cribl-control-plane 0.4.0b23__py3-none-any.whl → 0.5.0b3__py3-none-any.whl

cribl_control_plane/models/outputnetflow.py

@@ -30,7 +30,7 @@ class OutputNetflowHost(BaseModel):
 class OutputNetflowTypedDict(TypedDict):
     type: OutputNetflowType
     hosts: List[OutputNetflowHostTypedDict]
-    r"""One or more NetFlow destinations to forward events to"""
+    r"""One or more NetFlow Destinations to forward events to"""
     id: NotRequired[str]
     r"""Unique ID for this output"""
     pipeline: NotRequired[str]
@@ -43,14 +43,18 @@ class OutputNetflowTypedDict(TypedDict):
     r"""Tags for filtering and grouping in @{product}"""
     dns_resolve_period_sec: NotRequired[float]
     r"""How often to resolve the destination hostname to an IP address. Ignored if all destinations are IP addresses. A value of 0 means every datagram sent will incur a DNS lookup."""
+    enable_ip_spoofing: NotRequired[bool]
+    r"""Send NetFlow traffic using the original event's Source IP and port. To enable this, you must install the external `udp-sender` helper binary at `/usr/bin/udp-sender` on all Worker Nodes and grant it the `CAP_NET_RAW` capability."""
     description: NotRequired[str]
+    max_record_size: NotRequired[float]
+    r"""MTU in bytes. The actual maximum NetFlow payload size will be MTU minus IP and UDP headers (28 bytes for IPv4, 48 bytes for IPv6). For example, with the default MTU of 1500, the max payload is 1472 bytes for IPv4. Payloads exceeding this limit will be dropped."""
 
 
 class OutputNetflow(BaseModel):
     type: OutputNetflowType
 
     hosts: List[OutputNetflowHost]
-    r"""One or more NetFlow destinations to forward events to"""
+    r"""One or more NetFlow Destinations to forward events to"""
 
     id: Optional[str] = None
     r"""Unique ID for this output"""
@@ -74,4 +78,14 @@ class OutputNetflow(BaseModel):
     ] = 0
     r"""How often to resolve the destination hostname to an IP address. Ignored if all destinations are IP addresses. A value of 0 means every datagram sent will incur a DNS lookup."""
 
+    enable_ip_spoofing: Annotated[
+        Optional[bool], pydantic.Field(alias="enableIpSpoofing")
+    ] = False
+    r"""Send NetFlow traffic using the original event's Source IP and port. To enable this, you must install the external `udp-sender` helper binary at `/usr/bin/udp-sender` on all Worker Nodes and grant it the `CAP_NET_RAW` capability."""
+
     description: Optional[str] = None
+
+    max_record_size: Annotated[
+        Optional[float], pydantic.Field(alias="maxRecordSize")
+    ] = 1500
+    r"""MTU in bytes. The actual maximum NetFlow payload size will be MTU minus IP and UDP headers (28 bytes for IPv4, 48 bytes for IPv6). For example, with the default MTU of 1500, the max payload is 1472 bytes for IPv4. Payloads exceeding this limit will be dropped."""

cribl_control_plane/models/pipeline.py

@@ -2,6 +2,10 @@
 
 from __future__ import annotations
 from .pipelinefunctionconf import PipelineFunctionConf, PipelineFunctionConfTypedDict
+from .pipelinefunctionconf_input import (
+    PipelineFunctionConfInput,
+    PipelineFunctionConfInputTypedDict,
+)
 from cribl_control_plane.types import BaseModel
 import pydantic
 from typing import Dict, List, Optional
@@ -26,7 +30,7 @@ class PipelineGroups(BaseModel):
     r"""Whether this group is disabled"""
 
 
-class ConfTypedDict(TypedDict):
+class PipelineConfTypedDict(TypedDict):
     async_func_timeout: NotRequired[int]
     r"""Time (in ms) to wait for an async function to complete processing of a data item"""
     output: NotRequired[str]
@@ -39,7 +43,7 @@ class ConfTypedDict(TypedDict):
     groups: NotRequired[Dict[str, PipelineGroupsTypedDict]]
 
 
-class Conf(BaseModel):
+class PipelineConf(BaseModel):
     async_func_timeout: Annotated[
         Optional[int], pydantic.Field(alias="asyncFuncTimeout")
     ] = None
@@ -61,10 +65,54 @@ class Conf(BaseModel):
 
 class PipelineTypedDict(TypedDict):
     id: str
-    conf: ConfTypedDict
+    conf: PipelineConfTypedDict
 
 
 class Pipeline(BaseModel):
     id: str
 
-    conf: Conf
+    conf: PipelineConf
+
+
+class ConfInputTypedDict(TypedDict):
+    async_func_timeout: NotRequired[int]
+    r"""Time (in ms) to wait for an async function to complete processing of a data item"""
+    output: NotRequired[str]
+    r"""The output destination for events processed by this Pipeline"""
+    description: NotRequired[str]
+    streamtags: NotRequired[List[str]]
+    r"""Tags for filtering and grouping in @{product}"""
+    functions: NotRequired[List[PipelineFunctionConfInputTypedDict]]
+    r"""List of Functions to pass data through"""
+    groups: NotRequired[Dict[str, PipelineGroupsTypedDict]]
+
+
+class ConfInput(BaseModel):
+    async_func_timeout: Annotated[
+        Optional[int], pydantic.Field(alias="asyncFuncTimeout")
+    ] = None
+    r"""Time (in ms) to wait for an async function to complete processing of a data item"""
+
+    output: Optional[str] = "default"
+    r"""The output destination for events processed by this Pipeline"""
+
+    description: Optional[str] = None
+
+    streamtags: Optional[List[str]] = None
+    r"""Tags for filtering and grouping in @{product}"""
+
+    functions: Optional[List[PipelineFunctionConfInput]] = None
+    r"""List of Functions to pass data through"""
+
+    groups: Optional[Dict[str, PipelineGroups]] = None
+
+
+class PipelineInputTypedDict(TypedDict):
+    id: str
+    conf: ConfInputTypedDict
+
+
+class PipelineInput(BaseModel):
+    id: str
+
+    conf: ConfInput

cribl_control_plane/models/pipelinefunctionaggregatemetrics.py

@@ -0,0 +1,195 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane import models, utils
+from cribl_control_plane.types import BaseModel
+from cribl_control_plane.utils import validate_open_enum
+from enum import Enum
+import pydantic
+from pydantic import field_serializer
+from pydantic.functional_validators import PlainValidator
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionAggregateMetricsID(str, Enum):
+    r"""Function ID"""
+
+    AGGREGATE_METRICS = "aggregate_metrics"
+
+
+class PipelineFunctionAggregateMetricsMetricType(
+    str, Enum, metaclass=utils.OpenEnumMeta
+):
+    r"""The output metric type"""
+
+    AUTOMATIC = "automatic"
+    COUNTER = "counter"
+    DISTRIBUTION = "distribution"
+    GAUGE = "gauge"
+    HISTOGRAM = "histogram"
+    SUMMARY = "summary"
+    TIMER = "timer"
+
+
+class PipelineFunctionAggregateMetricsAggregationTypedDict(TypedDict):
+    agg: str
+    r"""Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+    metric_type: NotRequired[PipelineFunctionAggregateMetricsMetricType]
+    r"""The output metric type"""
+
+
+class PipelineFunctionAggregateMetricsAggregation(BaseModel):
+    agg: str
+    r"""Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+
+    metric_type: Annotated[
+        Annotated[
+            Optional[PipelineFunctionAggregateMetricsMetricType],
+            PlainValidator(validate_open_enum(False)),
+        ],
+        pydantic.Field(alias="metricType"),
+    ] = PipelineFunctionAggregateMetricsMetricType.AUTOMATIC
+    r"""The output metric type"""
+
+    @field_serializer("metric_type")
+    def serialize_metric_type(self, value):
+        if isinstance(value, str):
+            try:
+                return models.PipelineFunctionAggregateMetricsMetricType(value)
+            except ValueError:
+                return value
+        return value
+
+
+class PipelineFunctionAggregateMetricsAddTypedDict(TypedDict):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+    name: NotRequired[str]
+
+
+class PipelineFunctionAggregateMetricsAdd(BaseModel):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+    name: Optional[str] = None
+
+
+class PipelineFunctionAggregateMetricsConfTypedDict(TypedDict):
+    aggregations: List[PipelineFunctionAggregateMetricsAggregationTypedDict]
+    r"""Combination of Aggregation function and output metric type"""
+    passthrough: NotRequired[bool]
+    r"""Pass through the original events along with the aggregation events"""
+    preserve_group_bys: NotRequired[bool]
+    r"""Preserve the structure of the original aggregation event's groupby fields"""
+    sufficient_stats_only: NotRequired[bool]
+    r"""Output only statistics that are sufficient for the supplied aggregations"""
+    prefix: NotRequired[str]
+    r"""A prefix that is prepended to all of the fields output by this Aggregations Function"""
+    time_window: NotRequired[str]
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+    groupbys: NotRequired[List[str]]
+    r"""Optional: One or more dimensions to group aggregates by. Supports wildcard expressions. Wrap dimension names in quotes if using literal identifiers, such as 'service.name'. Warning: Using wildcard '*' causes all dimensions in the event to be included, which can result in high cardinality and increased memory usage. Exclude dimensions that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, *"""
+    flush_event_limit: NotRequired[float]
+    r"""The maximum number of events to include in any given aggregation event"""
+    flush_mem_limit: NotRequired[str]
+    r"""The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB)."""
+    cumulative: NotRequired[bool]
+    r"""Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush."""
+    should_treat_dots_as_literals: NotRequired[bool]
+    r"""Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'."""
+    add: NotRequired[List[PipelineFunctionAggregateMetricsAddTypedDict]]
+    r"""Set of key-value pairs to evaluate and add/set"""
+    flush_on_input_close: NotRequired[bool]
+    r"""Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior."""
+
+
+class PipelineFunctionAggregateMetricsConf(BaseModel):
+    aggregations: List[PipelineFunctionAggregateMetricsAggregation]
+    r"""Combination of Aggregation function and output metric type"""
+
+    passthrough: Optional[bool] = False
+    r"""Pass through the original events along with the aggregation events"""
+
+    preserve_group_bys: Annotated[
+        Optional[bool], pydantic.Field(alias="preserveGroupBys")
+    ] = False
+    r"""Preserve the structure of the original aggregation event's groupby fields"""
+
+    sufficient_stats_only: Annotated[
+        Optional[bool], pydantic.Field(alias="sufficientStatsOnly")
+    ] = False
+    r"""Output only statistics that are sufficient for the supplied aggregations"""
+
+    prefix: Optional[str] = None
+    r"""A prefix that is prepended to all of the fields output by this Aggregations Function"""
+
+    time_window: Annotated[Optional[str], pydantic.Field(alias="timeWindow")] = "10s"
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+
+    groupbys: Optional[List[str]] = None
+    r"""Optional: One or more dimensions to group aggregates by. Supports wildcard expressions. Wrap dimension names in quotes if using literal identifiers, such as 'service.name'. Warning: Using wildcard '*' causes all dimensions in the event to be included, which can result in high cardinality and increased memory usage. Exclude dimensions that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, *"""
+
+    flush_event_limit: Annotated[
+        Optional[float], pydantic.Field(alias="flushEventLimit")
+    ] = None
+    r"""The maximum number of events to include in any given aggregation event"""
+
+    flush_mem_limit: Annotated[Optional[str], pydantic.Field(alias="flushMemLimit")] = (
+        None
+    )
+    r"""The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB)."""
+
+    cumulative: Optional[bool] = False
+    r"""Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush."""
+
+    should_treat_dots_as_literals: Annotated[
+        Optional[bool], pydantic.Field(alias="shouldTreatDotsAsLiterals")
+    ] = True
+    r"""Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'."""
+
+    add: Optional[List[PipelineFunctionAggregateMetricsAdd]] = None
+    r"""Set of key-value pairs to evaluate and add/set"""
+
+    flush_on_input_close: Annotated[
+        Optional[bool], pydantic.Field(alias="flushOnInputClose")
+    ] = True
+    r"""Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior."""
+
+
+class PipelineFunctionAggregateMetricsTypedDict(TypedDict):
+    id: PipelineFunctionAggregateMetricsID
+    r"""Function ID"""
+    conf: PipelineFunctionAggregateMetricsConfTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionAggregateMetrics(BaseModel):
+    id: PipelineFunctionAggregateMetricsID
+    r"""Function ID"""
+
+    conf: PipelineFunctionAggregateMetricsConf
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctionaggregation.py

@@ -0,0 +1,159 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import List, Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionAggregationID(str, Enum):
+    r"""Function ID"""
+
+    AGGREGATION = "aggregation"
+
+
+class PipelineFunctionAggregationAddTypedDict(TypedDict):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+    name: NotRequired[str]
+
+
+class PipelineFunctionAggregationAdd(BaseModel):
+    value: str
+    r"""JavaScript expression to compute the value (can be constant)"""
+
+    name: Optional[str] = None
+
+
+class PipelineFunctionAggregationConfTypedDict(TypedDict):
+    aggregations: List[str]
+    r"""Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+    passthrough: NotRequired[bool]
+    r"""Pass through the original events along with the aggregation events"""
+    preserve_group_bys: NotRequired[bool]
+    r"""Preserve the structure of the original aggregation event's groupby fields"""
+    sufficient_stats_only: NotRequired[bool]
+    r"""Output only statistics that are sufficient for the supplied aggregations"""
+    metrics_mode: NotRequired[bool]
+    r"""Enable to output the aggregates as metrics. When disabled, aggregates are output as events."""
+    prefix: NotRequired[str]
+    r"""A prefix that is prepended to all of the fields output by this Aggregations Function"""
+    time_window: NotRequired[str]
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+    groupbys: NotRequired[List[str]]
+    r"""Optional: One or more fields to group aggregates by. Supports wildcard expressions. Warning: Using wildcard '*' causes all fields in the event to be included, which can result in high cardinality and increased memory usage. Exclude fields that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, *"""
+    flush_event_limit: NotRequired[float]
+    r"""The maximum number of events to include in any given aggregation event"""
+    flush_mem_limit: NotRequired[str]
+    r"""The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB)."""
+    cumulative: NotRequired[bool]
+    r"""Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush."""
+    search_agg_mode: NotRequired[str]
+    r"""Allows Cribl Search-specific aggregation configuration"""
+    add: NotRequired[List[PipelineFunctionAggregationAddTypedDict]]
+    r"""Set of key-value pairs to evaluate and add/set"""
+    should_treat_dots_as_literals: NotRequired[bool]
+    r"""Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'."""
+    flush_on_input_close: NotRequired[bool]
+    r"""Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior."""
+
+
+class PipelineFunctionAggregationConf(BaseModel):
+    aggregations: List[str]
+    r"""Aggregate function to perform on events. Example: sum(bytes).where(action=='REJECT').as(TotalBytes)"""
+
+    passthrough: Optional[bool] = False
+    r"""Pass through the original events along with the aggregation events"""
+
+    preserve_group_bys: Annotated[
+        Optional[bool], pydantic.Field(alias="preserveGroupBys")
+    ] = False
+    r"""Preserve the structure of the original aggregation event's groupby fields"""
+
+    sufficient_stats_only: Annotated[
+        Optional[bool], pydantic.Field(alias="sufficientStatsOnly")
+    ] = False
+    r"""Output only statistics that are sufficient for the supplied aggregations"""
+
+    metrics_mode: Annotated[Optional[bool], pydantic.Field(alias="metricsMode")] = False
+    r"""Enable to output the aggregates as metrics. When disabled, aggregates are output as events."""
+
+    prefix: Optional[str] = None
+    r"""A prefix that is prepended to all of the fields output by this Aggregations Function"""
+
+    time_window: Annotated[Optional[str], pydantic.Field(alias="timeWindow")] = "10s"
+    r"""The time span of the tumbling window for aggregating events. Must be a valid time string (such as 10s)."""
+
+    groupbys: Optional[List[str]] = None
+    r"""Optional: One or more fields to group aggregates by. Supports wildcard expressions. Warning: Using wildcard '*' causes all fields in the event to be included, which can result in high cardinality and increased memory usage. Exclude fields that can result in high cardinality before using wildcards. Example: !_time, !_numericValue, *"""
+
+    flush_event_limit: Annotated[
+        Optional[float], pydantic.Field(alias="flushEventLimit")
+    ] = None
+    r"""The maximum number of events to include in any given aggregation event"""
+
+    flush_mem_limit: Annotated[Optional[str], pydantic.Field(alias="flushMemLimit")] = (
+        None
+    )
+    r"""The memory usage limit to impose upon aggregations. Defaults to 80% of the process memory; value configured above default limit is ignored. Accepts numerals with units like KB and MB (example: 128MB)."""
+
+    cumulative: Optional[bool] = False
+    r"""Enable to retain aggregations for cumulative aggregations when flushing out an aggregation table event. When disabled (the default), aggregations are reset to 0 on flush."""
+
+    search_agg_mode: Annotated[Optional[str], pydantic.Field(alias="searchAggMode")] = (
+        None
+    )
+    r"""Allows Cribl Search-specific aggregation configuration"""
+
+    add: Optional[List[PipelineFunctionAggregationAdd]] = None
+    r"""Set of key-value pairs to evaluate and add/set"""
+
+    should_treat_dots_as_literals: Annotated[
+        Optional[bool], pydantic.Field(alias="shouldTreatDotsAsLiterals")
+    ] = False
+    r"""Treat dots in dimension names as literals. This is useful for top-level dimensions that contain dots, such as 'service.name'."""
+
+    flush_on_input_close: Annotated[
+        Optional[bool], pydantic.Field(alias="flushOnInputClose")
+    ] = True
+    r"""Flush aggregations when an input stream is closed. If disabled, Time Window Settings control flush behavior."""
+
+
+class PipelineFunctionAggregationTypedDict(TypedDict):
+    id: PipelineFunctionAggregationID
+    r"""Function ID"""
+    conf: PipelineFunctionAggregationConfTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionAggregation(BaseModel):
+    id: PipelineFunctionAggregationID
+    r"""Function ID"""
+
+    conf: PipelineFunctionAggregationConf
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctionautotimestamp.py

@@ -0,0 +1,56 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemaautotimestamp import (
+    FunctionConfSchemaAutoTimestamp,
+    FunctionConfSchemaAutoTimestampTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionAutoTimestampID(str, Enum):
+    r"""Function ID"""
+
+    AUTO_TIMESTAMP = "auto_timestamp"
+
+
+class PipelineFunctionAutoTimestampTypedDict(TypedDict):
+    id: PipelineFunctionAutoTimestampID
+    r"""Function ID"""
+    conf: FunctionConfSchemaAutoTimestampTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionAutoTimestamp(BaseModel):
+    id: PipelineFunctionAutoTimestampID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaAutoTimestamp
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""

cribl_control_plane/models/pipelinefunctioncef.py

@@ -0,0 +1,96 @@
+"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""
+
+from __future__ import annotations
+from .functionconfschemacef import (
+    FunctionConfSchemaCef,
+    FunctionConfSchemaCefInput,
+    FunctionConfSchemaCefInputTypedDict,
+    FunctionConfSchemaCefTypedDict,
+)
+from cribl_control_plane.types import BaseModel
+from enum import Enum
+import pydantic
+from typing import Optional
+from typing_extensions import Annotated, NotRequired, TypedDict
+
+
+class PipelineFunctionCefID(str, Enum):
+    r"""Function ID"""
+
+    CEF = "cef"
+
+
+class PipelineFunctionCefTypedDict(TypedDict):
+    id: PipelineFunctionCefID
+    r"""Function ID"""
+    conf: FunctionConfSchemaCefTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionCef(BaseModel):
+    id: PipelineFunctionCefID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaCef
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""
+
+
+class PipelineFunctionCefInputTypedDict(TypedDict):
+    id: PipelineFunctionCefID
+    r"""Function ID"""
+    conf: FunctionConfSchemaCefInputTypedDict
+    filter_: NotRequired[str]
+    r"""Filter that selects data to be fed through this Function"""
+    description: NotRequired[str]
+    r"""Simple description of this step"""
+    disabled: NotRequired[bool]
+    r"""If true, data will not be pushed through this function"""
+    final: NotRequired[bool]
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+    group_id: NotRequired[str]
+    r"""Group ID"""
+
+
+class PipelineFunctionCefInput(BaseModel):
+    id: PipelineFunctionCefID
+    r"""Function ID"""
+
+    conf: FunctionConfSchemaCefInput
+
+    filter_: Annotated[Optional[str], pydantic.Field(alias="filter")] = "true"
+    r"""Filter that selects data to be fed through this Function"""
+
+    description: Optional[str] = None
+    r"""Simple description of this step"""
+
+    disabled: Optional[bool] = None
+    r"""If true, data will not be pushed through this function"""
+
+    final: Optional[bool] = None
+    r"""If enabled, stops the results of this Function from being passed to the downstream Functions"""
+
+    group_id: Annotated[Optional[str], pydantic.Field(alias="groupId")] = None
+    r"""Group ID"""