cribl-control-plane 0.0.38a1__py3-none-any.whl → 0.0.40__py3-none-any.whl

cribl_control_plane/models/inputcrowdstrike.py

@@ -201,7 +201,7 @@ class InputCrowdstrikeTypedDict(TypedDict):
     skip_on_error: NotRequired[bool]
     r"""Skip files that trigger a processing error. Disabled by default, which allows retries after processing errors."""
     include_sqs_metadata: NotRequired[bool]
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
     enable_assume_role: NotRequired[bool]
     r"""Use Assume Role credentials to access Amazon S3"""
     assume_role_arn: NotRequired[str]
@@ -338,7 +338,7 @@ class InputCrowdstrike(BaseModel):
     include_sqs_metadata: Annotated[
         Optional[bool], pydantic.Field(alias="includeSqsMetadata")
     ] = False
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
 
     enable_assume_role: Annotated[
         Optional[bool], pydantic.Field(alias="enableAssumeRole")

cribl_control_plane/models/inputs3.py

@@ -196,7 +196,7 @@ class InputS3TypedDict(TypedDict):
     skip_on_error: NotRequired[bool]
     r"""Skip files that trigger a processing error. Disabled by default, which allows retries after processing errors."""
     include_sqs_metadata: NotRequired[bool]
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
     enable_assume_role: NotRequired[bool]
     r"""Use Assume Role credentials to access Amazon S3"""
     assume_role_arn: NotRequired[str]
@@ -337,7 +337,7 @@ class InputS3(BaseModel):
     include_sqs_metadata: Annotated[
         Optional[bool], pydantic.Field(alias="includeSqsMetadata")
     ] = False
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
 
     enable_assume_role: Annotated[
         Optional[bool], pydantic.Field(alias="enableAssumeRole")

cribl_control_plane/models/inputs3inventory.py

@@ -201,7 +201,7 @@ class InputS3InventoryTypedDict(TypedDict):
     skip_on_error: NotRequired[bool]
     r"""Skip files that trigger a processing error. Disabled by default, which allows retries after processing errors."""
     include_sqs_metadata: NotRequired[bool]
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
     enable_assume_role: NotRequired[bool]
     r"""Use Assume Role credentials to access Amazon S3"""
     assume_role_arn: NotRequired[str]
@@ -346,7 +346,7 @@ class InputS3Inventory(BaseModel):
     include_sqs_metadata: Annotated[
         Optional[bool], pydantic.Field(alias="includeSqsMetadata")
     ] = False
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
 
     enable_assume_role: Annotated[
         Optional[bool], pydantic.Field(alias="enableAssumeRole")

cribl_control_plane/models/inputsecuritylake.py

@@ -201,7 +201,7 @@ class InputSecurityLakeTypedDict(TypedDict):
     skip_on_error: NotRequired[bool]
     r"""Skip files that trigger a processing error. Disabled by default, which allows retries after processing errors."""
     include_sqs_metadata: NotRequired[bool]
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
     enable_assume_role: NotRequired[bool]
     r"""Use Assume Role credentials to access Amazon S3"""
     assume_role_arn: NotRequired[str]
@@ -342,7 +342,7 @@ class InputSecurityLake(BaseModel):
     include_sqs_metadata: Annotated[
         Optional[bool], pydantic.Field(alias="includeSqsMetadata")
     ] = False
-    r"""Include metadata from SQS notifications on outgoing events"""
+    r"""Attach SQS notification metadata to a __sqsMetadata field on each event"""
 
     enable_assume_role: Annotated[
         Optional[bool], pydantic.Field(alias="enableAssumeRole")

cribl_control_plane/models/inputwineventlogs.py

@@ -181,7 +181,7 @@ class InputWinEventLogs(BaseModel):
     pq: Optional[InputWinEventLogsPq] = None
 
     read_mode: Annotated[Optional[ReadMode], pydantic.Field(alias="readMode")] = (
-        ReadMode.OLDEST
+        ReadMode.NEWEST
     )
     r"""Read all stored and future event logs, or only future events"""
 

cribl_control_plane/models/jobinfo.py

@@ -0,0 +1,25 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .jobstatus import JobStatus, JobStatusTypedDict
+from .runnablejob import RunnableJob, RunnableJobTypedDict
+from cribl_control_plane.types import BaseModel
+from typing import Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class JobInfoTypedDict(TypedDict):
+    args: RunnableJobTypedDict
+    id: str
+    status: JobStatusTypedDict
+    keep: NotRequired[bool]
+
+
+class JobInfo(BaseModel):
+    args: RunnableJob
+
+    id: str
+
+    status: JobStatus
+
+    keep: Optional[bool] = None

cribl_control_plane/models/jobstatus.py

@@ -0,0 +1,17 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from typing import Any, Dict, Optional
+from typing_extensions import NotRequired, TypedDict
+
+
+class JobStatusTypedDict(TypedDict):
+    state: Dict[str, Any]
+    reason: NotRequired[Dict[str, Any]]
+
+
+class JobStatus(BaseModel):
+    state: Dict[str, Any]
+
+    reason: Optional[Dict[str, Any]] = None

cribl_control_plane/models/outputcrowdstrikenextgensiem.py

@@ -298,7 +298,7 @@ class OutputCrowdstrikeNextGenSiem(BaseModel):
     format_: Annotated[
         Optional[OutputCrowdstrikeNextGenSiemRequestFormat],
         pydantic.Field(alias="format"),
-    ] = OutputCrowdstrikeNextGenSiemRequestFormat.RAW
+    ] = OutputCrowdstrikeNextGenSiemRequestFormat.JSON
     r"""When set to JSON, the event is automatically formatted with required fields before sending. When set to Raw, only the event's `_raw` value is sent."""
 
     auth_type: Annotated[

cribl_control_plane/models/outputgooglepubsub.py

@@ -8,7 +8,7 @@ from typing import List, Optional
 from typing_extensions import Annotated, NotRequired, TypedDict
 
 
-class OutputGooglePubsubTypeGooglePubsub(str, Enum):
+class OutputGooglePubsubType(str, Enum):
     GOOGLE_PUBSUB = "google_pubsub"
 
 
@@ -20,25 +20,6 @@ class OutputGooglePubsubGoogleAuthenticationMethod(str, Enum):
     SECRET = "secret"
 
 
-class FlushPeriodSecType(str, Enum):
-    NUMBER = "number"
-
-
-class FlushPeriodSecTypedDict(TypedDict):
-    r"""Maximum time to wait before sending a batch (when batch size limit is not reached)."""
-
-    type: NotRequired[FlushPeriodSecType]
-    default: NotRequired[float]
-
-
-class FlushPeriodSec(BaseModel):
-    r"""Maximum time to wait before sending a batch (when batch size limit is not reached)."""
-
-    type: Optional[FlushPeriodSecType] = None
-
-    default: Optional[float] = None
-
-
 class OutputGooglePubsubBackpressureBehavior(str, Enum):
     r"""How to handle events when all receivers are exerting backpressure"""
 
@@ -78,7 +59,7 @@ class OutputGooglePubsubPqControls(BaseModel):
 
 
 class OutputGooglePubsubTypedDict(TypedDict):
-    type: OutputGooglePubsubTypeGooglePubsub
+    type: OutputGooglePubsubType
     topic_name: str
     r"""ID of the topic to send events to."""
     id: NotRequired[str]
@@ -111,8 +92,8 @@ class OutputGooglePubsubTypedDict(TypedDict):
     r"""Maximum number of queued batches before blocking."""
     max_record_size_kb: NotRequired[float]
     r"""Maximum size (KB) of batches to send."""
-    flush_period_sec: NotRequired[FlushPeriodSecTypedDict]
-    r"""Maximum time to wait before sending a batch (when batch size limit is not reached)."""
+    flush_period: NotRequired[float]
+    r"""Maximum time to wait before sending a batch (when batch size limit is not reached)"""
     max_in_progress: NotRequired[float]
     r"""The maximum number of in-progress API requests before backpressure is applied."""
     on_backpressure: NotRequired[OutputGooglePubsubBackpressureBehavior]
@@ -134,7 +115,7 @@ class OutputGooglePubsubTypedDict(TypedDict):
 
 
 class OutputGooglePubsub(BaseModel):
-    type: OutputGooglePubsubTypeGooglePubsub
+    type: OutputGooglePubsubType
 
     topic_name: Annotated[str, pydantic.Field(alias="topicName")]
     r"""ID of the topic to send events to."""
@@ -199,10 +180,8 @@ class OutputGooglePubsub(BaseModel):
     ] = 256
     r"""Maximum size (KB) of batches to send."""
 
-    flush_period_sec: Annotated[
-        Optional[FlushPeriodSec], pydantic.Field(alias="flushPeriodSec")
-    ] = None
-    r"""Maximum time to wait before sending a batch (when batch size limit is not reached)."""
+    flush_period: Annotated[Optional[float], pydantic.Field(alias="flushPeriod")] = 1
+    r"""Maximum time to wait before sending a batch (when batch size limit is not reached)"""
 
     max_in_progress: Annotated[
         Optional[float], pydantic.Field(alias="maxInProgress")

cribl_control_plane/models/outputsentineloneaisiem.py

@@ -25,7 +25,7 @@ class OutputSentinelOneAiSiemRegion(str, Enum):
 
 
 class AISIEMEndpointPath(str, Enum):
-    r"""Regional endpoint used to send events to, such as /services/collector/event or /services/collector/raw"""
+    r"""Endpoint to send events to. Use /services/collector/event for structured JSON payloads with standard HEC top-level fields. Use /services/collector/raw for unstructured log lines (plain text)."""
 
     ROOT_SERVICES_COLLECTOR_EVENT = "/services/collector/event"
     ROOT_SERVICES_COLLECTOR_RAW = "/services/collector/raw"
@@ -164,7 +164,7 @@ class OutputSentinelOneAiSiemTypedDict(TypedDict):
     region: NotRequired[OutputSentinelOneAiSiemRegion]
     r"""The SentinelOne region to send events to. In most cases you can find the region by either looking at your SentinelOne URL or knowing what geographic region your SentinelOne instance is contained in."""
     endpoint: NotRequired[AISIEMEndpointPath]
-    r"""Regional endpoint used to send events to, such as /services/collector/event or /services/collector/raw"""
+    r"""Endpoint to send events to. Use /services/collector/event for structured JSON payloads with standard HEC top-level fields. Use /services/collector/raw for unstructured log lines (plain text)."""
     concurrency: NotRequired[float]
     r"""Maximum number of ongoing requests before blocking"""
     max_payload_size_kb: NotRequired[float]
@@ -281,7 +281,7 @@ class OutputSentinelOneAiSiem(BaseModel):
     endpoint: Optional[AISIEMEndpointPath] = (
         AISIEMEndpointPath.ROOT_SERVICES_COLLECTOR_EVENT
     )
-    r"""Regional endpoint used to send events to, such as /services/collector/event or /services/collector/raw"""
+    r"""Endpoint to send events to. Use /services/collector/event for structured JSON payloads with standard HEC top-level fields. Use /services/collector/raw for unstructured log lines (plain text)."""
 
     concurrency: Optional[float] = 5
     r"""Maximum number of ongoing requests before blocking"""

cribl_control_plane/models/packinfo.py

@@ -9,19 +9,19 @@ from typing_extensions import Annotated, NotRequired, TypedDict
 
 class PackInfoTagsTypedDict(TypedDict):
     data_type: List[str]
-    domain: List[str]
-    streamtags: List[str]
     technology: List[str]
+    domain: NotRequired[List[str]]
+    streamtags: NotRequired[List[str]]
 
 
 class PackInfoTags(BaseModel):
     data_type: Annotated[List[str], pydantic.Field(alias="dataType")]
 
-    domain: List[str]
+    technology: List[str]
 
-    streamtags: List[str]
+    domain: Optional[List[str]] = None
 
-    technology: List[str]
+    streamtags: Optional[List[str]] = None
 
 
 class PackInfoTypedDict(TypedDict):

cribl_control_plane/models/packinstallinfo.py

@@ -9,25 +9,25 @@ from typing_extensions import Annotated, NotRequired, TypedDict
 
 class PackInstallInfoTagsTypedDict(TypedDict):
     data_type: List[str]
-    domain: List[str]
-    streamtags: List[str]
     technology: List[str]
+    domain: NotRequired[List[str]]
+    streamtags: NotRequired[List[str]]
 
 
 class PackInstallInfoTags(BaseModel):
     data_type: Annotated[List[str], pydantic.Field(alias="dataType")]
 
-    domain: List[str]
+    technology: List[str]
 
-    streamtags: List[str]
+    domain: Optional[List[str]] = None
 
-    technology: List[str]
+    streamtags: Optional[List[str]] = None
 
 
 class PackInstallInfoTypedDict(TypedDict):
     id: str
     source: str
-    warnings: Any
+    warnings: List[str]
     author: NotRequired[str]
     description: NotRequired[str]
     display_name: NotRequired[str]
@@ -47,7 +47,7 @@ class PackInstallInfo(BaseModel):
 
     source: str
 
-    warnings: Any
+    warnings: List[str]
 
     author: Optional[str] = None
 

cribl_control_plane/models/packrequestbody_union.py

@@ -0,0 +1,140 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import List, Optional, Union
+from typing_extensions import Annotated, NotRequired, TypeAliasType, TypedDict
+
+
+class PackRequestBodyTags2TypedDict(TypedDict):
+    data_type: NotRequired[List[str]]
+    domain: NotRequired[List[str]]
+    technology: NotRequired[List[str]]
+    streamtags: NotRequired[List[str]]
+
+
+class PackRequestBodyTags2(BaseModel):
+    data_type: Annotated[Optional[List[str]], pydantic.Field(alias="dataType")] = None
+
+    domain: Optional[List[str]] = None
+
+    technology: Optional[List[str]] = None
+
+    streamtags: Optional[List[str]] = None
+
+
+class PackRequestBody2TypedDict(TypedDict):
+    source: str
+    r"""The source of the pack. If not present, an empty pack will be created"""
+    id: NotRequired[str]
+    spec: NotRequired[str]
+    version: NotRequired[str]
+    min_log_stream_version: NotRequired[str]
+    display_name: NotRequired[str]
+    author: NotRequired[str]
+    description: NotRequired[str]
+    tags: NotRequired[PackRequestBodyTags2TypedDict]
+    allow_custom_functions: NotRequired[bool]
+    force: NotRequired[bool]
+
+
+class PackRequestBody2(BaseModel):
+    source: str
+    r"""The source of the pack. If not present, an empty pack will be created"""
+
+    id: Optional[str] = None
+
+    spec: Optional[str] = None
+
+    version: Optional[str] = None
+
+    min_log_stream_version: Annotated[
+        Optional[str], pydantic.Field(alias="minLogStreamVersion")
+    ] = None
+
+    display_name: Annotated[Optional[str], pydantic.Field(alias="displayName")] = None
+
+    author: Optional[str] = None
+
+    description: Optional[str] = None
+
+    tags: Optional[PackRequestBodyTags2] = None
+
+    allow_custom_functions: Annotated[
+        Optional[bool], pydantic.Field(alias="allowCustomFunctions")
+    ] = None
+
+    force: Optional[bool] = None
+
+
+class PackRequestBodyTags1TypedDict(TypedDict):
+    data_type: NotRequired[List[str]]
+    domain: NotRequired[List[str]]
+    technology: NotRequired[List[str]]
+    streamtags: NotRequired[List[str]]
+
+
+class PackRequestBodyTags1(BaseModel):
+    data_type: Annotated[Optional[List[str]], pydantic.Field(alias="dataType")] = None
+
+    domain: Optional[List[str]] = None
+
+    technology: Optional[List[str]] = None
+
+    streamtags: Optional[List[str]] = None
+
+
+class PackRequestBody1TypedDict(TypedDict):
+    id: str
+    spec: NotRequired[str]
+    version: NotRequired[str]
+    min_log_stream_version: NotRequired[str]
+    display_name: NotRequired[str]
+    author: NotRequired[str]
+    description: NotRequired[str]
+    source: NotRequired[str]
+    r"""The source of the pack. If not present, an empty pack will be created"""
+    tags: NotRequired[PackRequestBodyTags1TypedDict]
+    allow_custom_functions: NotRequired[bool]
+    force: NotRequired[bool]
+
+
+class PackRequestBody1(BaseModel):
+    id: str
+
+    spec: Optional[str] = None
+
+    version: Optional[str] = None
+
+    min_log_stream_version: Annotated[
+        Optional[str], pydantic.Field(alias="minLogStreamVersion")
+    ] = None
+
+    display_name: Annotated[Optional[str], pydantic.Field(alias="displayName")] = None
+
+    author: Optional[str] = None
+
+    description: Optional[str] = None
+
+    source: Optional[str] = None
+    r"""The source of the pack. If not present, an empty pack will be created"""
+
+    tags: Optional[PackRequestBodyTags1] = None
+
+    allow_custom_functions: Annotated[
+        Optional[bool], pydantic.Field(alias="allowCustomFunctions")
+    ] = None
+
+    force: Optional[bool] = None
+
+
+PackRequestBodyUnionTypedDict = TypeAliasType(
+    "PackRequestBodyUnionTypedDict",
+    Union[PackRequestBody1TypedDict, PackRequestBody2TypedDict],
+)
+
+
+PackRequestBodyUnion = TypeAliasType(
+    "PackRequestBodyUnion", Union[PackRequestBody1, PackRequestBody2]
+)

cribl_control_plane/models/packupgraderequest.py

@@ -0,0 +1,26 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PackUpgradeRequestTypedDict(TypedDict):
+    source: str
+    allow_custom_functions: NotRequired[bool]
+    minor: NotRequired[str]
+    spec: NotRequired[str]
+
+
+class PackUpgradeRequest(BaseModel):
+    source: str
+
+    allow_custom_functions: Annotated[
+        Optional[bool], pydantic.Field(alias="allowCustomFunctions")
+    ] = None
+
+    minor: Optional[str] = None
+
+    spec: Optional[str] = None

cribl_control_plane/models/runnablejob.py

@@ -0,0 +1,27 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .runnablejobcollection import RunnableJobCollection, RunnableJobCollectionTypedDict
+from .runnablejobexecutor import RunnableJobExecutor, RunnableJobExecutorTypedDict
+from .runnablejobscheduledsearch import (
+    RunnableJobScheduledSearch,
+    RunnableJobScheduledSearchTypedDict,
+)
+from typing import Union
+from typing_extensions import TypeAliasType
+
+
+RunnableJobTypedDict = TypeAliasType(
+    "RunnableJobTypedDict",
+    Union[
+        RunnableJobScheduledSearchTypedDict,
+        RunnableJobExecutorTypedDict,
+        RunnableJobCollectionTypedDict,
+    ],
+)
+
+
+RunnableJob = TypeAliasType(
+    "RunnableJob",
+    Union[RunnableJobScheduledSearch, RunnableJobExecutor, RunnableJobCollection],
+)