cribl-control-plane 0.0.21__py3-none-any.whl → 0.4.0b23__py3-none-any.whl

cribl_control_plane/models/functionmvpull.py

@@ -0,0 +1,99 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionMvPullID(str, Enum):
+    MV_PULL = "mv_pull"
+
+
+class FunctionMvPullSchemaTypedDict(TypedDict):
+    array_path: str
+    r"""Field name of the array within events that contains the data objects of interest. Can be a path."""
+    relative_key_path: str
+    r"""Extract the K-V pair's key from this field, relative to the data object."""
+    relative_value_path: str
+    r"""Extract the K-V pair's value from this field, relative to the data object."""
+    target_bag_path: NotRequired[str]
+    r"""Optionally, specify a bag as the target for K-V entries. If not specified, these entries are stored on each top-level event."""
+    delete_original: NotRequired[bool]
+    r"""Toggle this on to remove each original array of data objects after extraction. If toggled off, arrays are retained."""
+
+
+class FunctionMvPullSchema(BaseModel):
+    array_path: Annotated[str, pydantic.Field(alias="arrayPath")]
+    r"""Field name of the array within events that contains the data objects of interest. Can be a path."""
+
+    relative_key_path: Annotated[str, pydantic.Field(alias="relativeKeyPath")]
+    r"""Extract the K-V pair's key from this field, relative to the data object."""
+
+    relative_value_path: Annotated[str, pydantic.Field(alias="relativeValuePath")]
+    r"""Extract the K-V pair's value from this field, relative to the data object."""
+
+    target_bag_path: Annotated[Optional[str], pydantic.Field(alias="targetBagPath")] = (
+        None
+    )
+    r"""Optionally, specify a bag as the target for K-V entries. If not specified, these entries are stored on each top-level event."""
+
+    delete_original: Annotated[
+        Optional[bool], pydantic.Field(alias="deleteOriginal")
+    ] = False
+    r"""Toggle this on to remove each original array of data objects after extraction. If toggled off, arrays are retained."""
+
+
+class FunctionMvPullTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionMvPullID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionMvPullSchemaTypedDict]
+
+
+class FunctionMvPull(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionMvPullID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionMvPullSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionnotificationpolicies.py

@@ -0,0 +1,186 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Any, Dict, List, Optional, Union
+from typing_extensions import Annotated, NotRequired, TypeAliasType, TypedDict
+
+
+class FunctionNotificationPoliciesID(str, Enum):
+    NOTIFICATION_POLICIES = "notification_policies"
+
+
+class Operator(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""Comparison operator"""
+
+    EQUAL = "="
+    NOT_EQUAL = "!="
+    REGEX_MATCH = "=~"
+    REGEX_NOT_MATCH = "!~"
+
+
+ValueTypedDict = TypeAliasType("ValueTypedDict", Union[str, float, bool])
+r"""Value to compare against (string, number, boolean)"""
+
+
+Value = TypeAliasType("Value", Union[str, float, bool])
+r"""Value to compare against (string, number, boolean)"""
+
+
+class ConditionTypedDict(TypedDict):
+    key: str
+    r"""Event field name to match against"""
+    operator: Operator
+    r"""Comparison operator"""
+    value: ValueTypedDict
+    r"""Value to compare against (string, number, boolean)"""
+
+
+class Condition(BaseModel):
+    key: str
+    r"""Event field name to match against"""
+
+    operator: Annotated[Operator, PlainValidator(validate_open_enum(False))]
+    r"""Comparison operator"""
+
+    value: Value
+    r"""Value to compare against (string, number, boolean)"""
+
+    @field_serializer("operator")
+    def serialize_operator(self, value):
+        if isinstance(value, str):
+            try:
+                return models.Operator(value)
+            except ValueError:
+                return value
+        return value
+
+
+class TemplateTargetPairTypedDict(TypedDict):
+    template_id: str
+    r"""ID of the notification template to use"""
+    target_id: str
+    r"""ID of the notification target (output)"""
+
+
+class TemplateTargetPair(BaseModel):
+    template_id: Annotated[str, pydantic.Field(alias="templateId")]
+    r"""ID of the notification template to use"""
+
+    target_id: Annotated[str, pydantic.Field(alias="targetId")]
+    r"""ID of the notification target (output)"""
+
+
+class PolicyTypedDict(TypedDict):
+    id: str
+    r"""Unique identifier for this policy"""
+    template_target_pairs: List[TemplateTargetPairTypedDict]
+    r"""List of targets to route to and the templates to use"""
+    disabled: NotRequired[bool]
+    r"""If true, this policy will be skipped during evaluation"""
+    wait_to_group: NotRequired[float]
+    r"""Time to wait (in minutes) to group similar alerts before sending"""
+    group_by_labels: NotRequired[List[str]]
+    r"""Event fields to use for grouping"""
+    conditions: NotRequired[List[List[ConditionTypedDict]]]
+    r"""List of conditions. If ANY condition matches (OR), the policy applies. Each condition is a list of tags that must ALL match (AND)."""
+    final: NotRequired[bool]
+    r"""If true, stop evaluating further policies after this one matches"""
+
+
+class Policy(BaseModel):
+    id: str
+    r"""Unique identifier for this policy"""
+
+    template_target_pairs: Annotated[
+        List[TemplateTargetPair], pydantic.Field(alias="templateTargetPairs")
+    ]
+    r"""List of targets to route to and the templates to use"""
+
+    disabled: Optional[bool] = False
+    r"""If true, this policy will be skipped during evaluation"""
+
+    wait_to_group: Annotated[Optional[float], pydantic.Field(alias="waitToGroup")] = (
+        None
+    )
+    r"""Time to wait (in minutes) to group similar alerts before sending"""
+
+    group_by_labels: Annotated[
+        Optional[List[str]], pydantic.Field(alias="groupByLabels")
+    ] = None
+    r"""Event fields to use for grouping"""
+
+    conditions: Optional[List[List[Condition]]] = None
+    r"""List of conditions. If ANY condition matches (OR), the policy applies. Each condition is a list of tags that must ALL match (AND)."""
+
+    final: Optional[bool] = False
+    r"""If true, stop evaluating further policies after this one matches"""
+
+
+class NotificationPoliciesConfigurationTypedDict(TypedDict):
+    policies: NotRequired[List[PolicyTypedDict]]
+    r"""List of notification routing policies evaluated in order"""
+
+
+class NotificationPoliciesConfiguration(BaseModel):
+    policies: Optional[List[Policy]] = None
+    r"""List of notification routing policies evaluated in order"""
+
+
+class FunctionNotificationPoliciesTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionNotificationPoliciesID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[NotificationPoliciesConfigurationTypedDict]
+
+
+class FunctionNotificationPolicies(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionNotificationPoliciesID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[NotificationPoliciesConfiguration], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionnotifications.py

@@ -0,0 +1,85 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionNotificationsID(str, Enum):
+    NOTIFICATIONS = "notifications"
+
+
+class FunctionNotificationsSchemaTypedDict(TypedDict):
+    id: str
+    r"""Notification ID"""
+    field: str
+    r"""Notification event state field name"""
+    deduplicate: bool
+    r"""Toggle deduplication."""
+
+
+class FunctionNotificationsSchema(BaseModel):
+    id: str
+    r"""Notification ID"""
+
+    field: str
+    r"""Notification event state field name"""
+
+    deduplicate: bool
+    r"""Toggle deduplication."""
+
+
+class FunctionNotificationsTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionNotificationsID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionNotificationsSchemaTypedDict]
+
+
+class FunctionNotifications(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionNotificationsID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionNotificationsSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionnotify.py

@@ -0,0 +1,196 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionNotifyID(str, Enum):
+    NOTIFY = "notify"
+
+
+class TriggerType(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""Type of the trigger condition. custom applies a kusto expression over the results, and results count applies a comparison over results count"""
+
+    # Where
+    CUSTOM = "custom"
+    # Count of Results
+    RESULTS_COUNT = "resultsCount"
+
+
+class CountComparator(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""Operation to be applied over the results count"""
+
+    # greater than
+    GREATER_THAN_ = ">"
+    # less than
+    LESS_THAN_ = "<"
+    # equals
+    EQUAL_EQUAL_EQUAL_ = "==="
+    # not equal to
+    NOT_EQUAL_EQUAL_ = "!=="
+    # greater than or equal to
+    GREATER_THAN_EQUAL_ = ">="
+    # less than or equal to
+    LESS_THAN_EQUAL_ = "<="
+
+
+class NotifyConfigurationTypedDict(TypedDict):
+    search_id: str
+    r"""Id of the search this function is running on."""
+    saved_query_id: str
+    r"""Id of the saved query"""
+    search_url: str
+    r"""Url of the search results"""
+    auth_token: str
+    r"""Auth token for sending notification messages"""
+    messages_endpoint: str
+    r"""System messages api endpoint"""
+    group: NotRequired[str]
+    r"""Group the notification belongs to"""
+    notification_id: NotRequired[str]
+    r"""Workspace within the deployment to send the search results to."""
+    trigger: NotRequired[str]
+    r"""Js expression that filters events, a greater than 'Trigger Count' events will trigger the notification"""
+    trigger_type: NotRequired[TriggerType]
+    r"""Type of the trigger condition. custom applies a kusto expression over the results, and results count applies a comparison over results count"""
+    trigger_comparator: NotRequired[CountComparator]
+    r"""Operation to be applied over the results count"""
+    trigger_count: NotRequired[float]
+    r"""How many results that match trigger the condition"""
+    results_limit: NotRequired[float]
+    r"""Number of results to include in the notification event"""
+    message: NotRequired[str]
+    r"""Message content template, available fields: searchId, resultSet, savedQueryId, notificationId, searchResultsUrl"""
+    tenant_id: NotRequired[str]
+    r"""Current tenant id"""
+
+
+class NotifyConfiguration(BaseModel):
+    search_id: Annotated[str, pydantic.Field(alias="searchId")]
+    r"""Id of the search this function is running on."""
+
+    saved_query_id: Annotated[str, pydantic.Field(alias="savedQueryId")]
+    r"""Id of the saved query"""
+
+    search_url: Annotated[str, pydantic.Field(alias="searchUrl")]
+    r"""Url of the search results"""
+
+    auth_token: Annotated[str, pydantic.Field(alias="authToken")]
+    r"""Auth token for sending notification messages"""
+
+    messages_endpoint: Annotated[str, pydantic.Field(alias="messagesEndpoint")]
+    r"""System messages api endpoint"""
+
+    group: Optional[str] = "default"
+    r"""Group the notification belongs to"""
+
+    notification_id: Annotated[
+        Optional[str], pydantic.Field(alias="notificationId")
+    ] = "main"
+    r"""Workspace within the deployment to send the search results to."""
+
+    trigger: Optional[str] = None
+    r"""Js expression that filters events, a greater than 'Trigger Count' events will trigger the notification"""
+
+    trigger_type: Annotated[
+        Annotated[Optional[TriggerType], PlainValidator(validate_open_enum(False))],
+        pydantic.Field(alias="triggerType"),
+    ] = None
+    r"""Type of the trigger condition. custom applies a kusto expression over the results, and results count applies a comparison over results count"""
+
+    trigger_comparator: Annotated[
+        Annotated[Optional[CountComparator], PlainValidator(validate_open_enum(False))],
+        pydantic.Field(alias="triggerComparator"),
+    ] = None
+    r"""Operation to be applied over the results count"""
+
+    trigger_count: Annotated[Optional[float], pydantic.Field(alias="triggerCount")] = 0
+    r"""How many results that match trigger the condition"""
+
+    results_limit: Annotated[Optional[float], pydantic.Field(alias="resultsLimit")] = 50
+    r"""Number of results to include in the notification event"""
+
+    message: Optional[str] = None
+    r"""Message content template, available fields: searchId, resultSet, savedQueryId, notificationId, searchResultsUrl"""
+
+    tenant_id: Annotated[Optional[str], pydantic.Field(alias="tenantId")] = None
+    r"""Current tenant id"""
+
+    @field_serializer("trigger_type")
+    def serialize_trigger_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.TriggerType(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("trigger_comparator")
+    def serialize_trigger_comparator(self, value):
+        if isinstance(value, str):
+            try:
+                return models.CountComparator(value)
+            except ValueError:
+                return value
+        return value
+
+
+class FunctionNotifyTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionNotifyID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[NotifyConfigurationTypedDict]
+
+
+class FunctionNotify(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionNotifyID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[NotifyConfiguration], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionnumerify.py

@@ -0,0 +1,119 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionNumerifyID(str, Enum):
+    NUMERIFY = "numerify"
+
+
+class FunctionNumerifyFormat(str, Enum, metaclass=utils.OpenEnumMeta):
+    # None
+    NONE = "none"
+    # Fix
+    FIX = "fix"
+    # Floor
+    FLOOR = "floor"
+    # Ceil
+    CEIL = "ceil"
+
+
+class FunctionNumerifySchemaTypedDict(TypedDict):
+    depth: NotRequired[int]
+    r"""Depth to which the Numerify Function will search within a nested event. Depth greater than 5 (the default) could decrease performance."""
+    ignore_fields: NotRequired[List[str]]
+    r"""Fields to NOT numerify. Takes precedence over 'Include expression' when set. Supports wildcards. A '!' before field name(s) means: numerify all fields EXCEPT these. For syntax details, see [Wildcard Lists](https://docs.cribl.io/stream/introduction-reference/#wildcard-lists)."""
+    filter_expr: NotRequired[str]
+    r"""Optional JavaScript expression to determine whether a field should be numerified. If left blank, all fields will be numerified. Use the 'name' and 'value' global variables to access fields' names/values. Examples: `value != null`, `name=='fieldname'`. You can access other fields' values via `__e.<fieldName>`."""
+    format_: NotRequired[FunctionNumerifyFormat]
+
+
+class FunctionNumerifySchema(BaseModel):
+    depth: Optional[int] = 5
+    r"""Depth to which the Numerify Function will search within a nested event. Depth greater than 5 (the default) could decrease performance."""
+
+    ignore_fields: Annotated[
+        Optional[List[str]], pydantic.Field(alias="ignoreFields")
+    ] = None
+    r"""Fields to NOT numerify. Takes precedence over 'Include expression' when set. Supports wildcards. A '!' before field name(s) means: numerify all fields EXCEPT these. For syntax details, see [Wildcard Lists](https://docs.cribl.io/stream/introduction-reference/#wildcard-lists)."""
+
+    filter_expr: Annotated[Optional[str], pydantic.Field(alias="filterExpr")] = None
+    r"""Optional JavaScript expression to determine whether a field should be numerified. If left blank, all fields will be numerified. Use the 'name' and 'value' global variables to access fields' names/values. Examples: `value != null`, `name=='fieldname'`. You can access other fields' values via `__e.<fieldName>`."""
+
+    format_: Annotated[
+        Annotated[
+            Optional[FunctionNumerifyFormat], PlainValidator(validate_open_enum(False))
+        ],
+        pydantic.Field(alias="format"),
+    ] = FunctionNumerifyFormat.NONE
+
+    @field_serializer("format_")
+    def serialize_format_(self, value):
+        if isinstance(value, str):
+            try:
+                return models.FunctionNumerifyFormat(value)
+            except ValueError:
+                return value
+        return value
+
+
+class FunctionNumerifyTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionNumerifyID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionNumerifySchemaTypedDict]
+
+
+class FunctionNumerify(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionNumerifyID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionNumerifySchema], pydantic.Field(alias="schema")
+    ] = None