@cyvest/cyvest-js 5.4.1 → 6.1.0

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  */
 type InvestigationName = string | null;
 /**
- * Security level classification for checks, observables, and threat intelligence.
+ * Security level classification for findings, observables, and threat intelligence.
  *
  * Levels are ordered from lowest (NONE) to highest (MALICIOUS) severity.
  */
@@ -22,6 +22,11 @@ type Reason = string | null;
 type Tool = string | null;
 type ObjectType = string | null;
 type ObjectKey = string | null;
+type Subtype = string | null;
+type Namespace = string | null;
+type Subtype1 = string | null;
+type Namespace1 = string | null;
+type Aliases = ObservableAlias[];
 type ThreatIntels = string[];
 /**
  * Direction of a relationship between observables.
@@ -29,16 +34,23 @@ type ThreatIntels = string[];
 type RelationshipDirection = "outbound" | "inbound" | "bidirectional";
 type Relationships = Relationship[];
 /**
- * Checks that currently link to this observable (navigation-only).
+ * Findings that currently link to this observable (navigation-only).
  */
-type CheckLinks = string[];
+type FindingLinks = string[];
 /**
- * Controls how a Check↔Observable link propagates across merged investigations.
+ * Controls how a Finding↔Observable link propagates across merged investigations.
  */
 type PropagationMode = "LOCAL_ONLY" | "GLOBAL";
 type ObservableLinks = ObservableLink[];
+type EvidenceLinks = EvidenceLink[];
+type ExternalId = string | null;
+type Uri = string | null;
+/**
+ * Findings that currently link to this evidence (navigation-only).
+ */
+type FindingLinks1 = string[];
 type Taxonomies = Taxonomy[];
-type Checks1 = string[];
+type Findings1 = string[];
 /**
  * Root observable type used during data extraction.
  */
@@ -58,6 +70,7 @@ type ScoreMode = "max" | "sum";
  * schemas matching the actual model_dump() output.
  */
 interface CyvestInvestigation {
+    schema_version?: "6.0.0";
     /**
      * Stable investigation identity (ULID).
      */
@@ -75,7 +88,8 @@ interface CyvestInvestigation {
     whitelists: Whitelists;
     audit_log?: AuditLog;
     observables: Observables;
-    checks: Checks;
+    findings: Findings;
+    evidences: Evidences;
     threat_intels: ThreatIntels1;
     enrichments: Enrichments;
     tags: Tags;
@@ -122,11 +136,13 @@ interface Observables {
 /**
  * Represents a cyber observable (IP, URL, domain, hash, etc.).
  *
- * Observables can be linked to threat intelligence, checks, and other observables
+ * Observables can be linked to threat intelligence, findings, and other observables
  * through relationships.
  */
 interface Observable {
     type: string;
+    subtype?: Subtype;
+    namespace?: Namespace;
     value: string;
     internal: boolean;
     whitelisted: boolean;
@@ -134,16 +150,29 @@ interface Observable {
     extra: Extra;
     score: number;
     level: Level;
+    aliases: Aliases;
+    occurrence_count?: number;
     threat_intels: ThreatIntels;
     relationships: Relationships;
     key: string;
-    check_links: CheckLinks;
+    finding_links: FindingLinks;
     score_display: string;
     [k: string]: unknown;
 }
 interface Extra {
     [k: string]: unknown;
 }
+/**
+ * Source observable identity attached to a canonical observable.
+ */
+interface ObservableAlias {
+    type: string;
+    subtype?: Subtype1;
+    namespace?: Namespace1;
+    value: string;
+    count?: number;
+    [k: string]: unknown;
+}
 /**
  * Represents a relationship between observables.
  */
@@ -154,19 +183,19 @@ interface Relationship {
     [k: string]: unknown;
 }
 /**
- * Checks keyed by their unique key.
+ * Findings keyed by their unique key.
  */
-interface Checks {
-    [k: string]: Check;
+interface Findings {
+    [k: string]: Finding;
 }
 /**
  * Represents a verification step in the investigation.
  *
- * A check validates a specific aspect of the data under investigation
+ * A finding validates a specific aspect of the data under investigation
  * and contributes to the overall investigation score.
  */
-interface Check {
-    check_name: string;
+interface Finding {
+    finding_name: string;
     description: string;
     comment: string;
     extra: Extra1;
@@ -174,6 +203,7 @@ interface Check {
     level: Level;
     origin_investigation_id: string;
     observable_links: ObservableLinks;
+    evidence_links: EvidenceLinks;
     key: string;
     score_display: string;
     [k: string]: unknown;
@@ -182,12 +212,44 @@ interface Extra1 {
     [k: string]: unknown;
 }
 /**
- * Edge metadata for a Check↔Observable association.
+ * Edge metadata for a Finding↔Observable association.
  */
 interface ObservableLink {
     observable_key: string;
     propagation_mode?: PropagationMode;
 }
+/**
+ * Edge metadata for a Finding↔Evidence association.
+ */
+interface EvidenceLink {
+    evidence_key: string;
+}
+/**
+ * Evidence objects keyed by their unique key.
+ */
+interface Evidences {
+    [k: string]: Evidence;
+}
+/**
+ * Structured material supporting one or more findings.
+ */
+interface Evidence {
+    type: string;
+    title: string;
+    description: string;
+    source: string;
+    external_id: ExternalId;
+    content: unknown;
+    uri: Uri;
+    captured_at: string;
+    extra: Extra2;
+    key: string;
+    finding_links: FindingLinks1;
+    [k: string]: unknown;
+}
+interface Extra2 {
+    [k: string]: unknown;
+}
 /**
  * Threat intelligence entries keyed by their unique key.
  */
@@ -204,7 +266,7 @@ interface ThreatIntel {
     source: string;
     observable_key: string;
     comment: string;
-    extra: Extra2;
+    extra: Extra3;
     score: number;
     level: Level;
     taxonomies: Taxonomies;
@@ -212,7 +274,7 @@ interface ThreatIntel {
     score_display: string;
     [k: string]: unknown;
 }
-interface Extra2 {
+interface Extra3 {
     [k: string]: unknown;
 }
 /**
@@ -252,7 +314,7 @@ interface Tags {
     [k: string]: Tag;
 }
 /**
- * Groups checks for categorical organization.
+ * Groups findings for categorical organization.
  *
  * Tags allow structuring the investigation into logical sections
  * with aggregated scores and levels. Hierarchy is automatic based on
@@ -261,16 +323,16 @@ interface Tags {
 interface Tag {
     name: string;
     description?: string;
-    checks: Checks1;
+    findings: Findings1;
     key: string;
     /**
-     * Calculate the score from direct checks only (no hierarchy).
+     * Calculate the score from direct findings only (no hierarchy).
      *
      * For hierarchical aggregation (including descendant tags), use
      * Investigation.get_tag_aggregated_score() or TagProxy.get_aggregated_score().
      *
      * Returns:
-     *     Total score from direct checks
+     *     Total score from direct findings
      */
     direct_score: number;
     direct_level: Level;
@@ -288,9 +350,12 @@ interface StatisticsSchema {
     observables_by_type?: ObservablesByType;
     observables_by_level?: ObservablesByLevel;
     observables_by_type_and_level?: ObservablesByTypeAndLevel;
-    total_checks: number;
-    applied_checks: number;
-    checks_by_level?: ChecksByLevel;
+    total_findings: number;
+    applied_findings: number;
+    findings_by_level?: FindingsByLevel;
+    total_evidences: number;
+    evidences_by_type?: EvidencesByType;
+    evidences_by_source?: EvidencesBySource;
     total_threat_intel: number;
     threat_intel_by_source?: ThreatIntelBySource;
     threat_intel_by_level?: ThreatIntelByLevel;
@@ -307,9 +372,15 @@ interface ObservablesByTypeAndLevel {
         [k: string]: number;
     };
 }
-interface ChecksByLevel {
+interface FindingsByLevel {
     [k: string]: string[];
 }
+interface EvidencesByType {
+    [k: string]: number;
+}
+interface EvidencesBySource {
+    [k: string]: number;
+}
 interface ThreatIntelBySource {
     [k: string]: number;
 }
@@ -336,7 +407,7 @@ declare function isCyvest(json: unknown): json is CyvestInvestigation;
 /**
  * Key type prefixes used in Cyvest.
  */
-type KeyType = "obs" | "chk" | "ti" | "enr" | "tag";
+type KeyType = "obs" | "fnd" | "evd" | "ti" | "enr" | "tag";
 /**
  * Generate a unique key for an observable.
  *
@@ -352,22 +423,22 @@ type KeyType = "obs" | "chk" | "ti" | "enr" | "tag";
  * // => "obs:ipv4:192.168.1.1"
  * ```
  */
-declare function generateObservableKey(obsType: string, value: string): string;
+declare function generateObservableKey(obsType: string, value: string, subtype?: string, namespace?: string): string;
 /**
- * Generate a unique key for a check.
+ * Generate a unique key for a finding.
  *
- * Format: chk:{check_name}
+ * Format: fnd:{finding_name}
  *
- * @param checkName - Name of the check
- * @returns Unique check key
+ * @param findingName - Name of the finding
+ * @returns Unique finding key
  *
  * @example
  * ```ts
- * generateCheckKey("sender_verification")
- * // => "chk:sender_verification"
+ * generateFindingKey("sender_verification")
+ * // => "fnd:sender_verification"
  * ```
  */
-declare function generateCheckKey(checkName: string): string;
+declare function generateFindingKey(findingName: string): string;
 /**
  * Generate a unique key for threat intelligence.
  *
@@ -463,7 +534,7 @@ declare function isTagDescendantOf(descendantName: string, ancestorName: string)
  * Extract the type prefix from a key.
  *
  * @param key - The key to parse
- * @returns Type prefix (obs, chk, ti, enr, tag) or null if invalid
+ * @returns Type prefix (obs, fnd, evd, ti, enr, tag) or null if invalid
  *
  * @example
  * ```ts
@@ -473,7 +544,7 @@ declare function isTagDescendantOf(descendantName: string, ancestorName: string)
  */
 declare function parseKeyType(key: string): KeyType | null;
 /**
- * Validate a key format and optionally check its type.
+ * Validate a key format and optionally finding its type.
  *
  * @param key - The key to validate
  * @param expectedType - Optional expected type prefix
@@ -505,19 +576,19 @@ declare function parseObservableKey(key: string): {
     value: string;
 } | null;
 /**
- * Extract components from a check key.
+ * Extract components from a finding key.
  *
- * @param key - Check key to parse
- * @returns Object with checkName, or null if invalid
+ * @param key - Finding key to parse
+ * @returns Object with findingName, or null if invalid
  *
  * @example
  * ```ts
- * parseCheckKey("chk:sender_verification")
- * // => { checkName: "sender_verification" }
+ * parseFindingKey("fnd:sender_verification")
+ * // => { findingName: "sender_verification" }
  * ```
  */
-declare function parseCheckKey(key: string): {
-    checkName: string;
+declare function parseFindingKey(key: string): {
+    findingName: string;
 } | null;
 /**
  * Extract components from a threat intel key.
@@ -574,7 +645,7 @@ declare function normalizeLevel(level: string): Level;
 /**
  * Check if a string is a valid Level.
  *
- * @param level - String to check
+ * @param level - String to finding
  * @returns True if valid Level
  */
 declare function isValidLevel(level: string): level is Level;
@@ -641,7 +712,7 @@ declare function isLevelLowerThan(a: Level, b: Level): boolean;
 /**
  * Check if level a is at least as severe as level b.
  *
- * @param a - Level to check
+ * @param a - Level to finding
  * @param minLevel - Minimum required level
  * @returns True if a is at least minLevel
  *
@@ -688,9 +759,9 @@ declare function hasLevel(obj: unknown): obj is {
     level: Level;
 };
 /**
- * Extract level from an entity (Observable, Check, ThreatIntel, Tag).
+ * Extract level from an entity (Observable, Finding, ThreatIntel, Tag).
  */
-declare function getEntityLevel(entity: Observable | Check | ThreatIntel | Tag): Level;
+declare function getEntityLevel(entity: Observable | Finding | ThreatIntel | Tag): Level;
 
 /**
  * Get an observable by its key.
@@ -721,7 +792,7 @@ declare function getObservable(inv: CyvestInvestigation, key: string): Observabl
  * const obs = getObservableByTypeValue(investigation, "ipv4", "192.168.1.1");
  * ```
  */
-declare function getObservableByTypeValue(inv: CyvestInvestigation, type: string, value: string): Observable | undefined;
+declare function getObservableByTypeValue(inv: CyvestInvestigation, type: string, value: string, subtype?: string, namespace?: string): Observable | undefined;
 /**
  * Get the root observable of the investigation.
  *
@@ -741,44 +812,46 @@ declare function getObservableByTypeValue(inv: CyvestInvestigation, type: string
  */
 declare function getRootObservable(inv: CyvestInvestigation): Observable | undefined;
 /**
- * Get a check by its key.
+ * Get a finding by its key.
  *
  * @param inv - The investigation to search
- * @param key - Check key (e.g., "chk:sender_verification:email_headers")
- * @returns The check or undefined if not found
+ * @param key - Finding key (e.g., "fnd:sender_verification:email_headers")
+ * @returns The finding or undefined if not found
  *
  * @example
  * ```ts
- * const check = getCheck(investigation, "chk:sender_verification:email_headers");
+ * const finding = getFinding(investigation, "fnd:sender_verification:email_headers");
  * ```
  */
-declare function getCheck(inv: CyvestInvestigation, key: string): Check | undefined;
+declare function getFinding(inv: CyvestInvestigation, key: string): Finding | undefined;
 /**
- * Get a check by its name.
+ * Get a finding by its name.
  *
  * @param inv - The investigation to search
- * @param checkName - Check name
- * @returns The check or undefined if not found
+ * @param findingName - Finding name
+ * @returns The finding or undefined if not found
  *
  * @example
  * ```ts
- * const check = getCheckByName(investigation, "sender_verification");
+ * const finding = getFindingByName(investigation, "sender_verification");
  * ```
  */
-declare function getCheckByName(inv: CyvestInvestigation, checkName: string): Check | undefined;
+declare function getFindingByName(inv: CyvestInvestigation, findingName: string): Finding | undefined;
 /**
- * Get all checks as an array.
+ * Get all findings as an array.
  *
  * @param inv - The investigation
- * @returns Array of all checks
+ * @returns Array of all findings
  *
  * @example
  * ```ts
- * const allChecks = getAllChecks(investigation);
- * console.log(`Total checks: ${allChecks.length}`);
+ * const allFindings = getAllFindings(investigation);
+ * console.log(`Total findings: ${allFindings.length}`);
  * ```
  */
-declare function getAllChecks(inv: CyvestInvestigation): Check[];
+declare function getAllFindings(inv: CyvestInvestigation): Finding[];
+declare function getEvidence(inv: CyvestInvestigation, key: string): Evidence | undefined;
+declare function getAllEvidences(inv: CyvestInvestigation): Evidence[];
 /**
  * Get a threat intel entry by its key.
  *
@@ -901,7 +974,8 @@ declare function getDataExtraction(inv: CyvestInvestigation): DataExtractionSche
  */
 interface InvestigationCounts {
     observables: number;
-    checks: number;
+    findings: number;
+    evidences: number;
     threatIntels: number;
     enrichments: number;
     tags: number;
@@ -963,7 +1037,7 @@ declare function getTagDescendants(inv: CyvestInvestigation, tagName: string): T
  * Get the aggregated score for a tag including all descendant tags.
  *
  * The aggregated score includes:
- * - The tag's direct_score (from its direct checks)
+ * - The tag's direct_score (from its direct findings)
  * - Recursively, the aggregated scores of all child tags
  *
  * @param inv - The investigation
@@ -999,7 +1073,7 @@ declare function getTagAggregatedLevel(inv: CyvestInvestigation, tagName: string
  * Finder utilities for querying and filtering Cyvest Investigation data.
  *
  * These functions provide filtering, searching, and cross-referencing
- * capabilities for observables, checks, and threat intel.
+ * capabilities for observables, findings, and threat intel.
  */
 
 /**
@@ -1098,29 +1172,29 @@ declare function findWhitelistedObservables(inv: CyvestInvestigation): Observabl
  */
 declare function findObservablesWithThreatIntel(inv: CyvestInvestigation): Observable[];
 /**
- * Find all checks at a specific level.
+ * Find all findings at a specific level.
  *
  * @param inv - The investigation to search
  * @param level - Security level to filter by
- * @returns Array of matching checks
+ * @returns Array of matching findings
  */
-declare function findChecksByLevel(inv: CyvestInvestigation, level: Level): Check[];
+declare function findFindingsByLevel(inv: CyvestInvestigation, level: Level): Finding[];
 /**
- * Find all checks at or above a minimum level.
+ * Find all findings at or above a minimum level.
  *
  * @param inv - The investigation to search
  * @param minLevel - Minimum security level
- * @returns Array of matching checks
+ * @returns Array of matching findings
  */
-declare function findChecksAtLeast(inv: CyvestInvestigation, minLevel: Level): Check[];
+declare function findFindingsAtLeast(inv: CyvestInvestigation, minLevel: Level): Finding[];
 /**
- * Find checks by check name.
+ * Find findings by finding name.
  *
  * @param inv - The investigation to search
- * @param checkName - Check name to search for
- * @returns The matching check or undefined
+ * @param findingName - Finding name to search for
+ * @returns The matching finding or undefined
  */
-declare function findCheckByName(inv: CyvestInvestigation, checkName: string): Check | undefined;
+declare function findFindingByName(inv: CyvestInvestigation, findingName: string): Finding | undefined;
 /**
  * Find all threat intel from a specific source.
  *
@@ -1170,18 +1244,18 @@ declare function findTagsAtLeast(inv: CyvestInvestigation, minLevel: Level): Tag
  */
 declare function findTagsByNamePattern(inv: CyvestInvestigation, pattern: RegExp): Tag[];
 /**
- * Find all checks that generated or reference a specific observable.
+ * Find all findings that generated or reference a specific observable.
  *
  * @param inv - The investigation to search
  * @param observableKey - Key of the observable
- * @returns Array of checks that reference this observable
+ * @returns Array of findings that reference this observable
  *
  * @example
  * ```ts
- * const checks = findChecksForObservable(investigation, "obs:ipv4:192.168.1.1");
+ * const findings = findFindingsForObservable(investigation, "obs:ipv4:192.168.1.1");
  * ```
  */
-declare function findChecksForObservable(inv: CyvestInvestigation, observableKey: string): Check[];
+declare function findFindingsForObservable(inv: CyvestInvestigation, observableKey: string): Finding[];
 /**
  * Find all threat intel entries for a specific observable.
  *
@@ -1191,22 +1265,22 @@ declare function findChecksForObservable(inv: CyvestInvestigation, observableKey
  */
 declare function findThreatIntelsForObservable(inv: CyvestInvestigation, observableKey: string): ThreatIntel[];
 /**
- * Find all observables referenced by a specific check.
+ * Find all observables referenced by a specific finding.
  *
  * @param inv - The investigation to search
- * @param checkKey - Key of the check
- * @returns Array of observables referenced by this check
+ * @param findingKey - Key of the finding
+ * @returns Array of observables referenced by this finding
  */
-declare function findObservablesForCheck(inv: CyvestInvestigation, checkKey: string): Observable[];
+declare function findObservablesForFinding(inv: CyvestInvestigation, findingKey: string): Observable[];
 /**
- * Find all checks for a specific tag.
+ * Find all findings for a specific tag.
  *
  * @param inv - The investigation to search
  * @param tagKey - Key of the tag
- * @param recursive - Include checks from descendant tags (default: false)
- * @returns Array of checks in the tag
+ * @param recursive - Include findings from descendant tags (default: false)
+ * @returns Array of findings in the tag
  */
-declare function findChecksForTag(inv: CyvestInvestigation, tagKey: string, recursive?: boolean): Check[];
+declare function findFindingsForTag(inv: CyvestInvestigation, tagKey: string, recursive?: boolean): Finding[];
 /**
  * Sort observables by score (descending - highest first).
  *
@@ -1215,12 +1289,12 @@ declare function findChecksForTag(inv: CyvestInvestigation, tagKey: string, recu
  */
 declare function sortObservablesByScore(observables: Observable[]): Observable[];
 /**
- * Sort checks by score (descending - highest first).
+ * Sort findings by score (descending - highest first).
  *
- * @param checks - Array of checks to sort
+ * @param findings - Array of findings to sort
  * @returns Sorted array (new array, doesn't mutate input)
  */
-declare function sortChecksByScore(checks: Check[]): Check[];
+declare function sortFindingsByScore(findings: Finding[]): Finding[];
 /**
  * Sort observables by level (descending - most severe first).
  *
@@ -1229,12 +1303,12 @@ declare function sortChecksByScore(checks: Check[]): Check[];
  */
 declare function sortObservablesByLevel(observables: Observable[]): Observable[];
 /**
- * Sort checks by level (descending - most severe first).
+ * Sort findings by level (descending - most severe first).
  *
- * @param checks - Array of checks to sort
+ * @param findings - Array of findings to sort
  * @returns Sorted array (new array, doesn't mutate input)
  */
-declare function sortChecksByLevel(checks: Check[]): Check[];
+declare function sortFindingsByLevel(findings: Finding[]): Finding[];
 /**
  * Find the highest scoring observables.
  *
@@ -1244,13 +1318,13 @@ declare function sortChecksByLevel(checks: Check[]): Check[];
  */
 declare function findHighestScoringObservables(inv: CyvestInvestigation, n?: number): Observable[];
 /**
- * Find the highest scoring checks.
+ * Find the highest scoring findings.
  *
  * @param inv - The investigation to search
  * @param n - Number of results to return (default: 10)
- * @returns Array of highest scoring checks
+ * @returns Array of highest scoring findings
  */
-declare function findHighestScoringChecks(inv: CyvestInvestigation, n?: number): Check[];
+declare function findHighestScoringFindings(inv: CyvestInvestigation, n?: number): Finding[];
 /**
  * Find all malicious observables (convenience function).
  *
@@ -1266,26 +1340,26 @@ declare function findMaliciousObservables(inv: CyvestInvestigation): Observable[
  */
 declare function findSuspiciousObservables(inv: CyvestInvestigation): Observable[];
 /**
- * Find all malicious checks (convenience function).
+ * Find all malicious findings (convenience function).
  *
  * @param inv - The investigation to search
- * @returns Array of malicious checks
+ * @returns Array of malicious findings
  */
-declare function findMaliciousChecks(inv: CyvestInvestigation): Check[];
+declare function findMaliciousFindings(inv: CyvestInvestigation): Finding[];
 /**
- * Find all suspicious checks (convenience function).
+ * Find all suspicious findings (convenience function).
  *
  * @param inv - The investigation to search
- * @returns Array of suspicious checks
+ * @returns Array of suspicious findings
  */
-declare function findSuspiciousChecks(inv: CyvestInvestigation): Check[];
+declare function findSuspiciousFindings(inv: CyvestInvestigation): Finding[];
 /**
- * Get all check keys in the investigation.
+ * Get all finding keys in the investigation.
  *
  * @param inv - The investigation
- * @returns Array of check keys
+ * @returns Array of finding keys
  */
-declare function getAllCheckKeys(inv: CyvestInvestigation): string[];
+declare function getAllFindingKeys(inv: CyvestInvestigation): string[];
 /**
  * Get all observable types present in the investigation.
  *
@@ -1502,4 +1576,4 @@ declare function getRelationshipsForObservable(inv: CyvestInvestigation, observa
     }>;
 };
 
-export { type Actor, type AuditEvent, type AuditLog, type Check, type CheckLinks, type Checks, type Checks1, type ChecksByLevel, type CyvestInvestigation, type Data, type DataExtractionSchema, type Details, type Enrichment, type Enrichments, type Extra, type Extra1, type Extra2, type GraphEdge, type GraphNode, type InvestigationCounts, type InvestigationGraph, type InvestigationName, type InvestigationWhitelist, type Justification, type KeyType, LEVEL_COLORS, LEVEL_ORDER, LEVEL_VALUES, type Level, type ObjectKey, type ObjectType, type Observable, type ObservableLink, type ObservableLinks, type Observables, type ObservablesByLevel, type ObservablesByType, type ObservablesByTypeAndLevel, type PropagationMode, type Reason, type Relationship, type RelationshipDirection, type Relationships, type RootType, type ScoreMode, type StatisticsSchema, type Tag, type Tags, type Taxonomies, type Taxonomy, type ThreatIntel, type ThreatIntelByLevel, type ThreatIntelBySource, type ThreatIntels, type ThreatIntels1, type Tool, type Whitelists, areConnected, compareLevels, countRelationshipsByType, findCheckByName, findChecksAtLeast, findChecksByLevel, findChecksForObservable, findChecksForTag, findExternalObservables, findHighestScoringChecks, findHighestScoringObservables, findInternalObservables, findLeafObservables, findMaliciousChecks, findMaliciousObservables, findObservablesAtLeast, findObservablesByLevel, findObservablesByType, findObservablesByValue, findObservablesContaining, findObservablesForCheck, findObservablesMatching, findObservablesWithThreatIntel, findOrphanObservables, findPath, findSourceObservables, findSuspiciousChecks, findSuspiciousObservables, findTagsAtLeast, findTagsByLevel, findTagsByNamePattern, findThreatIntelAtLeast, findThreatIntelByLevel, findThreatIntelBySource, findThreatIntelsForObservable, findWhitelistedObservables, generateCheckKey, generateEnrichmentKey, generateObservableKey, generateTagKey, generateThreatIntelKey, getAllCheckKeys, getAllChecks, getAllEnrichments, getAllObservableTypes, getAllObservables, getAllRelationshipTypes, getAllTags, getAllThreatIntelSources, getAllThreatIntels, getCheck, getCheckByName, getColorForLevel, getColorForScore, getCounts, getDataExtraction, getEnrichment, getEnrichmentByName, getEntityLevel, getLevelFromScore, getObservable, getObservableByTypeValue, getObservableChildren, getObservableGraph, getObservableParents, getReachableObservables, getRelatedObservables, getRelatedObservablesByDirection, getRelatedObservablesByType, getRelationshipsForObservable, getRootObservable, getStartedAt, getStats, getTag, getTagAggregatedLevel, getTagAggregatedScore, getTagAncestors, getTagByName, getTagChildren, getTagDescendants, getThreatIntel, getThreatIntelBySourceObservable, getWhitelists, hasLevel, isCyvest, isLevelAtLeast, isLevelHigherThan, isLevelLowerThan, isTagChildOf, isTagDescendantOf, isValidLevel, maxLevel, minLevel, normalizeLevel, parseCheckKey, parseCyvest, parseKeyType, parseObservableKey, parseThreatIntelKey, sortChecksByLevel, sortChecksByScore, sortObservablesByLevel, sortObservablesByScore, validateKey };
+export { type Actor, type Aliases, type AuditEvent, type AuditLog, type CyvestInvestigation, type Data, type DataExtractionSchema, type Details, type Enrichment, type Enrichments, type Evidence, type EvidenceLink, type EvidenceLinks, type Evidences, type EvidencesBySource, type EvidencesByType, type ExternalId, type Extra, type Extra1, type Extra2, type Extra3, type Finding, type FindingLinks, type FindingLinks1, type Findings, type Findings1, type FindingsByLevel, type GraphEdge, type GraphNode, type InvestigationCounts, type InvestigationGraph, type InvestigationName, type InvestigationWhitelist, type Justification, type KeyType, LEVEL_COLORS, LEVEL_ORDER, LEVEL_VALUES, type Level, type Namespace, type Namespace1, type ObjectKey, type ObjectType, type Observable, type ObservableAlias, type ObservableLink, type ObservableLinks, type Observables, type ObservablesByLevel, type ObservablesByType, type ObservablesByTypeAndLevel, type PropagationMode, type Reason, type Relationship, type RelationshipDirection, type Relationships, type RootType, type ScoreMode, type StatisticsSchema, type Subtype, type Subtype1, type Tag, type Tags, type Taxonomies, type Taxonomy, type ThreatIntel, type ThreatIntelByLevel, type ThreatIntelBySource, type ThreatIntels, type ThreatIntels1, type Tool, type Uri, type Whitelists, areConnected, compareLevels, countRelationshipsByType, findExternalObservables, findFindingByName, findFindingsAtLeast, findFindingsByLevel, findFindingsForObservable, findFindingsForTag, findHighestScoringFindings, findHighestScoringObservables, findInternalObservables, findLeafObservables, findMaliciousFindings, findMaliciousObservables, findObservablesAtLeast, findObservablesByLevel, findObservablesByType, findObservablesByValue, findObservablesContaining, findObservablesForFinding, findObservablesMatching, findObservablesWithThreatIntel, findOrphanObservables, findPath, findSourceObservables, findSuspiciousFindings, findSuspiciousObservables, findTagsAtLeast, findTagsByLevel, findTagsByNamePattern, findThreatIntelAtLeast, findThreatIntelByLevel, findThreatIntelBySource, findThreatIntelsForObservable, findWhitelistedObservables, generateEnrichmentKey, generateFindingKey, generateObservableKey, generateTagKey, generateThreatIntelKey, getAllEnrichments, getAllEvidences, getAllFindingKeys, getAllFindings, getAllObservableTypes, getAllObservables, getAllRelationshipTypes, getAllTags, getAllThreatIntelSources, getAllThreatIntels, getColorForLevel, getColorForScore, getCounts, getDataExtraction, getEnrichment, getEnrichmentByName, getEntityLevel, getEvidence, getFinding, getFindingByName, getLevelFromScore, getObservable, getObservableByTypeValue, getObservableChildren, getObservableGraph, getObservableParents, getReachableObservables, getRelatedObservables, getRelatedObservablesByDirection, getRelatedObservablesByType, getRelationshipsForObservable, getRootObservable, getStartedAt, getStats, getTag, getTagAggregatedLevel, getTagAggregatedScore, getTagAncestors, getTagByName, getTagChildren, getTagDescendants, getThreatIntel, getThreatIntelBySourceObservable, getWhitelists, hasLevel, isCyvest, isLevelAtLeast, isLevelHigherThan, isLevelLowerThan, isTagChildOf, isTagDescendantOf, isValidLevel, maxLevel, minLevel, normalizeLevel, parseCyvest, parseFindingKey, parseKeyType, parseObservableKey, parseThreatIntelKey, sortFindingsByLevel, sortFindingsByScore, sortObservablesByLevel, sortObservablesByScore, validateKey };