@oneuptime/common 11.5.9 → 11.5.10

package/Types/BaseDatabase/AggregationIntervalUtil.ts

@@ -36,9 +36,23 @@ export class AggregationIntervalUtil {
 
     const diff: number = endDate.getTime() - startDate.getTime();
 
+    /*
+     * ~180-point budget per chart: each tier keeps the rendered point
+     * count in the tens-to-hundreds instead of collapsing a 4h window
+     * to ~4 hourly points or exploding a 12h window into 720 minutes.
+     */
     if (diff <= 1000 * 60 * 60 * 3) {
       // if less than 3 hours, then get minute precision
       return AggregationInterval.Minute;
+    } else if (diff <= 1000 * 60 * 60 * 12) {
+      // 12 hours
+      return AggregationInterval.FiveMinutes;
+    } else if (diff <= 1000 * 60 * 60 * 24) {
+      // 24 hours
+      return AggregationInterval.FifteenMinutes;
+    } else if (diff <= 1000 * 60 * 60 * 24 * 3) {
+      // 3 days
+      return AggregationInterval.ThirtyMinutes;
     } else if (diff <= 1000 * 60 * 60 * 24 * 7) {
       // 7 days
       return AggregationInterval.Hour;
@@ -69,6 +83,12 @@ export class AggregationIntervalUtil {
     switch (interval) {
       case AggregationInterval.Minute:
         return 1000 * 60;
+      case AggregationInterval.FiveMinutes:
+        return 1000 * 60 * 5;
+      case AggregationInterval.FifteenMinutes:
+        return 1000 * 60 * 15;
+      case AggregationInterval.ThirtyMinutes:
+        return 1000 * 60 * 30;
       case AggregationInterval.Hour:
         return 1000 * 60 * 60;
       case AggregationInterval.Day:
@@ -102,11 +122,13 @@ export class AggregationIntervalUtil {
    * (the first bucket is partial and its timestamp falls before the axis
    * origin).
    *
-   * Only Minute/Hour/Day are aligned: for those the fixed-ms epoch grid is
-   * an EXACT match for ClickHouse's UTC bucketing (epoch-day == UTC
-   * midnight), and these are the windows where the leading gap is actually
-   * visible. Week/Month/Year snap to calendar boundaries (Monday / 1st /
-   * Jan-1) server-side, which a fixed-ms grid can't reproduce, so those (and
+   * Only the sub-day intervals (Minute through Hour, plus Day) are aligned:
+   * for those the fixed-ms epoch grid is an EXACT match for ClickHouse's
+   * UTC bucketing (5/15/30-minute `toStartOfInterval` grids are counted in
+   * whole intervals since the epoch, and epoch-day == UTC midnight), and
+   * these are the windows where the leading gap is actually visible.
+   * Week/Month/Year snap to calendar boundaries (Monday / 1st / Jan-1)
+   * server-side, which a fixed-ms grid can't reproduce, so those (and
    * `Total`) are returned UNCHANGED rather than risk shifting the gap for
    * long windows — their pre-existing behavior is preserved.
    */
@@ -117,6 +139,9 @@ export class AggregationIntervalUtil {
     const ms: number = OneUptimeDate.fromString(date).getTime();
     const alignableIntervals: Array<AggregationInterval> = [
       AggregationInterval.Minute,
+      AggregationInterval.FiveMinutes,
+      AggregationInterval.FifteenMinutes,
+      AggregationInterval.ThirtyMinutes,
       AggregationInterval.Hour,
       AggregationInterval.Day,
     ];

package/Types/Dashboard/DashboardComponents/DashboardTraceChartComponent.ts

@@ -33,6 +33,22 @@ export default interface DashboardTraceChartComponent extends BaseComponent {
     groupByAttribute?: string | undefined;
     // Cap on the number of series when split (default 10).
     topLimit?: number | undefined;
+    /*
+     * Optional user-chosen lead color for the chart, stored as a hex string
+     * (e.g. "#6366f1"). Single-series → the series color; split charts → the
+     * first unpinned series, with the rest following the default palette.
+     * Same semantics as MetricQueryConfigData.color on the metric Chart
+     * widget. Unset = Auto (default palette).
+     */
+    color?: string | undefined;
+    /*
+     * Per-series color pins for split charts, keyed by "key=value" segment
+     * (e.g. { "url.host=api.example.com": "#10b981" }) — the same storage
+     * shape as MetricQueryConfigData.colorsByGroup, so the shared
+     * SeriesGroupColorSelector editor works unchanged. Unpinned series fall
+     * back to `color` (lead) then the default palette.
+     */
+    colorsByGroup?: Record<string, string> | undefined;
     /*
      * Include non-root spans. Off by default so "Request Count" matches the
      * traces explorer, which is root-spans-only.

package/Types/Email/EmailTemplateType.ts

@@ -86,6 +86,9 @@ enum EmailTemplateType {
   Invoice = "Invoice.hbs",
 
   ClickhouseCapacityWarning = "ClickhouseCapacityWarning.hbs",
+
+  EnterpriseLicenseUserLimitBreach = "EnterpriseLicenseUserLimitBreach.hbs",
+  EnterpriseLicenseExpiryReminder = "EnterpriseLicenseExpiryReminder.hbs",
 }
 
 export default EmailTemplateType;

package/Types/Marketing/MarketingConversion.ts

@@ -0,0 +1,11 @@
+export enum MarketingConversionType {
+  SignUp = "SignUp",
+  PaidSubscription = "PaidSubscription",
+}
+
+export enum MarketingConversionUploadStatus {
+  Uploaded = "Uploaded",
+  Failed = "Failed",
+  // No click id relevant to this ad platform — nothing to upload.
+  Skipped = "Skipped",
+}

package/Types/Metrics/MetricQueryConfigData.ts

@@ -13,6 +13,16 @@ export interface ChartSeries {
 }
 
 export default interface MetricQueryConfigData {
+  /*
+   * Stable identity for this query, independent of its position in the
+   * queryConfigs array. Chart layers key per-chart UI state (hidden
+   * series, search, Top-N, sort) on this id so removing/reordering
+   * queries doesn't transfer one chart's state to another. Assigned at
+   * query-creation sites (ObjectID-based); older persisted configs won't
+   * have it, so consumers must tolerate its absence. Intentionally NOT
+   * part of the explorer URL serialization.
+   */
+  id?: string | undefined;
   metricAliasData?: MetricAliasData | undefined;
   metricQueryData: MetricQueryData;
   getSeries?: ((data: AggregatedModel) => ChartSeries) | undefined;
@@ -59,4 +69,15 @@ export default interface MetricQueryConfigData {
    * on agent restart) are clamped to 0.
    */
   transformAsRate?: boolean | undefined;
+  /*
+   * When true, this query is drawn on the PREVIOUS query's chart panel,
+   * sharing its axes, instead of getting a panel of its own. Consecutive
+   * flagged queries chain onto the same panel. Has no effect on the
+   * first query, or when the previous query produced no result (the
+   * query then falls back to its own panel). Both queries are evaluated
+   * over the SAME time window — this is a same-window visual overlay,
+   * not a period-over-period time shift. Plain persisted data like the
+   * fields above (dashboards, saved views, explorer URLs).
+   */
+  overlayWithPreviousQuery?: boolean | undefined;
 }

package/Types/Metrics/MetricQueryData.ts

@@ -17,4 +17,12 @@ export default interface MetricQueryData {
    * whatever) incident creation from a single metric monitor.
    */
   groupByAttributeKeys?: Array<string> | undefined;
+  /**
+   * How many series (groups) to plot for a grouped query. Passed to the
+   * server as `AggregateBy.topK.count` so only the top-N groups (ranked
+   * by max over the window) are fetched, and used as the client-side
+   * display cap. Unset = the default cap (10). Plain persisted data —
+   * saved views and dashboards carry it like any other query field.
+   */
+  topN?: number | undefined;
 }

package/Types/Metrics/MetricViewData.ts

@@ -3,4 +3,12 @@ import MetricsViewConfig from "./MetricsViewConfig";
 
 export default interface MetricViewData extends MetricsViewConfig {
   startAndEndDate: InBetween<Date> | null;
+  /*
+   * Optional relative-time token (a Range enum value from
+   * Common/Types/Time/TimeRange, e.g. "Past 1 Hour"). When set, the
+   * resolved startAndEndDate re-anchors to "now" on fetch/refresh instead
+   * of staying pinned to the instant it was first resolved. Custom /
+   * pinned absolute windows carry no token.
+   */
+  rangeToken?: string | undefined;
 }

package/Types/Monitor/MonitorMetricType.ts

@@ -34,6 +34,14 @@ enum MonitorMetricType {
   SnmpInterfaceUtilizationPercent = "oneuptime.monitor.snmp.interface.utilization.percent",
   SnmpInterfaceErrorsPerSecond = "oneuptime.monitor.snmp.interface.errors.per.second",
 
+  /*
+   * One series per polled OID that returned a numeric value (oid / oidName
+   * attributes) — CPU, memory, temperature from vendor templates and any
+   * custom OID a user adds. This is what makes polled OIDs chartable and
+   * evaluable over time.
+   */
+  SnmpOidValue = "oneuptime.monitor.snmp.oid.value",
+
   /*
    * Extended server/VM metrics. Emitted when the agent payload contains them;
    * absent for older agents, which keeps the pipeline backwards-compatible.

package/Types/Monitor/MonitorStep.ts

@@ -47,6 +47,7 @@ import MonitorStepDnssecMonitor, {
 import MonitorStepSqlMonitor, {
   MonitorStepSqlMonitorUtil,
 } from "./MonitorStepSqlMonitor";
+import SqlDatabaseType from "./SqlDatabaseType";
 import MonitorStepExternalStatusPageMonitor, {
   MonitorStepExternalStatusPageMonitorUtil,
 } from "./MonitorStepExternalStatusPageMonitor";
@@ -780,6 +781,14 @@ export default class MonitorStep extends DatabaseProperty {
       if (!value.data.sqlMonitor.query || !value.data.sqlMonitor.query.trim()) {
         return "SQL query is required";
       }
+
+      if (
+        value.data.sqlMonitor.useWindowsIntegratedAuthentication &&
+        value.data.sqlMonitor.databaseType !==
+          SqlDatabaseType.MicrosoftSqlServer
+      ) {
+        return "Windows Integrated Authentication is only supported for Microsoft SQL Server";
+      }
     }
 
     if (monitorType === MonitorType.ExternalStatusPage) {

package/Types/Monitor/MonitorStepSqlMonitor.ts

@@ -64,6 +64,12 @@ export default interface MonitorStepSqlMonitor {
   username: string;
   // Raw password OR a {{monitorSecrets.name}} reference resolved server-side.
   password: string;
+  /*
+   * Microsoft SQL Server only: authenticate with the identity under which the
+   * probe is running (SSPI on Windows, Kerberos on Linux/macOS). Username and
+   * password are ignored when this is enabled.
+   */
+  useWindowsIntegratedAuthentication: boolean;
   useSsl: boolean;
   /*
    * When SSL is on, whether the server certificate chain must validate. Users
@@ -87,6 +93,7 @@ export class MonitorStepSqlMonitorUtil {
       databaseName: "",
       username: "",
       password: "",
+      useWindowsIntegratedAuthentication: false,
       useSsl: false,
       rejectUnauthorizedSsl: true,
       query: "",
@@ -105,6 +112,9 @@ export class MonitorStepSqlMonitorUtil {
       databaseName: (json["databaseName"] as string) || "",
       username: (json["username"] as string) || "",
       password: (json["password"] as string) || "",
+      useWindowsIntegratedAuthentication: Boolean(
+        json["useWindowsIntegratedAuthentication"],
+      ),
       useSsl: Boolean(json["useSsl"]),
       rejectUnauthorizedSsl:
         json["rejectUnauthorizedSsl"] === undefined ||
@@ -130,6 +140,8 @@ export class MonitorStepSqlMonitorUtil {
       databaseName: monitor.databaseName,
       username: monitor.username,
       password: monitor.password,
+      useWindowsIntegratedAuthentication:
+        monitor.useWindowsIntegratedAuthentication,
       useSsl: monitor.useSsl,
       rejectUnauthorizedSsl: monitor.rejectUnauthorizedSsl,
       query: monitor.query,

package/Types/Monitor/MonitorType.ts

@@ -480,7 +480,8 @@ export class MonitorTypeHelper {
     return (
       monitorType === MonitorType.IncomingRequest ||
       monitorType === MonitorType.IncomingEmail ||
-      monitorType === MonitorType.Server
+      monitorType === MonitorType.Server ||
+      monitorType === MonitorType.NetworkDevice
     );
   }
 

package/Types/Monitor/SSLMonitor/SslMonitorResponse.ts

@@ -1,14 +1,19 @@
+/*
+ * Every field is optional AND explicitly undefined-able: a certificate need
+ * not carry any given subject field, and under exactOptionalPropertyTypes the
+ * probe cannot assign a "may be absent" value into a bare optional property.
+ */
 export default interface SslMonitorResponse {
-  isSelfSigned?: boolean;
-  createdAt?: Date;
-  expiresAt?: Date;
-  commonName?: string;
-  organizationalUnit?: string;
-  organization?: string;
-  locality?: string;
-  state?: string;
-  country?: string;
-  serialNumber?: string;
-  fingerprint?: string;
-  fingerprint256?: string;
+  isSelfSigned?: boolean | undefined;
+  createdAt?: Date | undefined;
+  expiresAt?: Date | undefined;
+  commonName?: string | undefined;
+  organizationalUnit?: string | undefined;
+  organization?: string | undefined;
+  locality?: string | undefined;
+  state?: string | undefined;
+  country?: string | undefined;
+  serialNumber?: string | undefined;
+  fingerprint?: string | undefined;
+  fingerprint256?: string | undefined;
 }

package/Types/Monitor/SnmpMonitor/CdpNeighbor.ts

@@ -0,0 +1,13 @@
+/*
+ * One neighbor entry from a Cisco device's CDP cache (CISCO-CDP-MIB
+ * cdpCacheTable). Collected as a fallback/complement to LLDP — plenty of
+ * Cisco estates run CDP only, and without it their topology is empty. The
+ * server matches remoteDeviceId against known NetworkDevices the same way it
+ * matches LLDP remoteSysName.
+ */
+export default interface CdpNeighbor {
+  localInterfaceIndex?: number | undefined;
+  remoteDeviceId?: string | undefined;
+  remotePortId?: string | undefined;
+  remotePlatform?: string | undefined;
+}

package/Types/Monitor/SnmpMonitor/NetworkTopology.ts

@@ -1,11 +1,17 @@
 /*
  * A derived view of the network topology for one project, built server-side
- * from the LLDP neighbor data each device reports. Nodes are devices;
- * unmanaged neighbors (LLDP peers with no matching NetworkDevice) appear as
- * lightweight nodes so the graph doesn't dead-end. Edges are LLDP links.
+ * from the LLDP and CDP neighbor data each device reports. Nodes are devices;
+ * unmanaged neighbors (discovery-protocol peers with no matching
+ * NetworkDevice) appear as lightweight nodes so the graph doesn't dead-end.
+ * Edges are physical links — one per device pair even when both ends (or
+ * both protocols) report it — annotated with the operational state of the
+ * interface at each end when the neighbor entry identifies it.
  */
 export type NetworkTopologyNodeStatus = "up" | "down" | "unknown";
 
+// Which discovery protocol(s) reported a link.
+export type NetworkTopologyLinkProtocol = "lldp" | "cdp";
+
 export interface NetworkTopologyNode {
   // Device id for managed nodes; a synthetic "unmanaged:<key>" id otherwise.
   id: string;
@@ -14,6 +20,27 @@ export interface NetworkTopologyNode {
   status: NetworkTopologyNodeStatus;
   interfacesUp?: number | undefined;
   interfacesDown?: number | undefined;
+  // Extra device identity for search and the detail panel (managed nodes).
+  sysName?: string | undefined;
+  vendor?: string | undefined;
+  // For unmanaged CDP peers this carries the reported platform string.
+  deviceModel?: string | undefined;
+}
+
+/*
+ * Operational state of one end of a link, resolved from the NetworkInterface
+ * row for that (device, interfaceIndex) pair when the neighbor entry carries
+ * enough to identify it. All fields optional — enrichment is best-effort.
+ */
+export interface NetworkTopologyEdgeEndpoint {
+  interfaceIndex?: number | undefined;
+  interfaceName?: string | undefined;
+  isOperationallyUp?: boolean | undefined;
+  isAdministrativelyUp?: boolean | undefined;
+  utilizationPercent?: number | undefined;
+  inRateMbps?: number | undefined;
+  outRateMbps?: number | undefined;
+  errorsPerSecond?: number | undefined;
 }
 
 export interface NetworkTopologyEdge {
@@ -21,9 +48,16 @@ export interface NetworkTopologyEdge {
   toNodeId: string;
   fromPort?: string | undefined;
   toPort?: string | undefined;
+  // Discovery protocols that reported this link (deduped union).
+  protocols?: Array<NetworkTopologyLinkProtocol> | undefined;
+  // Operational data at each end, when the endpoint interface is known.
+  fromInterface?: NetworkTopologyEdgeEndpoint | undefined;
+  toInterface?: NetworkTopologyEdgeEndpoint | undefined;
 }
 
 export default interface NetworkTopology {
   nodes: Array<NetworkTopologyNode>;
   edges: Array<NetworkTopologyEdge>;
+  // True when the device query hit its per-project cap — graph may be partial.
+  isTruncated?: boolean | undefined;
 }

package/Types/Monitor/SnmpMonitor/SnmpAuthProtocol.ts

@@ -5,4 +5,50 @@ enum SnmpAuthProtocol {
   SHA512 = "SHA512",
 }
 
+/*
+ * Same free-text column problem as SnmpPrivProtocol: snmpV3AuthProtocol has no
+ * check constraint, and reading it by casting the raw string to this enum
+ * silently drops to the probe's default of MD5 — the weakest digest — when the
+ * spelling does not match exactly. "SHA-256" is what the form labels that
+ * option, so it is a realistic thing to find in a hand-written row.
+ *
+ * This protocol also selects the hash used to localize the *privacy* key
+ * (RFC 3414 section 2.6), so getting it wrong corrupts the DES/AES key as well
+ * as the authentication digest. Both ends then disagree and the device simply
+ * stops answering.
+ *
+ * See SnmpPrivProtocol for why parse() returns undefined instead of a default.
+ * SHA here is SHA-1, the original RFC 3414 algorithm.
+ */
+export class SnmpAuthProtocolUtil {
+  public static parse(
+    value: string | undefined | null,
+  ): SnmpAuthProtocol | undefined {
+    switch ((value || "").trim().toLowerCase()) {
+      case "md5":
+        return SnmpAuthProtocol.MD5;
+      case "sha":
+      case "sha1":
+      case "sha-1":
+        return SnmpAuthProtocol.SHA;
+      case "sha256":
+      case "sha-256":
+        return SnmpAuthProtocol.SHA256;
+      case "sha512":
+      case "sha-512":
+        return SnmpAuthProtocol.SHA512;
+      default:
+        return undefined;
+    }
+  }
+
+  public static isUnrecognized(value: string | undefined | null): boolean {
+    if (!(value || "").trim()) {
+      return false;
+    }
+
+    return SnmpAuthProtocolUtil.parse(value) === undefined;
+  }
+}
+
 export default SnmpAuthProtocol;

package/Types/Monitor/SnmpMonitor/SnmpEntityInfo.ts

@@ -0,0 +1,15 @@
+/*
+ * Hardware identity from ENTITY-MIB entPhysicalTable (1.3.6.1.2.1.47.1.1.1).
+ * The probe picks the chassis row (entPhysicalClass == 3), falling back to
+ * the lowest-indexed row that carries a serial number, since stacked or
+ * modular devices expose one row per component. All fields are best-effort —
+ * many low-end devices do not implement ENTITY-MIB at all.
+ */
+export default interface SnmpEntityInfo {
+  manufacturer?: string | undefined;
+  model?: string | undefined;
+  serialNumber?: string | undefined;
+  hardwareRevision?: string | undefined;
+  firmwareVersion?: string | undefined;
+  softwareVersion?: string | undefined;
+}

package/Types/Monitor/SnmpMonitor/SnmpInterface.ts

@@ -15,6 +15,14 @@ export default interface SnmpInterface {
   alias?: string | undefined;
   isOperationallyUp: boolean;
   isAdministrativelyUp: boolean;
+  /*
+   * ifPhysAddress formatted as lowercase colon-separated hex
+   * ("aa:bb:cc:dd:ee:ff"); undefined for interfaces with no MAC (loopbacks,
+   * tunnels) or when the device returns an empty octet string.
+   */
+  macAddress?: string | undefined;
+  // IANAifType number (ifType column) — 6 = ethernetCsmacd, 24 = loopback...
+  interfaceType?: number | undefined;
   speedInBitsPerSecond?: number | undefined;
   inOctets?: number | undefined;
   outOctets?: number | undefined;

package/Types/Monitor/SnmpMonitor/SnmpMonitorResponse.ts

@@ -2,6 +2,9 @@ import ProbeAttempt from "../../Probe/ProbeAttempt";
 import SnmpDataType from "./SnmpDataType";
 import SnmpInterface from "./SnmpInterface";
 import LldpNeighbor from "./LldpNeighbor";
+import CdpNeighbor from "./CdpNeighbor";
+import SnmpSystemInfo from "./SnmpSystemInfo";
+import SnmpEntityInfo from "./SnmpEntityInfo";
 
 export interface SnmpOidResponse {
   oid: string;
@@ -26,18 +29,24 @@ export default interface SnmpMonitorResponse {
   interfaces?: Array<SnmpInterface> | undefined;
   interfaceWalkFailure?: string | undefined;
   /*
-   * System-group identity (sysDescr / sysName), collected alongside the
-   * interface walk. Used to enrich the NetworkDevice resource.
+   * System-group identity, collected alongside the interface walk. Used to
+   * enrich the NetworkDevice resource. Older probes send only
+   * sysDescr/sysName.
    */
-  systemInfo?:
-    | {
-        sysDescr?: string | undefined;
-        sysName?: string | undefined;
-      }
-    | undefined;
+  systemInfo?: SnmpSystemInfo | undefined;
+  /*
+   * ENTITY-MIB hardware identity (manufacturer/model/serial/firmware),
+   * collected alongside the interface walk on devices that implement it.
+   */
+  entityInfo?: SnmpEntityInfo | undefined;
   /*
    * LLDP neighbors discovered during the walk (when interface monitoring is
    * enabled). Used to build the network topology graph.
    */
   lldpNeighbors?: Array<LldpNeighbor> | undefined;
+  /*
+   * CDP neighbors, walked as a complement to LLDP for Cisco estates.
+   * Undefined on older probes and non-CDP devices.
+   */
+  cdpNeighbors?: Array<CdpNeighbor> | undefined;
 }

package/Types/Monitor/SnmpMonitor/SnmpPrivProtocol.ts

@@ -4,4 +4,57 @@ enum SnmpPrivProtocol {
   AES256 = "AES256",
 }
 
+/*
+ * The snmpV3PrivProtocol column is free text (character varying, no check
+ * constraint), so what lands in it is only as good as whoever wrote it. The
+ * forms write these enum values, but a direct API call, a hand-edited row or
+ * a restored backup can put anything there.
+ *
+ * parse() is the only correct way to read that column. Reading it by casting
+ * the raw string to this enum type compiles fine and then silently misses:
+ * an "AES-256" (the label the form shows) or "aes" is not === any member, so
+ * the probe's protocol switch falls to its default and encrypts with DES —
+ * the weakest option — against a device that expects AES. The poll then fails
+ * in a way that looks like a timeout rather than a config error.
+ *
+ * Returning undefined rather than a default member is deliberate: "unset" and
+ * "unreadable" are different problems, and only the caller knows whether it is
+ * safe to fall back. isUnrecognized() names the second case so the probe can
+ * refuse to poll rather than guess a cipher.
+ *
+ * The accepted spellings cover case, surrounding whitespace, and the hyphen
+ * the UI labels use. AES here is AES-128, per RFC 3826.
+ */
+export class SnmpPrivProtocolUtil {
+  public static parse(
+    value: string | undefined | null,
+  ): SnmpPrivProtocol | undefined {
+    switch ((value || "").trim().toLowerCase()) {
+      case "des":
+        return SnmpPrivProtocol.DES;
+      case "aes":
+      case "aes128":
+      case "aes-128":
+        return SnmpPrivProtocol.AES;
+      case "aes256":
+      case "aes-256":
+        return SnmpPrivProtocol.AES256;
+      default:
+        return undefined;
+    }
+  }
+
+  /*
+   * True only when something is stored and none of the spellings match — an
+   * empty or absent column is "unset", not "unrecognized".
+   */
+  public static isUnrecognized(value: string | undefined | null): boolean {
+    if (!(value || "").trim()) {
+      return false;
+    }
+
+    return SnmpPrivProtocolUtil.parse(value) === undefined;
+  }
+}
+
 export default SnmpPrivProtocol;

package/Types/Monitor/SnmpMonitor/SnmpSecurityLevel.ts

@@ -4,4 +4,47 @@ enum SnmpSecurityLevel {
   AuthPriv = "authPriv",
 }
 
+/*
+ * This is the most consequential of the v3 enums to misread, because the
+ * fallback is not merely a weaker algorithm — it is no security at all.
+ *
+ * The snmpV3SecurityLevel column is free text. Casting it straight to this
+ * enum and letting an unmatched value fall through to NoAuthNoPriv means a
+ * device configured for authPriv gets polled with its authentication and
+ * privacy material dropped: the username goes out in cleartext and nothing is
+ * encrypted. The device rejects it, so the visible symptom is a dead monitor
+ * rather than a config error, and the downgrade itself is invisible.
+ *
+ * The keys ("AuthPriv") and values ("authPriv") differ only by the case of the
+ * first letter, which is exactly the kind of drift a hand-written row or an
+ * API caller reading the docs will produce. Lowercasing collapses the two
+ * spellings onto each other, so parse() accepts both by construction.
+ *
+ * See SnmpPrivProtocol for why parse() returns undefined rather than a default.
+ */
+export class SnmpSecurityLevelUtil {
+  public static parse(
+    value: string | undefined | null,
+  ): SnmpSecurityLevel | undefined {
+    switch ((value || "").trim().toLowerCase()) {
+      case "noauthnopriv":
+        return SnmpSecurityLevel.NoAuthNoPriv;
+      case "authnopriv":
+        return SnmpSecurityLevel.AuthNoPriv;
+      case "authpriv":
+        return SnmpSecurityLevel.AuthPriv;
+      default:
+        return undefined;
+    }
+  }
+
+  public static isUnrecognized(value: string | undefined | null): boolean {
+    if (!(value || "").trim()) {
+      return false;
+    }
+
+    return SnmpSecurityLevelUtil.parse(value) === undefined;
+  }
+}
+
 export default SnmpSecurityLevel;

package/Types/Monitor/SnmpMonitor/SnmpSystemInfo.ts

@@ -0,0 +1,16 @@
+/*
+ * The SNMPv2 system group (1.3.6.1.2.1.1), read by the probe alongside the
+ * interface walk and by subnet discovery. sysObjectId is the vendor's
+ * registered enterprise OID — the canonical device fingerprint used to
+ * suggest a vendor OID template and derive the vendor name without MIBs.
+ * sysUpTimeSeconds is converted from TimeTicks (hundredths of a second) on
+ * the probe.
+ */
+export default interface SnmpSystemInfo {
+  sysDescr?: string | undefined;
+  sysName?: string | undefined;
+  sysObjectId?: string | undefined;
+  sysLocation?: string | undefined;
+  sysContact?: string | undefined;
+  sysUpTimeSeconds?: number | undefined;
+}