Package types (0.6.4)

AWS EC2 Hosts Settings.

AWS EC2 Instances Settings.

AWS EC2 Vpcs Settings.

AWSIAMSettings contains details needed for creating an AWS IAM feed.

Request message to add chart in a dashboard.

Response message for adding chart in a dashboard.

Additional S3 access key secret auth.

Advanced filter configuration for the filter widget.

Settings required by Amazon Kinesis Firehose Feeds(HTTP-Push).

Amazon S3 settings.

AmazonS3V2Settings is the settings proto for Omniflow S3 feeds.

Amazon SQS settings.

AmazonSQSV2Settings is the settings proto for Omniflow SQS feeds.

Anomali IOC settings.

Azure AD Audit settings.

Azure AD Context settings.

Azure AD settings.

Azure auth.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

A message containing fields used to authenticate with Azure Blob Storage.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

Azure Blob Storage settings.

AzureBlobStoreV2Settings is the settings proto for Azure Blob Storage feeds.

Settings required by Azure Event Hub Feeds.

Azure MDM Intune settings.

Azure V2 Workload Identity Federation.

Request message to get dashboard charts in batch.

Response message for getting dashboard charts in batch.

This resource represents the BigQuery export configuration for a Chronicle instance which includes Google Cloud Platform resources like Cloud Storage buckets, BigQuery datasets etc and the export settings for each data source.

The BigQueryExportPackage entitled for the Chronicle instance.

Request to create data table rows in bulk.

Response message with created data table rows.

Request to get data table rows in bulk.

Response message with data table rows.

Request to replace data table rows in bulk.

Response message with data table rows that replaced existing data table rows.

Request to update data table rows in bulk.

Response message with updated data table rows.

Button config for a chart.

Claims identifying a specific customer.

CloudPassage settings.

Metadata of the column.

CompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.

CompilationPosition represents the location of a compilation diagnostic in rule text.

Request message for ComputeAllFindingsRefinementActivities method.

Response message for ComputeAllFindingsRefinementActivities method.

Request message for ComputeFindingsRefinementActivity method.

Response message for ComputeFindingsRefinementActivity method.

PAN Cortex XDR settings.

Request message for CreateDataAccessLabel.

Request message for CreateDataAccessScope.

A request to create DataTable.

Request to create data table row.

Request message for CreateFeed.

Request message for CreateFindingsRefinement method.

Request message to create a dashboard.

A request to create a reference list.

Request message for CreateRetrohunt method.

Request message for CreateRule method.

Request message for creating watchlist.

CrowdStrike Alerts settings.

CrowdStrike Detects settings.

Checkpoint configuration to enable sequential (cursor-based) polling.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

Configuration for dependent requests (child chaining).

CustomAPIHeaderAuth lists HTTP headers for custom API auth.

CustomAPIHeaderKeyValue defines dynamic headers key-values for Custom API.

Info for No-Authentication custom API feeds.

Pagination strategy for the request.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

CustomAPIQueryAuth lists URL Query parameters for custom API auth.

CustomAPIQueryKeyValue defines dynamic query parameters key-values for Custom API Auth.

Configuration for the outgoing API request.

Configuration for handling the API response.

Settings required by Feeds of Custom API (Codeless). Supports fetching data from third-party APIs with configurable pagination, authentication, and response parsing.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

Container for a specific API interaction.

AccessType of the dashboard.

DashboardChart resource.

Definition of the dashboard including filters, layout, charts' configurations.

Dashboard level filter that can be used in native dashboards as well as inputs to execute query.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

DashboardQuery resource.

Type of the dashboard.

User Data for Native Dashboard

A DataAccessLabel is a label on events to define user access to data.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

Reference object to a data access label.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

A DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.

LINT.IfChange(data_sources)

The export settings for a data source.

DataTable represents the data table resource.

DataTableColumnInfo represents the column metadata of the datatable. The column_index represents the ordering of the values in DataTableRow.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

The message containing the errors for a data table operation.

DataTableRow represents a single row in a data table.

DataTableScopeInfo specifies the scope info of the data table.

DataTableUpdateSource denotes the source that updated the data table.

Request message to delete a data access label.

Request message to delete a data access scope.

Request message for deleting data tables.

Request to delete data table row.

Request message to delete a feed.

Request message to delete a dashboard.

Request message for the DeleteRule method.

Request message for deleting watchlist.

The activity for a findings refinement that is a detection exclusion. The activity is broken down per detector.

Describes the detectors a detection exclusion is applied to.

DisableFeed request message.

Settings required by Feeds of DummyLogType(used for testing purposes).

Duo Authentication settings.

Duo User Context settings.

Request message to duplicate chart in a dashboard.

Response message for duplicating chart in a dashboard.

Request message to duplicate a dashboard.

Request message to edit chart in a dashboard.

Response message for editing chart in a dashboard.

EnableFeed request message.

Request message to execute a dashboard query.

Response message for executing a dashboard query.

Request message to export list of dashboard.

Response message for exporting a dashboard.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

FeaturedContentMetadata holds metadata about the Featured Content.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

FeaturedContentNativeDashboard resource.

Feed is a resource that contains feed information needed to create a feed.

Additional details of the feed, these details are dynamic and will be different for each of the feeds.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

FeedFailureDetails contains details about the errors thrown by chronicle for the feeds. These are user visible details. These details help user identify the root cause and take appropriate action for the feed errors.

FeedPack is a logical container for related LogTypes for which feeds can be configured.

FeedServiceAccount is a resource that wraps the feed service account's name.

Metadata that pertains to feed source types (see Feed.FeedDetails.FeedSourceType) that is useful for building interfaces to construct valid Feed messages.

Request message for FetchServiceAccountForCustomer.

Represents a set of logic conditions used to refine various types of findings such as curated rule detections.

The activity for a specific findings refinement.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

The FindingsRefinementDeployment resource represents the deployment state of a findings refinement.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

The type of findings refinement, which determines what the findings refinement runs over and the mechanism by which it runs.

Fox-IT STIX settings.

GenerateSecret request message.

GenerateSecret response message.

The request message to fetch BigQuery Export configuration.

Request message to get a dashboard chart.

Request message to get a dashboard query.

Request message to retrieve a data access label.

Request message to retrieve a data access scope.

The request message for GetDataTableOperationErrors.

A request to get details about a data table.

Request to get data table row.

Request message to get a FeaturedContentNativeDashboard.

Request message for GetFeedPack.

Request message to retrieve a feed.

Request message for GetFindingsRefinementDeployment method.

Request message for GetFindingsRefinement method.

Request to get a Instance.

Request message to get a dashboard.

A request to get details about a reference list.

Request message for GetRetrohunt method.

Request message for GetRuleDeployment.

Request message for GetRule method.

Request message for getting a watchlist.

Google Cloud Identity Device Users settings.

Google Cloud Identity Devices settings.

GoogleCloudStorageEventDrivenSettings is the settings proto for Omniflow Google Cloud Storage feeds driven by pubsub events.

Google Cloud Storage settings.

GoogleCloudStorageV2Settings is the settings proto for Omniflow Google Cloud Storage feeds.

Header key-value pairs.

HTTP header based authentication.

HTTP settings.

Settings required by Amazon Kinesis Firehose Feeds(HTTPS-Push V2).

Settings required by Google Cloud Platform Pub/Sub Feeds(HTTPS-Push V2).

Settings required by Webhook Feeds(HTTPS-Push V2).

Imperva WAF settings.

ImportExportStatus is a wrapper for dashboard name and status.

Inline source for importing dashboards.

Request message to import dashboards.

Response message for importing dashboards.

ImportPushLogsRequest request message.

In app linking start

Representation of an ingestion label type.

InlineDestination for exporting a dashboard.

InputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4

Request message to install a FeaturedContentNativeDashboard.

Response message for installing a FeaturedContentNativeDashboard.

A Instance represents an instantiation of the Instance product.

A language feature describes a specific capability or syntax of the query language used in a dashboard query, such as JOINS, STAGES, or DATA_TABLES.

The state of the latest data source export job.

Request message for ListAllFindingsRefinementDeployments method.

Response message for ListAllFindingsRefinementDeployments method.

Request message for ListDataAccessLabels.

Response message for ListDataAccessLabels.

Request message for ListDataAccessScopes.

Response message for ListDataAccessScopes.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

Request to list data table rows.

Response message for listing data table rows.

A request for a list of data tables.

Response message for listing data tables.

Request message to list FeaturedContentNativeDashboards.

Response message for listing FeaturedContentNativeDashboards.

Request message for ListFeedPacks.

Response message for ListFeedPacks.

ListFeedSourceTypeSchemas request message. Note that Feed schemas do not contain customer data, so are not scoped to a particular customer.

ListFeedSourceTypeSchemas response message.

Request message for ListFeed.

Response message for ListFeed.

Request message for ListFindingsRefinements method.

Response message for ListFindingsRefinements method.

ListLogTypeSchemas request message. Note that feed schemas do not contain customer data, so are not scoped to a particular customer.

ListLogTypeSchemas response message.

Request message to list dashboards.

Response message for listing dashboards.

A request for a list of reference lists.

A response to a request for a list of reference lists.

Request message for ListRetrohunts method.

Response message for ListRetrohunts method.

Request message for ListRuleDeployments.

Response message for ListRuleDeployments.

Request message for ListRuleExecutionErrors.

Response message for ListRuleExecutionErrors.

Request message for ListRuleRevisions method.

Response message for ListRuleRevisions method.

Request message for ListRules method.

Response message for ListRules method.

Request message for listing watchlists.

Response message for listing watchlists.

Metadata that pertains to a log type in the context of Feeds, and is useful for building interfaces to construct valid Feed messages.

Mandiant IOC settings.

Markdown config for a dashboard tile.

Trend to be displayed for the metric charts as.

Metric format to be displayed for the metric charts.

Trend to be displayed for the metric charts as.

Microsoft Graph Alert settings.

Microsoft OAuth 2.0 client credentials grant.

Microsoft Security Center alert settings.

Mimecast Mail settings.

Mimecast Mail V2 Settings.

OAuth 2.0 client credentials grant. See https://tools.ietf.org/html/rfc6749.

Info for MssoAuthentication using a username, password, and login api endpoint.

NativeDashboard resource.

NativeDashboardView indicates the scope of fields to populate when returning the dashboard resource.

NativeDashboardWithChartsAndQueries for exporting a dashboard.

Netskope Alert settings.

Netskope Alert V2 settings.

OAuth 2.0 client credentials grant. See https://tools.ietf.org/html/rfc6749.

OAuth 2.0 JWT grant. See, https://tools.ietf.org/html/rfc7519

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

OAuth 2.0 password grant. See https://tools.ietf.org/html/rfc6749.

OAuth 2.0 refresh token grant. See https://tools.ietf.org/html/rfc6749.

Office 365 settings.

Okta settings.

Okta user context settings.

Outcome filter for the findings refinement. This is used to filter the findings refinement based on the outcome variable values.

PackLogtype is a log type featured in the feed pack.

PAN IOC settings.

PAN Prisma Cloud auth.

PAN Prisma Cloud settings.

Plot mode for the map.

Point size type for the map.

Proofpoint Mail settings.

Proofpoint On-demand settings.

The request message to provision BigQuery Export configuration.

Settings required by Google Cloud Pub/Sub Feeds(HTTP-Push).

Qualys Scan settings.

Qualys VM settings.

Runtime error for a dashboard query.

RH-ISAC settings.

RS credentials.

Rapid7 Insight settings.

Recorded Future IOC settings.

A reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.

An entry in a reference list.

The error generated when verifying the reference list.

ReferenceListScope specifies the list of scope names of the reference list.

The syntax type indicating how list entries should be validated.

ReferenceListView is a mechanism for viewing partial responses of the ReferenceList resource.

Request message to remove chart from a dashboard.

Render type of the data in the chart.

Retrohunt is an execution of a Rule over a time range in the past.

Operation Metadata for Retrohunts.

The Rule resource represents a user-created rule. NEXT TAG: 21

The RuleDeployment resource represents the deployment state of a Rule.

The RuleExecutionError resource represents an error generated from running/deploying a rule.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

RuleType indicates the YARA-L rule type of user-created and Google Cloud Threat Intelligence (GCTI) authored rules.

RuleView indicates the scope of fields to populate when returning the Rule resource.

RunFrequency indicates the run frequency at which a YARA-L 2 rule will run if enabled.

Amazon S3 auth.

A message containing fields used to authenticate with Amazon S3.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

AWS S3 regions: https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region.

S3 V2 access key and secret auth.

AWS IAM Role Auth for S3 V2.

Amazon SQS access key and secret auth.

Amazon SQS auth.

A message containing fields used to authenticate with Amazon SQS.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

SQS V2 access key and secret auth.

AWS IAM Role Auth for SQS V2.

An SSL client certificate keypair.

Salesforce settings.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

ScopeInfo specifies the scope info of the reference list.

An enumeration of the possible types of a Feed.details field, where type implies both encoding and semantics. This is used in constructing a schema in order to construct a UI for creating well formed feeds.

SentinelOne Alert settings.

ServiceNow CMDB settings.

Severity represents the severity level of the rule.

SFTP Auth.

SFTP settings.

Source deletion option controls whether source files should be deleted after transferring.

Source deletion option determines whether source files should be deleted after transferring.

Symantec Event Export settings.

Thinkst Canary settings.

ThreatConnect IOC Settings.

TileType indicates what type of chart tile it is i.e., visualization chart, button or text.

TimeUnit supported for PAST filter operator.

Metadata of the timestamp column.

Settings required by Feeds of TrellixHxAlerts.

Settings required by Feeds of TrellixHxBulkAcqs.

Settings required by Feeds of TrellixHxHosts.

Settings for TrellixIAMAuthentication.

Info for TrellixLocalAuthentication using a username, password, endpoint, and header name.

TrellixStarXAuthentication contains a oneof with all of the authentication types supported by Trellix *X devices.

This message has oneof_ fields (mutually exclusive fields). For each oneof, at most one member field can be set at the same time. Setting any member of the oneof automatically clears all other members.

.. _oneof: https://proto-plus-python.readthedocs.io/en/stable/fields.html#oneofs-mutually-exclusive-fields

The type of URIs specified in the source URIs.

The request message to update BigQuery Export configuration.

Request message for UpdateDataAccessLabel method.

Request message for UpdateDataAccessScope method.

A request to update details of data table.

Request to update data table row.

Request message for UpdateFeed.

Request message for UpdateFindingsRefinementDeployment method.

Request message for UpdateFindingsRefinement method.

Request message to update a dashboard.

A request to update a reference list.

Request message for UpdateRuleDeployment.

Request message for UpdateRule method.

Request message for updating watchlist.

Info for username and secret based authentication.

VerifyReferenceList request message.

VerifyListResponse response message.

Request message for VerifyRuleText method.

Response message for VerifyRuleText method.

Visual map for various charts. More info:

https://echarts.apache.org/en/option.html#visualMap

A watchlist is a list of entities that allows for bulk operations over the included entities.

A collection of user preferences for watchlist UI configuration.

Settings required by Webhook Feeds(HTTP-Push).

Authentication for Workday.

Workday settings.

Workspace Activity settings.

Workspace Alert settings.

Workspace Chrome OS settings.

Workspace Groups settings.

Workspace Mobile settings.

Workspace Privileges settings.

Workspace Users settings.