cribl-control-plane 0.0.39__py3-none-any.whl → 0.4.0b23__py3-none-any.whl

cribl_control_plane/models/functiongeoip.py

@@ -0,0 +1,120 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionGeoipID(str, Enum):
+    GEOIP = "geoip"
+
+
+class AdditionalFieldTypedDict(TypedDict):
+    extra_in_field: str
+    r"""Field name in which to find an IP to look up. Can be nested."""
+    extra_out_field: str
+    r"""Field name in which to store the GeoIP lookup results"""
+
+
+class AdditionalField(BaseModel):
+    extra_in_field: Annotated[str, pydantic.Field(alias="extraInField")]
+    r"""Field name in which to find an IP to look up. Can be nested."""
+
+    extra_out_field: Annotated[str, pydantic.Field(alias="extraOutField")]
+    r"""Field name in which to store the GeoIP lookup results"""
+
+
+class OutputFieldMappingsTypedDict(TypedDict):
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class OutputFieldMappings(BaseModel):
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class FunctionGeoipSchemaTypedDict(TypedDict):
+    file: str
+    r"""Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension"""
+    in_field: NotRequired[str]
+    r"""Field name in which to find an IP to look up. Can be nested."""
+    out_field: NotRequired[str]
+    r"""Field name in which to store the GeoIP lookup results"""
+    additional_fields: NotRequired[List[AdditionalFieldTypedDict]]
+    out_field_mappings: NotRequired[OutputFieldMappingsTypedDict]
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class FunctionGeoipSchema(BaseModel):
+    file: str
+    r"""Select an uploaded Maxmind database, or specify path to a Maxmind database with .mmdb extension"""
+
+    in_field: Annotated[Optional[str], pydantic.Field(alias="inField")] = "ip"
+    r"""Field name in which to find an IP to look up. Can be nested."""
+
+    out_field: Annotated[Optional[str], pydantic.Field(alias="outField")] = "geoip"
+    r"""Field name in which to store the GeoIP lookup results"""
+
+    additional_fields: Annotated[
+        Optional[List[AdditionalField]], pydantic.Field(alias="additionalFields")
+    ] = None
+
+    out_field_mappings: Annotated[
+        Optional[OutputFieldMappings], pydantic.Field(alias="outFieldMappings")
+    ] = None
+    r"""Search-specific mappings for granular control over event enrichment"""
+
+
+class FunctionGeoipTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionGeoipID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionGeoipSchemaTypedDict]
+
+
+class FunctionGeoip(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionGeoipID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionGeoipSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functiongrok.py

@@ -0,0 +1,95 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionGrokID(str, Enum):
+    GROK = "grok"
+
+
+class PatternListTypedDict(TypedDict):
+    pattern: str
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+
+
+class PatternList(BaseModel):
+    pattern: str
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+
+
+class FunctionGrokSchemaTypedDict(TypedDict):
+    pattern: str
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+    pattern_list: NotRequired[List[PatternListTypedDict]]
+    source: NotRequired[str]
+    r"""Field on which to perform Grok extractions"""
+
+
+class FunctionGrokSchema(BaseModel):
+    pattern: str
+    r"""Grok pattern to extract fields. Syntax supported: %{PATTERN_NAME:FIELD_NAME}"""
+
+    pattern_list: Annotated[
+        Optional[List[PatternList]], pydantic.Field(alias="patternList")
+    ] = None
+
+    source: Optional[str] = "_raw"
+    r"""Field on which to perform Grok extractions"""
+
+
+class FunctionGrokTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionGrokID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionGrokSchemaTypedDict]
+
+
+class FunctionGrok(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionGrokID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[Optional[FunctionGrokSchema], pydantic.Field(alias="schema")] = (
+        None
+    )

cribl_control_plane/models/functionhandlebar.py

@@ -0,0 +1,112 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionHandlebarID(str, Enum):
+    HANDLEBAR = "handlebar"
+
+
+class TemplateDefinitionTypedDict(TypedDict):
+    content: str
+    r"""Handlebars template string"""
+    description: NotRequired[str]
+    r"""Optional description of what this template is used for"""
+    type: NotRequired[str]
+    r"""Type categorization for the template (e.g., Universal, Email, Slack)"""
+
+
+class TemplateDefinition(BaseModel):
+    content: str
+    r"""Handlebars template string"""
+
+    description: Optional[str] = None
+    r"""Optional description of what this template is used for"""
+
+    type: Optional[str] = "Universal"
+    r"""Type categorization for the template (e.g., Universal, Email, Slack)"""
+
+
+class FunctionHandlebarSchemaTypedDict(TypedDict):
+    templates: Dict[str, TemplateDefinitionTypedDict]
+    r"""Object with template_id as keys and template definitions as values. Uses event.__template_id to select template at runtime."""
+    target_field: NotRequired[str]
+    r"""Field name to store the rendered template result. Defaults to _raw."""
+    parse_json: NotRequired[bool]
+    r"""Parse the rendered template as JSON and store as an object instead of a string. Useful for building structured data like Slack blocks."""
+    remove_on_null: NotRequired[bool]
+    r"""Remove the target field if the rendered result is empty or null."""
+
+
+class FunctionHandlebarSchema(BaseModel):
+    templates: Dict[str, TemplateDefinition]
+    r"""Object with template_id as keys and template definitions as values. Uses event.__template_id to select template at runtime."""
+
+    target_field: Annotated[Optional[str], pydantic.Field(alias="targetField")] = "_raw"
+    r"""Field name to store the rendered template result. Defaults to _raw."""
+
+    parse_json: Annotated[Optional[bool], pydantic.Field(alias="parseJson")] = False
+    r"""Parse the rendered template as JSON and store as an object instead of a string. Useful for building structured data like Slack blocks."""
+
+    remove_on_null: Annotated[Optional[bool], pydantic.Field(alias="removeOnNull")] = (
+        True
+    )
+    r"""Remove the target field if the rendered result is empty or null."""
+
+
+class FunctionHandlebarTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionHandlebarID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionHandlebarSchemaTypedDict]
+
+
+class FunctionHandlebar(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionHandlebarID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionHandlebarSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionjoin.py

@@ -0,0 +1,112 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionJoinID(str, Enum):
+    JOIN = "join"
+
+
+class FieldConditionTypedDict(TypedDict):
+    left_field_name: str
+    r"""The field name to join on, on the left side."""
+    right_field_name: str
+    r"""The field name on the right side of the data, i.e. the stage results, that we are joining with"""
+
+
+class FieldCondition(BaseModel):
+    left_field_name: Annotated[str, pydantic.Field(alias="leftFieldName")]
+    r"""The field name to join on, on the left side."""
+
+    right_field_name: Annotated[str, pydantic.Field(alias="rightFieldName")]
+    r"""The field name on the right side of the data, i.e. the stage results, that we are joining with"""
+
+
+class JoinConfigurationTypedDict(TypedDict):
+    field_conditions: List[FieldConditionTypedDict]
+    r"""Fields to use when joining"""
+    kind: NotRequired[str]
+    r"""Join kind, e.g. inner"""
+    hints: NotRequired[Dict[str, str]]
+    r"""Hints passed to the join function"""
+    search_job_id: NotRequired[str]
+    r"""The id for this search job."""
+    stage_id: NotRequired[str]
+    r"""The stage we are joining with."""
+
+
+class JoinConfiguration(BaseModel):
+    field_conditions: Annotated[
+        List[FieldCondition], pydantic.Field(alias="fieldConditions")
+    ]
+    r"""Fields to use when joining"""
+
+    kind: Optional[str] = None
+    r"""Join kind, e.g. inner"""
+
+    hints: Optional[Dict[str, str]] = None
+    r"""Hints passed to the join function"""
+
+    search_job_id: Annotated[Optional[str], pydantic.Field(alias="searchJobId")] = None
+    r"""The id for this search job."""
+
+    stage_id: Annotated[Optional[str], pydantic.Field(alias="stageId")] = None
+    r"""The stage we are joining with."""
+
+
+class FunctionJoinTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionJoinID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[JoinConfigurationTypedDict]
+
+
+class FunctionJoin(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionJoinID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[Optional[JoinConfiguration], pydantic.Field(alias="schema")] = (
+        None
+    )

cribl_control_plane/models/functionjsonunroll.py

@@ -0,0 +1,80 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionJSONUnrollID(str, Enum):
+    JSON_UNROLL = "json_unroll"
+
+
+class FunctionJSONUnrollSchemaTypedDict(TypedDict):
+    path: str
+    r"""Path to array to unroll, such as foo.0.bar"""
+    name: NotRequired[str]
+    r"""Name of each exploded array element in each new event. Leave empty to expand the array element with its original name."""
+
+
+class FunctionJSONUnrollSchema(BaseModel):
+    path: str
+    r"""Path to array to unroll, such as foo.0.bar"""
+
+    name: Optional[str] = None
+    r"""Name of each exploded array element in each new event. Leave empty to expand the array element with its original name."""
+
+
+class FunctionJSONUnrollTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionJSONUnrollID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionJSONUnrollSchemaTypedDict]
+
+
+class FunctionJSONUnroll(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionJSONUnrollID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionJSONUnrollSchema], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionlakeexport.py

@@ -0,0 +1,102 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionLakeExportID(str, Enum):
+    LAKE_EXPORT = "lake_export"
+
+
+class LakeExportConfigurationTypedDict(TypedDict):
+    search_job_id: str
+    r"""Id of the search job this function is running on."""
+    dataset: str
+    r"""Name of the dataset"""
+    lake: NotRequired[str]
+    r"""Name of the lake"""
+    tee: NotRequired[str]
+    r"""Tee results to search. When set to true results will be shipped instead of stats"""
+    flush_ms: NotRequired[float]
+    r"""How often are stats flushed in ms"""
+    suppress_previews: NotRequired[bool]
+    r"""Disables generation of intermediate stats. When true stats will be emitted only on end"""
+
+
+class LakeExportConfiguration(BaseModel):
+    search_job_id: Annotated[str, pydantic.Field(alias="searchJobId")]
+    r"""Id of the search job this function is running on."""
+
+    dataset: str
+    r"""Name of the dataset"""
+
+    lake: Optional[str] = "default"
+    r"""Name of the lake"""
+
+    tee: Optional[str] = "false"
+    r"""Tee results to search. When set to true results will be shipped instead of stats"""
+
+    flush_ms: Annotated[Optional[float], pydantic.Field(alias="flushMs")] = 1000
+    r"""How often are stats flushed in ms"""
+
+    suppress_previews: Annotated[
+        Optional[bool], pydantic.Field(alias="suppressPreviews")
+    ] = None
+    r"""Disables generation of intermediate stats. When true stats will be emitted only on end"""
+
+
+class FunctionLakeExportTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionLakeExportID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[LakeExportConfigurationTypedDict]
+
+
+class FunctionLakeExport(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionLakeExportID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[LakeExportConfiguration], pydantic.Field(alias="schema")
+    ] = None

cribl_control_plane/models/functionlimit.py

@@ -0,0 +1,75 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Any, Dict, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class FunctionLimitID(str, Enum):
+    LIMIT = "limit"
+
+
+class FunctionLimitSchemaTypedDict(TypedDict):
+    limit: NotRequired[int]
+    r"""Number of qualifying events to pass through"""
+
+
+class FunctionLimitSchema(BaseModel):
+    limit: Optional[int] = 100
+    r"""Number of qualifying events to pass through"""
+
+
+class FunctionLimitTypedDict(TypedDict):
+    filename: str
+    group: str
+    id: FunctionLimitID
+    load_time: float
+    mod_time: float
+    name: str
+    uischema: Dict[str, Any]
+    version: str
+    async_timeout: NotRequired[float]
+    cribl_version: NotRequired[str]
+    disabled: NotRequired[bool]
+    handle_signals: NotRequired[bool]
+    sync: NotRequired[bool]
+    schema_: NotRequired[FunctionLimitSchemaTypedDict]
+
+
+class FunctionLimit(BaseModel):
+    filename: Annotated[str, pydantic.Field(alias="__filename")]
+
+    group: str
+
+    id: FunctionLimitID
+
+    load_time: Annotated[float, pydantic.Field(alias="loadTime")]
+
+    mod_time: Annotated[float, pydantic.Field(alias="modTime")]
+
+    name: str
+
+    uischema: Dict[str, Any]
+
+    version: str
+
+    async_timeout: Annotated[Optional[float], pydantic.Field(alias="asyncTimeout")] = (
+        None
+    )
+
+    cribl_version: Optional[str] = None
+
+    disabled: Optional[bool] = None
+
+    handle_signals: Annotated[Optional[bool], pydantic.Field(alias="handleSignals")] = (
+        None
+    )
+
+    sync: Optional[bool] = None
+
+    schema_: Annotated[
+        Optional[FunctionLimitSchema], pydantic.Field(alias="schema")
+    ] = None