization
+     */
+    name: string;
+};
+export type FilterAssetTagsDto = {
     [key: string]: unknown;
 };
+export type RenameAssetTagDto = {
+    /**
+     * New unique asset tag name within the organization
+     */
+    name: string;
+};
 export type TaskResponseDto = {
     /**
      * Unique task identifier
@@ -862,7 +1098,7 @@ export type RebootEndpointDto = {
     /**
      * Filter to select the target assets/endpoints for reboot
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
 };
 export type ShutdownEndpointDto = {
     /**
@@ -872,7 +1108,7 @@ export type ShutdownEndpointDto = {
     /**
      * Filter to select the target assets/endpoints for shutdown
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
 };
 export type RetrieveLogsDto = {
     /**
@@ -902,7 +1138,7 @@ export type SetIsolationOnEndpointDto = {
     /**
      * Filter to select the target assets/endpoints
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
 };
 export type FilterEndpointTasksDto = {
     /**
@@ -921,6 +1157,10 @@ export type FilterEndpointTasksDto = {
      * Task status list
      */
     status?: Array<'scheduled' | 'assigned' | 'processing' | 'completed' | 'failed' | 'expired' | 'cancelled' | 'compressing' | 'uploading' | 'analyzing' | 'partially-completed'>;
+    /**
+     * When true, returns running (processing-phase) non-update tasks that conflict with a responder update
+     */
+    conflictingWithUpdate?: boolean;
     /**
      * Task execution type list
      */
@@ -1667,6 +1907,16 @@ export type ChangePasswordRequestDto = {
      */
     confirmPassword: string;
 };
+export type ResetUserPasswordResponseDto = {
+    /**
+     * Single-use link to hand to the user so they can choose a new password. Treat it as a credential: it is valid once, and only until it expires.
+     */
+    resetUrl: string;
+    /**
+     * Moment the link stops working.
+     */
+    expiresAt: string;
+};
 export type UpdateUserDto = {
     [key: string]: unknown;
 };
@@ -2686,6 +2936,10 @@ export type FilterTaxiiIndicatorsRequestDto = {
      * Maximum confidence score (0–100)
      */
     maxConfidence?: number;
+    /**
+     * Filter by STIX labels (match any selected label)
+     */
+    labels?: Array<string>;
     /**
      * Filter by organization IDs (comma-separated)
      */
@@ -3689,7 +3943,7 @@ export type EvidenceRepositoryInfoDto = {
     /**
      * Repository type
      */
-    type: 'smb' | 'sftp' | 'azure-storage' | 'amazon-s3' | 's3-compatible' | 'ftps' | 'google-cloud-storage';
+    type: 'smb' | 'sftp' | 'azure-storage' | 'amazon-s3' | 's3-compatible' | 'ftps' | 'google-cloud-storage' | 'box';
     /**
      * Host for network repositories
      */
@@ -3746,6 +4000,26 @@ export type EvidenceRepositoryInfoDto = {
      * Google Cloud Storage client email
      */
     gcsClientEmail?: string;
+    /**
+     * Box authentication method
+     */
+    boxAuthMethod?: 'ccg' | 'jwt' | 'developer-token';
+    /**
+     * Box application client ID
+     */
+    boxClientId?: string;
+    /**
+     * Box enterprise ID
+     */
+    boxEnterpriseId?: string;
+    /**
+     * Box user ID
+     */
+    boxUserId?: string;
+    /**
+     * Box destination folder ID. "0" is the All Files root folder.
+     */
+    boxFolderId?: string;
     /**
      * Username who last used the repository
      */
@@ -3806,6 +4080,12 @@ export type ValidateGoogleCloudStorageDto = {
 export type GoogleCloudStorageRepositoryDto = {
     [key: string]: unknown;
 };
+export type ValidateBoxDto = {
+    [key: string]: unknown;
+};
+export type BoxRepositoryDto = {
+    [key: string]: unknown;
+};
 export type FilterNotificationsDto = {
     [key: string]: unknown;
 };
@@ -3859,8 +4139,19 @@ export type UpdateAuditLogEventFilterRequestDto = {
     filteredEventTypes?: Array<string>;
     skipChainedEvents?: boolean;
 };
-export type PolicyFilterEndpointDto = {
-    [key: string]: unknown;
+export type PolicyMatchStatsFilterDto = {
+    /**
+     * Recursive endpoint filter expression
+     */
+    expression: Array<unknown>;
+    /**
+     * Organization IDs used to scope the matched endpoints
+     */
+    organizationIds: Array<number>;
+    /**
+     * Free-text endpoint search
+     */
+    searchTerm?: string;
 };
 export type FilterPoliciesDto = {
     [key: string]: unknown;
@@ -4903,6 +5194,44 @@ export type FilterUserCasesDto = {
      */
     closeReasons?: string;
 };
+export type CreateCaseEndpointsExpressionExportDto = {
+    /**
+     * Number of items per page
+     */
+    pageSize?: number;
+    /**
+     * Page number to retrieve
+     */
+    pageNumber?: number;
+    /**
+     * Sort direction
+     */
+    sortType?: 'ASC' | 'DESC';
+    /**
+     * Field name to sort by
+     */
+    sortBy?: string;
+    /**
+     * Recursive filter expression: [field, operator, value] leaves joined by and/or
+     */
+    filter: Array<unknown>;
+    /**
+     * Organization IDs (required for tenant isolation)
+     */
+    organizationIds: Array<number>;
+    /**
+     * Free-text multi-column search
+     */
+    searchTerm?: string;
+    /**
+     * Requested CSV column order
+     */
+    columnsOrder?: string;
+    /**
+     * Visible CSV columns
+     */
+    exportedColumns?: Array<string>;
+};
 export type CreateCaseDto = {
     /**
      * Name of the case (alphanumeric characters only)
@@ -5055,6 +5384,36 @@ export type FilterCaseTasksDto = {
 export type FilterCaseTaskAssignmentsDto = {
     [key: string]: unknown;
 };
+export type FilterCaseEndpointsByExpressionDto = {
+    /**
+     * Number of items per page
+     */
+    pageSize?: number;
+    /**
+     * Page number to retrieve
+     */
+    pageNumber?: number;
+    /**
+     * Sort direction
+     */
+    sortType?: 'ASC' | 'DESC';
+    /**
+     * Field name to sort by
+     */
+    sortBy?: string;
+    /**
+     * Recursive filter expression: [field, operator, value] leaves joined by and/or
+     */
+    filter: Array<unknown>;
+    /**
+     * Organization IDs (required for tenant isolation)
+     */
+    organizationIds: Array<number>;
+    /**
+     * Free-text multi-column search
+     */
+    searchTerm?: string;
+};
 export type FilterCaseActivitiesDto = {
     /**
      * Activity types to filter
@@ -5779,7 +6138,7 @@ export type AcquireBaselineEvidenceDto = {
     /**
      * Endpoint filter to select targets for baseline acquisition.
      */
-    filter: FilterEndpointDto;
+    filter: EndpointFilterWithExpressionDto;
 };
 export type FilterApiTokenRequestDto = {
     /**
@@ -6025,7 +6384,7 @@ export type CreateInvestigationFlagV2RequestDto = {
      */
     description?: string;
     /**
-     * Owning organization as id or exact name. Optional: defaults to the caller organization when the caller has exactly one, otherwise to the default organization.
+     * Owning organization as id or exact name. Optional: defaults to the caller organization when the caller has exactly one. Multi-organization and all-organization callers must pass it explicitly.
      */
     organization?: number | string;
     /**
@@ -6561,13 +6920,13 @@ export type FilterRecentActivityRequestDto = {
 };
 export type SingleAssetActionV2RequestDto = {
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
 export type SingleAssetVersionUpdateV2RequestDto = {
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6581,7 +6940,7 @@ export type BulkAssetActionV2RequestDto = {
      */
     assets: Array<string>;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6601,7 +6960,7 @@ export type BulkAssetVersionUpdateV2RequestDto = {
      */
     assets: Array<string>;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6611,7 +6970,7 @@ export type BulkAssetMaintenanceV2RequestDto = {
      */
     assets: Array<string>;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6625,7 +6984,7 @@ export type BulkAssetTagsV2RequestDto = {
      */
     tags: Array<string>;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6639,7 +6998,7 @@ export type SetAssetUpdateExclusionV2RequestDto = {
      */
     excludedFromUpdates: boolean;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6653,7 +7012,7 @@ export type SetAssetConnectionRouteV2RequestDto = {
      */
     relayServerId: number | null;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6667,7 +7026,7 @@ export type SetAssetMitreDatabaseVersionV2RequestDto = {
      */
     version: string;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6685,7 +7044,7 @@ export type BulkAssetDeleteV2RequestDto = {
      */
     mode: 'purge' | 'uninstall' | 'purge-and-uninstall';
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6732,6 +7091,10 @@ export type BulkAssetTriageV2RequestDto = {
      * Triage rules to run, referenced by id or exact name (at most 100).
      */
     ruleIds: Array<string>;
+    /**
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
+     */
+    organizations?: number | string | Array<number | string> | 'all';
     /**
      * CPU usage cap for the triage task (percent).
      */
@@ -6793,7 +7156,7 @@ export type ReplaceAssetTagsV2RequestDto = {
      */
     tags: Array<string>;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6803,7 +7166,7 @@ export type UpdateAssetLabelV2RequestDto = {
      */
     label: string | null;
     /**
-     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omit to default to organization id 0. Empty arrays are rejected.
+     * Organizations scope. Polymorphic: pass a single number id, a single string name, an array mixing ids and names, or the literal string "all". Omission follows the endpoint-specific organization policy. Empty arrays are rejected.
      */
     organizations?: number | string | Array<number | string> | 'all';
 };
@@ -6915,53 +7278,25 @@ export type InteractMessageV2FilterRequestDto = {
     /**
      * Filter by session UUIDs.
      */
-    sessionId?: Array<string>;
-    /**
-     * Filter by message status.
-     */
-    status?: Array<'queued' | 'running' | 'completed' | 'failed' | 'cancelled'>;
-    /**
-     * Filter by detected command type.
-     */
-    detectedType?: Array<'airNative' | 'osquery' | 'exec'>;
-    /**
-     * Snippet UUID or name; reserved value "none" matches messages with no snippet.
-     */
-    snippetId?: Array<string>;
+    sessionId?: Array<string>;
     /**
      * Filter by message creation time range.
      */
     createdAt?: InteractDateRangeV2FilterDto;
-    /**
-     * Filter by message completion time range.
-     */
-    completedAt?: InteractDateRangeV2FilterDto;
 };
 export type InteractSessionV2FilterRequestDto = {
     /**
      * Filter by session UUIDs.
      */
     sessionId?: Array<string>;
-    /**
-     * Filter by derived activity state.
-     */
-    activityState?: Array<'active' | 'idle'>;
     /**
      * Filter by session creator username.
      */
     createdBy?: Array<string>;
-    /**
-     * Case UUID or name.
-     */
-    caseId?: Array<string>;
     /**
      * Filter by session creation time range.
      */
     createdAt?: InteractDateRangeV2FilterDto;
-    /**
-     * Filter by last-activity time range.
-     */
-    lastActivityAt?: InteractDateRangeV2FilterDto;
 };
 export type AcquisitionWebhookDto = {
     [key: string]: unknown;
@@ -7102,9 +7437,6 @@ export type GetPresetFiltersByFilterRequestDto = {
      */
     type: 'ENDPOINT' | 'DISK_IMAGE';
 };
-export type IPresetFilter = {
-    [key: string]: unknown;
-};
 export type CreatePresetFilterRequestDto = {
     /**
      * The name of the preset filter
@@ -7117,7 +7449,7 @@ export type CreatePresetFilterRequestDto = {
     /**
      * The filter of the preset filter
      */
-    filter: Array<IPresetFilter>;
+    filter: Array<unknown>;
     /**
      * The organization ID of the preset filter
      */
@@ -7143,7 +7475,7 @@ export type PresetFilterResponseDto = {
     /**
      * The filter of the preset filter
      */
-    filter: Array<IPresetFilter>;
+    filter: Array<unknown>;
     /**
      * The created by of the preset filter
      */
@@ -7157,7 +7489,7 @@ export type UpdatePresetFilterRequestDto = {
     /**
      * The filter of the preset filter
      */
-    filter: Array<IPresetFilter>;
+    filter: Array<unknown>;
 };
 export type FilterAutomationExecutionsDto = {
     [key: string]: unknown;
@@ -7165,6 +7497,12 @@ export type FilterAutomationExecutionsDto = {
 export type AutomationDto = {
     [key: string]: unknown;
 };
+export type CreatedAutomationResponseDto = {
+    /**
+     * Identifier of the created automation, so the caller can address it without a follow-up search.
+     */
+    id: string;
+};
 export type FilterAutomationsDto = {
     [key: string]: unknown;
 };
@@ -7174,6 +7512,12 @@ export type GetAutomationExecutionsFilterDto = {
 export type GetAutomationChangeHistoryFilterDto = {
     [key: string]: unknown;
 };
+export type TriggerSecretResponseDto = {
+    /**
+     * Plain trigger secret. Only a one-way fingerprint of it is stored, so this is the only time it can be read.
+     */
+    secret: string;
+};
 export type CreateFullTextSearchProfileRequestDto = {
     /**
      * The name of the full text search profile
@@ -7713,7 +8057,7 @@ export type DeployCloudAssetsDtoWritable = {
 export type UpdateEndpointConnectionRouteDtoWritable = {
     [key: string]: unknown;
 };
-export type FilterTagsDtoWritable = {
+export type FilterAssetTagsDtoWritable = {
     [key: string]: unknown;
 };
 export type PagingQueryResultDtoWritable = {
@@ -8005,10 +8349,13 @@ export type ValidateGoogleCloudStorageDtoWritable = {
 export type GoogleCloudStorageRepositoryDtoWritable = {
     [key: string]: unknown;
 };
-export type FilterNotificationsDtoWritable = {
+export type ValidateBoxDtoWritable = {
     [key: string]: unknown;
 };
-export type PolicyFilterEndpointDtoWritable = {
+export type BoxRepositoryDtoWritable = {
+    [key: string]: unknown;
+};
+export type FilterNotificationsDtoWritable = {
     [key: string]: unknown;
 };
 export type FilterPoliciesDtoWritable = {
@@ -8269,9 +8616,6 @@ export type CreateDataUsageFilterDtoWritable = {
 export type UpdateDataUsageFilterDtoWritable = {
     [key: string]: unknown;
 };
-export type IPresetFilterWritable = {
-    [key: string]: unknown;
-};
 export type FilterAutomationExecutionsDtoWritable = {
     [key: string]: unknown;
 };
@@ -8621,6 +8965,32 @@ export type AssetsGetManyByFilter2Responses = {
     200: AssetsPageDto;
 };
 export type AssetsGetManyByFilter2Response = AssetsGetManyByFilter2Responses[keyof AssetsGetManyByFilter2Responses];
+export type AssetsGetManyByFilterExpressionData = {
+    body: FilterEndpointByExpressionDto;
+    path?: never;
+    query?: never;
+    url: '/api/public/endpoints/filter-query';
+};
+export type AssetsGetManyByFilterExpressionResponses = {
+    /**
+     * Assets retrieved successfully
+     */
+    200: AssetsPageDto;
+};
+export type AssetsGetManyByFilterExpressionResponse = AssetsGetManyByFilterExpressionResponses[keyof AssetsGetManyByFilterExpressionResponses];
+export type AssetsGetManyByFilterExpression2Data = {
+    body: FilterEndpointByExpressionDto;
+    path?: never;
+    query?: never;
+    url: '/api/public/assets/filter-query';
+};
+export type AssetsGetManyByFilterExpression2Responses = {
+    /**
+     * Assets retrieved successfully
+     */
+    200: AssetsPageDto;
+};
+export type AssetsGetManyByFilterExpression2Response = AssetsGetManyByFilterExpression2Responses[keyof AssetsGetManyByFilterExpression2Responses];
 export type EndpointGetEndpointsWithTaskCountData = {
     body?: never;
     path?: never;
@@ -8648,28 +9018,6 @@ export type EndpointGetEndpointsWithTaskCountData = {
 export type EndpointGetEndpointsWithTaskCountResponses = {
     200: unknown;
 };
-export type EndpointGetEndpointsStats0Data = {
-    body?: never;
-    path?: never;
-    query: {
-        filter: FilterEndpointDto;
-    };
-    url: '/api/public/endpoints/stats';
-};
-export type EndpointGetEndpointsStats0Responses = {
-    200: unknown;
-};
-export type EndpointGetEndpointsStats1Data = {
-    body?: never;
-    path?: never;
-    query: {
-        filter: FilterEndpointDto;
-    };
-    url: '/api/public/assets/stats';
-};
-export type EndpointGetEndpointsStats1Responses = {
-    200: unknown;
-};
 export type EndpointGetDeviceNameConflicts0Data = {
     body?: never;
     path?: never;
@@ -8916,58 +9264,22 @@ export type AssetsSetMitreAttackDatabaseVersion2Responses = {
     201: unknown;
 };
 export type EndpointFilterDisks0Data = {
-    body?: never;
+    body: FilterEndpointByExpressionDto;
     path?: never;
-    query: {
-        /**
-         * Number of items per page
-         */
-        pageSize?: number;
-        /**
-         * Page number to retrieve
-         */
-        pageNumber?: number;
-        /**
-         * Sort direction
-         */
-        sortType?: 'ASC' | 'DESC';
-        /**
-         * Field name to sort by
-         */
-        sortBy?: string;
-        filter: FilterEndpointDto;
-    };
+    query?: never;
     url: '/api/public/endpoints/disks';
 };
 export type EndpointFilterDisks0Responses = {
-    200: unknown;
+    201: unknown;
 };
 export type EndpointFilterDisks1Data = {
-    body?: never;
+    body: FilterEndpointByExpressionDto;
     path?: never;
-    query: {
-        /**
-         * Number of items per page
-         */
-        pageSize?: number;
-        /**
-         * Page number to retrieve
-         */
-        pageNumber?: number;
-        /**
-         * Sort direction
-         */
-        sortType?: 'ASC' | 'DESC';
-        /**
-         * Field name to sort by
-         */
-        sortBy?: string;
-        filter: FilterEndpointDto;
-    };
+    query?: never;
     url: '/api/public/assets/disks';
 };
 export type EndpointFilterDisks1Responses = {
-    200: unknown;
+    201: unknown;
 };
 export type EndpointFilterByPolicyFilter0Data = {
     body: FilterEndpointsByPolicyFilterDtoWritable;
@@ -9261,7 +9573,7 @@ export type EndpointSetMaintenanceMode1Data = {
 export type EndpointSetMaintenanceMode1Responses = {
     201: unknown;
 };
-export type EndpointTagFilterTagsData = {
+export type EndpointTagFilterAssetTagsData = {
     body?: never;
     path?: never;
     query: {
@@ -9281,29 +9593,47 @@ export type EndpointTagFilterTagsData = {
          * Field name to sort by
          */
         sortBy?: string;
-        filter: FilterTagsDtoWritable;
+        filter: FilterAssetTagsDtoWritable;
     };
     url: '/api/public/asset-tags';
 };
-export type EndpointTagFilterTagsResponses = {
+export type EndpointTagFilterAssetTagsResponses = {
     200: unknown;
 };
-export type EndpointTagDeleteAllTagsData = {
+export type EndpointTagCreateAssetTagData = {
+    body: CreateAssetTagDto;
+    path?: never;
+    query?: never;
+    url: '/api/public/asset-tags';
+};
+export type EndpointTagCreateAssetTagResponses = {
+    201: unknown;
+};
+export type EndpointTagDeleteAllAssetTagsData = {
     body?: never;
     path?: never;
     query?: never;
     url: '/api/public/asset-tags/{organizationId}/all';
 };
-export type EndpointTagDeleteAllTagsResponses = {
+export type EndpointTagDeleteAllAssetTagsResponses = {
     200: unknown;
 };
-export type EndpointTagDeleteTagData = {
+export type EndpointTagDeleteAssetTagData = {
     body?: never;
     path?: never;
     query?: never;
     url: '/api/public/asset-tags/{organizationId}/{id}';
 };
-export type EndpointTagDeleteTagResponses = {
+export type EndpointTagDeleteAssetTagResponses = {
+    200: unknown;
+};
+export type EndpointTagRenameAssetTagData = {
+    body: RenameAssetTagDto;
+    path?: never;
+    query?: never;
+    url: '/api/public/asset-tags/{organizationId}/{id}';
+};
+export type EndpointTagRenameAssetTagResponses = {
     200: unknown;
 };
 export type EndpointGroupGetChildGroupsOfGroupData = {
@@ -9944,10 +10274,6 @@ export type TasksV2ApiControllerListTaskAssetsData = {
          * Deep-object asset filter, e.g. filter[searchTerm], filter[status][], filter[subtype][], filter[platform][], filter[os][], filter[tagIds][].
          */
         filter?: ListAssetsV2RequestDto;
-        /**
-         * Organization scope: "all" or comma-separated numeric organization ids. Defaults to all accessible organizations when omitted.
-         */
-        organizations?: unknown;
     };
     url: '/api/v2/tasks/{taskId}/assets';
 };
@@ -10063,6 +10389,10 @@ export type TasksTriageV2ApiControllerListHuntTasksData = {
          * Deep-object hunt filter, e.g. filter[searchTerm], filter[status][], filter[executionType][], filter[ruleIds][], filter[taskCreatedBy][], filter[hasDroneData], filter[hasMatch].
          */
         filter?: HuntTaskFilterV2RequestDto;
+        /**
+         * Organization scope: id, name, mixed comma-separated list, or "all". Defaults to all accessible organizations when omitted.
+         */
+        organizations?: string;
     };
     url: '/api/v2/hunt';
 };
@@ -10985,8 +11315,9 @@ export type UserResetUserPasswordData = {
     url: '/api/public/user-management/users/{id}/reset-password';
 };
 export type UserResetUserPasswordResponses = {
-    201: unknown;
+    200: ResetUserPasswordResponseDto;
 };
+export type UserResetUserPasswordResponse = UserResetUserPasswordResponses[keyof UserResetUserPasswordResponses];
 export type UserCreateApiUserData = {
     body: CreateApiUserDtoWritable;
     path?: never;
@@ -11478,12 +11809,7 @@ export type AcquisitionLibraryDeviceV2ApiControllerListResponse = AcquisitionLib
 export type AcquisitionLibraryDeviceV2ApiControllerCreateData = {
     body: CreateDeviceAcquisitionProfileV2RequestDto;
     path?: never;
-    query?: {
-        /**
-         * Organization scope: "all" or comma-separated numeric organization ids. Defaults to all accessible organizations when omitted.
-         */
-        organizations?: string;
-    };
+    query?: never;
     url: '/api/v2/libraries/acquisition/device';
 };
 export type AcquisitionLibraryDeviceV2ApiControllerCreateErrors = {
@@ -13088,6 +13414,38 @@ export type EvidenceRepositoryUpdateGoogleCloudStorageData = {
 export type EvidenceRepositoryUpdateGoogleCloudStorageResponses = {
     200: unknown;
 };
+export type EvidenceRepositoryValidateBoxData = {
+    body: ValidateBoxDtoWritable;
+    path?: never;
+    query?: never;
+    url: '/api/public/evidences/repositories/validate/box';
+};
+export type EvidenceRepositoryValidateBoxResponses = {
+    201: unknown;
+};
+export type EvidenceRepositoryCreateBoxData = {
+    body: BoxRepositoryDtoWritable;
+    path?: never;
+    query?: never;
+    url: '/api/public/evidences/repositories/box';
+};
+export type EvidenceRepositoryCreateBoxResponses = {
+    201: unknown;
+};
+export type EvidenceRepositoryUpdateBoxData = {
+    body: BoxRepositoryDtoWritable;
+    path: {
+        /**
+         * Evidence repository identifier
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/public/evidences/repositories/box/{id}';
+};
+export type EvidenceRepositoryUpdateBoxResponses = {
+    200: unknown;
+};
 export type NotificationDeleteAllData = {
     body?: never;
     path?: never;
@@ -13222,7 +13580,7 @@ export type AuditLogsUpdateEventFilterResponses = {
     200: unknown;
 };
 export type PolicyGetMatchStatsData = {
-    body: PolicyFilterEndpointDtoWritable;
+    body: PolicyMatchStatsFilterDto;
     path?: never;
     query?: never;
     url: '/api/public/policies/match-stats';
@@ -15007,6 +15365,68 @@ export type CaseExportCaseEndpoints1Data = {
 export type CaseExportCaseEndpoints1Responses = {
     200: unknown;
 };
+export type CasesDownloadAssetsExpressionExportData = {
+    body?: never;
+    path: {
+        id: string;
+    };
+    query: {
+        exportId: string;
+    };
+    url: '/api/public/cases/{id}/endpoints/export-query';
+};
+export type CasesDownloadAssetsExpressionExportResponses = {
+    200: unknown;
+};
+export type CasesCreateAssetsExpressionExportData = {
+    body: CreateCaseEndpointsExpressionExportDto;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/public/cases/{id}/endpoints/export-query';
+};
+export type CasesCreateAssetsExpressionExportResponses = {
+    /**
+     * Export created successfully
+     */
+    200: {
+        exportId?: string;
+        exportUrl?: string;
+    };
+};
+export type CasesCreateAssetsExpressionExportResponse = CasesCreateAssetsExpressionExportResponses[keyof CasesCreateAssetsExpressionExportResponses];
+export type CasesDownloadAssetsExpressionExport2Data = {
+    body?: never;
+    path: {
+        id: string;
+    };
+    query: {
+        exportId: string;
+    };
+    url: '/api/public/cases/{id}/assets/export-query';
+};
+export type CasesDownloadAssetsExpressionExport2Responses = {
+    200: unknown;
+};
+export type CasesCreateAssetsExpressionExport2Data = {
+    body: CreateCaseEndpointsExpressionExportDto;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/public/cases/{id}/assets/export-query';
+};
+export type CasesCreateAssetsExpressionExport2Responses = {
+    /**
+     * Export created successfully
+     */
+    200: {
+        exportId?: string;
+        exportUrl?: string;
+    };
+};
+export type CasesCreateAssetsExpressionExport2Response = CasesCreateAssetsExpressionExport2Responses[keyof CasesCreateAssetsExpressionExport2Responses];
 export type CasesGetData = {
     body?: never;
     path: {
@@ -15286,6 +15706,36 @@ export type CasesGetEndpoints2Responses = {
     200: AssetsPageDto;
 };
 export type CasesGetEndpoints2Response = CasesGetEndpoints2Responses[keyof CasesGetEndpoints2Responses];
+export type CasesGetAssetsByFilterExpressionData = {
+    body: FilterCaseEndpointsByExpressionDto;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/public/cases/{id}/endpoints/filter-query';
+};
+export type CasesGetAssetsByFilterExpressionResponses = {
+    /**
+     * Case assets retrieved successfully
+     */
+    200: AssetsPageDto;
+};
+export type CasesGetAssetsByFilterExpressionResponse = CasesGetAssetsByFilterExpressionResponses[keyof CasesGetAssetsByFilterExpressionResponses];
+export type CasesGetAssetsByFilterExpression2Data = {
+    body: FilterCaseEndpointsByExpressionDto;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/public/cases/{id}/assets/filter-query';
+};
+export type CasesGetAssetsByFilterExpression2Responses = {
+    /**
+     * Case assets retrieved successfully
+     */
+    200: AssetsPageDto;
+};
+export type CasesGetAssetsByFilterExpression2Response = CasesGetAssetsByFilterExpression2Responses[keyof CasesGetAssetsByFilterExpression2Responses];
 export type CasesGetActivitiesData = {
     body?: never;
     path: {
@@ -17588,7 +18038,12 @@ export type InvestigationEvidenceFlagV2ApiControllerFlagEvidenceData = {
          */
         idOrName: string;
     };
-    query?: never;
+    query?: {
+        /**
+         * Organization scope: id, name, mixed comma-separated list, or "all". Defaults to all accessible organizations when omitted.
+         */
+        organizations?: string;
+    };
     url: '/api/v2/investigations/{idOrName}/flag';
 };
 export type InvestigationEvidenceFlagV2ApiControllerFlagEvidenceErrors = {
@@ -17630,7 +18085,12 @@ export type InvestigationEvidenceFlagV2ApiControllerUnflagEvidenceData = {
          */
         idOrName: string;
     };
-    query?: never;
+    query?: {
+        /**
+         * Organization scope: id, name, mixed comma-separated list, or "all". Defaults to all accessible organizations when omitted.
+         */
+        organizations?: string;
+    };
     url: '/api/v2/investigations/{idOrName}/unflag';
 };
 export type InvestigationEvidenceFlagV2ApiControllerUnflagEvidenceErrors = {
@@ -17672,7 +18132,12 @@ export type InvestigationSqlV2ApiControllerGetSchemaData = {
          */
         idOrName: string;
     };
-    query?: never;
+    query?: {
+        /**
+         * Organization scope: id, name, mixed comma-separated list, or "all". Defaults to all accessible organizations when omitted.
+         */
+        organizations?: string;
+    };
     url: '/api/v2/investigations/{idOrName}/schema';
 };
 export type InvestigationSqlV2ApiControllerGetSchemaErrors = {
@@ -17714,7 +18179,12 @@ export type InvestigationSqlV2ApiControllerExecuteSqlQueryData = {
          */
         idOrName: string;
     };
-    query?: never;
+    query?: {
+        /**
+         * Organization scope: id, name, mixed comma-separated list, or "all". Defaults to all accessible organizations when omitted.
+         */
+        organizations?: string;
+    };
     url: '/api/v2/investigations/{idOrName}/sql-query';
 };
 export type InvestigationSqlV2ApiControllerExecuteSqlQueryErrors = {
@@ -19929,7 +20399,7 @@ export type AssetInteractMessageV2ApiControllerListForAssetData = {
         sortType?: 'ASC' | 'DESC';
         sortBy?: 'createdAt';
         /**
-         * Deep-object filter, e.g. filter[sessionId]=<uuid>, filter[status][]=completed, filter[detectedType][]=terminal, filter[snippetId]=<uuid|none>, filter[createdAt][start]/[end], filter[completedAt][start]/[end].
+         * Deep-object filter, e.g. filter[sessionId]=<uuid>, filter[createdAt][from]/[to].
          */
         filter?: InteractMessageV2FilterRequestDto;
     };
@@ -20869,7 +21339,7 @@ export type AssetInteractMessageV2ApiControllerListSessionsForAssetData = {
         sortType?: 'ASC' | 'DESC';
         sortBy?: 'createdAt';
         /**
-         * Deep-object filter, e.g. filter[sessionId]=<uuid>, filter[createdBy]=<username>, filter[createdAt][start]/[end].
+         * Deep-object filter, e.g. filter[sessionId]=<uuid>, filter[createdBy]=<username>, filter[createdAt][from]/[to].
          */
         filter?: InteractSessionV2FilterRequestDto;
     };
@@ -21488,8 +21958,12 @@ export type AutomationHubCreateAutomationData = {
     url: '/api/public/automation-hub';
 };
 export type AutomationHubCreateAutomationResponses = {
-    201: unknown;
+    /**
+     * Automation created successfully
+     */
+    201: CreatedAutomationResponseDto;
 };
+export type AutomationHubCreateAutomationResponse = AutomationHubCreateAutomationResponses[keyof AutomationHubCreateAutomationResponses];
 export type AutomationHubGetActionTypesData = {
     body?: never;
     path?: never;
@@ -21631,6 +22105,21 @@ export type AutomationHubGetAutomationChangeHistoryData = {
 export type AutomationHubGetAutomationChangeHistoryResponses = {
     200: unknown;
 };
+export type AutomationHubGenerateTriggerSecretData = {
+    body?: never;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/public/automation-hub/{id}/trigger/secret';
+};
+export type AutomationHubGenerateTriggerSecretResponses = {
+    /**
+     * Trigger secret generated. The secret is only returned once in this response.
+     */
+    201: TriggerSecretResponseDto;
+};
+export type AutomationHubGenerateTriggerSecretResponse = AutomationHubGenerateTriggerSecretResponses[keyof AutomationHubGenerateTriggerSecretResponses];
 export type AutomationHubEnableAutomationData = {
     body?: never;
     path: {
@@ -21939,12 +22428,7 @@ export type CloudAcquisitionLibraryApiControllerListResponse = CloudAcquisitionL
 export type CloudAcquisitionLibraryApiControllerCreateData = {
     body: CreateCloudAcquisitionProfileV2RequestDto;
     path?: never;
-    query?: {
-        /**
-         * Organization scope: "all" or comma-separated numeric organization ids. Defaults to all accessible organizations when omitted.
-         */
-        organizations?: string;
-    };
+    query?: never;
     url: '/api/v2/libraries/acquisition/cloud';
 };
 export type CloudAcquisitionLibraryApiControllerCreateErrors = {
@@ -22332,12 +22816,7 @@ export type DiskImageAcquisitionLibraryApiControllerListResponse = DiskImageAcqu
 export type DiskImageAcquisitionLibraryApiControllerCreateData = {
     body: CreateDiskImageAcquisitionProfileV2RequestDto;
     path?: never;
-    query?: {
-        /**
-         * Organization scope: "all" or comma-separated numeric organization ids. Defaults to all accessible organizations when omitted.
-         */
-        organizations?: string;
-    };
+    query?: never;
     url: '/api/v2/libraries/acquisition/disk-image';
 };
 export type DiskImageAcquisitionLibraryApiControllerCreateErrors = {