@oneuptime/common 12.0.29 → 12.0.31

package/Models/AnalyticsModels/SecurityEvent.ts

@@ -7,7 +7,6 @@ import AnalyticsTableColumn, {
 } from "../../Types/AnalyticsDatabase/TableColumn";
 import TableColumnType from "../../Types/AnalyticsDatabase/TableColumnType";
 import { ColumnAccessControl } from "../../Types/BaseDatabase/AccessControl";
-import OperationalResource from "../../Types/Database/AccessControl/OperationalResource";
 import OwnedThrough from "../../Types/Database/AccessControl/OwnedThrough";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
@@ -31,23 +30,41 @@ import ServiceType from "../../Types/Telemetry/ServiceType";
  * ("everything mentioning this host") cheap.
  */
 
+/*
+ * Security events read through the Security tiers and nothing broader.
+ *
+ * The layout mirrors Log, but the access list deliberately does not: Log names
+ * ProjectMember, the project-wide Viewer and the three Telemetry tiers, and if
+ * this table did the same then every principal in the project could read the
+ * SIEM. A Telemetry Admin is trusted with logs, metrics and traces; that is not
+ * the same decision as being trusted with authentication failures, privilege
+ * escalations and the detections written over them, and an organisation running
+ * a SIEM needs to be able to make the second decision separately from the first.
+ *
+ * ProjectOwner and ProjectAdmin stay so a project is never locked out of its own
+ * data - they are the principals who can grant the Security tiers in the first
+ * place, so excluding them would only mean nobody could open the door.
+ */
 const readPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
-  Permission.ProjectMember,
-  Permission.Viewer,
-  Permission.TelemetryAdmin,
-  Permission.TelemetryMember,
-  Permission.TelemetryViewer,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
   Permission.ReadSecurityEvent,
 ];
 
+/*
+ * Rows normally arrive through the SecOps poller, the detection-rule evaluator
+ * and the threat-intel matcher, all of which insert as root and never reach
+ * this list. It gates the CRUD API only, which is why it stops at the tiers
+ * that administer the SIEM.
+ */
 const createPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
-  Permission.ProjectMember,
-  Permission.TelemetryAdmin,
-  Permission.TelemetryMember,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
   Permission.CreateSecurityEvent,
 ];
 
@@ -149,7 +166,19 @@ function arrayTextColumn(
   });
 }
 
-@OperationalResource()
+/*
+ * Not @OperationalResource, which Log and Span both are.
+ *
+ * That decorator's only effect on an analytics model is to widen the table's
+ * permission list with the *AllOperationalResources wildcards - the grant whose
+ * own description reads "all operational resources in this project (Monitor,
+ * Incident, Alert, StatusPage, etc.)". Nobody handing that to an integration is
+ * deciding to hand it the SIEM, and leaving it on would have left one door open
+ * behind the Security tiers.
+ *
+ * @OwnedThrough stays: owned-scope filtering keys off it alone, so a Security
+ * role granted with scope=Owned still narrows to the services it owns.
+ */
 @OwnedThrough("primaryEntityId", Service, { includeProjectScope: true })
 export default class SecurityEvent extends AnalyticsBaseModel {
   public constructor() {
@@ -450,17 +479,20 @@ export default class SecurityEvent extends AnalyticsBaseModel {
         update: [
           Permission.ProjectOwner,
           Permission.ProjectAdmin,
-          Permission.ProjectMember,
-          Permission.TelemetryAdmin,
-          Permission.TelemetryMember,
+          Permission.SecurityAdmin,
+          Permission.SecurityMember,
           Permission.EditSecurityEvent,
         ],
+        /*
+         * Deleting a security event destroys the record of something that
+         * happened, which is the one thing a SIEM exists to keep. It sits on
+         * the Admin tier rather than Member for the same reason the retention
+         * policy does.
+         */
         delete: [
           Permission.ProjectOwner,
           Permission.ProjectAdmin,
-          Permission.ProjectMember,
-          Permission.TelemetryAdmin,
-          Permission.TelemetryMember,
+          Permission.SecurityAdmin,
           Permission.DeleteSecurityEvent,
         ],
       },

package/Models/AnalyticsModels/ThreatIntelIndicator.ts

@@ -30,14 +30,18 @@ import Permission from "../../Types/Permission";
  * lazy garbage collection, not expiry enforcement.
  */
 
+/*
+ * Indicators read through the Security tiers, like every other SIEM table.
+ * Which IOCs a project subscribes to is itself intelligence about what it is
+ * defending against, so it follows the security events it is matched against
+ * rather than the telemetry it sits beside in ClickHouse.
+ */
 const readPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
-  Permission.ProjectMember,
-  Permission.Viewer,
-  Permission.TelemetryAdmin,
-  Permission.TelemetryMember,
-  Permission.TelemetryViewer,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
   Permission.ReadProjectThreatIntelFeed,
 ];
 
@@ -258,6 +262,7 @@ export default class ThreatIntelIndicator extends AnalyticsBaseModel {
         delete: [
           Permission.ProjectOwner,
           Permission.ProjectAdmin,
+          Permission.SecurityAdmin,
           Permission.DeleteProjectThreatIntelFeed,
         ],
       },

package/Models/DatabaseModels/AlertSeverity.ts

@@ -33,6 +33,14 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @EnableDocumentation()
 @EnableMCP()
+/*
+ * The Security tiers read this table but hold none of the alert permissions.
+ * A Sigma detection rule and a threat-intel feed each choose the severity of
+ * the alert they open, so the SIEM's own forms select from here; without the
+ * read grant the dropdown 500s and the rule cannot be configured at all.
+ * Read-only, and only on the severity list itself - it says nothing about
+ * which alerts a Security role may see.
+ */
 @TenantColumn("projectId")
 @TableAccessControl({
   create: [
@@ -49,6 +57,9 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
     Permission.AlertAdmin,
     Permission.AlertMember,
     Permission.AlertViewer,
+    Permission.SecurityAdmin,
+    Permission.SecurityMember,
+    Permission.SecurityViewer,
     Permission.ReadAlertSeverity,
   ],
   delete: [
@@ -100,6 +111,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -143,6 +157,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -178,6 +195,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [
@@ -213,6 +233,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -247,6 +270,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [
@@ -286,6 +312,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -327,6 +356,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -354,6 +386,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -391,6 +426,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [],
@@ -423,6 +461,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [
@@ -466,6 +507,9 @@ export default class AlertSeverity extends BaseModel {
       Permission.AlertAdmin,
       Permission.AlertMember,
       Permission.AlertViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadAlertSeverity,
     ],
     update: [

package/Models/DatabaseModels/DetectionRule.ts

@@ -22,26 +22,35 @@ import Permission from "../../Types/Permission";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * Part of the SIEM, so it reads and is administered through the Security
+ * tiers rather than the Telemetry ones it used to share a list with. A
+ * detection rule and a threat-intel subscription describe what a project is
+ * watching for and what it believes it is up against, which is security
+ * posture rather than observability configuration.
+ */
 const createPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
   Permission.CreateProjectDetectionRule,
 ];
 
 const readPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
-  Permission.ProjectMember,
-  Permission.Viewer,
-  Permission.TelemetryAdmin,
-  Permission.TelemetryMember,
-  Permission.TelemetryViewer,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
   Permission.ReadProjectDetectionRule,
 ];
 
 const updatePermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
   Permission.EditProjectDetectionRule,
 ];
 
@@ -84,6 +93,8 @@ const updatePermissions: Array<Permission> = [
   delete: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
+    Permission.SecurityAdmin,
+    Permission.SecurityMember,
     Permission.DeleteProjectDetectionRule,
   ],
   update: updatePermissions,

package/Models/DatabaseModels/GoogleSecOpsConnection.ts

@@ -19,19 +19,28 @@ import Permission from "../../Types/Permission";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * Configuring the connector means pointing the project at someone's Chronicle
+ * instance and holding the service-account key that reads it, so it stays on
+ * the Admin tiers. SecurityAdmin joins them: this is the SIEM's own plumbing,
+ * and the role that runs the SIEM is the one that should be able to connect it
+ * to a source without also being a project administrator.
+ *
+ * The key itself is not covered by any of these - serviceAccountJson declares
+ * `read: []` and is never returned by the API.
+ */
 const adminPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
 ];
 
 const readPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
-  Permission.ProjectMember,
-  Permission.Viewer,
-  Permission.TelemetryAdmin,
-  Permission.TelemetryMember,
-  Permission.TelemetryViewer,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
 ];
 
 /*

package/Models/DatabaseModels/IncidentSeverity.ts

@@ -33,6 +33,14 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @EnableDocumentation()
 @EnableMCP()
+/*
+ * The Security tiers read this table but hold none of the incident permissions.
+ * A Sigma detection rule and a threat-intel feed each choose the severity of
+ * the incident they open, so the SIEM's own forms select from here; without the
+ * read grant the dropdown 500s and the rule cannot be configured at all.
+ * Read-only, and only on the severity list itself - it says nothing about
+ * which incidents a Security role may see.
+ */
 @TenantColumn("projectId")
 @TableAccessControl({
   create: [
@@ -49,6 +57,9 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
     Permission.IncidentAdmin,
     Permission.IncidentMember,
     Permission.IncidentViewer,
+    Permission.SecurityAdmin,
+    Permission.SecurityMember,
+    Permission.SecurityViewer,
     Permission.ReadIncidentSeverity,
   ],
   delete: [
@@ -100,6 +111,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -143,6 +157,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -178,6 +195,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [
@@ -213,6 +233,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -247,6 +270,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [
@@ -286,6 +312,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -327,6 +356,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -354,6 +386,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -391,6 +426,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [],
@@ -423,6 +461,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [
@@ -466,6 +507,9 @@ export default class IncidentSeverity extends BaseModel {
       Permission.IncidentAdmin,
       Permission.IncidentMember,
       Permission.IncidentViewer,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
       Permission.ReadIncidentSeverity,
     ],
     update: [

package/Models/DatabaseModels/Index.ts

@@ -12,6 +12,7 @@ import NetworkDeviceOwnerUser from "./NetworkDeviceOwnerUser";
 import NetworkDeviceOwnerRule from "./NetworkDeviceOwnerRule";
 import NetworkDeviceLabelRule from "./NetworkDeviceLabelRule";
 import NetworkDeviceAutoImportRule from "./NetworkDeviceAutoImportRule";
+import NetworkDeviceOidTemplate from "./NetworkDeviceOidTemplate";
 import NetworkDeviceDiscoveryScan from "./NetworkDeviceDiscoveryScan";
 import NetworkInterface from "./NetworkInterface";
 import NetworkSite from "./NetworkSite";
@@ -164,6 +165,12 @@ import OnCallDutyPolicyScheduleLayer from "./OnCallDutyPolicyScheduleLayer";
 import OnCallDutyPolicyScheduleLayerUser from "./OnCallDutyPolicyScheduleLayerUser";
 import OnCallDutyPolicyScheduleOwnerTeam from "./OnCallDutyPolicyScheduleOwnerTeam";
 import OnCallDutyPolicyScheduleOwnerUser from "./OnCallDutyPolicyScheduleOwnerUser";
+// On-call calendar feeds and shift reminders
+import UserOnCallCalendarFeed from "./UserOnCallCalendarFeed";
+import OnCallDutyPolicyScheduleCalendarFeed from "./OnCallDutyPolicyScheduleCalendarFeed";
+import ProjectOnCallCalendarFeed from "./ProjectOnCallCalendarFeed";
+import UserOnCallShiftReminder from "./UserOnCallShiftReminder";
+import UserOnCallShiftReminderLog from "./UserOnCallShiftReminderLog";
 
 // On-Call Duty Label and Owner Rules
 import OnCallDutyPolicyLabelRule from "./OnCallDutyPolicyLabelRule";
@@ -762,6 +769,11 @@ const AllModelTypes: Array<{
   OnCallDutyPolicyScheduleLayerUser,
   OnCallDutyPolicyScheduleOwnerTeam,
   OnCallDutyPolicyScheduleOwnerUser,
+  OnCallDutyPolicyScheduleCalendarFeed,
+  ProjectOnCallCalendarFeed,
+  UserOnCallCalendarFeed,
+  UserOnCallShiftReminder,
+  UserOnCallShiftReminderLog,
   OnCallDutyPolicyFeed,
   OnCallDutyPolicyOwnerTeam,
   OnCallDutyPolicyOwnerUser,
@@ -867,6 +879,7 @@ const AllModelTypes: Array<{
   NetworkDeviceOwnerRule,
   NetworkDeviceLabelRule,
   NetworkDeviceAutoImportRule,
+  NetworkDeviceOidTemplate,
   NetworkDeviceDiscoveryScan,
   NetworkInterface,
   NetworkSite,

package/Models/DatabaseModels/NetworkDevice.ts

@@ -1,6 +1,7 @@
 import Label from "./Label";
 import Monitor from "./Monitor";
 import MonitorStatus from "./MonitorStatus";
+import NetworkDeviceOidTemplate from "./NetworkDeviceOidTemplate";
 import NetworkSite from "./NetworkSite";
 import Probe from "./Probe";
 import Project from "./Project";
@@ -116,6 +117,18 @@ import {
  * free to maintain and the alternative is a full scan per rollup.
  */
 @Index(["projectId", "siteId"])
+/*
+ * "Which devices use this OID Collection Template?" - the count on the
+ * template page, the Template column's filter on the device list, and the
+ * FK's own ON DELETE SET NULL scan.
+ *
+ * Project-prefixed and composite, like every other index on this table and
+ * for the reason written at the top of this block: a bare column index on a
+ * nullable FK is one btree entry per row of the product's hottest table,
+ * paid on every poll, to serve queries that all carry a projectId anyway.
+ * This is the same shape siteId gets above, and deliberately so.
+ */
+@Index(["projectId", "oidTemplateId"])
 /*
  * The other half of the Overview's attention list: reachable devices with the
  * most dark ports.
@@ -588,6 +601,103 @@ export default class NetworkDevice extends BaseModel {
   })
   public siteId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDevice,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "oidTemplateId",
+    type: TableColumnType.Entity,
+    modelType: NetworkDeviceOidTemplate,
+    title: "OID Collection Template",
+    description:
+      "The OID Collection Template this device collects, on top of any device-specific Health OIDs below. The link is live: editing the template changes what this device collects on its next poll.",
+  })
+  @ManyToOne(
+    () => {
+      return NetworkDeviceOidTemplate;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "oidTemplateId" })
+  public oidTemplate?: NetworkDeviceOidTemplate = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDevice,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  /*
+   * No column-level index here on purpose - the composite
+   * (projectId, oidTemplateId) declared at the top of the class serves every
+   * reader. See the comment there.
+   */
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "OID Collection Template ID",
+    description: "ID of the OID Collection Template this device collects",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public oidTemplateId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [
@@ -1474,9 +1584,9 @@ export default class NetworkDevice extends BaseModel {
   @TableColumn({
     type: TableColumnType.JSON,
     required: false,
-    title: "Health OIDs",
+    title: "Device-Specific Health OIDs",
     description:
-      "SNMP OIDs (CPU, memory, temperature, or any custom OID) collected on each poll. Values are recorded as metrics and can be alerted on through monitor criteria.",
+      "SNMP OIDs collected on each poll for this device ALONE, on top of whatever its OID Collection Template collects. Values are recorded as metrics and can be alerted on through monitor criteria. If several devices need the same OID, put it on a template instead.",
   })
   @Column({
     type: ColumnType.JSON,
@@ -1608,7 +1718,7 @@ export default class NetworkDevice extends BaseModel {
     required: false,
     title: "Last Walk Log",
     description:
-      "The previous poll's raw walk response. Kept so interface rates (bandwidth, utilization, errors/sec) can be computed as counter deltas between polls. Managed by the server.",
+      "The previous poll's interface counters. Kept so interface rates (bandwidth, utilization, errors/sec) can be computed as counter deltas between polls, and stores nothing else - the rest of the walk response has no reader and this column is rewritten on every poll of every device. Managed by the server.",
   })
   @Column({
     type: ColumnType.JSON,