@oneuptime/common 11.5.8 → 11.5.10

package/Types/Monitor/MonitorStepSqlMonitor.ts

@@ -64,6 +64,12 @@ export default interface MonitorStepSqlMonitor {
   username: string;
   // Raw password OR a {{monitorSecrets.name}} reference resolved server-side.
   password: string;
+  /*
+   * Microsoft SQL Server only: authenticate with the identity under which the
+   * probe is running (SSPI on Windows, Kerberos on Linux/macOS). Username and
+   * password are ignored when this is enabled.
+   */
+  useWindowsIntegratedAuthentication: boolean;
   useSsl: boolean;
   /*
    * When SSL is on, whether the server certificate chain must validate. Users
@@ -87,6 +93,7 @@ export class MonitorStepSqlMonitorUtil {
       databaseName: "",
       username: "",
       password: "",
+      useWindowsIntegratedAuthentication: false,
       useSsl: false,
       rejectUnauthorizedSsl: true,
       query: "",
@@ -105,6 +112,9 @@ export class MonitorStepSqlMonitorUtil {
       databaseName: (json["databaseName"] as string) || "",
       username: (json["username"] as string) || "",
       password: (json["password"] as string) || "",
+      useWindowsIntegratedAuthentication: Boolean(
+        json["useWindowsIntegratedAuthentication"],
+      ),
       useSsl: Boolean(json["useSsl"]),
       rejectUnauthorizedSsl:
         json["rejectUnauthorizedSsl"] === undefined ||
@@ -130,6 +140,8 @@ export class MonitorStepSqlMonitorUtil {
       databaseName: monitor.databaseName,
       username: monitor.username,
       password: monitor.password,
+      useWindowsIntegratedAuthentication:
+        monitor.useWindowsIntegratedAuthentication,
       useSsl: monitor.useSsl,
       rejectUnauthorizedSsl: monitor.rejectUnauthorizedSsl,
       query: monitor.query,

package/Types/Monitor/MonitorType.ts

@@ -480,7 +480,8 @@ export class MonitorTypeHelper {
     return (
       monitorType === MonitorType.IncomingRequest ||
       monitorType === MonitorType.IncomingEmail ||
-      monitorType === MonitorType.Server
+      monitorType === MonitorType.Server ||
+      monitorType === MonitorType.NetworkDevice
     );
   }
 

package/Types/Monitor/SSLMonitor/SslMonitorResponse.ts

@@ -1,14 +1,19 @@
+/*
+ * Every field is optional AND explicitly undefined-able: a certificate need
+ * not carry any given subject field, and under exactOptionalPropertyTypes the
+ * probe cannot assign a "may be absent" value into a bare optional property.
+ */
 export default interface SslMonitorResponse {
-  isSelfSigned?: boolean;
-  createdAt?: Date;
-  expiresAt?: Date;
-  commonName?: string;
-  organizationalUnit?: string;
-  organization?: string;
-  locality?: string;
-  state?: string;
-  country?: string;
-  serialNumber?: string;
-  fingerprint?: string;
-  fingerprint256?: string;
+  isSelfSigned?: boolean | undefined;
+  createdAt?: Date | undefined;
+  expiresAt?: Date | undefined;
+  commonName?: string | undefined;
+  organizationalUnit?: string | undefined;
+  organization?: string | undefined;
+  locality?: string | undefined;
+  state?: string | undefined;
+  country?: string | undefined;
+  serialNumber?: string | undefined;
+  fingerprint?: string | undefined;
+  fingerprint256?: string | undefined;
 }

package/Types/Monitor/SnmpMonitor/CdpNeighbor.ts

@@ -0,0 +1,13 @@
+/*
+ * One neighbor entry from a Cisco device's CDP cache (CISCO-CDP-MIB
+ * cdpCacheTable). Collected as a fallback/complement to LLDP — plenty of
+ * Cisco estates run CDP only, and without it their topology is empty. The
+ * server matches remoteDeviceId against known NetworkDevices the same way it
+ * matches LLDP remoteSysName.
+ */
+export default interface CdpNeighbor {
+  localInterfaceIndex?: number | undefined;
+  remoteDeviceId?: string | undefined;
+  remotePortId?: string | undefined;
+  remotePlatform?: string | undefined;
+}

package/Types/Monitor/SnmpMonitor/NetworkTopology.ts

@@ -1,11 +1,17 @@
 /*
  * A derived view of the network topology for one project, built server-side
- * from the LLDP neighbor data each device reports. Nodes are devices;
- * unmanaged neighbors (LLDP peers with no matching NetworkDevice) appear as
- * lightweight nodes so the graph doesn't dead-end. Edges are LLDP links.
+ * from the LLDP and CDP neighbor data each device reports. Nodes are devices;
+ * unmanaged neighbors (discovery-protocol peers with no matching
+ * NetworkDevice) appear as lightweight nodes so the graph doesn't dead-end.
+ * Edges are physical links — one per device pair even when both ends (or
+ * both protocols) report it — annotated with the operational state of the
+ * interface at each end when the neighbor entry identifies it.
  */
 export type NetworkTopologyNodeStatus = "up" | "down" | "unknown";
 
+// Which discovery protocol(s) reported a link.
+export type NetworkTopologyLinkProtocol = "lldp" | "cdp";
+
 export interface NetworkTopologyNode {
   // Device id for managed nodes; a synthetic "unmanaged:<key>" id otherwise.
   id: string;
@@ -14,6 +20,27 @@ export interface NetworkTopologyNode {
   status: NetworkTopologyNodeStatus;
   interfacesUp?: number | undefined;
   interfacesDown?: number | undefined;
+  // Extra device identity for search and the detail panel (managed nodes).
+  sysName?: string | undefined;
+  vendor?: string | undefined;
+  // For unmanaged CDP peers this carries the reported platform string.
+  deviceModel?: string | undefined;
+}
+
+/*
+ * Operational state of one end of a link, resolved from the NetworkInterface
+ * row for that (device, interfaceIndex) pair when the neighbor entry carries
+ * enough to identify it. All fields optional — enrichment is best-effort.
+ */
+export interface NetworkTopologyEdgeEndpoint {
+  interfaceIndex?: number | undefined;
+  interfaceName?: string | undefined;
+  isOperationallyUp?: boolean | undefined;
+  isAdministrativelyUp?: boolean | undefined;
+  utilizationPercent?: number | undefined;
+  inRateMbps?: number | undefined;
+  outRateMbps?: number | undefined;
+  errorsPerSecond?: number | undefined;
 }
 
 export interface NetworkTopologyEdge {
@@ -21,9 +48,16 @@ export interface NetworkTopologyEdge {
   toNodeId: string;
   fromPort?: string | undefined;
   toPort?: string | undefined;
+  // Discovery protocols that reported this link (deduped union).
+  protocols?: Array<NetworkTopologyLinkProtocol> | undefined;
+  // Operational data at each end, when the endpoint interface is known.
+  fromInterface?: NetworkTopologyEdgeEndpoint | undefined;
+  toInterface?: NetworkTopologyEdgeEndpoint | undefined;
 }
 
 export default interface NetworkTopology {
   nodes: Array<NetworkTopologyNode>;
   edges: Array<NetworkTopologyEdge>;
+  // True when the device query hit its per-project cap — graph may be partial.
+  isTruncated?: boolean | undefined;
 }

package/Types/Monitor/SnmpMonitor/SnmpAuthProtocol.ts

@@ -5,4 +5,50 @@ enum SnmpAuthProtocol {
   SHA512 = "SHA512",
 }
 
+/*
+ * Same free-text column problem as SnmpPrivProtocol: snmpV3AuthProtocol has no
+ * check constraint, and reading it by casting the raw string to this enum
+ * silently drops to the probe's default of MD5 — the weakest digest — when the
+ * spelling does not match exactly. "SHA-256" is what the form labels that
+ * option, so it is a realistic thing to find in a hand-written row.
+ *
+ * This protocol also selects the hash used to localize the *privacy* key
+ * (RFC 3414 section 2.6), so getting it wrong corrupts the DES/AES key as well
+ * as the authentication digest. Both ends then disagree and the device simply
+ * stops answering.
+ *
+ * See SnmpPrivProtocol for why parse() returns undefined instead of a default.
+ * SHA here is SHA-1, the original RFC 3414 algorithm.
+ */
+export class SnmpAuthProtocolUtil {
+  public static parse(
+    value: string | undefined | null,
+  ): SnmpAuthProtocol | undefined {
+    switch ((value || "").trim().toLowerCase()) {
+      case "md5":
+        return SnmpAuthProtocol.MD5;
+      case "sha":
+      case "sha1":
+      case "sha-1":
+        return SnmpAuthProtocol.SHA;
+      case "sha256":
+      case "sha-256":
+        return SnmpAuthProtocol.SHA256;
+      case "sha512":
+      case "sha-512":
+        return SnmpAuthProtocol.SHA512;
+      default:
+        return undefined;
+    }
+  }
+
+  public static isUnrecognized(value: string | undefined | null): boolean {
+    if (!(value || "").trim()) {
+      return false;
+    }
+
+    return SnmpAuthProtocolUtil.parse(value) === undefined;
+  }
+}
+
 export default SnmpAuthProtocol;

package/Types/Monitor/SnmpMonitor/SnmpEntityInfo.ts

@@ -0,0 +1,15 @@
+/*
+ * Hardware identity from ENTITY-MIB entPhysicalTable (1.3.6.1.2.1.47.1.1.1).
+ * The probe picks the chassis row (entPhysicalClass == 3), falling back to
+ * the lowest-indexed row that carries a serial number, since stacked or
+ * modular devices expose one row per component. All fields are best-effort —
+ * many low-end devices do not implement ENTITY-MIB at all.
+ */
+export default interface SnmpEntityInfo {
+  manufacturer?: string | undefined;
+  model?: string | undefined;
+  serialNumber?: string | undefined;
+  hardwareRevision?: string | undefined;
+  firmwareVersion?: string | undefined;
+  softwareVersion?: string | undefined;
+}

package/Types/Monitor/SnmpMonitor/SnmpInterface.ts

@@ -15,6 +15,14 @@ export default interface SnmpInterface {
   alias?: string | undefined;
   isOperationallyUp: boolean;
   isAdministrativelyUp: boolean;
+  /*
+   * ifPhysAddress formatted as lowercase colon-separated hex
+   * ("aa:bb:cc:dd:ee:ff"); undefined for interfaces with no MAC (loopbacks,
+   * tunnels) or when the device returns an empty octet string.
+   */
+  macAddress?: string | undefined;
+  // IANAifType number (ifType column) — 6 = ethernetCsmacd, 24 = loopback...
+  interfaceType?: number | undefined;
   speedInBitsPerSecond?: number | undefined;
   inOctets?: number | undefined;
   outOctets?: number | undefined;

package/Types/Monitor/SnmpMonitor/SnmpMonitorResponse.ts

@@ -2,6 +2,9 @@ import ProbeAttempt from "../../Probe/ProbeAttempt";
 import SnmpDataType from "./SnmpDataType";
 import SnmpInterface from "./SnmpInterface";
 import LldpNeighbor from "./LldpNeighbor";
+import CdpNeighbor from "./CdpNeighbor";
+import SnmpSystemInfo from "./SnmpSystemInfo";
+import SnmpEntityInfo from "./SnmpEntityInfo";
 
 export interface SnmpOidResponse {
   oid: string;
@@ -26,18 +29,24 @@ export default interface SnmpMonitorResponse {
   interfaces?: Array<SnmpInterface> | undefined;
   interfaceWalkFailure?: string | undefined;
   /*
-   * System-group identity (sysDescr / sysName), collected alongside the
-   * interface walk. Used to enrich the NetworkDevice resource.
+   * System-group identity, collected alongside the interface walk. Used to
+   * enrich the NetworkDevice resource. Older probes send only
+   * sysDescr/sysName.
    */
-  systemInfo?:
-    | {
-        sysDescr?: string | undefined;
-        sysName?: string | undefined;
-      }
-    | undefined;
+  systemInfo?: SnmpSystemInfo | undefined;
+  /*
+   * ENTITY-MIB hardware identity (manufacturer/model/serial/firmware),
+   * collected alongside the interface walk on devices that implement it.
+   */
+  entityInfo?: SnmpEntityInfo | undefined;
   /*
    * LLDP neighbors discovered during the walk (when interface monitoring is
    * enabled). Used to build the network topology graph.
    */
   lldpNeighbors?: Array<LldpNeighbor> | undefined;
+  /*
+   * CDP neighbors, walked as a complement to LLDP for Cisco estates.
+   * Undefined on older probes and non-CDP devices.
+   */
+  cdpNeighbors?: Array<CdpNeighbor> | undefined;
 }

package/Types/Monitor/SnmpMonitor/SnmpPrivProtocol.ts

@@ -4,4 +4,57 @@ enum SnmpPrivProtocol {
   AES256 = "AES256",
 }
 
+/*
+ * The snmpV3PrivProtocol column is free text (character varying, no check
+ * constraint), so what lands in it is only as good as whoever wrote it. The
+ * forms write these enum values, but a direct API call, a hand-edited row or
+ * a restored backup can put anything there.
+ *
+ * parse() is the only correct way to read that column. Reading it by casting
+ * the raw string to this enum type compiles fine and then silently misses:
+ * an "AES-256" (the label the form shows) or "aes" is not === any member, so
+ * the probe's protocol switch falls to its default and encrypts with DES —
+ * the weakest option — against a device that expects AES. The poll then fails
+ * in a way that looks like a timeout rather than a config error.
+ *
+ * Returning undefined rather than a default member is deliberate: "unset" and
+ * "unreadable" are different problems, and only the caller knows whether it is
+ * safe to fall back. isUnrecognized() names the second case so the probe can
+ * refuse to poll rather than guess a cipher.
+ *
+ * The accepted spellings cover case, surrounding whitespace, and the hyphen
+ * the UI labels use. AES here is AES-128, per RFC 3826.
+ */
+export class SnmpPrivProtocolUtil {
+  public static parse(
+    value: string | undefined | null,
+  ): SnmpPrivProtocol | undefined {
+    switch ((value || "").trim().toLowerCase()) {
+      case "des":
+        return SnmpPrivProtocol.DES;
+      case "aes":
+      case "aes128":
+      case "aes-128":
+        return SnmpPrivProtocol.AES;
+      case "aes256":
+      case "aes-256":
+        return SnmpPrivProtocol.AES256;
+      default:
+        return undefined;
+    }
+  }
+
+  /*
+   * True only when something is stored and none of the spellings match — an
+   * empty or absent column is "unset", not "unrecognized".
+   */
+  public static isUnrecognized(value: string | undefined | null): boolean {
+    if (!(value || "").trim()) {
+      return false;
+    }
+
+    return SnmpPrivProtocolUtil.parse(value) === undefined;
+  }
+}
+
 export default SnmpPrivProtocol;

package/Types/Monitor/SnmpMonitor/SnmpSecurityLevel.ts

@@ -4,4 +4,47 @@ enum SnmpSecurityLevel {
   AuthPriv = "authPriv",
 }
 
+/*
+ * This is the most consequential of the v3 enums to misread, because the
+ * fallback is not merely a weaker algorithm — it is no security at all.
+ *
+ * The snmpV3SecurityLevel column is free text. Casting it straight to this
+ * enum and letting an unmatched value fall through to NoAuthNoPriv means a
+ * device configured for authPriv gets polled with its authentication and
+ * privacy material dropped: the username goes out in cleartext and nothing is
+ * encrypted. The device rejects it, so the visible symptom is a dead monitor
+ * rather than a config error, and the downgrade itself is invisible.
+ *
+ * The keys ("AuthPriv") and values ("authPriv") differ only by the case of the
+ * first letter, which is exactly the kind of drift a hand-written row or an
+ * API caller reading the docs will produce. Lowercasing collapses the two
+ * spellings onto each other, so parse() accepts both by construction.
+ *
+ * See SnmpPrivProtocol for why parse() returns undefined rather than a default.
+ */
+export class SnmpSecurityLevelUtil {
+  public static parse(
+    value: string | undefined | null,
+  ): SnmpSecurityLevel | undefined {
+    switch ((value || "").trim().toLowerCase()) {
+      case "noauthnopriv":
+        return SnmpSecurityLevel.NoAuthNoPriv;
+      case "authnopriv":
+        return SnmpSecurityLevel.AuthNoPriv;
+      case "authpriv":
+        return SnmpSecurityLevel.AuthPriv;
+      default:
+        return undefined;
+    }
+  }
+
+  public static isUnrecognized(value: string | undefined | null): boolean {
+    if (!(value || "").trim()) {
+      return false;
+    }
+
+    return SnmpSecurityLevelUtil.parse(value) === undefined;
+  }
+}
+
 export default SnmpSecurityLevel;

package/Types/Monitor/SnmpMonitor/SnmpSystemInfo.ts

@@ -0,0 +1,16 @@
+/*
+ * The SNMPv2 system group (1.3.6.1.2.1.1), read by the probe alongside the
+ * interface walk and by subnet discovery. sysObjectId is the vendor's
+ * registered enterprise OID — the canonical device fingerprint used to
+ * suggest a vendor OID template and derive the vendor name without MIBs.
+ * sysUpTimeSeconds is converted from TimeTicks (hundredths of a second) on
+ * the probe.
+ */
+export default interface SnmpSystemInfo {
+  sysDescr?: string | undefined;
+  sysName?: string | undefined;
+  sysObjectId?: string | undefined;
+  sysLocation?: string | undefined;
+  sysContact?: string | undefined;
+  sysUpTimeSeconds?: number | undefined;
+}

package/Types/Monitor/SnmpMonitor/SnmpVendorTemplate.ts

@@ -48,7 +48,7 @@ const MIKROTIK: SnmpVendorTemplate = {
   id: "mikrotik-routeros",
   label: "MikroTik RouterOS",
   description:
-    "CPU load, CPU temperature, and voltage from the MikroTik health MIB, plus standard Host Resources CPU.",
+    "CPU load, board temperature, and voltage from the MikroTik health MIB, plus standard Host Resources CPU.",
   oids: [
     {
       oid: "1.3.6.1.2.1.25.3.3.1.2.1",
@@ -56,9 +56,10 @@ const MIKROTIK: SnmpVendorTemplate = {
       description: "hrProcessorLoad — first processor.",
     },
     {
+      // .10.0 is mtxrHlTemperature (board temp); processor temp is .11.0.
       oid: "1.3.6.1.4.1.14988.1.1.3.10.0",
-      name: "CPU Temperature (C)",
-      description: "mtxrHlProcessorTemperature.",
+      name: "Temperature (C)",
+      description: "mtxrHlTemperature — system/board temperature.",
     },
     {
       oid: "1.3.6.1.4.1.14988.1.1.3.8.0",
@@ -128,6 +129,58 @@ export const SnmpVendorTemplates: Array<SnmpVendorTemplate> = [
   UBIQUITI,
 ];
 
+/*
+ * IANA private-enterprise numbers → vendor display names, for the vendors
+ * that actually show up on monitored networks. Used to derive a vendor from
+ * sysObjectID (1.3.6.1.4.1.<enterprise>...) when the device does not
+ * implement ENTITY-MIB. Not exhaustive by design — unknown enterprises just
+ * leave the vendor blank.
+ */
+const ENTERPRISE_VENDOR_NAMES: Record<number, string> = {
+  9: "Cisco",
+  11: "HPE",
+  43: "3Com",
+  171: "D-Link",
+  207: "Allied Telesis",
+  674: "Dell",
+  1588: "Brocade",
+  1916: "Extreme Networks",
+  2011: "Huawei",
+  2021: "Net-SNMP",
+  2636: "Juniper",
+  3224: "NetScreen",
+  3375: "F5",
+  4526: "Netgear",
+  6027: "Force10",
+  6486: "Alcatel-Lucent",
+  6574: "Synology",
+  8072: "Net-SNMP",
+  9303: "PacketFront",
+  10002: "Frogfoot",
+  11863: "TP-Link",
+  12325: "pfSense",
+  12356: "Fortinet",
+  14823: "Aruba",
+  14988: "MikroTik",
+  17163: "Riverbed",
+  22610: "Vyatta",
+  24681: "QNAP",
+  25461: "Palo Alto Networks",
+  25506: "H3C",
+  26543: "Yamaha",
+  30065: "Arista",
+  35098: "PICA8",
+  41112: "Ubiquiti",
+  47196: "OPNsense",
+};
+
+// sysObjectID template routing: enterprise number → vendor template id.
+const ENTERPRISE_TEMPLATE_IDS: Record<number, string> = {
+  9: "cisco-ios",
+  14988: "mikrotik-routeros",
+  41112: "ubiquiti-edgeos",
+};
+
 export default class SnmpVendorTemplateUtil {
   public static getAll(): Array<SnmpVendorTemplate> {
     return SnmpVendorTemplates;
@@ -139,6 +192,69 @@ export default class SnmpVendorTemplateUtil {
     });
   }
 
+  /*
+   * Extracts the IANA private-enterprise number from a sysObjectID value
+   * ("1.3.6.1.4.1.<enterprise>...", with or without a leading dot). Returns
+   * undefined for OIDs outside the enterprises arc (e.g. the mib-2 values
+   * some appliances report).
+   */
+  public static getEnterpriseNumber(
+    sysObjectId: string | undefined,
+  ): number | undefined {
+    if (!sysObjectId) {
+      return undefined;
+    }
+
+    const normalized: string = sysObjectId.trim().replace(/^\./, "");
+    const enterprisesPrefix: string = "1.3.6.1.4.1.";
+
+    if (!normalized.startsWith(enterprisesPrefix)) {
+      return undefined;
+    }
+
+    const enterprisePart: string | undefined = normalized
+      .substring(enterprisesPrefix.length)
+      .split(".")[0];
+
+    const enterpriseNumber: number = parseInt(enterprisePart || "", 10);
+    return isNaN(enterpriseNumber) ? undefined : enterpriseNumber;
+  }
+
+  public static getVendorNameBySysObjectId(
+    sysObjectId: string | undefined,
+  ): string | undefined {
+    const enterpriseNumber: number | undefined =
+      SnmpVendorTemplateUtil.getEnterpriseNumber(sysObjectId);
+
+    if (enterpriseNumber === undefined) {
+      return undefined;
+    }
+
+    return ENTERPRISE_VENDOR_NAMES[enterpriseNumber];
+  }
+
+  /*
+   * Suggests the vendor OID template matching a device's sysObjectID.
+   * Returns undefined when no vendor-specific template exists — callers can
+   * fall back to the generic Host Resources template, which most
+   * Linux-based appliances answer.
+   */
+  public static matchBySysObjectId(
+    sysObjectId: string | undefined,
+  ): SnmpVendorTemplate | undefined {
+    const enterpriseNumber: number | undefined =
+      SnmpVendorTemplateUtil.getEnterpriseNumber(sysObjectId);
+
+    if (enterpriseNumber === undefined) {
+      return undefined;
+    }
+
+    const templateId: string | undefined =
+      ENTERPRISE_TEMPLATE_IDS[enterpriseNumber];
+
+    return templateId ? SnmpVendorTemplateUtil.getById(templateId) : undefined;
+  }
+
   /*
    * Merges a template's OIDs into an existing list, skipping any OID already
    * present so applying a template twice (or applying two overlapping ones)

package/Types/Monitor/SnmpMonitor/SnmpVersion.ts

@@ -4,4 +4,44 @@ enum SnmpVersion {
   V3 = "3",
 }
 
+/*
+ * Two spellings exist, and they belong to two different layers:
+ *
+ *   - These enum VALUES ("1"/"2c"/"3") are the probe-contract spelling.
+ *     MonitorStepSnmpMonitor.snmpVersion is typed as this enum, and
+ *     SnmpMonitor branches on it to pick the session type.
+ *   - The KEYS ("V1"/"V2c"/"V3") are the stored spelling. The free-text
+ *     snmpVersion column on NetworkDevice / NetworkDeviceDiscoveryScan holds
+ *     these: it is what every form writes, what the column default is, and
+ *     what the public API reference documents as the allowed values.
+ *
+ * parse() is the conversion at that seam, and it is the only correct way to
+ * read the column. Comparing the raw column against an enum member instead
+ * silently takes the wrong branch — a stored "V3" is not === SnmpVersion.V3
+ * ("3"), so a v3 device reads as v2c and gets polled in cleartext.
+ *
+ * parse() also accepts the value spelling and mixed case, so a row written by
+ * hand (direct API call, manual DB edit) can't strand a device in the wrong
+ * branch. No product path writes that spelling — the tolerance is a guard, not
+ * a sign that the column is expected to hold both.
+ */
+export class SnmpVersionUtil {
+  public static parse(value: string | undefined | null): SnmpVersion {
+    switch ((value || "").trim().toLowerCase()) {
+      case "1":
+      case "v1":
+        return SnmpVersion.V1;
+      case "3":
+      case "v3":
+        return SnmpVersion.V3;
+      default:
+        return SnmpVersion.V2c;
+    }
+  }
+
+  public static isV3(value: string | undefined | null): boolean {
+    return SnmpVersionUtil.parse(value) === SnmpVersion.V3;
+  }
+}
+
 export default SnmpVersion;

package/Types/NetFlow/NetworkFlowRecord.ts

@@ -0,0 +1,25 @@
+/*
+ * One network flow parsed from a NetFlow v5 record, forwarded by a probe's
+ * NetFlow receiver to the server, where it is correlated to a NetworkDevice
+ * by the EXPORTER's IP address (the router/switch that sent the datagram)
+ * and written into the ClickHouse NetworkFlow table. Source/destination
+ * describe the traffic itself; exporterIpAddress identifies the device that
+ * observed it. Flow timestamps are converted to wall-clock time by the
+ * probe from the datagram's sysUptime/unixSecs header fields.
+ */
+export default interface NetworkFlowRecord {
+  exporterIpAddress: string;
+  sourceIpAddress: string;
+  destinationIpAddress: string;
+  sourcePort: number;
+  destinationPort: number;
+  protocolNumber: number;
+  octets: number;
+  packets: number;
+  flowStartAt: Date;
+  flowEndAt: Date;
+  inputInterfaceIndex?: number | undefined;
+  outputInterfaceIndex?: number | undefined;
+  tcpFlags?: number | undefined;
+  tos?: number | undefined;
+}

package/Types/Syslog/SyslogMessage.ts

@@ -0,0 +1,18 @@
+/*
+ * A syslog message received by a probe's syslog receiver and forwarded to
+ * the server, where it is correlated to a NetworkDevice by source IP and
+ * written into the telemetry Logs pipeline. Facility and severity are the
+ * RFC 5424 numerical codes decoded from the message's <PRI> prefix
+ * (facility 0-23, severity 0-7). The timestamp comes from the message
+ * itself when parseable, otherwise it equals receivedAt.
+ */
+export default interface SyslogMessage {
+  sourceIpAddress: string;
+  facility: number;
+  severity: number;
+  timestamp: Date;
+  hostname?: string | undefined;
+  appName?: string | undefined;
+  message: string;
+  receivedAt: Date;
+}

package/Types/Telemetry/TelemetrySavedViewState.ts

@@ -1,3 +1,5 @@
+import { JSONObject } from "../JSON";
+
 /*
  * Serializable view state for the Metrics and Traces explorers. Stored in the
  * `query` JSONB column of MetricSavedView / TraceSavedView. This is the same
@@ -25,4 +27,11 @@ export default interface TelemetrySavedViewState {
   pageSize?: number | undefined;
   // Traces explorer: root-spans-only toggle (defaults to true when absent).
   rootOnly?: boolean | undefined;
+  /*
+   * Metrics explorer: the full chart-builder state — MetricsViewConfig-
+   * shaped { queryConfigs, formulaConfigs } plus a time-range token.
+   * Kept loosely typed like the rest of this state: the explorer owns
+   * serialization and must deserialize defensively.
+   */
+  explorerConfig?: JSONObject | undefined;
 }