cribl-control-plane 0.0.39__py3-none-any.whl → 0.5.0b3__py3-none-any.whl

cribl_control_plane/models/outputcribltcp.py

@@ -1,9 +1,13 @@
 """Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
 
 from __future__ import annotations
+from cribl_control_plane import models, utils
 from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
 from enum import Enum
 import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
 from typing import List, Optional
 from typing_extensions import Annotated, NotRequired, TypedDict
 
@@ -12,21 +16,23 @@ class OutputCriblTCPType(str, Enum):
     CRIBL_TCP = "cribl_tcp"
 
 
-class OutputCriblTCPCompression(str, Enum):
+class OutputCriblTCPCompression(str, Enum, metaclass=utils.OpenEnumMeta):
     r"""Codec to use to compress the data before sending"""
 
+    # None
     NONE = "none"
+    # Gzip
     GZIP = "gzip"
 
 
-class OutputCriblTCPMinimumTLSVersion(str, Enum):
+class OutputCriblTCPMinimumTLSVersion(str, Enum, metaclass=utils.OpenEnumMeta):
     TL_SV1 = "TLSv1"
     TL_SV1_1 = "TLSv1.1"
     TL_SV1_2 = "TLSv1.2"
     TL_SV1_3 = "TLSv1.3"
 
 
-class OutputCriblTCPMaximumTLSVersion(str, Enum):
+class OutputCriblTCPMaximumTLSVersion(str, Enum, metaclass=utils.OpenEnumMeta):
     TL_SV1 = "TLSv1"
     TL_SV1_1 = "TLSv1.1"
     TL_SV1_2 = "TLSv1.2"
@@ -86,23 +92,70 @@ class OutputCriblTCPTLSSettingsClientSide(BaseModel):
     r"""Passphrase to use to decrypt private key"""
 
     min_version: Annotated[
-        Optional[OutputCriblTCPMinimumTLSVersion], pydantic.Field(alias="minVersion")
+        Annotated[
+            Optional[OutputCriblTCPMinimumTLSVersion],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="minVersion"),
     ] = None
 
     max_version: Annotated[
-        Optional[OutputCriblTCPMaximumTLSVersion], pydantic.Field(alias="maxVersion")
+        Annotated[
+            Optional[OutputCriblTCPMaximumTLSVersion],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="maxVersion"),
     ] = None
 
+    @field_serializer("min_version")
+    def serialize_min_version(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPMinimumTLSVersion(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("max_version")
+    def serialize_max_version(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPMaximumTLSVersion(value)
+            except ValueError:
+                return value
+        return value
+
+
+class OutputCriblTCPAuthTokenTypedDict(TypedDict):
+    token_secret: str
+    r"""Select or create a stored text secret"""
+    enabled: NotRequired[bool]
+    description: NotRequired[str]
+    r"""Optional token description"""
+
+
+class OutputCriblTCPAuthToken(BaseModel):
+    token_secret: Annotated[str, pydantic.Field(alias="tokenSecret")]
+    r"""Select or create a stored text secret"""
+
+    enabled: Optional[bool] = True
+
+    description: Optional[str] = None
+    r"""Optional token description"""
+
 
-class OutputCriblTCPBackpressureBehavior(str, Enum):
+class OutputCriblTCPBackpressureBehavior(str, Enum, metaclass=utils.OpenEnumMeta):
     r"""How to handle events when all receivers are exerting backpressure"""
 
+    # Block
     BLOCK = "block"
+    # Drop
     DROP = "drop"
+    # Persistent Queue
     QUEUE = "queue"
 
 
-class OutputCriblTCPTLS(str, Enum):
+class OutputCriblTCPTLS(str, Enum, metaclass=utils.OpenEnumMeta):
     r"""Whether to inherit TLS configs from group setting or disable TLS"""
 
     INHERIT = "inherit"
@@ -129,7 +182,9 @@ class OutputCriblTCPHost(BaseModel):
     port: Optional[float] = 10300
     r"""The port to connect to on the provided host"""
 
-    tls: Optional[OutputCriblTCPTLS] = OutputCriblTCPTLS.INHERIT
+    tls: Annotated[
+        Optional[OutputCriblTCPTLS], PlainValidator(validate_open_enum(False))
+    ] = OutputCriblTCPTLS.INHERIT
     r"""Whether to inherit TLS configs from group setting or disable TLS"""
 
     servername: Optional[str] = None
@@ -138,29 +193,45 @@ class OutputCriblTCPHost(BaseModel):
     weight: Optional[float] = 1
     r"""Assign a weight (>0) to each endpoint to indicate its traffic-handling capability"""
 
+    @field_serializer("tls")
+    def serialize_tls(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPTLS(value)
+            except ValueError:
+                return value
+        return value
+
+
+class OutputCriblTCPMode(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
+
+    # Error
+    ERROR = "error"
+    # Backpressure
+    ALWAYS = "always"
+    # Always On
+    BACKPRESSURE = "backpressure"
+
 
-class OutputCriblTCPPqCompressCompression(str, Enum):
+class OutputCriblTCPPqCompressCompression(str, Enum, metaclass=utils.OpenEnumMeta):
     r"""Codec to use to compress the persisted data"""
 
+    # None
     NONE = "none"
+    # Gzip
     GZIP = "gzip"
 
 
-class OutputCriblTCPQueueFullBehavior(str, Enum):
+class OutputCriblTCPQueueFullBehavior(str, Enum, metaclass=utils.OpenEnumMeta):
     r"""How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged."""
 
+    # Block
     BLOCK = "block"
+    # Drop new data
     DROP = "drop"
 
 
-class OutputCriblTCPMode(str, Enum):
-    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
-
-    ERROR = "error"
-    BACKPRESSURE = "backpressure"
-    ALWAYS = "always"
-
-
 class OutputCriblTCPPqControlsTypedDict(TypedDict):
     pass
 
@@ -196,6 +267,8 @@ class OutputCriblTCPTypedDict(TypedDict):
     r"""Amount of time (milliseconds) to wait for a write to complete before assuming connection is dead"""
     token_ttl_minutes: NotRequired[float]
     r"""The number of minutes before the internally generated authentication token expires, valid values between 1 and 60"""
+    auth_tokens: NotRequired[List[OutputCriblTCPAuthTokenTypedDict]]
+    r"""Shared secrets to be used by connected environments to authorize connections. These tokens should also be installed in Cribl TCP Source in Cribl.Cloud."""
     exclude_fields: NotRequired[List[str]]
     r"""Fields to exclude from the event. By default, all internal fields except `__output` are sent. Example: `cribl_pipe`, `c*`. Wildcards supported."""
     on_backpressure: NotRequired[OutputCriblTCPBackpressureBehavior]
@@ -215,6 +288,16 @@ class OutputCriblTCPTypedDict(TypedDict):
     r"""How far back in time to keep traffic stats for load balancing purposes"""
     max_concurrent_senders: NotRequired[float]
     r"""Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited."""
+    pq_strict_ordering: NotRequired[bool]
+    r"""Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed."""
+    pq_rate_per_sec: NotRequired[float]
+    r"""Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling."""
+    pq_mode: NotRequired[OutputCriblTCPMode]
+    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
+    pq_max_buffer_size: NotRequired[float]
+    r"""The maximum number of events to hold in memory before writing the events to disk"""
+    pq_max_backpressure_sec: NotRequired[float]
+    r"""How long (in seconds) to wait for backpressure to resolve before engaging the queue"""
     pq_max_file_size: NotRequired[str]
     r"""The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.)"""
     pq_max_size: NotRequired[str]
@@ -225,8 +308,6 @@ class OutputCriblTCPTypedDict(TypedDict):
     r"""Codec to use to compress the persisted data"""
     pq_on_backpressure: NotRequired[OutputCriblTCPQueueFullBehavior]
     r"""How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged."""
-    pq_mode: NotRequired[OutputCriblTCPMode]
-    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
     pq_controls: NotRequired[OutputCriblTCPPqControlsTypedDict]
 
 
@@ -255,7 +336,9 @@ class OutputCriblTCP(BaseModel):
     )
     r"""Use load-balanced destinations"""
 
-    compression: Optional[OutputCriblTCPCompression] = OutputCriblTCPCompression.GZIP
+    compression: Annotated[
+        Optional[OutputCriblTCPCompression], PlainValidator(validate_open_enum(False))
+    ] = OutputCriblTCPCompression.GZIP
     r"""Codec to use to compress the data before sending"""
 
     log_failed_requests: Annotated[
@@ -285,13 +368,21 @@ class OutputCriblTCP(BaseModel):
     ] = 60
     r"""The number of minutes before the internally generated authentication token expires, valid values between 1 and 60"""
 
+    auth_tokens: Annotated[
+        Optional[List[OutputCriblTCPAuthToken]], pydantic.Field(alias="authTokens")
+    ] = None
+    r"""Shared secrets to be used by connected environments to authorize connections. These tokens should also be installed in Cribl TCP Source in Cribl.Cloud."""
+
     exclude_fields: Annotated[
         Optional[List[str]], pydantic.Field(alias="excludeFields")
     ] = None
     r"""Fields to exclude from the event. By default, all internal fields except `__output` are sent. Example: `cribl_pipe`, `c*`. Wildcards supported."""
 
     on_backpressure: Annotated[
-        Optional[OutputCriblTCPBackpressureBehavior],
+        Annotated[
+            Optional[OutputCriblTCPBackpressureBehavior],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="onBackpressure"),
     ] = OutputCriblTCPBackpressureBehavior.BLOCK
     r"""How to handle events when all receivers are exerting backpressure"""
@@ -325,6 +416,34 @@ class OutputCriblTCP(BaseModel):
     ] = 0
     r"""Maximum number of concurrent connections (per Worker Process). A random set of IPs will be picked on every DNS resolution period. Use 0 for unlimited."""
 
+    pq_strict_ordering: Annotated[
+        Optional[bool], pydantic.Field(alias="pqStrictOrdering")
+    ] = True
+    r"""Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed."""
+
+    pq_rate_per_sec: Annotated[
+        Optional[float], pydantic.Field(alias="pqRatePerSec")
+    ] = 0
+    r"""Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling."""
+
+    pq_mode: Annotated[
+        Annotated[
+            Optional[OutputCriblTCPMode], PlainValidator(validate_open_enum(False))
+        ],
+        pydantic.Field(alias="pqMode"),
+    ] = OutputCriblTCPMode.ERROR
+    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
+
+    pq_max_buffer_size: Annotated[
+        Optional[float], pydantic.Field(alias="pqMaxBufferSize")
+    ] = 42
+    r"""The maximum number of events to hold in memory before writing the events to disk"""
+
+    pq_max_backpressure_sec: Annotated[
+        Optional[float], pydantic.Field(alias="pqMaxBackpressureSec")
+    ] = 30
+    r"""How long (in seconds) to wait for backpressure to resolve before engaging the queue"""
+
     pq_max_file_size: Annotated[
         Optional[str], pydantic.Field(alias="pqMaxFileSize")
     ] = "1 MB"
@@ -339,22 +458,68 @@ class OutputCriblTCP(BaseModel):
     r"""The location for the persistent queue files. To this field's value, the system will append: /<worker-id>/<output-id>."""
 
     pq_compress: Annotated[
-        Optional[OutputCriblTCPPqCompressCompression],
+        Annotated[
+            Optional[OutputCriblTCPPqCompressCompression],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="pqCompress"),
     ] = OutputCriblTCPPqCompressCompression.NONE
     r"""Codec to use to compress the persisted data"""
 
     pq_on_backpressure: Annotated[
-        Optional[OutputCriblTCPQueueFullBehavior],
+        Annotated[
+            Optional[OutputCriblTCPQueueFullBehavior],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="pqOnBackpressure"),
     ] = OutputCriblTCPQueueFullBehavior.BLOCK
     r"""How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged."""
 
-    pq_mode: Annotated[Optional[OutputCriblTCPMode], pydantic.Field(alias="pqMode")] = (
-        OutputCriblTCPMode.ERROR
-    )
-    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
-
     pq_controls: Annotated[
         Optional[OutputCriblTCPPqControls], pydantic.Field(alias="pqControls")
     ] = None
+
+    @field_serializer("compression")
+    def serialize_compression(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPCompression(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("on_backpressure")
+    def serialize_on_backpressure(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPBackpressureBehavior(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("pq_mode")
+    def serialize_pq_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPMode(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("pq_compress")
+    def serialize_pq_compress(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPPqCompressCompression(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("pq_on_backpressure")
+    def serialize_pq_on_backpressure(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCriblTCPQueueFullBehavior(value)
+            except ValueError:
+                return value
+        return value

cribl_control_plane/models/outputcrowdstrikenextgensiem.py

@@ -1,9 +1,13 @@
 """Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
 
 from __future__ import annotations
+from cribl_control_plane import models, utils
 from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
 from enum import Enum
 import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
 from typing import List, Optional
 from typing_extensions import Annotated, NotRequired, TypedDict
 
@@ -23,22 +27,33 @@ class OutputCrowdstrikeNextGenSiemExtraHTTPHeader(BaseModel):
     name: Optional[str] = None
 
 
-class OutputCrowdstrikeNextGenSiemFailedRequestLoggingMode(str, Enum):
+class OutputCrowdstrikeNextGenSiemFailedRequestLoggingMode(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
     r"""Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below."""
 
+    # Payload
     PAYLOAD = "payload"
+    # Payload + Headers
     PAYLOAD_AND_HEADERS = "payloadAndHeaders"
+    # None
     NONE = "none"
 
 
-class OutputCrowdstrikeNextGenSiemRequestFormat(str, Enum):
+class OutputCrowdstrikeNextGenSiemRequestFormat(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
     r"""When set to JSON, the event is automatically formatted with required fields before sending. When set to Raw, only the event's `_raw` value is sent."""
 
+    # JSON
     JSON = "JSON"
+    # Raw
     RAW = "raw"
 
 
-class OutputCrowdstrikeNextGenSiemAuthenticationMethod(str, Enum):
+class OutputCrowdstrikeNextGenSiemAuthenticationMethod(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
     r"""Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate"""
 
     MANUAL = "manual"
@@ -99,36 +114,50 @@ class OutputCrowdstrikeNextGenSiemTimeoutRetrySettings(BaseModel):
     r"""The maximum backoff interval, in milliseconds, Cribl Stream should apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is 180,000 ms (180 seconds)."""
 
 
-class OutputCrowdstrikeNextGenSiemBackpressureBehavior(str, Enum):
+class OutputCrowdstrikeNextGenSiemBackpressureBehavior(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
     r"""How to handle events when all receivers are exerting backpressure"""
 
+    # Block
     BLOCK = "block"
+    # Drop
     DROP = "drop"
+    # Persistent Queue
     QUEUE = "queue"
 
 
-class OutputCrowdstrikeNextGenSiemCompression(str, Enum):
+class OutputCrowdstrikeNextGenSiemMode(str, Enum, metaclass=utils.OpenEnumMeta):
+    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
+
+    # Error
+    ERROR = "error"
+    # Backpressure
+    ALWAYS = "always"
+    # Always On
+    BACKPRESSURE = "backpressure"
+
+
+class OutputCrowdstrikeNextGenSiemCompression(str, Enum, metaclass=utils.OpenEnumMeta):
     r"""Codec to use to compress the persisted data"""
 
+    # None
     NONE = "none"
+    # Gzip
     GZIP = "gzip"
 
 
-class OutputCrowdstrikeNextGenSiemQueueFullBehavior(str, Enum):
+class OutputCrowdstrikeNextGenSiemQueueFullBehavior(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
     r"""How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged."""
 
+    # Block
     BLOCK = "block"
+    # Drop new data
     DROP = "drop"
 
 
-class OutputCrowdstrikeNextGenSiemMode(str, Enum):
-    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
-
-    ERROR = "error"
-    BACKPRESSURE = "backpressure"
-    ALWAYS = "always"
-
-
 class OutputCrowdstrikeNextGenSiemPqControlsTypedDict(TypedDict):
     pass
 
@@ -201,6 +230,16 @@ class OutputCrowdstrikeNextGenSiemTypedDict(TypedDict):
     token: NotRequired[str]
     text_secret: NotRequired[str]
     r"""Select or create a stored text secret"""
+    pq_strict_ordering: NotRequired[bool]
+    r"""Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed."""
+    pq_rate_per_sec: NotRequired[float]
+    r"""Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling."""
+    pq_mode: NotRequired[OutputCrowdstrikeNextGenSiemMode]
+    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
+    pq_max_buffer_size: NotRequired[float]
+    r"""The maximum number of events to hold in memory before writing the events to disk"""
+    pq_max_backpressure_sec: NotRequired[float]
+    r"""How long (in seconds) to wait for backpressure to resolve before engaging the queue"""
     pq_max_file_size: NotRequired[str]
     r"""The maximum size to store in each queue file before closing and optionally compressing (KB, MB, etc.)"""
     pq_max_size: NotRequired[str]
@@ -211,8 +250,6 @@ class OutputCrowdstrikeNextGenSiemTypedDict(TypedDict):
     r"""Codec to use to compress the persisted data"""
     pq_on_backpressure: NotRequired[OutputCrowdstrikeNextGenSiemQueueFullBehavior]
     r"""How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged."""
-    pq_mode: NotRequired[OutputCrowdstrikeNextGenSiemMode]
-    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
     pq_controls: NotRequired[OutputCrowdstrikeNextGenSiemPqControlsTypedDict]
 
 
@@ -285,7 +322,10 @@ class OutputCrowdstrikeNextGenSiem(BaseModel):
     r"""Enable round-robin DNS lookup. When a DNS server returns multiple addresses, @{product} will cycle through them in the order returned. For optimal performance, consider enabling this setting for non-load balanced destinations."""
 
     failed_request_logging_mode: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemFailedRequestLoggingMode],
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemFailedRequestLoggingMode],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="failedRequestLoggingMode"),
     ] = OutputCrowdstrikeNextGenSiemFailedRequestLoggingMode.NONE
     r"""Data to log when a request fails. All headers are redacted by default, unless listed as safe headers below."""
@@ -296,13 +336,19 @@ class OutputCrowdstrikeNextGenSiem(BaseModel):
     r"""List of headers that are safe to log in plain text"""
 
     format_: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemRequestFormat],
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemRequestFormat],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="format"),
     ] = OutputCrowdstrikeNextGenSiemRequestFormat.JSON
     r"""When set to JSON, the event is automatically formatted with required fields before sending. When set to Raw, only the event's `_raw` value is sent."""
 
     auth_type: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemAuthenticationMethod],
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemAuthenticationMethod],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="authType"),
     ] = OutputCrowdstrikeNextGenSiemAuthenticationMethod.MANUAL
     r"""Select Manual to enter an auth token directly, or select Secret to use a text secret to authenticate"""
@@ -320,11 +366,14 @@ class OutputCrowdstrikeNextGenSiem(BaseModel):
 
     response_honor_retry_after_header: Annotated[
         Optional[bool], pydantic.Field(alias="responseHonorRetryAfterHeader")
-    ] = False
+    ] = True
     r"""Honor any Retry-After header that specifies a delay (in seconds) no longer than 180 seconds after the retry request. @{product} limits the delay to 180 seconds, even if the Retry-After header specifies a longer delay. When enabled, takes precedence over user-configured retry options. When disabled, all Retry-After headers are ignored."""
 
     on_backpressure: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemBackpressureBehavior],
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemBackpressureBehavior],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="onBackpressure"),
     ] = OutputCrowdstrikeNextGenSiemBackpressureBehavior.BLOCK
     r"""How to handle events when all receivers are exerting backpressure"""
@@ -336,6 +385,35 @@ class OutputCrowdstrikeNextGenSiem(BaseModel):
     text_secret: Annotated[Optional[str], pydantic.Field(alias="textSecret")] = None
     r"""Select or create a stored text secret"""
 
+    pq_strict_ordering: Annotated[
+        Optional[bool], pydantic.Field(alias="pqStrictOrdering")
+    ] = True
+    r"""Use FIFO (first in, first out) processing. Disable to forward new events to receivers before queue is flushed."""
+
+    pq_rate_per_sec: Annotated[
+        Optional[float], pydantic.Field(alias="pqRatePerSec")
+    ] = 0
+    r"""Throttling rate (in events per second) to impose while writing to Destinations from PQ. Defaults to 0, which disables throttling."""
+
+    pq_mode: Annotated[
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemMode],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="pqMode"),
+    ] = OutputCrowdstrikeNextGenSiemMode.ERROR
+    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
+
+    pq_max_buffer_size: Annotated[
+        Optional[float], pydantic.Field(alias="pqMaxBufferSize")
+    ] = 42
+    r"""The maximum number of events to hold in memory before writing the events to disk"""
+
+    pq_max_backpressure_sec: Annotated[
+        Optional[float], pydantic.Field(alias="pqMaxBackpressureSec")
+    ] = 30
+    r"""How long (in seconds) to wait for backpressure to resolve before engaging the queue"""
+
     pq_max_file_size: Annotated[
         Optional[str], pydantic.Field(alias="pqMaxFileSize")
     ] = "1 MB"
@@ -350,23 +428,89 @@ class OutputCrowdstrikeNextGenSiem(BaseModel):
     r"""The location for the persistent queue files. To this field's value, the system will append: /<worker-id>/<output-id>."""
 
     pq_compress: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemCompression],
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemCompression],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="pqCompress"),
     ] = OutputCrowdstrikeNextGenSiemCompression.NONE
     r"""Codec to use to compress the persisted data"""
 
     pq_on_backpressure: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemQueueFullBehavior],
+        Annotated[
+            Optional[OutputCrowdstrikeNextGenSiemQueueFullBehavior],
+            PlainValidator(validate_open_enum(False)),
+        ],
         pydantic.Field(alias="pqOnBackpressure"),
     ] = OutputCrowdstrikeNextGenSiemQueueFullBehavior.BLOCK
     r"""How to handle events when the queue is exerting backpressure (full capacity or low disk). 'Block' is the same behavior as non-PQ blocking. 'Drop new data' throws away incoming data, while leaving the contents of the PQ unchanged."""
 
-    pq_mode: Annotated[
-        Optional[OutputCrowdstrikeNextGenSiemMode], pydantic.Field(alias="pqMode")
-    ] = OutputCrowdstrikeNextGenSiemMode.ERROR
-    r"""In Error mode, PQ writes events to the filesystem if the Destination is unavailable. In Backpressure mode, PQ writes events to the filesystem when it detects backpressure from the Destination. In Always On mode, PQ always writes events to the filesystem."""
-
     pq_controls: Annotated[
         Optional[OutputCrowdstrikeNextGenSiemPqControls],
         pydantic.Field(alias="pqControls"),
     ] = None
+
+    @field_serializer("failed_request_logging_mode")
+    def serialize_failed_request_logging_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemFailedRequestLoggingMode(
+                    value
+                )
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("format_")
+    def serialize_format_(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemRequestFormat(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("auth_type")
+    def serialize_auth_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemAuthenticationMethod(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("on_backpressure")
+    def serialize_on_backpressure(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemBackpressureBehavior(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("pq_mode")
+    def serialize_pq_mode(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemMode(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("pq_compress")
+    def serialize_pq_compress(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemCompression(value)
+            except ValueError:
+                return value
+        return value
+
+    @field_serializer("pq_on_backpressure")
+    def serialize_pq_on_backpressure(self, value):
+        if isinstance(value, str):
+            try:
+                return models.OutputCrowdstrikeNextGenSiemQueueFullBehavior(value)
+            except ValueError:
+                return value
+        return value