1package securityinsight 2 3// Copyright (c) Microsoft Corporation. All rights reserved. 4// Licensed under the MIT License. See License.txt in the project root for license information. 5// 6// Code generated by Microsoft (R) AutoRest Code Generator. 7// Changes may cause incorrect behavior and will be lost if the code is regenerated. 8 9import ( 10 "context" 11 "encoding/json" 12 "github.com/Azure/go-autorest/autorest" 13 "github.com/Azure/go-autorest/autorest/date" 14 "github.com/Azure/go-autorest/autorest/to" 15 "github.com/Azure/go-autorest/tracing" 16 "github.com/gofrs/uuid" 17 "net/http" 18) 19 20// The package's fully qualified name. 21const fqdn = "github.com/Azure/azure-sdk-for-go/services/preview/securityinsight/mgmt/2019-01-01-preview/securityinsight" 22 23// AADCheckRequirements represents AAD (Azure Active Directory) requirements check request. 24type AADCheckRequirements struct { 25 // AADCheckRequirementsProperties - AAD (Azure Active Directory) requirements check properties. 26 *AADCheckRequirementsProperties `json:"properties,omitempty"` 27 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 28 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 29} 30 31// MarshalJSON is the custom marshaler for AADCheckRequirements. 32func (acr AADCheckRequirements) MarshalJSON() ([]byte, error) { 33 acr.Kind = KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory 34 objectMap := make(map[string]interface{}) 35 if acr.AADCheckRequirementsProperties != nil { 36 objectMap["properties"] = acr.AADCheckRequirementsProperties 37 } 38 if acr.Kind != "" { 39 objectMap["kind"] = acr.Kind 40 } 41 return json.Marshal(objectMap) 42} 43 44// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 45func (acr AADCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 46 return &acr, true 47} 48 49// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 50func (acr AADCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 51 return nil, false 52} 53 54// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 55func (acr AADCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 56 return nil, false 57} 58 59// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 60func (acr AADCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 61 return nil, false 62} 63 64// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 65func (acr AADCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 66 return nil, false 67} 68 69// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 70func (acr AADCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 71 return nil, false 72} 73 74// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 75func (acr AADCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 76 return nil, false 77} 78 79// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 80func (acr AADCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 81 return nil, false 82} 83 84// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 85func (acr AADCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 86 return nil, false 87} 88 89// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 90func (acr AADCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 91 return nil, false 92} 93 94// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 95func (acr AADCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 96 return nil, false 97} 98 99// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 100func (acr AADCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 101 return nil, false 102} 103 104// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 105func (acr AADCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 106 return nil, false 107} 108 109// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AADCheckRequirements. 110func (acr AADCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 111 return &acr, true 112} 113 114// UnmarshalJSON is the custom unmarshaler for AADCheckRequirements struct. 115func (acr *AADCheckRequirements) UnmarshalJSON(body []byte) error { 116 var m map[string]*json.RawMessage 117 err := json.Unmarshal(body, &m) 118 if err != nil { 119 return err 120 } 121 for k, v := range m { 122 switch k { 123 case "properties": 124 if v != nil { 125 var aADCheckRequirementsProperties AADCheckRequirementsProperties 126 err = json.Unmarshal(*v, &aADCheckRequirementsProperties) 127 if err != nil { 128 return err 129 } 130 acr.AADCheckRequirementsProperties = &aADCheckRequirementsProperties 131 } 132 case "kind": 133 if v != nil { 134 var kind KindBasicDataConnectorsCheckRequirements 135 err = json.Unmarshal(*v, &kind) 136 if err != nil { 137 return err 138 } 139 acr.Kind = kind 140 } 141 } 142 } 143 144 return nil 145} 146 147// AADCheckRequirementsProperties AAD (Azure Active Directory) requirements check properties. 148type AADCheckRequirementsProperties struct { 149 // TenantID - The tenant id to connect to, and get the data from. 150 TenantID *string `json:"tenantId,omitempty"` 151} 152 153// AADDataConnector represents AAD (Azure Active Directory) data connector. 154type AADDataConnector struct { 155 // AADDataConnectorProperties - AAD (Azure Active Directory) data connector properties. 156 *AADDataConnectorProperties `json:"properties,omitempty"` 157 // ID - READ-ONLY; Azure resource Id 158 ID *string `json:"id,omitempty"` 159 // Name - READ-ONLY; Azure resource name 160 Name *string `json:"name,omitempty"` 161 // Type - READ-ONLY; Azure resource type 162 Type *string `json:"type,omitempty"` 163 // Etag - Etag of the azure resource 164 Etag *string `json:"etag,omitempty"` 165 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 166 Kind KindBasicDataConnector `json:"kind,omitempty"` 167} 168 169// MarshalJSON is the custom marshaler for AADDataConnector. 170func (adc AADDataConnector) MarshalJSON() ([]byte, error) { 171 adc.Kind = KindBasicDataConnectorKindAzureActiveDirectory 172 objectMap := make(map[string]interface{}) 173 if adc.AADDataConnectorProperties != nil { 174 objectMap["properties"] = adc.AADDataConnectorProperties 175 } 176 if adc.Etag != nil { 177 objectMap["etag"] = adc.Etag 178 } 179 if adc.Kind != "" { 180 objectMap["kind"] = adc.Kind 181 } 182 return json.Marshal(objectMap) 183} 184 185// AsAADDataConnector is the BasicDataConnector implementation for AADDataConnector. 186func (adc AADDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 187 return &adc, true 188} 189 190// AsAATPDataConnector is the BasicDataConnector implementation for AADDataConnector. 191func (adc AADDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 192 return nil, false 193} 194 195// AsMSTIDataConnector is the BasicDataConnector implementation for AADDataConnector. 196func (adc AADDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 197 return nil, false 198} 199 200// AsMTPDataConnector is the BasicDataConnector implementation for AADDataConnector. 201func (adc AADDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 202 return nil, false 203} 204 205// AsASCDataConnector is the BasicDataConnector implementation for AADDataConnector. 206func (adc AADDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 207 return nil, false 208} 209 210// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AADDataConnector. 211func (adc AADDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 212 return nil, false 213} 214 215// AsDynamics365DataConnector is the BasicDataConnector implementation for AADDataConnector. 216func (adc AADDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 217 return nil, false 218} 219 220// AsMCASDataConnector is the BasicDataConnector implementation for AADDataConnector. 221func (adc AADDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 222 return nil, false 223} 224 225// AsMDATPDataConnector is the BasicDataConnector implementation for AADDataConnector. 226func (adc AADDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 227 return nil, false 228} 229 230// AsOfficeATPDataConnector is the BasicDataConnector implementation for AADDataConnector. 231func (adc AADDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 232 return nil, false 233} 234 235// AsOfficeDataConnector is the BasicDataConnector implementation for AADDataConnector. 236func (adc AADDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 237 return nil, false 238} 239 240// AsTIDataConnector is the BasicDataConnector implementation for AADDataConnector. 241func (adc AADDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 242 return nil, false 243} 244 245// AsTiTaxiiDataConnector is the BasicDataConnector implementation for AADDataConnector. 246func (adc AADDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 247 return nil, false 248} 249 250// AsDataConnector is the BasicDataConnector implementation for AADDataConnector. 251func (adc AADDataConnector) AsDataConnector() (*DataConnector, bool) { 252 return nil, false 253} 254 255// AsBasicDataConnector is the BasicDataConnector implementation for AADDataConnector. 256func (adc AADDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 257 return &adc, true 258} 259 260// UnmarshalJSON is the custom unmarshaler for AADDataConnector struct. 261func (adc *AADDataConnector) UnmarshalJSON(body []byte) error { 262 var m map[string]*json.RawMessage 263 err := json.Unmarshal(body, &m) 264 if err != nil { 265 return err 266 } 267 for k, v := range m { 268 switch k { 269 case "properties": 270 if v != nil { 271 var aADDataConnectorProperties AADDataConnectorProperties 272 err = json.Unmarshal(*v, &aADDataConnectorProperties) 273 if err != nil { 274 return err 275 } 276 adc.AADDataConnectorProperties = &aADDataConnectorProperties 277 } 278 case "id": 279 if v != nil { 280 var ID string 281 err = json.Unmarshal(*v, &ID) 282 if err != nil { 283 return err 284 } 285 adc.ID = &ID 286 } 287 case "name": 288 if v != nil { 289 var name string 290 err = json.Unmarshal(*v, &name) 291 if err != nil { 292 return err 293 } 294 adc.Name = &name 295 } 296 case "type": 297 if v != nil { 298 var typeVar string 299 err = json.Unmarshal(*v, &typeVar) 300 if err != nil { 301 return err 302 } 303 adc.Type = &typeVar 304 } 305 case "etag": 306 if v != nil { 307 var etag string 308 err = json.Unmarshal(*v, &etag) 309 if err != nil { 310 return err 311 } 312 adc.Etag = &etag 313 } 314 case "kind": 315 if v != nil { 316 var kind KindBasicDataConnector 317 err = json.Unmarshal(*v, &kind) 318 if err != nil { 319 return err 320 } 321 adc.Kind = kind 322 } 323 } 324 } 325 326 return nil 327} 328 329// AADDataConnectorProperties AAD (Azure Active Directory) data connector properties. 330type AADDataConnectorProperties struct { 331 // TenantID - The tenant id to connect to, and get the data from. 332 TenantID *string `json:"tenantId,omitempty"` 333 // DataTypes - The available data types for the connector. 334 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 335} 336 337// AATPCheckRequirements represents AATP (Azure Advanced Threat Protection) requirements check request. 338type AATPCheckRequirements struct { 339 // AATPCheckRequirementsProperties - AATP (Azure Advanced Threat Protection) requirements check properties. 340 *AATPCheckRequirementsProperties `json:"properties,omitempty"` 341 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 342 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 343} 344 345// MarshalJSON is the custom marshaler for AATPCheckRequirements. 346func (acr AATPCheckRequirements) MarshalJSON() ([]byte, error) { 347 acr.Kind = KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection 348 objectMap := make(map[string]interface{}) 349 if acr.AATPCheckRequirementsProperties != nil { 350 objectMap["properties"] = acr.AATPCheckRequirementsProperties 351 } 352 if acr.Kind != "" { 353 objectMap["kind"] = acr.Kind 354 } 355 return json.Marshal(objectMap) 356} 357 358// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 359func (acr AATPCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 360 return nil, false 361} 362 363// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 364func (acr AATPCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 365 return &acr, true 366} 367 368// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 369func (acr AATPCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 370 return nil, false 371} 372 373// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 374func (acr AATPCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 375 return nil, false 376} 377 378// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 379func (acr AATPCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 380 return nil, false 381} 382 383// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 384func (acr AATPCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 385 return nil, false 386} 387 388// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 389func (acr AATPCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 390 return nil, false 391} 392 393// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 394func (acr AATPCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 395 return nil, false 396} 397 398// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 399func (acr AATPCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 400 return nil, false 401} 402 403// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 404func (acr AATPCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 405 return nil, false 406} 407 408// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 409func (acr AATPCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 410 return nil, false 411} 412 413// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 414func (acr AATPCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 415 return nil, false 416} 417 418// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 419func (acr AATPCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 420 return nil, false 421} 422 423// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AATPCheckRequirements. 424func (acr AATPCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 425 return &acr, true 426} 427 428// UnmarshalJSON is the custom unmarshaler for AATPCheckRequirements struct. 429func (acr *AATPCheckRequirements) UnmarshalJSON(body []byte) error { 430 var m map[string]*json.RawMessage 431 err := json.Unmarshal(body, &m) 432 if err != nil { 433 return err 434 } 435 for k, v := range m { 436 switch k { 437 case "properties": 438 if v != nil { 439 var aATPCheckRequirementsProperties AATPCheckRequirementsProperties 440 err = json.Unmarshal(*v, &aATPCheckRequirementsProperties) 441 if err != nil { 442 return err 443 } 444 acr.AATPCheckRequirementsProperties = &aATPCheckRequirementsProperties 445 } 446 case "kind": 447 if v != nil { 448 var kind KindBasicDataConnectorsCheckRequirements 449 err = json.Unmarshal(*v, &kind) 450 if err != nil { 451 return err 452 } 453 acr.Kind = kind 454 } 455 } 456 } 457 458 return nil 459} 460 461// AATPCheckRequirementsProperties AATP (Azure Advanced Threat Protection) requirements check properties. 462type AATPCheckRequirementsProperties struct { 463 // TenantID - The tenant id to connect to, and get the data from. 464 TenantID *string `json:"tenantId,omitempty"` 465} 466 467// AATPDataConnector represents AATP (Azure Advanced Threat Protection) data connector. 468type AATPDataConnector struct { 469 // AATPDataConnectorProperties - AATP (Azure Advanced Threat Protection) data connector properties. 470 *AATPDataConnectorProperties `json:"properties,omitempty"` 471 // ID - READ-ONLY; Azure resource Id 472 ID *string `json:"id,omitempty"` 473 // Name - READ-ONLY; Azure resource name 474 Name *string `json:"name,omitempty"` 475 // Type - READ-ONLY; Azure resource type 476 Type *string `json:"type,omitempty"` 477 // Etag - Etag of the azure resource 478 Etag *string `json:"etag,omitempty"` 479 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 480 Kind KindBasicDataConnector `json:"kind,omitempty"` 481} 482 483// MarshalJSON is the custom marshaler for AATPDataConnector. 484func (adc AATPDataConnector) MarshalJSON() ([]byte, error) { 485 adc.Kind = KindBasicDataConnectorKindAzureAdvancedThreatProtection 486 objectMap := make(map[string]interface{}) 487 if adc.AATPDataConnectorProperties != nil { 488 objectMap["properties"] = adc.AATPDataConnectorProperties 489 } 490 if adc.Etag != nil { 491 objectMap["etag"] = adc.Etag 492 } 493 if adc.Kind != "" { 494 objectMap["kind"] = adc.Kind 495 } 496 return json.Marshal(objectMap) 497} 498 499// AsAADDataConnector is the BasicDataConnector implementation for AATPDataConnector. 500func (adc AATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 501 return nil, false 502} 503 504// AsAATPDataConnector is the BasicDataConnector implementation for AATPDataConnector. 505func (adc AATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 506 return &adc, true 507} 508 509// AsMSTIDataConnector is the BasicDataConnector implementation for AATPDataConnector. 510func (adc AATPDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 511 return nil, false 512} 513 514// AsMTPDataConnector is the BasicDataConnector implementation for AATPDataConnector. 515func (adc AATPDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 516 return nil, false 517} 518 519// AsASCDataConnector is the BasicDataConnector implementation for AATPDataConnector. 520func (adc AATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 521 return nil, false 522} 523 524// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AATPDataConnector. 525func (adc AATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 526 return nil, false 527} 528 529// AsDynamics365DataConnector is the BasicDataConnector implementation for AATPDataConnector. 530func (adc AATPDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 531 return nil, false 532} 533 534// AsMCASDataConnector is the BasicDataConnector implementation for AATPDataConnector. 535func (adc AATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 536 return nil, false 537} 538 539// AsMDATPDataConnector is the BasicDataConnector implementation for AATPDataConnector. 540func (adc AATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 541 return nil, false 542} 543 544// AsOfficeATPDataConnector is the BasicDataConnector implementation for AATPDataConnector. 545func (adc AATPDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 546 return nil, false 547} 548 549// AsOfficeDataConnector is the BasicDataConnector implementation for AATPDataConnector. 550func (adc AATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 551 return nil, false 552} 553 554// AsTIDataConnector is the BasicDataConnector implementation for AATPDataConnector. 555func (adc AATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 556 return nil, false 557} 558 559// AsTiTaxiiDataConnector is the BasicDataConnector implementation for AATPDataConnector. 560func (adc AATPDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 561 return nil, false 562} 563 564// AsDataConnector is the BasicDataConnector implementation for AATPDataConnector. 565func (adc AATPDataConnector) AsDataConnector() (*DataConnector, bool) { 566 return nil, false 567} 568 569// AsBasicDataConnector is the BasicDataConnector implementation for AATPDataConnector. 570func (adc AATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 571 return &adc, true 572} 573 574// UnmarshalJSON is the custom unmarshaler for AATPDataConnector struct. 575func (adc *AATPDataConnector) UnmarshalJSON(body []byte) error { 576 var m map[string]*json.RawMessage 577 err := json.Unmarshal(body, &m) 578 if err != nil { 579 return err 580 } 581 for k, v := range m { 582 switch k { 583 case "properties": 584 if v != nil { 585 var aATPDataConnectorProperties AATPDataConnectorProperties 586 err = json.Unmarshal(*v, &aATPDataConnectorProperties) 587 if err != nil { 588 return err 589 } 590 adc.AATPDataConnectorProperties = &aATPDataConnectorProperties 591 } 592 case "id": 593 if v != nil { 594 var ID string 595 err = json.Unmarshal(*v, &ID) 596 if err != nil { 597 return err 598 } 599 adc.ID = &ID 600 } 601 case "name": 602 if v != nil { 603 var name string 604 err = json.Unmarshal(*v, &name) 605 if err != nil { 606 return err 607 } 608 adc.Name = &name 609 } 610 case "type": 611 if v != nil { 612 var typeVar string 613 err = json.Unmarshal(*v, &typeVar) 614 if err != nil { 615 return err 616 } 617 adc.Type = &typeVar 618 } 619 case "etag": 620 if v != nil { 621 var etag string 622 err = json.Unmarshal(*v, &etag) 623 if err != nil { 624 return err 625 } 626 adc.Etag = &etag 627 } 628 case "kind": 629 if v != nil { 630 var kind KindBasicDataConnector 631 err = json.Unmarshal(*v, &kind) 632 if err != nil { 633 return err 634 } 635 adc.Kind = kind 636 } 637 } 638 } 639 640 return nil 641} 642 643// AATPDataConnectorProperties AATP (Azure Advanced Threat Protection) data connector properties. 644type AATPDataConnectorProperties struct { 645 // TenantID - The tenant id to connect to, and get the data from. 646 TenantID *string `json:"tenantId,omitempty"` 647 // DataTypes - The available data types for the connector. 648 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 649} 650 651// AccountEntity represents an account entity. 652type AccountEntity struct { 653 // AccountEntityProperties - Account entity properties 654 *AccountEntityProperties `json:"properties,omitempty"` 655 // ID - READ-ONLY; Azure resource Id 656 ID *string `json:"id,omitempty"` 657 // Name - READ-ONLY; Azure resource name 658 Name *string `json:"name,omitempty"` 659 // Type - READ-ONLY; Azure resource type 660 Type *string `json:"type,omitempty"` 661 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 662 Kind KindBasicEntity `json:"kind,omitempty"` 663} 664 665// MarshalJSON is the custom marshaler for AccountEntity. 666func (ae AccountEntity) MarshalJSON() ([]byte, error) { 667 ae.Kind = KindBasicEntityKindAccount 668 objectMap := make(map[string]interface{}) 669 if ae.AccountEntityProperties != nil { 670 objectMap["properties"] = ae.AccountEntityProperties 671 } 672 if ae.Kind != "" { 673 objectMap["kind"] = ae.Kind 674 } 675 return json.Marshal(objectMap) 676} 677 678// AsAccountEntity is the BasicEntity implementation for AccountEntity. 679func (ae AccountEntity) AsAccountEntity() (*AccountEntity, bool) { 680 return &ae, true 681} 682 683// AsAzureResourceEntity is the BasicEntity implementation for AccountEntity. 684func (ae AccountEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 685 return nil, false 686} 687 688// AsCloudApplicationEntity is the BasicEntity implementation for AccountEntity. 689func (ae AccountEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 690 return nil, false 691} 692 693// AsDNSEntity is the BasicEntity implementation for AccountEntity. 694func (ae AccountEntity) AsDNSEntity() (*DNSEntity, bool) { 695 return nil, false 696} 697 698// AsFileEntity is the BasicEntity implementation for AccountEntity. 699func (ae AccountEntity) AsFileEntity() (*FileEntity, bool) { 700 return nil, false 701} 702 703// AsFileHashEntity is the BasicEntity implementation for AccountEntity. 704func (ae AccountEntity) AsFileHashEntity() (*FileHashEntity, bool) { 705 return nil, false 706} 707 708// AsHostEntity is the BasicEntity implementation for AccountEntity. 709func (ae AccountEntity) AsHostEntity() (*HostEntity, bool) { 710 return nil, false 711} 712 713// AsHuntingBookmark is the BasicEntity implementation for AccountEntity. 714func (ae AccountEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 715 return nil, false 716} 717 718// AsSecurityAlert is the BasicEntity implementation for AccountEntity. 719func (ae AccountEntity) AsSecurityAlert() (*SecurityAlert, bool) { 720 return nil, false 721} 722 723// AsIPEntity is the BasicEntity implementation for AccountEntity. 724func (ae AccountEntity) AsIPEntity() (*IPEntity, bool) { 725 return nil, false 726} 727 728// AsMailboxEntity is the BasicEntity implementation for AccountEntity. 729func (ae AccountEntity) AsMailboxEntity() (*MailboxEntity, bool) { 730 return nil, false 731} 732 733// AsMailClusterEntity is the BasicEntity implementation for AccountEntity. 734func (ae AccountEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 735 return nil, false 736} 737 738// AsMailMessageEntity is the BasicEntity implementation for AccountEntity. 739func (ae AccountEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 740 return nil, false 741} 742 743// AsSubmissionMailEntity is the BasicEntity implementation for AccountEntity. 744func (ae AccountEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 745 return nil, false 746} 747 748// AsMalwareEntity is the BasicEntity implementation for AccountEntity. 749func (ae AccountEntity) AsMalwareEntity() (*MalwareEntity, bool) { 750 return nil, false 751} 752 753// AsProcessEntity is the BasicEntity implementation for AccountEntity. 754func (ae AccountEntity) AsProcessEntity() (*ProcessEntity, bool) { 755 return nil, false 756} 757 758// AsRegistryKeyEntity is the BasicEntity implementation for AccountEntity. 759func (ae AccountEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 760 return nil, false 761} 762 763// AsRegistryValueEntity is the BasicEntity implementation for AccountEntity. 764func (ae AccountEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 765 return nil, false 766} 767 768// AsSecurityGroupEntity is the BasicEntity implementation for AccountEntity. 769func (ae AccountEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 770 return nil, false 771} 772 773// AsURLEntity is the BasicEntity implementation for AccountEntity. 774func (ae AccountEntity) AsURLEntity() (*URLEntity, bool) { 775 return nil, false 776} 777 778// AsIoTDeviceEntity is the BasicEntity implementation for AccountEntity. 779func (ae AccountEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 780 return nil, false 781} 782 783// AsEntity is the BasicEntity implementation for AccountEntity. 784func (ae AccountEntity) AsEntity() (*Entity, bool) { 785 return nil, false 786} 787 788// AsBasicEntity is the BasicEntity implementation for AccountEntity. 789func (ae AccountEntity) AsBasicEntity() (BasicEntity, bool) { 790 return &ae, true 791} 792 793// UnmarshalJSON is the custom unmarshaler for AccountEntity struct. 794func (ae *AccountEntity) UnmarshalJSON(body []byte) error { 795 var m map[string]*json.RawMessage 796 err := json.Unmarshal(body, &m) 797 if err != nil { 798 return err 799 } 800 for k, v := range m { 801 switch k { 802 case "properties": 803 if v != nil { 804 var accountEntityProperties AccountEntityProperties 805 err = json.Unmarshal(*v, &accountEntityProperties) 806 if err != nil { 807 return err 808 } 809 ae.AccountEntityProperties = &accountEntityProperties 810 } 811 case "id": 812 if v != nil { 813 var ID string 814 err = json.Unmarshal(*v, &ID) 815 if err != nil { 816 return err 817 } 818 ae.ID = &ID 819 } 820 case "name": 821 if v != nil { 822 var name string 823 err = json.Unmarshal(*v, &name) 824 if err != nil { 825 return err 826 } 827 ae.Name = &name 828 } 829 case "type": 830 if v != nil { 831 var typeVar string 832 err = json.Unmarshal(*v, &typeVar) 833 if err != nil { 834 return err 835 } 836 ae.Type = &typeVar 837 } 838 case "kind": 839 if v != nil { 840 var kind KindBasicEntity 841 err = json.Unmarshal(*v, &kind) 842 if err != nil { 843 return err 844 } 845 ae.Kind = kind 846 } 847 } 848 } 849 850 return nil 851} 852 853// AccountEntityProperties account entity property bag. 854type AccountEntityProperties struct { 855 // AadTenantID - READ-ONLY; The Azure Active Directory tenant id. 856 AadTenantID *string `json:"aadTenantId,omitempty"` 857 // AadUserID - READ-ONLY; The Azure Active Directory user id. 858 AadUserID *string `json:"aadUserId,omitempty"` 859 // AccountName - READ-ONLY; The name of the account. This field should hold only the name without any domain added to it, i.e. administrator. 860 AccountName *string `json:"accountName,omitempty"` 861 // DisplayName - READ-ONLY; The display name of the account. 862 DisplayName *string `json:"displayName,omitempty"` 863 // HostEntityID - READ-ONLY; The Host entity id that contains the account in case it is a local account (not domain joined) 864 HostEntityID *string `json:"hostEntityId,omitempty"` 865 // IsDomainJoined - READ-ONLY; Determines whether this is a domain account. 866 IsDomainJoined *bool `json:"isDomainJoined,omitempty"` 867 // NtDomain - READ-ONLY; The NetBIOS domain name as it appears in the alert format – domain\username. Examples: NT AUTHORITY. 868 NtDomain *string `json:"ntDomain,omitempty"` 869 // ObjectGUID - READ-ONLY; The objectGUID attribute is a single-value attribute that is the unique identifier for the object, assigned by active directory. 870 ObjectGUID *uuid.UUID `json:"objectGuid,omitempty"` 871 // Puid - READ-ONLY; The Azure Active Directory Passport User ID. 872 Puid *string `json:"puid,omitempty"` 873 // Sid - READ-ONLY; The account security identifier, e.g. S-1-5-18. 874 Sid *string `json:"sid,omitempty"` 875 // UpnSuffix - READ-ONLY; The user principal name suffix for the account, in some cases it is also the domain name. Examples: contoso.com. 876 UpnSuffix *string `json:"upnSuffix,omitempty"` 877 // DNSDomain - READ-ONLY; The fully qualified domain DNS name. 878 DNSDomain *string `json:"dnsDomain,omitempty"` 879 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 880 AdditionalData map[string]interface{} `json:"additionalData"` 881 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 882 FriendlyName *string `json:"friendlyName,omitempty"` 883} 884 885// MarshalJSON is the custom marshaler for AccountEntityProperties. 886func (aep AccountEntityProperties) MarshalJSON() ([]byte, error) { 887 objectMap := make(map[string]interface{}) 888 return json.Marshal(objectMap) 889} 890 891// ActionPropertiesBase action property bag base. 892type ActionPropertiesBase struct { 893 // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. 894 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 895} 896 897// ActionRequest action for alert rule. 898type ActionRequest struct { 899 // ActionRequestProperties - Action properties for put request 900 *ActionRequestProperties `json:"properties,omitempty"` 901 // ID - READ-ONLY; Azure resource Id 902 ID *string `json:"id,omitempty"` 903 // Name - READ-ONLY; Azure resource name 904 Name *string `json:"name,omitempty"` 905 // Type - READ-ONLY; Azure resource type 906 Type *string `json:"type,omitempty"` 907 // Etag - Etag of the azure resource 908 Etag *string `json:"etag,omitempty"` 909} 910 911// MarshalJSON is the custom marshaler for ActionRequest. 912func (ar ActionRequest) MarshalJSON() ([]byte, error) { 913 objectMap := make(map[string]interface{}) 914 if ar.ActionRequestProperties != nil { 915 objectMap["properties"] = ar.ActionRequestProperties 916 } 917 if ar.Etag != nil { 918 objectMap["etag"] = ar.Etag 919 } 920 return json.Marshal(objectMap) 921} 922 923// UnmarshalJSON is the custom unmarshaler for ActionRequest struct. 924func (ar *ActionRequest) UnmarshalJSON(body []byte) error { 925 var m map[string]*json.RawMessage 926 err := json.Unmarshal(body, &m) 927 if err != nil { 928 return err 929 } 930 for k, v := range m { 931 switch k { 932 case "properties": 933 if v != nil { 934 var actionRequestProperties ActionRequestProperties 935 err = json.Unmarshal(*v, &actionRequestProperties) 936 if err != nil { 937 return err 938 } 939 ar.ActionRequestProperties = &actionRequestProperties 940 } 941 case "id": 942 if v != nil { 943 var ID string 944 err = json.Unmarshal(*v, &ID) 945 if err != nil { 946 return err 947 } 948 ar.ID = &ID 949 } 950 case "name": 951 if v != nil { 952 var name string 953 err = json.Unmarshal(*v, &name) 954 if err != nil { 955 return err 956 } 957 ar.Name = &name 958 } 959 case "type": 960 if v != nil { 961 var typeVar string 962 err = json.Unmarshal(*v, &typeVar) 963 if err != nil { 964 return err 965 } 966 ar.Type = &typeVar 967 } 968 case "etag": 969 if v != nil { 970 var etag string 971 err = json.Unmarshal(*v, &etag) 972 if err != nil { 973 return err 974 } 975 ar.Etag = &etag 976 } 977 } 978 } 979 980 return nil 981} 982 983// ActionRequestProperties action property bag. 984type ActionRequestProperties struct { 985 // TriggerURI - Logic App Callback URL for this specific workflow. 986 TriggerURI *string `json:"triggerUri,omitempty"` 987 // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. 988 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 989} 990 991// ActionResponse action for alert rule. 992type ActionResponse struct { 993 autorest.Response `json:"-"` 994 // Etag - Etag of the action. 995 Etag *string `json:"etag,omitempty"` 996 // ActionResponseProperties - Action properties for get request 997 *ActionResponseProperties `json:"properties,omitempty"` 998 // ID - READ-ONLY; Azure resource Id 999 ID *string `json:"id,omitempty"` 1000 // Name - READ-ONLY; Azure resource name 1001 Name *string `json:"name,omitempty"` 1002 // Type - READ-ONLY; Azure resource type 1003 Type *string `json:"type,omitempty"` 1004} 1005 1006// MarshalJSON is the custom marshaler for ActionResponse. 1007func (ar ActionResponse) MarshalJSON() ([]byte, error) { 1008 objectMap := make(map[string]interface{}) 1009 if ar.Etag != nil { 1010 objectMap["etag"] = ar.Etag 1011 } 1012 if ar.ActionResponseProperties != nil { 1013 objectMap["properties"] = ar.ActionResponseProperties 1014 } 1015 return json.Marshal(objectMap) 1016} 1017 1018// UnmarshalJSON is the custom unmarshaler for ActionResponse struct. 1019func (ar *ActionResponse) UnmarshalJSON(body []byte) error { 1020 var m map[string]*json.RawMessage 1021 err := json.Unmarshal(body, &m) 1022 if err != nil { 1023 return err 1024 } 1025 for k, v := range m { 1026 switch k { 1027 case "etag": 1028 if v != nil { 1029 var etag string 1030 err = json.Unmarshal(*v, &etag) 1031 if err != nil { 1032 return err 1033 } 1034 ar.Etag = &etag 1035 } 1036 case "properties": 1037 if v != nil { 1038 var actionResponseProperties ActionResponseProperties 1039 err = json.Unmarshal(*v, &actionResponseProperties) 1040 if err != nil { 1041 return err 1042 } 1043 ar.ActionResponseProperties = &actionResponseProperties 1044 } 1045 case "id": 1046 if v != nil { 1047 var ID string 1048 err = json.Unmarshal(*v, &ID) 1049 if err != nil { 1050 return err 1051 } 1052 ar.ID = &ID 1053 } 1054 case "name": 1055 if v != nil { 1056 var name string 1057 err = json.Unmarshal(*v, &name) 1058 if err != nil { 1059 return err 1060 } 1061 ar.Name = &name 1062 } 1063 case "type": 1064 if v != nil { 1065 var typeVar string 1066 err = json.Unmarshal(*v, &typeVar) 1067 if err != nil { 1068 return err 1069 } 1070 ar.Type = &typeVar 1071 } 1072 } 1073 } 1074 1075 return nil 1076} 1077 1078// ActionResponseProperties action property bag. 1079type ActionResponseProperties struct { 1080 // WorkflowID - The name of the logic app's workflow. 1081 WorkflowID *string `json:"workflowId,omitempty"` 1082 // LogicAppResourceID - Logic App Resource Id, /subscriptions/{my-subscription}/resourceGroups/{my-resource-group}/providers/Microsoft.Logic/workflows/{my-workflow-id}. 1083 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 1084} 1085 1086// ActionsList list all the actions. 1087type ActionsList struct { 1088 autorest.Response `json:"-"` 1089 // NextLink - READ-ONLY; URL to fetch the next set of actions. 1090 NextLink *string `json:"nextLink,omitempty"` 1091 // Value - Array of actions. 1092 Value *[]ActionResponse `json:"value,omitempty"` 1093} 1094 1095// MarshalJSON is the custom marshaler for ActionsList. 1096func (al ActionsList) MarshalJSON() ([]byte, error) { 1097 objectMap := make(map[string]interface{}) 1098 if al.Value != nil { 1099 objectMap["value"] = al.Value 1100 } 1101 return json.Marshal(objectMap) 1102} 1103 1104// ActionsListIterator provides access to a complete listing of ActionResponse values. 1105type ActionsListIterator struct { 1106 i int 1107 page ActionsListPage 1108} 1109 1110// NextWithContext advances to the next value. If there was an error making 1111// the request the iterator does not advance and the error is returned. 1112func (iter *ActionsListIterator) NextWithContext(ctx context.Context) (err error) { 1113 if tracing.IsEnabled() { 1114 ctx = tracing.StartSpan(ctx, fqdn+"/ActionsListIterator.NextWithContext") 1115 defer func() { 1116 sc := -1 1117 if iter.Response().Response.Response != nil { 1118 sc = iter.Response().Response.Response.StatusCode 1119 } 1120 tracing.EndSpan(ctx, sc, err) 1121 }() 1122 } 1123 iter.i++ 1124 if iter.i < len(iter.page.Values()) { 1125 return nil 1126 } 1127 err = iter.page.NextWithContext(ctx) 1128 if err != nil { 1129 iter.i-- 1130 return err 1131 } 1132 iter.i = 0 1133 return nil 1134} 1135 1136// Next advances to the next value. If there was an error making 1137// the request the iterator does not advance and the error is returned. 1138// Deprecated: Use NextWithContext() instead. 1139func (iter *ActionsListIterator) Next() error { 1140 return iter.NextWithContext(context.Background()) 1141} 1142 1143// NotDone returns true if the enumeration should be started or is not yet complete. 1144func (iter ActionsListIterator) NotDone() bool { 1145 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 1146} 1147 1148// Response returns the raw server response from the last page request. 1149func (iter ActionsListIterator) Response() ActionsList { 1150 return iter.page.Response() 1151} 1152 1153// Value returns the current value or a zero-initialized value if the 1154// iterator has advanced beyond the end of the collection. 1155func (iter ActionsListIterator) Value() ActionResponse { 1156 if !iter.page.NotDone() { 1157 return ActionResponse{} 1158 } 1159 return iter.page.Values()[iter.i] 1160} 1161 1162// Creates a new instance of the ActionsListIterator type. 1163func NewActionsListIterator(page ActionsListPage) ActionsListIterator { 1164 return ActionsListIterator{page: page} 1165} 1166 1167// IsEmpty returns true if the ListResult contains no values. 1168func (al ActionsList) IsEmpty() bool { 1169 return al.Value == nil || len(*al.Value) == 0 1170} 1171 1172// hasNextLink returns true if the NextLink is not empty. 1173func (al ActionsList) hasNextLink() bool { 1174 return al.NextLink != nil && len(*al.NextLink) != 0 1175} 1176 1177// actionsListPreparer prepares a request to retrieve the next set of results. 1178// It returns nil if no more results exist. 1179func (al ActionsList) actionsListPreparer(ctx context.Context) (*http.Request, error) { 1180 if !al.hasNextLink() { 1181 return nil, nil 1182 } 1183 return autorest.Prepare((&http.Request{}).WithContext(ctx), 1184 autorest.AsJSON(), 1185 autorest.AsGet(), 1186 autorest.WithBaseURL(to.String(al.NextLink))) 1187} 1188 1189// ActionsListPage contains a page of ActionResponse values. 1190type ActionsListPage struct { 1191 fn func(context.Context, ActionsList) (ActionsList, error) 1192 al ActionsList 1193} 1194 1195// NextWithContext advances to the next page of values. If there was an error making 1196// the request the page does not advance and the error is returned. 1197func (page *ActionsListPage) NextWithContext(ctx context.Context) (err error) { 1198 if tracing.IsEnabled() { 1199 ctx = tracing.StartSpan(ctx, fqdn+"/ActionsListPage.NextWithContext") 1200 defer func() { 1201 sc := -1 1202 if page.Response().Response.Response != nil { 1203 sc = page.Response().Response.Response.StatusCode 1204 } 1205 tracing.EndSpan(ctx, sc, err) 1206 }() 1207 } 1208 for { 1209 next, err := page.fn(ctx, page.al) 1210 if err != nil { 1211 return err 1212 } 1213 page.al = next 1214 if !next.hasNextLink() || !next.IsEmpty() { 1215 break 1216 } 1217 } 1218 return nil 1219} 1220 1221// Next advances to the next page of values. If there was an error making 1222// the request the page does not advance and the error is returned. 1223// Deprecated: Use NextWithContext() instead. 1224func (page *ActionsListPage) Next() error { 1225 return page.NextWithContext(context.Background()) 1226} 1227 1228// NotDone returns true if the page enumeration should be started or is not yet complete. 1229func (page ActionsListPage) NotDone() bool { 1230 return !page.al.IsEmpty() 1231} 1232 1233// Response returns the raw server response from the last page request. 1234func (page ActionsListPage) Response() ActionsList { 1235 return page.al 1236} 1237 1238// Values returns the slice of values for the current page or nil if there are no values. 1239func (page ActionsListPage) Values() []ActionResponse { 1240 if page.al.IsEmpty() { 1241 return nil 1242 } 1243 return *page.al.Value 1244} 1245 1246// Creates a new instance of the ActionsListPage type. 1247func NewActionsListPage(cur ActionsList, getNextPage func(context.Context, ActionsList) (ActionsList, error)) ActionsListPage { 1248 return ActionsListPage{ 1249 fn: getNextPage, 1250 al: cur, 1251 } 1252} 1253 1254// ActivityTimelineItem represents Activity timeline item. 1255type ActivityTimelineItem struct { 1256 // QueryID - The activity query id. 1257 QueryID *string `json:"queryId,omitempty"` 1258 // BucketStartTimeUTC - The grouping bucket start time. 1259 BucketStartTimeUTC *date.Time `json:"bucketStartTimeUTC,omitempty"` 1260 // BucketEndTimeUTC - The grouping bucket end time. 1261 BucketEndTimeUTC *date.Time `json:"bucketEndTimeUTC,omitempty"` 1262 // FirstActivityTimeUTC - The time of the first activity in the grouping bucket. 1263 FirstActivityTimeUTC *date.Time `json:"firstActivityTimeUTC,omitempty"` 1264 // LastActivityTimeUTC - The time of the last activity in the grouping bucket. 1265 LastActivityTimeUTC *date.Time `json:"lastActivityTimeUTC,omitempty"` 1266 // Content - The activity timeline content. 1267 Content *string `json:"content,omitempty"` 1268 // Title - The activity timeline title. 1269 Title *string `json:"title,omitempty"` 1270 // Kind - Possible values include: 'KindBasicEntityTimelineItemKindEntityTimelineItem', 'KindBasicEntityTimelineItemKindActivity', 'KindBasicEntityTimelineItemKindSecurityAlert', 'KindBasicEntityTimelineItemKindBookmark' 1271 Kind KindBasicEntityTimelineItem `json:"kind,omitempty"` 1272} 1273 1274// MarshalJSON is the custom marshaler for ActivityTimelineItem. 1275func (ati ActivityTimelineItem) MarshalJSON() ([]byte, error) { 1276 ati.Kind = KindBasicEntityTimelineItemKindActivity 1277 objectMap := make(map[string]interface{}) 1278 if ati.QueryID != nil { 1279 objectMap["queryId"] = ati.QueryID 1280 } 1281 if ati.BucketStartTimeUTC != nil { 1282 objectMap["bucketStartTimeUTC"] = ati.BucketStartTimeUTC 1283 } 1284 if ati.BucketEndTimeUTC != nil { 1285 objectMap["bucketEndTimeUTC"] = ati.BucketEndTimeUTC 1286 } 1287 if ati.FirstActivityTimeUTC != nil { 1288 objectMap["firstActivityTimeUTC"] = ati.FirstActivityTimeUTC 1289 } 1290 if ati.LastActivityTimeUTC != nil { 1291 objectMap["lastActivityTimeUTC"] = ati.LastActivityTimeUTC 1292 } 1293 if ati.Content != nil { 1294 objectMap["content"] = ati.Content 1295 } 1296 if ati.Title != nil { 1297 objectMap["title"] = ati.Title 1298 } 1299 if ati.Kind != "" { 1300 objectMap["kind"] = ati.Kind 1301 } 1302 return json.Marshal(objectMap) 1303} 1304 1305// AsActivityTimelineItem is the BasicEntityTimelineItem implementation for ActivityTimelineItem. 1306func (ati ActivityTimelineItem) AsActivityTimelineItem() (*ActivityTimelineItem, bool) { 1307 return &ati, true 1308} 1309 1310// AsSecurityAlertTimelineItem is the BasicEntityTimelineItem implementation for ActivityTimelineItem. 1311func (ati ActivityTimelineItem) AsSecurityAlertTimelineItem() (*SecurityAlertTimelineItem, bool) { 1312 return nil, false 1313} 1314 1315// AsBookmarkTimelineItem is the BasicEntityTimelineItem implementation for ActivityTimelineItem. 1316func (ati ActivityTimelineItem) AsBookmarkTimelineItem() (*BookmarkTimelineItem, bool) { 1317 return nil, false 1318} 1319 1320// AsEntityTimelineItem is the BasicEntityTimelineItem implementation for ActivityTimelineItem. 1321func (ati ActivityTimelineItem) AsEntityTimelineItem() (*EntityTimelineItem, bool) { 1322 return nil, false 1323} 1324 1325// AsBasicEntityTimelineItem is the BasicEntityTimelineItem implementation for ActivityTimelineItem. 1326func (ati ActivityTimelineItem) AsBasicEntityTimelineItem() (BasicEntityTimelineItem, bool) { 1327 return &ati, true 1328} 1329 1330// BasicAggregations the aggregation. 1331type BasicAggregations interface { 1332 AsCasesAggregation() (*CasesAggregation, bool) 1333 AsAggregations() (*Aggregations, bool) 1334} 1335 1336// Aggregations the aggregation. 1337type Aggregations struct { 1338 autorest.Response `json:"-"` 1339 // ID - READ-ONLY; Azure resource Id 1340 ID *string `json:"id,omitempty"` 1341 // Name - READ-ONLY; Azure resource name 1342 Name *string `json:"name,omitempty"` 1343 // Type - READ-ONLY; Azure resource type 1344 Type *string `json:"type,omitempty"` 1345 // Kind - Possible values include: 'KindAggregations', 'KindCasesAggregation' 1346 Kind Kind `json:"kind,omitempty"` 1347} 1348 1349func unmarshalBasicAggregations(body []byte) (BasicAggregations, error) { 1350 var m map[string]interface{} 1351 err := json.Unmarshal(body, &m) 1352 if err != nil { 1353 return nil, err 1354 } 1355 1356 switch m["kind"] { 1357 case string(KindCasesAggregation): 1358 var ca CasesAggregation 1359 err := json.Unmarshal(body, &ca) 1360 return ca, err 1361 default: 1362 var a Aggregations 1363 err := json.Unmarshal(body, &a) 1364 return a, err 1365 } 1366} 1367func unmarshalBasicAggregationsArray(body []byte) ([]BasicAggregations, error) { 1368 var rawMessages []*json.RawMessage 1369 err := json.Unmarshal(body, &rawMessages) 1370 if err != nil { 1371 return nil, err 1372 } 1373 1374 aArray := make([]BasicAggregations, len(rawMessages)) 1375 1376 for index, rawMessage := range rawMessages { 1377 a, err := unmarshalBasicAggregations(*rawMessage) 1378 if err != nil { 1379 return nil, err 1380 } 1381 aArray[index] = a 1382 } 1383 return aArray, nil 1384} 1385 1386// MarshalJSON is the custom marshaler for Aggregations. 1387func (a Aggregations) MarshalJSON() ([]byte, error) { 1388 a.Kind = KindAggregations 1389 objectMap := make(map[string]interface{}) 1390 if a.Kind != "" { 1391 objectMap["kind"] = a.Kind 1392 } 1393 return json.Marshal(objectMap) 1394} 1395 1396// AsCasesAggregation is the BasicAggregations implementation for Aggregations. 1397func (a Aggregations) AsCasesAggregation() (*CasesAggregation, bool) { 1398 return nil, false 1399} 1400 1401// AsAggregations is the BasicAggregations implementation for Aggregations. 1402func (a Aggregations) AsAggregations() (*Aggregations, bool) { 1403 return &a, true 1404} 1405 1406// AsBasicAggregations is the BasicAggregations implementation for Aggregations. 1407func (a Aggregations) AsBasicAggregations() (BasicAggregations, bool) { 1408 return &a, true 1409} 1410 1411// AggregationsKind describes an Azure resource with kind. 1412type AggregationsKind struct { 1413 // Kind - The kind of the setting 1414 Kind *string `json:"kind,omitempty"` 1415} 1416 1417// AggregationsModel ... 1418type AggregationsModel struct { 1419 autorest.Response `json:"-"` 1420 Value BasicAggregations `json:"value,omitempty"` 1421} 1422 1423// UnmarshalJSON is the custom unmarshaler for AggregationsModel struct. 1424func (am *AggregationsModel) UnmarshalJSON(body []byte) error { 1425 a, err := unmarshalBasicAggregations(body) 1426 if err != nil { 1427 return err 1428 } 1429 am.Value = a 1430 1431 return nil 1432} 1433 1434// BasicAlertRule alert rule. 1435type BasicAlertRule interface { 1436 AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) 1437 AsFusionAlertRule() (*FusionAlertRule, bool) 1438 AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) 1439 AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) 1440 AsScheduledAlertRule() (*ScheduledAlertRule, bool) 1441 AsAlertRule() (*AlertRule, bool) 1442} 1443 1444// AlertRule alert rule. 1445type AlertRule struct { 1446 autorest.Response `json:"-"` 1447 // ID - READ-ONLY; Azure resource Id 1448 ID *string `json:"id,omitempty"` 1449 // Name - READ-ONLY; Azure resource name 1450 Name *string `json:"name,omitempty"` 1451 // Type - READ-ONLY; Azure resource type 1452 Type *string `json:"type,omitempty"` 1453 // Etag - Etag of the azure resource 1454 Etag *string `json:"etag,omitempty"` 1455 // Kind - Possible values include: 'KindBasicAlertRuleKindAlertRule', 'KindBasicAlertRuleKindMLBehaviorAnalytics', 'KindBasicAlertRuleKindFusion', 'KindBasicAlertRuleKindThreatIntelligence', 'KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleKindScheduled' 1456 Kind KindBasicAlertRule `json:"kind,omitempty"` 1457} 1458 1459func unmarshalBasicAlertRule(body []byte) (BasicAlertRule, error) { 1460 var m map[string]interface{} 1461 err := json.Unmarshal(body, &m) 1462 if err != nil { 1463 return nil, err 1464 } 1465 1466 switch m["kind"] { 1467 case string(KindBasicAlertRuleKindMLBehaviorAnalytics): 1468 var mbaar MLBehaviorAnalyticsAlertRule 1469 err := json.Unmarshal(body, &mbaar) 1470 return mbaar, err 1471 case string(KindBasicAlertRuleKindFusion): 1472 var far FusionAlertRule 1473 err := json.Unmarshal(body, &far) 1474 return far, err 1475 case string(KindBasicAlertRuleKindThreatIntelligence): 1476 var tiar ThreatIntelligenceAlertRule 1477 err := json.Unmarshal(body, &tiar) 1478 return tiar, err 1479 case string(KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation): 1480 var msicar MicrosoftSecurityIncidentCreationAlertRule 1481 err := json.Unmarshal(body, &msicar) 1482 return msicar, err 1483 case string(KindBasicAlertRuleKindScheduled): 1484 var sar ScheduledAlertRule 1485 err := json.Unmarshal(body, &sar) 1486 return sar, err 1487 default: 1488 var ar AlertRule 1489 err := json.Unmarshal(body, &ar) 1490 return ar, err 1491 } 1492} 1493func unmarshalBasicAlertRuleArray(body []byte) ([]BasicAlertRule, error) { 1494 var rawMessages []*json.RawMessage 1495 err := json.Unmarshal(body, &rawMessages) 1496 if err != nil { 1497 return nil, err 1498 } 1499 1500 arArray := make([]BasicAlertRule, len(rawMessages)) 1501 1502 for index, rawMessage := range rawMessages { 1503 ar, err := unmarshalBasicAlertRule(*rawMessage) 1504 if err != nil { 1505 return nil, err 1506 } 1507 arArray[index] = ar 1508 } 1509 return arArray, nil 1510} 1511 1512// MarshalJSON is the custom marshaler for AlertRule. 1513func (ar AlertRule) MarshalJSON() ([]byte, error) { 1514 ar.Kind = KindBasicAlertRuleKindAlertRule 1515 objectMap := make(map[string]interface{}) 1516 if ar.Etag != nil { 1517 objectMap["etag"] = ar.Etag 1518 } 1519 if ar.Kind != "" { 1520 objectMap["kind"] = ar.Kind 1521 } 1522 return json.Marshal(objectMap) 1523} 1524 1525// AsMLBehaviorAnalyticsAlertRule is the BasicAlertRule implementation for AlertRule. 1526func (ar AlertRule) AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) { 1527 return nil, false 1528} 1529 1530// AsFusionAlertRule is the BasicAlertRule implementation for AlertRule. 1531func (ar AlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 1532 return nil, false 1533} 1534 1535// AsThreatIntelligenceAlertRule is the BasicAlertRule implementation for AlertRule. 1536func (ar AlertRule) AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) { 1537 return nil, false 1538} 1539 1540// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for AlertRule. 1541func (ar AlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 1542 return nil, false 1543} 1544 1545// AsScheduledAlertRule is the BasicAlertRule implementation for AlertRule. 1546func (ar AlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 1547 return nil, false 1548} 1549 1550// AsAlertRule is the BasicAlertRule implementation for AlertRule. 1551func (ar AlertRule) AsAlertRule() (*AlertRule, bool) { 1552 return &ar, true 1553} 1554 1555// AsBasicAlertRule is the BasicAlertRule implementation for AlertRule. 1556func (ar AlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 1557 return &ar, true 1558} 1559 1560// AlertRuleKind1 describes an Azure resource with kind. 1561type AlertRuleKind1 struct { 1562 // Kind - The kind of the alert rule. Possible values include: 'AlertRuleKindScheduled', 'AlertRuleKindMicrosoftSecurityIncidentCreation', 'AlertRuleKindFusion', 'AlertRuleKindMLBehaviorAnalytics', 'AlertRuleKindThreatIntelligence' 1563 Kind AlertRuleKind `json:"kind,omitempty"` 1564} 1565 1566// AlertRuleModel ... 1567type AlertRuleModel struct { 1568 autorest.Response `json:"-"` 1569 Value BasicAlertRule `json:"value,omitempty"` 1570} 1571 1572// UnmarshalJSON is the custom unmarshaler for AlertRuleModel struct. 1573func (arm *AlertRuleModel) UnmarshalJSON(body []byte) error { 1574 ar, err := unmarshalBasicAlertRule(body) 1575 if err != nil { 1576 return err 1577 } 1578 arm.Value = ar 1579 1580 return nil 1581} 1582 1583// AlertRulesList list all the alert rules. 1584type AlertRulesList struct { 1585 autorest.Response `json:"-"` 1586 // NextLink - READ-ONLY; URL to fetch the next set of alert rules. 1587 NextLink *string `json:"nextLink,omitempty"` 1588 // Value - Array of alert rules. 1589 Value *[]BasicAlertRule `json:"value,omitempty"` 1590} 1591 1592// MarshalJSON is the custom marshaler for AlertRulesList. 1593func (arl AlertRulesList) MarshalJSON() ([]byte, error) { 1594 objectMap := make(map[string]interface{}) 1595 if arl.Value != nil { 1596 objectMap["value"] = arl.Value 1597 } 1598 return json.Marshal(objectMap) 1599} 1600 1601// UnmarshalJSON is the custom unmarshaler for AlertRulesList struct. 1602func (arl *AlertRulesList) UnmarshalJSON(body []byte) error { 1603 var m map[string]*json.RawMessage 1604 err := json.Unmarshal(body, &m) 1605 if err != nil { 1606 return err 1607 } 1608 for k, v := range m { 1609 switch k { 1610 case "nextLink": 1611 if v != nil { 1612 var nextLink string 1613 err = json.Unmarshal(*v, &nextLink) 1614 if err != nil { 1615 return err 1616 } 1617 arl.NextLink = &nextLink 1618 } 1619 case "value": 1620 if v != nil { 1621 value, err := unmarshalBasicAlertRuleArray(*v) 1622 if err != nil { 1623 return err 1624 } 1625 arl.Value = &value 1626 } 1627 } 1628 } 1629 1630 return nil 1631} 1632 1633// AlertRulesListIterator provides access to a complete listing of AlertRule values. 1634type AlertRulesListIterator struct { 1635 i int 1636 page AlertRulesListPage 1637} 1638 1639// NextWithContext advances to the next value. If there was an error making 1640// the request the iterator does not advance and the error is returned. 1641func (iter *AlertRulesListIterator) NextWithContext(ctx context.Context) (err error) { 1642 if tracing.IsEnabled() { 1643 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRulesListIterator.NextWithContext") 1644 defer func() { 1645 sc := -1 1646 if iter.Response().Response.Response != nil { 1647 sc = iter.Response().Response.Response.StatusCode 1648 } 1649 tracing.EndSpan(ctx, sc, err) 1650 }() 1651 } 1652 iter.i++ 1653 if iter.i < len(iter.page.Values()) { 1654 return nil 1655 } 1656 err = iter.page.NextWithContext(ctx) 1657 if err != nil { 1658 iter.i-- 1659 return err 1660 } 1661 iter.i = 0 1662 return nil 1663} 1664 1665// Next advances to the next value. If there was an error making 1666// the request the iterator does not advance and the error is returned. 1667// Deprecated: Use NextWithContext() instead. 1668func (iter *AlertRulesListIterator) Next() error { 1669 return iter.NextWithContext(context.Background()) 1670} 1671 1672// NotDone returns true if the enumeration should be started or is not yet complete. 1673func (iter AlertRulesListIterator) NotDone() bool { 1674 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 1675} 1676 1677// Response returns the raw server response from the last page request. 1678func (iter AlertRulesListIterator) Response() AlertRulesList { 1679 return iter.page.Response() 1680} 1681 1682// Value returns the current value or a zero-initialized value if the 1683// iterator has advanced beyond the end of the collection. 1684func (iter AlertRulesListIterator) Value() BasicAlertRule { 1685 if !iter.page.NotDone() { 1686 return AlertRule{} 1687 } 1688 return iter.page.Values()[iter.i] 1689} 1690 1691// Creates a new instance of the AlertRulesListIterator type. 1692func NewAlertRulesListIterator(page AlertRulesListPage) AlertRulesListIterator { 1693 return AlertRulesListIterator{page: page} 1694} 1695 1696// IsEmpty returns true if the ListResult contains no values. 1697func (arl AlertRulesList) IsEmpty() bool { 1698 return arl.Value == nil || len(*arl.Value) == 0 1699} 1700 1701// hasNextLink returns true if the NextLink is not empty. 1702func (arl AlertRulesList) hasNextLink() bool { 1703 return arl.NextLink != nil && len(*arl.NextLink) != 0 1704} 1705 1706// alertRulesListPreparer prepares a request to retrieve the next set of results. 1707// It returns nil if no more results exist. 1708func (arl AlertRulesList) alertRulesListPreparer(ctx context.Context) (*http.Request, error) { 1709 if !arl.hasNextLink() { 1710 return nil, nil 1711 } 1712 return autorest.Prepare((&http.Request{}).WithContext(ctx), 1713 autorest.AsJSON(), 1714 autorest.AsGet(), 1715 autorest.WithBaseURL(to.String(arl.NextLink))) 1716} 1717 1718// AlertRulesListPage contains a page of BasicAlertRule values. 1719type AlertRulesListPage struct { 1720 fn func(context.Context, AlertRulesList) (AlertRulesList, error) 1721 arl AlertRulesList 1722} 1723 1724// NextWithContext advances to the next page of values. If there was an error making 1725// the request the page does not advance and the error is returned. 1726func (page *AlertRulesListPage) NextWithContext(ctx context.Context) (err error) { 1727 if tracing.IsEnabled() { 1728 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRulesListPage.NextWithContext") 1729 defer func() { 1730 sc := -1 1731 if page.Response().Response.Response != nil { 1732 sc = page.Response().Response.Response.StatusCode 1733 } 1734 tracing.EndSpan(ctx, sc, err) 1735 }() 1736 } 1737 for { 1738 next, err := page.fn(ctx, page.arl) 1739 if err != nil { 1740 return err 1741 } 1742 page.arl = next 1743 if !next.hasNextLink() || !next.IsEmpty() { 1744 break 1745 } 1746 } 1747 return nil 1748} 1749 1750// Next advances to the next page of values. If there was an error making 1751// the request the page does not advance and the error is returned. 1752// Deprecated: Use NextWithContext() instead. 1753func (page *AlertRulesListPage) Next() error { 1754 return page.NextWithContext(context.Background()) 1755} 1756 1757// NotDone returns true if the page enumeration should be started or is not yet complete. 1758func (page AlertRulesListPage) NotDone() bool { 1759 return !page.arl.IsEmpty() 1760} 1761 1762// Response returns the raw server response from the last page request. 1763func (page AlertRulesListPage) Response() AlertRulesList { 1764 return page.arl 1765} 1766 1767// Values returns the slice of values for the current page or nil if there are no values. 1768func (page AlertRulesListPage) Values() []BasicAlertRule { 1769 if page.arl.IsEmpty() { 1770 return nil 1771 } 1772 return *page.arl.Value 1773} 1774 1775// Creates a new instance of the AlertRulesListPage type. 1776func NewAlertRulesListPage(cur AlertRulesList, getNextPage func(context.Context, AlertRulesList) (AlertRulesList, error)) AlertRulesListPage { 1777 return AlertRulesListPage{ 1778 fn: getNextPage, 1779 arl: cur, 1780 } 1781} 1782 1783// BasicAlertRuleTemplate alert rule template. 1784type BasicAlertRuleTemplate interface { 1785 AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) 1786 AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) 1787 AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) 1788 AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) 1789 AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) 1790 AsAlertRuleTemplate() (*AlertRuleTemplate, bool) 1791} 1792 1793// AlertRuleTemplate alert rule template. 1794type AlertRuleTemplate struct { 1795 autorest.Response `json:"-"` 1796 // ID - READ-ONLY; Azure resource Id 1797 ID *string `json:"id,omitempty"` 1798 // Name - READ-ONLY; Azure resource name 1799 Name *string `json:"name,omitempty"` 1800 // Type - READ-ONLY; Azure resource type 1801 Type *string `json:"type,omitempty"` 1802 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindMLBehaviorAnalytics', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindThreatIntelligence', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 1803 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 1804} 1805 1806func unmarshalBasicAlertRuleTemplate(body []byte) (BasicAlertRuleTemplate, error) { 1807 var m map[string]interface{} 1808 err := json.Unmarshal(body, &m) 1809 if err != nil { 1810 return nil, err 1811 } 1812 1813 switch m["kind"] { 1814 case string(KindBasicAlertRuleTemplateKindMLBehaviorAnalytics): 1815 var mbaart MLBehaviorAnalyticsAlertRuleTemplate 1816 err := json.Unmarshal(body, &mbaart) 1817 return mbaart, err 1818 case string(KindBasicAlertRuleTemplateKindFusion): 1819 var fart FusionAlertRuleTemplate 1820 err := json.Unmarshal(body, &fart) 1821 return fart, err 1822 case string(KindBasicAlertRuleTemplateKindThreatIntelligence): 1823 var tiart ThreatIntelligenceAlertRuleTemplate 1824 err := json.Unmarshal(body, &tiart) 1825 return tiart, err 1826 case string(KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation): 1827 var msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate 1828 err := json.Unmarshal(body, &msicart) 1829 return msicart, err 1830 case string(KindBasicAlertRuleTemplateKindScheduled): 1831 var sart ScheduledAlertRuleTemplate 1832 err := json.Unmarshal(body, &sart) 1833 return sart, err 1834 default: 1835 var art AlertRuleTemplate 1836 err := json.Unmarshal(body, &art) 1837 return art, err 1838 } 1839} 1840func unmarshalBasicAlertRuleTemplateArray(body []byte) ([]BasicAlertRuleTemplate, error) { 1841 var rawMessages []*json.RawMessage 1842 err := json.Unmarshal(body, &rawMessages) 1843 if err != nil { 1844 return nil, err 1845 } 1846 1847 artArray := make([]BasicAlertRuleTemplate, len(rawMessages)) 1848 1849 for index, rawMessage := range rawMessages { 1850 art, err := unmarshalBasicAlertRuleTemplate(*rawMessage) 1851 if err != nil { 1852 return nil, err 1853 } 1854 artArray[index] = art 1855 } 1856 return artArray, nil 1857} 1858 1859// MarshalJSON is the custom marshaler for AlertRuleTemplate. 1860func (art AlertRuleTemplate) MarshalJSON() ([]byte, error) { 1861 art.Kind = KindBasicAlertRuleTemplateKindAlertRuleTemplate 1862 objectMap := make(map[string]interface{}) 1863 if art.Kind != "" { 1864 objectMap["kind"] = art.Kind 1865 } 1866 return json.Marshal(objectMap) 1867} 1868 1869// AsMLBehaviorAnalyticsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1870func (art AlertRuleTemplate) AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) { 1871 return nil, false 1872} 1873 1874// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1875func (art AlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 1876 return nil, false 1877} 1878 1879// AsThreatIntelligenceAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1880func (art AlertRuleTemplate) AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) { 1881 return nil, false 1882} 1883 1884// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1885func (art AlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 1886 return nil, false 1887} 1888 1889// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1890func (art AlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 1891 return nil, false 1892} 1893 1894// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1895func (art AlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 1896 return &art, true 1897} 1898 1899// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for AlertRuleTemplate. 1900func (art AlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 1901 return &art, true 1902} 1903 1904// AlertRuleTemplateDataSource alert rule template data sources 1905type AlertRuleTemplateDataSource struct { 1906 // ConnectorID - The connector id that provides the following data types 1907 ConnectorID *string `json:"connectorId,omitempty"` 1908 // DataTypes - The data types used by the alert rule template 1909 DataTypes *[]string `json:"dataTypes,omitempty"` 1910} 1911 1912// AlertRuleTemplateModel ... 1913type AlertRuleTemplateModel struct { 1914 autorest.Response `json:"-"` 1915 Value BasicAlertRuleTemplate `json:"value,omitempty"` 1916} 1917 1918// UnmarshalJSON is the custom unmarshaler for AlertRuleTemplateModel struct. 1919func (artm *AlertRuleTemplateModel) UnmarshalJSON(body []byte) error { 1920 art, err := unmarshalBasicAlertRuleTemplate(body) 1921 if err != nil { 1922 return err 1923 } 1924 artm.Value = art 1925 1926 return nil 1927} 1928 1929// AlertRuleTemplatePropertiesBase base alert rule template property bag. 1930type AlertRuleTemplatePropertiesBase struct { 1931 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 1932 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 1933 // LastUpdatedDateUTC - READ-ONLY; The last time that this alert rule template has been updated. 1934 LastUpdatedDateUTC *date.Time `json:"lastUpdatedDateUTC,omitempty"` 1935 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 1936 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 1937 // Description - The description of the alert rule template. 1938 Description *string `json:"description,omitempty"` 1939 // DisplayName - The display name for alert rule template. 1940 DisplayName *string `json:"displayName,omitempty"` 1941 // RequiredDataConnectors - The required data sources for this template 1942 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 1943 // Status - The alert rule template status. Possible values include: 'TemplateStatusInstalled', 'TemplateStatusAvailable', 'TemplateStatusNotAvailable' 1944 Status TemplateStatus `json:"status,omitempty"` 1945} 1946 1947// MarshalJSON is the custom marshaler for AlertRuleTemplatePropertiesBase. 1948func (artpb AlertRuleTemplatePropertiesBase) MarshalJSON() ([]byte, error) { 1949 objectMap := make(map[string]interface{}) 1950 if artpb.AlertRulesCreatedByTemplateCount != nil { 1951 objectMap["alertRulesCreatedByTemplateCount"] = artpb.AlertRulesCreatedByTemplateCount 1952 } 1953 if artpb.Description != nil { 1954 objectMap["description"] = artpb.Description 1955 } 1956 if artpb.DisplayName != nil { 1957 objectMap["displayName"] = artpb.DisplayName 1958 } 1959 if artpb.RequiredDataConnectors != nil { 1960 objectMap["requiredDataConnectors"] = artpb.RequiredDataConnectors 1961 } 1962 if artpb.Status != "" { 1963 objectMap["status"] = artpb.Status 1964 } 1965 return json.Marshal(objectMap) 1966} 1967 1968// AlertRuleTemplatesList list all the alert rule templates. 1969type AlertRuleTemplatesList struct { 1970 autorest.Response `json:"-"` 1971 // NextLink - READ-ONLY; URL to fetch the next set of alert rule templates. 1972 NextLink *string `json:"nextLink,omitempty"` 1973 // Value - Array of alert rule templates. 1974 Value *[]BasicAlertRuleTemplate `json:"value,omitempty"` 1975} 1976 1977// MarshalJSON is the custom marshaler for AlertRuleTemplatesList. 1978func (artl AlertRuleTemplatesList) MarshalJSON() ([]byte, error) { 1979 objectMap := make(map[string]interface{}) 1980 if artl.Value != nil { 1981 objectMap["value"] = artl.Value 1982 } 1983 return json.Marshal(objectMap) 1984} 1985 1986// UnmarshalJSON is the custom unmarshaler for AlertRuleTemplatesList struct. 1987func (artl *AlertRuleTemplatesList) UnmarshalJSON(body []byte) error { 1988 var m map[string]*json.RawMessage 1989 err := json.Unmarshal(body, &m) 1990 if err != nil { 1991 return err 1992 } 1993 for k, v := range m { 1994 switch k { 1995 case "nextLink": 1996 if v != nil { 1997 var nextLink string 1998 err = json.Unmarshal(*v, &nextLink) 1999 if err != nil { 2000 return err 2001 } 2002 artl.NextLink = &nextLink 2003 } 2004 case "value": 2005 if v != nil { 2006 value, err := unmarshalBasicAlertRuleTemplateArray(*v) 2007 if err != nil { 2008 return err 2009 } 2010 artl.Value = &value 2011 } 2012 } 2013 } 2014 2015 return nil 2016} 2017 2018// AlertRuleTemplatesListIterator provides access to a complete listing of AlertRuleTemplate values. 2019type AlertRuleTemplatesListIterator struct { 2020 i int 2021 page AlertRuleTemplatesListPage 2022} 2023 2024// NextWithContext advances to the next value. If there was an error making 2025// the request the iterator does not advance and the error is returned. 2026func (iter *AlertRuleTemplatesListIterator) NextWithContext(ctx context.Context) (err error) { 2027 if tracing.IsEnabled() { 2028 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRuleTemplatesListIterator.NextWithContext") 2029 defer func() { 2030 sc := -1 2031 if iter.Response().Response.Response != nil { 2032 sc = iter.Response().Response.Response.StatusCode 2033 } 2034 tracing.EndSpan(ctx, sc, err) 2035 }() 2036 } 2037 iter.i++ 2038 if iter.i < len(iter.page.Values()) { 2039 return nil 2040 } 2041 err = iter.page.NextWithContext(ctx) 2042 if err != nil { 2043 iter.i-- 2044 return err 2045 } 2046 iter.i = 0 2047 return nil 2048} 2049 2050// Next advances to the next value. If there was an error making 2051// the request the iterator does not advance and the error is returned. 2052// Deprecated: Use NextWithContext() instead. 2053func (iter *AlertRuleTemplatesListIterator) Next() error { 2054 return iter.NextWithContext(context.Background()) 2055} 2056 2057// NotDone returns true if the enumeration should be started or is not yet complete. 2058func (iter AlertRuleTemplatesListIterator) NotDone() bool { 2059 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 2060} 2061 2062// Response returns the raw server response from the last page request. 2063func (iter AlertRuleTemplatesListIterator) Response() AlertRuleTemplatesList { 2064 return iter.page.Response() 2065} 2066 2067// Value returns the current value or a zero-initialized value if the 2068// iterator has advanced beyond the end of the collection. 2069func (iter AlertRuleTemplatesListIterator) Value() BasicAlertRuleTemplate { 2070 if !iter.page.NotDone() { 2071 return AlertRuleTemplate{} 2072 } 2073 return iter.page.Values()[iter.i] 2074} 2075 2076// Creates a new instance of the AlertRuleTemplatesListIterator type. 2077func NewAlertRuleTemplatesListIterator(page AlertRuleTemplatesListPage) AlertRuleTemplatesListIterator { 2078 return AlertRuleTemplatesListIterator{page: page} 2079} 2080 2081// IsEmpty returns true if the ListResult contains no values. 2082func (artl AlertRuleTemplatesList) IsEmpty() bool { 2083 return artl.Value == nil || len(*artl.Value) == 0 2084} 2085 2086// hasNextLink returns true if the NextLink is not empty. 2087func (artl AlertRuleTemplatesList) hasNextLink() bool { 2088 return artl.NextLink != nil && len(*artl.NextLink) != 0 2089} 2090 2091// alertRuleTemplatesListPreparer prepares a request to retrieve the next set of results. 2092// It returns nil if no more results exist. 2093func (artl AlertRuleTemplatesList) alertRuleTemplatesListPreparer(ctx context.Context) (*http.Request, error) { 2094 if !artl.hasNextLink() { 2095 return nil, nil 2096 } 2097 return autorest.Prepare((&http.Request{}).WithContext(ctx), 2098 autorest.AsJSON(), 2099 autorest.AsGet(), 2100 autorest.WithBaseURL(to.String(artl.NextLink))) 2101} 2102 2103// AlertRuleTemplatesListPage contains a page of BasicAlertRuleTemplate values. 2104type AlertRuleTemplatesListPage struct { 2105 fn func(context.Context, AlertRuleTemplatesList) (AlertRuleTemplatesList, error) 2106 artl AlertRuleTemplatesList 2107} 2108 2109// NextWithContext advances to the next page of values. If there was an error making 2110// the request the page does not advance and the error is returned. 2111func (page *AlertRuleTemplatesListPage) NextWithContext(ctx context.Context) (err error) { 2112 if tracing.IsEnabled() { 2113 ctx = tracing.StartSpan(ctx, fqdn+"/AlertRuleTemplatesListPage.NextWithContext") 2114 defer func() { 2115 sc := -1 2116 if page.Response().Response.Response != nil { 2117 sc = page.Response().Response.Response.StatusCode 2118 } 2119 tracing.EndSpan(ctx, sc, err) 2120 }() 2121 } 2122 for { 2123 next, err := page.fn(ctx, page.artl) 2124 if err != nil { 2125 return err 2126 } 2127 page.artl = next 2128 if !next.hasNextLink() || !next.IsEmpty() { 2129 break 2130 } 2131 } 2132 return nil 2133} 2134 2135// Next advances to the next page of values. If there was an error making 2136// the request the page does not advance and the error is returned. 2137// Deprecated: Use NextWithContext() instead. 2138func (page *AlertRuleTemplatesListPage) Next() error { 2139 return page.NextWithContext(context.Background()) 2140} 2141 2142// NotDone returns true if the page enumeration should be started or is not yet complete. 2143func (page AlertRuleTemplatesListPage) NotDone() bool { 2144 return !page.artl.IsEmpty() 2145} 2146 2147// Response returns the raw server response from the last page request. 2148func (page AlertRuleTemplatesListPage) Response() AlertRuleTemplatesList { 2149 return page.artl 2150} 2151 2152// Values returns the slice of values for the current page or nil if there are no values. 2153func (page AlertRuleTemplatesListPage) Values() []BasicAlertRuleTemplate { 2154 if page.artl.IsEmpty() { 2155 return nil 2156 } 2157 return *page.artl.Value 2158} 2159 2160// Creates a new instance of the AlertRuleTemplatesListPage type. 2161func NewAlertRuleTemplatesListPage(cur AlertRuleTemplatesList, getNextPage func(context.Context, AlertRuleTemplatesList) (AlertRuleTemplatesList, error)) AlertRuleTemplatesListPage { 2162 return AlertRuleTemplatesListPage{ 2163 fn: getNextPage, 2164 artl: cur, 2165 } 2166} 2167 2168// AlertsDataTypeOfDataConnector alerts data type for data connectors. 2169type AlertsDataTypeOfDataConnector struct { 2170 // Alerts - Alerts data type connection. 2171 Alerts *AlertsDataTypeOfDataConnectorAlerts `json:"alerts,omitempty"` 2172} 2173 2174// AlertsDataTypeOfDataConnectorAlerts alerts data type connection. 2175type AlertsDataTypeOfDataConnectorAlerts struct { 2176 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 2177 State DataTypeState `json:"state,omitempty"` 2178} 2179 2180// ASCCheckRequirements represents ASC (Azure Security Center) requirements check request. 2181type ASCCheckRequirements struct { 2182 // ASCCheckRequirementsProperties - ASC (Azure Security Center) requirements check properties. 2183 *ASCCheckRequirementsProperties `json:"properties,omitempty"` 2184 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 2185 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 2186} 2187 2188// MarshalJSON is the custom marshaler for ASCCheckRequirements. 2189func (acr ASCCheckRequirements) MarshalJSON() ([]byte, error) { 2190 acr.Kind = KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter 2191 objectMap := make(map[string]interface{}) 2192 if acr.ASCCheckRequirementsProperties != nil { 2193 objectMap["properties"] = acr.ASCCheckRequirementsProperties 2194 } 2195 if acr.Kind != "" { 2196 objectMap["kind"] = acr.Kind 2197 } 2198 return json.Marshal(objectMap) 2199} 2200 2201// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2202func (acr ASCCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 2203 return nil, false 2204} 2205 2206// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2207func (acr ASCCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 2208 return nil, false 2209} 2210 2211// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2212func (acr ASCCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 2213 return nil, false 2214} 2215 2216// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2217func (acr ASCCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 2218 return nil, false 2219} 2220 2221// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2222func (acr ASCCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 2223 return &acr, true 2224} 2225 2226// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2227func (acr ASCCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 2228 return nil, false 2229} 2230 2231// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2232func (acr ASCCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 2233 return nil, false 2234} 2235 2236// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2237func (acr ASCCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 2238 return nil, false 2239} 2240 2241// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2242func (acr ASCCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 2243 return nil, false 2244} 2245 2246// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2247func (acr ASCCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 2248 return nil, false 2249} 2250 2251// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2252func (acr ASCCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 2253 return nil, false 2254} 2255 2256// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2257func (acr ASCCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 2258 return nil, false 2259} 2260 2261// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2262func (acr ASCCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 2263 return nil, false 2264} 2265 2266// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for ASCCheckRequirements. 2267func (acr ASCCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 2268 return &acr, true 2269} 2270 2271// UnmarshalJSON is the custom unmarshaler for ASCCheckRequirements struct. 2272func (acr *ASCCheckRequirements) UnmarshalJSON(body []byte) error { 2273 var m map[string]*json.RawMessage 2274 err := json.Unmarshal(body, &m) 2275 if err != nil { 2276 return err 2277 } 2278 for k, v := range m { 2279 switch k { 2280 case "properties": 2281 if v != nil { 2282 var aSCCheckRequirementsProperties ASCCheckRequirementsProperties 2283 err = json.Unmarshal(*v, &aSCCheckRequirementsProperties) 2284 if err != nil { 2285 return err 2286 } 2287 acr.ASCCheckRequirementsProperties = &aSCCheckRequirementsProperties 2288 } 2289 case "kind": 2290 if v != nil { 2291 var kind KindBasicDataConnectorsCheckRequirements 2292 err = json.Unmarshal(*v, &kind) 2293 if err != nil { 2294 return err 2295 } 2296 acr.Kind = kind 2297 } 2298 } 2299 } 2300 2301 return nil 2302} 2303 2304// ASCCheckRequirementsProperties ASC (Azure Security Center) requirements check properties. 2305type ASCCheckRequirementsProperties struct { 2306 // SubscriptionID - The subscription id to connect to, and get the data from. 2307 SubscriptionID *string `json:"subscriptionId,omitempty"` 2308} 2309 2310// ASCDataConnector represents ASC (Azure Security Center) data connector. 2311type ASCDataConnector struct { 2312 // ASCDataConnectorProperties - ASC (Azure Security Center) data connector properties. 2313 *ASCDataConnectorProperties `json:"properties,omitempty"` 2314 // ID - READ-ONLY; Azure resource Id 2315 ID *string `json:"id,omitempty"` 2316 // Name - READ-ONLY; Azure resource name 2317 Name *string `json:"name,omitempty"` 2318 // Type - READ-ONLY; Azure resource type 2319 Type *string `json:"type,omitempty"` 2320 // Etag - Etag of the azure resource 2321 Etag *string `json:"etag,omitempty"` 2322 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 2323 Kind KindBasicDataConnector `json:"kind,omitempty"` 2324} 2325 2326// MarshalJSON is the custom marshaler for ASCDataConnector. 2327func (adc ASCDataConnector) MarshalJSON() ([]byte, error) { 2328 adc.Kind = KindBasicDataConnectorKindAzureSecurityCenter 2329 objectMap := make(map[string]interface{}) 2330 if adc.ASCDataConnectorProperties != nil { 2331 objectMap["properties"] = adc.ASCDataConnectorProperties 2332 } 2333 if adc.Etag != nil { 2334 objectMap["etag"] = adc.Etag 2335 } 2336 if adc.Kind != "" { 2337 objectMap["kind"] = adc.Kind 2338 } 2339 return json.Marshal(objectMap) 2340} 2341 2342// AsAADDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2343func (adc ASCDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 2344 return nil, false 2345} 2346 2347// AsAATPDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2348func (adc ASCDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 2349 return nil, false 2350} 2351 2352// AsMSTIDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2353func (adc ASCDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 2354 return nil, false 2355} 2356 2357// AsMTPDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2358func (adc ASCDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 2359 return nil, false 2360} 2361 2362// AsASCDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2363func (adc ASCDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 2364 return &adc, true 2365} 2366 2367// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2368func (adc ASCDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 2369 return nil, false 2370} 2371 2372// AsDynamics365DataConnector is the BasicDataConnector implementation for ASCDataConnector. 2373func (adc ASCDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 2374 return nil, false 2375} 2376 2377// AsMCASDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2378func (adc ASCDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 2379 return nil, false 2380} 2381 2382// AsMDATPDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2383func (adc ASCDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 2384 return nil, false 2385} 2386 2387// AsOfficeATPDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2388func (adc ASCDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 2389 return nil, false 2390} 2391 2392// AsOfficeDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2393func (adc ASCDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 2394 return nil, false 2395} 2396 2397// AsTIDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2398func (adc ASCDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 2399 return nil, false 2400} 2401 2402// AsTiTaxiiDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2403func (adc ASCDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 2404 return nil, false 2405} 2406 2407// AsDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2408func (adc ASCDataConnector) AsDataConnector() (*DataConnector, bool) { 2409 return nil, false 2410} 2411 2412// AsBasicDataConnector is the BasicDataConnector implementation for ASCDataConnector. 2413func (adc ASCDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 2414 return &adc, true 2415} 2416 2417// UnmarshalJSON is the custom unmarshaler for ASCDataConnector struct. 2418func (adc *ASCDataConnector) UnmarshalJSON(body []byte) error { 2419 var m map[string]*json.RawMessage 2420 err := json.Unmarshal(body, &m) 2421 if err != nil { 2422 return err 2423 } 2424 for k, v := range m { 2425 switch k { 2426 case "properties": 2427 if v != nil { 2428 var aSCDataConnectorProperties ASCDataConnectorProperties 2429 err = json.Unmarshal(*v, &aSCDataConnectorProperties) 2430 if err != nil { 2431 return err 2432 } 2433 adc.ASCDataConnectorProperties = &aSCDataConnectorProperties 2434 } 2435 case "id": 2436 if v != nil { 2437 var ID string 2438 err = json.Unmarshal(*v, &ID) 2439 if err != nil { 2440 return err 2441 } 2442 adc.ID = &ID 2443 } 2444 case "name": 2445 if v != nil { 2446 var name string 2447 err = json.Unmarshal(*v, &name) 2448 if err != nil { 2449 return err 2450 } 2451 adc.Name = &name 2452 } 2453 case "type": 2454 if v != nil { 2455 var typeVar string 2456 err = json.Unmarshal(*v, &typeVar) 2457 if err != nil { 2458 return err 2459 } 2460 adc.Type = &typeVar 2461 } 2462 case "etag": 2463 if v != nil { 2464 var etag string 2465 err = json.Unmarshal(*v, &etag) 2466 if err != nil { 2467 return err 2468 } 2469 adc.Etag = &etag 2470 } 2471 case "kind": 2472 if v != nil { 2473 var kind KindBasicDataConnector 2474 err = json.Unmarshal(*v, &kind) 2475 if err != nil { 2476 return err 2477 } 2478 adc.Kind = kind 2479 } 2480 } 2481 } 2482 2483 return nil 2484} 2485 2486// ASCDataConnectorProperties ASC (Azure Security Center) data connector properties. 2487type ASCDataConnectorProperties struct { 2488 // SubscriptionID - The subscription id to connect to, and get the data from. 2489 SubscriptionID *string `json:"subscriptionId,omitempty"` 2490 // DataTypes - The available data types for the connector. 2491 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 2492} 2493 2494// AutomationRule represents an automation rule. 2495type AutomationRule struct { 2496 autorest.Response `json:"-"` 2497 // AutomationRuleProperties - Automation rule properties 2498 *AutomationRuleProperties `json:"properties,omitempty"` 2499 // ID - READ-ONLY; Azure resource Id 2500 ID *string `json:"id,omitempty"` 2501 // Name - READ-ONLY; Azure resource name 2502 Name *string `json:"name,omitempty"` 2503 // Type - READ-ONLY; Azure resource type 2504 Type *string `json:"type,omitempty"` 2505 // Etag - Etag of the azure resource 2506 Etag *string `json:"etag,omitempty"` 2507} 2508 2509// MarshalJSON is the custom marshaler for AutomationRule. 2510func (ar AutomationRule) MarshalJSON() ([]byte, error) { 2511 objectMap := make(map[string]interface{}) 2512 if ar.AutomationRuleProperties != nil { 2513 objectMap["properties"] = ar.AutomationRuleProperties 2514 } 2515 if ar.Etag != nil { 2516 objectMap["etag"] = ar.Etag 2517 } 2518 return json.Marshal(objectMap) 2519} 2520 2521// UnmarshalJSON is the custom unmarshaler for AutomationRule struct. 2522func (ar *AutomationRule) UnmarshalJSON(body []byte) error { 2523 var m map[string]*json.RawMessage 2524 err := json.Unmarshal(body, &m) 2525 if err != nil { 2526 return err 2527 } 2528 for k, v := range m { 2529 switch k { 2530 case "properties": 2531 if v != nil { 2532 var automationRuleProperties AutomationRuleProperties 2533 err = json.Unmarshal(*v, &automationRuleProperties) 2534 if err != nil { 2535 return err 2536 } 2537 ar.AutomationRuleProperties = &automationRuleProperties 2538 } 2539 case "id": 2540 if v != nil { 2541 var ID string 2542 err = json.Unmarshal(*v, &ID) 2543 if err != nil { 2544 return err 2545 } 2546 ar.ID = &ID 2547 } 2548 case "name": 2549 if v != nil { 2550 var name string 2551 err = json.Unmarshal(*v, &name) 2552 if err != nil { 2553 return err 2554 } 2555 ar.Name = &name 2556 } 2557 case "type": 2558 if v != nil { 2559 var typeVar string 2560 err = json.Unmarshal(*v, &typeVar) 2561 if err != nil { 2562 return err 2563 } 2564 ar.Type = &typeVar 2565 } 2566 case "etag": 2567 if v != nil { 2568 var etag string 2569 err = json.Unmarshal(*v, &etag) 2570 if err != nil { 2571 return err 2572 } 2573 ar.Etag = &etag 2574 } 2575 } 2576 } 2577 2578 return nil 2579} 2580 2581// BasicAutomationRuleAction describes an automation rule action 2582type BasicAutomationRuleAction interface { 2583 AsAutomationRuleRunPlaybookAction() (*AutomationRuleRunPlaybookAction, bool) 2584 AsAutomationRuleModifyPropertiesAction() (*AutomationRuleModifyPropertiesAction, bool) 2585 AsAutomationRuleAction() (*AutomationRuleAction, bool) 2586} 2587 2588// AutomationRuleAction describes an automation rule action 2589type AutomationRuleAction struct { 2590 // Order - The order of execution of the automation rule action 2591 Order *int32 `json:"order,omitempty"` 2592 // ActionType - Possible values include: 'ActionTypeAutomationRuleAction', 'ActionTypeRunPlaybook', 'ActionTypeModifyProperties' 2593 ActionType ActionType `json:"actionType,omitempty"` 2594} 2595 2596func unmarshalBasicAutomationRuleAction(body []byte) (BasicAutomationRuleAction, error) { 2597 var m map[string]interface{} 2598 err := json.Unmarshal(body, &m) 2599 if err != nil { 2600 return nil, err 2601 } 2602 2603 switch m["actionType"] { 2604 case string(ActionTypeRunPlaybook): 2605 var arrpa AutomationRuleRunPlaybookAction 2606 err := json.Unmarshal(body, &arrpa) 2607 return arrpa, err 2608 case string(ActionTypeModifyProperties): 2609 var armpa AutomationRuleModifyPropertiesAction 2610 err := json.Unmarshal(body, &armpa) 2611 return armpa, err 2612 default: 2613 var ara AutomationRuleAction 2614 err := json.Unmarshal(body, &ara) 2615 return ara, err 2616 } 2617} 2618func unmarshalBasicAutomationRuleActionArray(body []byte) ([]BasicAutomationRuleAction, error) { 2619 var rawMessages []*json.RawMessage 2620 err := json.Unmarshal(body, &rawMessages) 2621 if err != nil { 2622 return nil, err 2623 } 2624 2625 araArray := make([]BasicAutomationRuleAction, len(rawMessages)) 2626 2627 for index, rawMessage := range rawMessages { 2628 ara, err := unmarshalBasicAutomationRuleAction(*rawMessage) 2629 if err != nil { 2630 return nil, err 2631 } 2632 araArray[index] = ara 2633 } 2634 return araArray, nil 2635} 2636 2637// MarshalJSON is the custom marshaler for AutomationRuleAction. 2638func (ara AutomationRuleAction) MarshalJSON() ([]byte, error) { 2639 ara.ActionType = ActionTypeAutomationRuleAction 2640 objectMap := make(map[string]interface{}) 2641 if ara.Order != nil { 2642 objectMap["order"] = ara.Order 2643 } 2644 if ara.ActionType != "" { 2645 objectMap["actionType"] = ara.ActionType 2646 } 2647 return json.Marshal(objectMap) 2648} 2649 2650// AsAutomationRuleRunPlaybookAction is the BasicAutomationRuleAction implementation for AutomationRuleAction. 2651func (ara AutomationRuleAction) AsAutomationRuleRunPlaybookAction() (*AutomationRuleRunPlaybookAction, bool) { 2652 return nil, false 2653} 2654 2655// AsAutomationRuleModifyPropertiesAction is the BasicAutomationRuleAction implementation for AutomationRuleAction. 2656func (ara AutomationRuleAction) AsAutomationRuleModifyPropertiesAction() (*AutomationRuleModifyPropertiesAction, bool) { 2657 return nil, false 2658} 2659 2660// AsAutomationRuleAction is the BasicAutomationRuleAction implementation for AutomationRuleAction. 2661func (ara AutomationRuleAction) AsAutomationRuleAction() (*AutomationRuleAction, bool) { 2662 return &ara, true 2663} 2664 2665// AsBasicAutomationRuleAction is the BasicAutomationRuleAction implementation for AutomationRuleAction. 2666func (ara AutomationRuleAction) AsBasicAutomationRuleAction() (BasicAutomationRuleAction, bool) { 2667 return &ara, true 2668} 2669 2670// BasicAutomationRuleCondition describes an automation rule condition 2671type BasicAutomationRuleCondition interface { 2672 AsAutomationRulePropertyValuesCondition() (*AutomationRulePropertyValuesCondition, bool) 2673 AsAutomationRuleCondition() (*AutomationRuleCondition, bool) 2674} 2675 2676// AutomationRuleCondition describes an automation rule condition 2677type AutomationRuleCondition struct { 2678 // ConditionType - Possible values include: 'ConditionTypeAutomationRuleCondition', 'ConditionTypeProperty' 2679 ConditionType ConditionType `json:"conditionType,omitempty"` 2680} 2681 2682func unmarshalBasicAutomationRuleCondition(body []byte) (BasicAutomationRuleCondition, error) { 2683 var m map[string]interface{} 2684 err := json.Unmarshal(body, &m) 2685 if err != nil { 2686 return nil, err 2687 } 2688 2689 switch m["conditionType"] { 2690 case string(ConditionTypeProperty): 2691 var arpvc AutomationRulePropertyValuesCondition 2692 err := json.Unmarshal(body, &arpvc) 2693 return arpvc, err 2694 default: 2695 var arc AutomationRuleCondition 2696 err := json.Unmarshal(body, &arc) 2697 return arc, err 2698 } 2699} 2700func unmarshalBasicAutomationRuleConditionArray(body []byte) ([]BasicAutomationRuleCondition, error) { 2701 var rawMessages []*json.RawMessage 2702 err := json.Unmarshal(body, &rawMessages) 2703 if err != nil { 2704 return nil, err 2705 } 2706 2707 arcArray := make([]BasicAutomationRuleCondition, len(rawMessages)) 2708 2709 for index, rawMessage := range rawMessages { 2710 arc, err := unmarshalBasicAutomationRuleCondition(*rawMessage) 2711 if err != nil { 2712 return nil, err 2713 } 2714 arcArray[index] = arc 2715 } 2716 return arcArray, nil 2717} 2718 2719// MarshalJSON is the custom marshaler for AutomationRuleCondition. 2720func (arc AutomationRuleCondition) MarshalJSON() ([]byte, error) { 2721 arc.ConditionType = ConditionTypeAutomationRuleCondition 2722 objectMap := make(map[string]interface{}) 2723 if arc.ConditionType != "" { 2724 objectMap["conditionType"] = arc.ConditionType 2725 } 2726 return json.Marshal(objectMap) 2727} 2728 2729// AsAutomationRulePropertyValuesCondition is the BasicAutomationRuleCondition implementation for AutomationRuleCondition. 2730func (arc AutomationRuleCondition) AsAutomationRulePropertyValuesCondition() (*AutomationRulePropertyValuesCondition, bool) { 2731 return nil, false 2732} 2733 2734// AsAutomationRuleCondition is the BasicAutomationRuleCondition implementation for AutomationRuleCondition. 2735func (arc AutomationRuleCondition) AsAutomationRuleCondition() (*AutomationRuleCondition, bool) { 2736 return &arc, true 2737} 2738 2739// AsBasicAutomationRuleCondition is the BasicAutomationRuleCondition implementation for AutomationRuleCondition. 2740func (arc AutomationRuleCondition) AsBasicAutomationRuleCondition() (BasicAutomationRuleCondition, bool) { 2741 return &arc, true 2742} 2743 2744// AutomationRuleModifyPropertiesAction describes an automation rule action to modify an object's 2745// properties 2746type AutomationRuleModifyPropertiesAction struct { 2747 // ActionConfiguration - The configuration of the modify properties automation rule action 2748 ActionConfiguration *AutomationRuleModifyPropertiesActionActionConfiguration `json:"actionConfiguration,omitempty"` 2749 // Order - The order of execution of the automation rule action 2750 Order *int32 `json:"order,omitempty"` 2751 // ActionType - Possible values include: 'ActionTypeAutomationRuleAction', 'ActionTypeRunPlaybook', 'ActionTypeModifyProperties' 2752 ActionType ActionType `json:"actionType,omitempty"` 2753} 2754 2755// MarshalJSON is the custom marshaler for AutomationRuleModifyPropertiesAction. 2756func (armpa AutomationRuleModifyPropertiesAction) MarshalJSON() ([]byte, error) { 2757 armpa.ActionType = ActionTypeModifyProperties 2758 objectMap := make(map[string]interface{}) 2759 if armpa.ActionConfiguration != nil { 2760 objectMap["actionConfiguration"] = armpa.ActionConfiguration 2761 } 2762 if armpa.Order != nil { 2763 objectMap["order"] = armpa.Order 2764 } 2765 if armpa.ActionType != "" { 2766 objectMap["actionType"] = armpa.ActionType 2767 } 2768 return json.Marshal(objectMap) 2769} 2770 2771// AsAutomationRuleRunPlaybookAction is the BasicAutomationRuleAction implementation for AutomationRuleModifyPropertiesAction. 2772func (armpa AutomationRuleModifyPropertiesAction) AsAutomationRuleRunPlaybookAction() (*AutomationRuleRunPlaybookAction, bool) { 2773 return nil, false 2774} 2775 2776// AsAutomationRuleModifyPropertiesAction is the BasicAutomationRuleAction implementation for AutomationRuleModifyPropertiesAction. 2777func (armpa AutomationRuleModifyPropertiesAction) AsAutomationRuleModifyPropertiesAction() (*AutomationRuleModifyPropertiesAction, bool) { 2778 return &armpa, true 2779} 2780 2781// AsAutomationRuleAction is the BasicAutomationRuleAction implementation for AutomationRuleModifyPropertiesAction. 2782func (armpa AutomationRuleModifyPropertiesAction) AsAutomationRuleAction() (*AutomationRuleAction, bool) { 2783 return nil, false 2784} 2785 2786// AsBasicAutomationRuleAction is the BasicAutomationRuleAction implementation for AutomationRuleModifyPropertiesAction. 2787func (armpa AutomationRuleModifyPropertiesAction) AsBasicAutomationRuleAction() (BasicAutomationRuleAction, bool) { 2788 return &armpa, true 2789} 2790 2791// AutomationRuleModifyPropertiesActionActionConfiguration the configuration of the modify properties 2792// automation rule action 2793type AutomationRuleModifyPropertiesActionActionConfiguration struct { 2794 // Classification - The reason the incident was closed. Possible values include: 'IncidentClassificationUndetermined', 'IncidentClassificationTruePositive', 'IncidentClassificationBenignPositive', 'IncidentClassificationFalsePositive' 2795 Classification IncidentClassification `json:"classification,omitempty"` 2796 // ClassificationComment - Describes the reason the incident was closed 2797 ClassificationComment *string `json:"classificationComment,omitempty"` 2798 // ClassificationReason - The classification reason to close the incident with. Possible values include: 'IncidentClassificationReasonSuspiciousActivity', 'IncidentClassificationReasonSuspiciousButExpected', 'IncidentClassificationReasonIncorrectAlertLogic', 'IncidentClassificationReasonInaccurateData' 2799 ClassificationReason IncidentClassificationReason `json:"classificationReason,omitempty"` 2800 // Labels - List of labels to add to the incident 2801 Labels *[]IncidentLabel `json:"labels,omitempty"` 2802 // Owner - Describes a user that the incident is assigned to 2803 Owner *IncidentOwnerInfo `json:"owner,omitempty"` 2804 // Severity - The severity of the incident. Possible values include: 'IncidentSeverityHigh', 'IncidentSeverityMedium', 'IncidentSeverityLow', 'IncidentSeverityInformational' 2805 Severity IncidentSeverity `json:"severity,omitempty"` 2806 // Status - The status of the incident. Possible values include: 'IncidentStatusNew', 'IncidentStatusActive', 'IncidentStatusClosed' 2807 Status IncidentStatus `json:"status,omitempty"` 2808} 2809 2810// AutomationRuleProperties describes automation rule properties 2811type AutomationRuleProperties struct { 2812 // DisplayName - The display name of the automation rule 2813 DisplayName *string `json:"displayName,omitempty"` 2814 // Order - The order of execution of the automation rule 2815 Order *int32 `json:"order,omitempty"` 2816 // TriggeringLogic - The triggering logic of the automation rule 2817 TriggeringLogic *AutomationRuleTriggeringLogic `json:"triggeringLogic,omitempty"` 2818 // Actions - The actions to execute when the automation rule is triggered 2819 Actions *[]BasicAutomationRuleAction `json:"actions,omitempty"` 2820 // CreatedTimeUtc - READ-ONLY; The time the automation rule was created 2821 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 2822 // LastModifiedTimeUtc - READ-ONLY; The last time the automation rule was updated 2823 LastModifiedTimeUtc *date.Time `json:"lastModifiedTimeUtc,omitempty"` 2824 // CreatedBy - READ-ONLY; Describes the client that created the automation rule 2825 CreatedBy *ClientInfo `json:"createdBy,omitempty"` 2826 // LastModifiedBy - READ-ONLY; Describes the client that last updated the automation rule 2827 LastModifiedBy *ClientInfo `json:"lastModifiedBy,omitempty"` 2828} 2829 2830// MarshalJSON is the custom marshaler for AutomationRuleProperties. 2831func (arp AutomationRuleProperties) MarshalJSON() ([]byte, error) { 2832 objectMap := make(map[string]interface{}) 2833 if arp.DisplayName != nil { 2834 objectMap["displayName"] = arp.DisplayName 2835 } 2836 if arp.Order != nil { 2837 objectMap["order"] = arp.Order 2838 } 2839 if arp.TriggeringLogic != nil { 2840 objectMap["triggeringLogic"] = arp.TriggeringLogic 2841 } 2842 if arp.Actions != nil { 2843 objectMap["actions"] = arp.Actions 2844 } 2845 return json.Marshal(objectMap) 2846} 2847 2848// UnmarshalJSON is the custom unmarshaler for AutomationRuleProperties struct. 2849func (arp *AutomationRuleProperties) UnmarshalJSON(body []byte) error { 2850 var m map[string]*json.RawMessage 2851 err := json.Unmarshal(body, &m) 2852 if err != nil { 2853 return err 2854 } 2855 for k, v := range m { 2856 switch k { 2857 case "displayName": 2858 if v != nil { 2859 var displayName string 2860 err = json.Unmarshal(*v, &displayName) 2861 if err != nil { 2862 return err 2863 } 2864 arp.DisplayName = &displayName 2865 } 2866 case "order": 2867 if v != nil { 2868 var order int32 2869 err = json.Unmarshal(*v, &order) 2870 if err != nil { 2871 return err 2872 } 2873 arp.Order = &order 2874 } 2875 case "triggeringLogic": 2876 if v != nil { 2877 var triggeringLogic AutomationRuleTriggeringLogic 2878 err = json.Unmarshal(*v, &triggeringLogic) 2879 if err != nil { 2880 return err 2881 } 2882 arp.TriggeringLogic = &triggeringLogic 2883 } 2884 case "actions": 2885 if v != nil { 2886 actions, err := unmarshalBasicAutomationRuleActionArray(*v) 2887 if err != nil { 2888 return err 2889 } 2890 arp.Actions = &actions 2891 } 2892 case "createdTimeUtc": 2893 if v != nil { 2894 var createdTimeUtc date.Time 2895 err = json.Unmarshal(*v, &createdTimeUtc) 2896 if err != nil { 2897 return err 2898 } 2899 arp.CreatedTimeUtc = &createdTimeUtc 2900 } 2901 case "lastModifiedTimeUtc": 2902 if v != nil { 2903 var lastModifiedTimeUtc date.Time 2904 err = json.Unmarshal(*v, &lastModifiedTimeUtc) 2905 if err != nil { 2906 return err 2907 } 2908 arp.LastModifiedTimeUtc = &lastModifiedTimeUtc 2909 } 2910 case "createdBy": 2911 if v != nil { 2912 var createdBy ClientInfo 2913 err = json.Unmarshal(*v, &createdBy) 2914 if err != nil { 2915 return err 2916 } 2917 arp.CreatedBy = &createdBy 2918 } 2919 case "lastModifiedBy": 2920 if v != nil { 2921 var lastModifiedBy ClientInfo 2922 err = json.Unmarshal(*v, &lastModifiedBy) 2923 if err != nil { 2924 return err 2925 } 2926 arp.LastModifiedBy = &lastModifiedBy 2927 } 2928 } 2929 } 2930 2931 return nil 2932} 2933 2934// AutomationRulePropertyValuesCondition describes an automation rule condition that evaluates a property's 2935// value 2936type AutomationRulePropertyValuesCondition struct { 2937 // ConditionProperties - The configuration of the automation rule condition 2938 ConditionProperties *AutomationRulePropertyValuesConditionConditionProperties `json:"conditionProperties,omitempty"` 2939 // ConditionType - Possible values include: 'ConditionTypeAutomationRuleCondition', 'ConditionTypeProperty' 2940 ConditionType ConditionType `json:"conditionType,omitempty"` 2941} 2942 2943// MarshalJSON is the custom marshaler for AutomationRulePropertyValuesCondition. 2944func (arpvc AutomationRulePropertyValuesCondition) MarshalJSON() ([]byte, error) { 2945 arpvc.ConditionType = ConditionTypeProperty 2946 objectMap := make(map[string]interface{}) 2947 if arpvc.ConditionProperties != nil { 2948 objectMap["conditionProperties"] = arpvc.ConditionProperties 2949 } 2950 if arpvc.ConditionType != "" { 2951 objectMap["conditionType"] = arpvc.ConditionType 2952 } 2953 return json.Marshal(objectMap) 2954} 2955 2956// AsAutomationRulePropertyValuesCondition is the BasicAutomationRuleCondition implementation for AutomationRulePropertyValuesCondition. 2957func (arpvc AutomationRulePropertyValuesCondition) AsAutomationRulePropertyValuesCondition() (*AutomationRulePropertyValuesCondition, bool) { 2958 return &arpvc, true 2959} 2960 2961// AsAutomationRuleCondition is the BasicAutomationRuleCondition implementation for AutomationRulePropertyValuesCondition. 2962func (arpvc AutomationRulePropertyValuesCondition) AsAutomationRuleCondition() (*AutomationRuleCondition, bool) { 2963 return nil, false 2964} 2965 2966// AsBasicAutomationRuleCondition is the BasicAutomationRuleCondition implementation for AutomationRulePropertyValuesCondition. 2967func (arpvc AutomationRulePropertyValuesCondition) AsBasicAutomationRuleCondition() (BasicAutomationRuleCondition, bool) { 2968 return &arpvc, true 2969} 2970 2971// AutomationRulePropertyValuesConditionConditionProperties the configuration of the automation rule 2972// condition 2973type AutomationRulePropertyValuesConditionConditionProperties struct { 2974 // PropertyName - The property to evaluate. Possible values include: 'AutomationRulePropertyConditionSupportedPropertyIncidentTitle', 'AutomationRulePropertyConditionSupportedPropertyIncidentDescription', 'AutomationRulePropertyConditionSupportedPropertyIncidentSeverity', 'AutomationRulePropertyConditionSupportedPropertyIncidentStatus', 'AutomationRulePropertyConditionSupportedPropertyIncidentTactics', 'AutomationRulePropertyConditionSupportedPropertyIncidentRelatedAnalyticRuleIds', 'AutomationRulePropertyConditionSupportedPropertyIncidentProviderName', 'AutomationRulePropertyConditionSupportedPropertyAccountAadTenantID', 'AutomationRulePropertyConditionSupportedPropertyAccountAadUserID', 'AutomationRulePropertyConditionSupportedPropertyAccountName', 'AutomationRulePropertyConditionSupportedPropertyAccountNTDomain', 'AutomationRulePropertyConditionSupportedPropertyAccountPUID', 'AutomationRulePropertyConditionSupportedPropertyAccountSid', 'AutomationRulePropertyConditionSupportedPropertyAccountObjectGUID', 'AutomationRulePropertyConditionSupportedPropertyAccountUPNSuffix', 'AutomationRulePropertyConditionSupportedPropertyAzureResourceResourceID', 'AutomationRulePropertyConditionSupportedPropertyAzureResourceSubscriptionID', 'AutomationRulePropertyConditionSupportedPropertyCloudApplicationAppID', 'AutomationRulePropertyConditionSupportedPropertyCloudApplicationAppName', 'AutomationRulePropertyConditionSupportedPropertyDNSDomainName', 'AutomationRulePropertyConditionSupportedPropertyFileDirectory', 'AutomationRulePropertyConditionSupportedPropertyFileName', 'AutomationRulePropertyConditionSupportedPropertyFileHashValue', 'AutomationRulePropertyConditionSupportedPropertyHostAzureID', 'AutomationRulePropertyConditionSupportedPropertyHostName', 'AutomationRulePropertyConditionSupportedPropertyHostNetBiosName', 'AutomationRulePropertyConditionSupportedPropertyHostNTDomain', 'AutomationRulePropertyConditionSupportedPropertyHostOSVersion', 'AutomationRulePropertyConditionSupportedPropertyIoTDeviceID', 'AutomationRulePropertyConditionSupportedPropertyIoTDeviceName', 'AutomationRulePropertyConditionSupportedPropertyIoTDeviceType', 'AutomationRulePropertyConditionSupportedPropertyIoTDeviceVendor', 'AutomationRulePropertyConditionSupportedPropertyIoTDeviceModel', 'AutomationRulePropertyConditionSupportedPropertyIoTDeviceOperatingSystem', 'AutomationRulePropertyConditionSupportedPropertyIPAddress', 'AutomationRulePropertyConditionSupportedPropertyMailboxDisplayName', 'AutomationRulePropertyConditionSupportedPropertyMailboxPrimaryAddress', 'AutomationRulePropertyConditionSupportedPropertyMailboxUPN', 'AutomationRulePropertyConditionSupportedPropertyMailMessageDeliveryAction', 'AutomationRulePropertyConditionSupportedPropertyMailMessageDeliveryLocation', 'AutomationRulePropertyConditionSupportedPropertyMailMessageRecipient', 'AutomationRulePropertyConditionSupportedPropertyMailMessageSenderIP', 'AutomationRulePropertyConditionSupportedPropertyMailMessageSubject', 'AutomationRulePropertyConditionSupportedPropertyMailMessageP1Sender', 'AutomationRulePropertyConditionSupportedPropertyMailMessageP2Sender', 'AutomationRulePropertyConditionSupportedPropertyMalwareCategory', 'AutomationRulePropertyConditionSupportedPropertyMalwareName', 'AutomationRulePropertyConditionSupportedPropertyProcessCommandLine', 'AutomationRulePropertyConditionSupportedPropertyProcessID', 'AutomationRulePropertyConditionSupportedPropertyRegistryKey', 'AutomationRulePropertyConditionSupportedPropertyRegistryValueData', 'AutomationRulePropertyConditionSupportedPropertyURL' 2975 PropertyName AutomationRulePropertyConditionSupportedProperty `json:"propertyName,omitempty"` 2976 // Operator - The operator to use for evaluation the condition. Possible values include: 'AutomationRulePropertyConditionSupportedOperatorEquals', 'AutomationRulePropertyConditionSupportedOperatorNotEquals', 'AutomationRulePropertyConditionSupportedOperatorContains', 'AutomationRulePropertyConditionSupportedOperatorNotContains', 'AutomationRulePropertyConditionSupportedOperatorStartsWith', 'AutomationRulePropertyConditionSupportedOperatorNotStartsWith', 'AutomationRulePropertyConditionSupportedOperatorEndsWith', 'AutomationRulePropertyConditionSupportedOperatorNotEndsWith' 2977 Operator AutomationRulePropertyConditionSupportedOperator `json:"operator,omitempty"` 2978 // PropertyValues - The values to use for evaluating the condition 2979 PropertyValues *[]string `json:"propertyValues,omitempty"` 2980} 2981 2982// AutomationRuleRunPlaybookAction describes an automation rule action to run a playbook 2983type AutomationRuleRunPlaybookAction struct { 2984 // ActionConfiguration - The configuration of the run playbook automation rule action 2985 ActionConfiguration *AutomationRuleRunPlaybookActionActionConfiguration `json:"actionConfiguration,omitempty"` 2986 // Order - The order of execution of the automation rule action 2987 Order *int32 `json:"order,omitempty"` 2988 // ActionType - Possible values include: 'ActionTypeAutomationRuleAction', 'ActionTypeRunPlaybook', 'ActionTypeModifyProperties' 2989 ActionType ActionType `json:"actionType,omitempty"` 2990} 2991 2992// MarshalJSON is the custom marshaler for AutomationRuleRunPlaybookAction. 2993func (arrpa AutomationRuleRunPlaybookAction) MarshalJSON() ([]byte, error) { 2994 arrpa.ActionType = ActionTypeRunPlaybook 2995 objectMap := make(map[string]interface{}) 2996 if arrpa.ActionConfiguration != nil { 2997 objectMap["actionConfiguration"] = arrpa.ActionConfiguration 2998 } 2999 if arrpa.Order != nil { 3000 objectMap["order"] = arrpa.Order 3001 } 3002 if arrpa.ActionType != "" { 3003 objectMap["actionType"] = arrpa.ActionType 3004 } 3005 return json.Marshal(objectMap) 3006} 3007 3008// AsAutomationRuleRunPlaybookAction is the BasicAutomationRuleAction implementation for AutomationRuleRunPlaybookAction. 3009func (arrpa AutomationRuleRunPlaybookAction) AsAutomationRuleRunPlaybookAction() (*AutomationRuleRunPlaybookAction, bool) { 3010 return &arrpa, true 3011} 3012 3013// AsAutomationRuleModifyPropertiesAction is the BasicAutomationRuleAction implementation for AutomationRuleRunPlaybookAction. 3014func (arrpa AutomationRuleRunPlaybookAction) AsAutomationRuleModifyPropertiesAction() (*AutomationRuleModifyPropertiesAction, bool) { 3015 return nil, false 3016} 3017 3018// AsAutomationRuleAction is the BasicAutomationRuleAction implementation for AutomationRuleRunPlaybookAction. 3019func (arrpa AutomationRuleRunPlaybookAction) AsAutomationRuleAction() (*AutomationRuleAction, bool) { 3020 return nil, false 3021} 3022 3023// AsBasicAutomationRuleAction is the BasicAutomationRuleAction implementation for AutomationRuleRunPlaybookAction. 3024func (arrpa AutomationRuleRunPlaybookAction) AsBasicAutomationRuleAction() (BasicAutomationRuleAction, bool) { 3025 return &arrpa, true 3026} 3027 3028// AutomationRuleRunPlaybookActionActionConfiguration the configuration of the run playbook automation rule 3029// action 3030type AutomationRuleRunPlaybookActionActionConfiguration struct { 3031 // LogicAppResourceID - The resource id of the playbook resource 3032 LogicAppResourceID *string `json:"logicAppResourceId,omitempty"` 3033 // TenantID - The tenant id of the playbook resource 3034 TenantID *string `json:"tenantId,omitempty"` 3035} 3036 3037// AutomationRulesList list all the automation rules. 3038type AutomationRulesList struct { 3039 autorest.Response `json:"-"` 3040 // NextLink - READ-ONLY; URL to fetch the next set of automation rules. 3041 NextLink *string `json:"nextLink,omitempty"` 3042 // Value - Array of automation rules. 3043 Value *[]AutomationRule `json:"value,omitempty"` 3044} 3045 3046// MarshalJSON is the custom marshaler for AutomationRulesList. 3047func (arl AutomationRulesList) MarshalJSON() ([]byte, error) { 3048 objectMap := make(map[string]interface{}) 3049 if arl.Value != nil { 3050 objectMap["value"] = arl.Value 3051 } 3052 return json.Marshal(objectMap) 3053} 3054 3055// AutomationRulesListIterator provides access to a complete listing of AutomationRule values. 3056type AutomationRulesListIterator struct { 3057 i int 3058 page AutomationRulesListPage 3059} 3060 3061// NextWithContext advances to the next value. If there was an error making 3062// the request the iterator does not advance and the error is returned. 3063func (iter *AutomationRulesListIterator) NextWithContext(ctx context.Context) (err error) { 3064 if tracing.IsEnabled() { 3065 ctx = tracing.StartSpan(ctx, fqdn+"/AutomationRulesListIterator.NextWithContext") 3066 defer func() { 3067 sc := -1 3068 if iter.Response().Response.Response != nil { 3069 sc = iter.Response().Response.Response.StatusCode 3070 } 3071 tracing.EndSpan(ctx, sc, err) 3072 }() 3073 } 3074 iter.i++ 3075 if iter.i < len(iter.page.Values()) { 3076 return nil 3077 } 3078 err = iter.page.NextWithContext(ctx) 3079 if err != nil { 3080 iter.i-- 3081 return err 3082 } 3083 iter.i = 0 3084 return nil 3085} 3086 3087// Next advances to the next value. If there was an error making 3088// the request the iterator does not advance and the error is returned. 3089// Deprecated: Use NextWithContext() instead. 3090func (iter *AutomationRulesListIterator) Next() error { 3091 return iter.NextWithContext(context.Background()) 3092} 3093 3094// NotDone returns true if the enumeration should be started or is not yet complete. 3095func (iter AutomationRulesListIterator) NotDone() bool { 3096 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 3097} 3098 3099// Response returns the raw server response from the last page request. 3100func (iter AutomationRulesListIterator) Response() AutomationRulesList { 3101 return iter.page.Response() 3102} 3103 3104// Value returns the current value or a zero-initialized value if the 3105// iterator has advanced beyond the end of the collection. 3106func (iter AutomationRulesListIterator) Value() AutomationRule { 3107 if !iter.page.NotDone() { 3108 return AutomationRule{} 3109 } 3110 return iter.page.Values()[iter.i] 3111} 3112 3113// Creates a new instance of the AutomationRulesListIterator type. 3114func NewAutomationRulesListIterator(page AutomationRulesListPage) AutomationRulesListIterator { 3115 return AutomationRulesListIterator{page: page} 3116} 3117 3118// IsEmpty returns true if the ListResult contains no values. 3119func (arl AutomationRulesList) IsEmpty() bool { 3120 return arl.Value == nil || len(*arl.Value) == 0 3121} 3122 3123// hasNextLink returns true if the NextLink is not empty. 3124func (arl AutomationRulesList) hasNextLink() bool { 3125 return arl.NextLink != nil && len(*arl.NextLink) != 0 3126} 3127 3128// automationRulesListPreparer prepares a request to retrieve the next set of results. 3129// It returns nil if no more results exist. 3130func (arl AutomationRulesList) automationRulesListPreparer(ctx context.Context) (*http.Request, error) { 3131 if !arl.hasNextLink() { 3132 return nil, nil 3133 } 3134 return autorest.Prepare((&http.Request{}).WithContext(ctx), 3135 autorest.AsJSON(), 3136 autorest.AsGet(), 3137 autorest.WithBaseURL(to.String(arl.NextLink))) 3138} 3139 3140// AutomationRulesListPage contains a page of AutomationRule values. 3141type AutomationRulesListPage struct { 3142 fn func(context.Context, AutomationRulesList) (AutomationRulesList, error) 3143 arl AutomationRulesList 3144} 3145 3146// NextWithContext advances to the next page of values. If there was an error making 3147// the request the page does not advance and the error is returned. 3148func (page *AutomationRulesListPage) NextWithContext(ctx context.Context) (err error) { 3149 if tracing.IsEnabled() { 3150 ctx = tracing.StartSpan(ctx, fqdn+"/AutomationRulesListPage.NextWithContext") 3151 defer func() { 3152 sc := -1 3153 if page.Response().Response.Response != nil { 3154 sc = page.Response().Response.Response.StatusCode 3155 } 3156 tracing.EndSpan(ctx, sc, err) 3157 }() 3158 } 3159 for { 3160 next, err := page.fn(ctx, page.arl) 3161 if err != nil { 3162 return err 3163 } 3164 page.arl = next 3165 if !next.hasNextLink() || !next.IsEmpty() { 3166 break 3167 } 3168 } 3169 return nil 3170} 3171 3172// Next advances to the next page of values. If there was an error making 3173// the request the page does not advance and the error is returned. 3174// Deprecated: Use NextWithContext() instead. 3175func (page *AutomationRulesListPage) Next() error { 3176 return page.NextWithContext(context.Background()) 3177} 3178 3179// NotDone returns true if the page enumeration should be started or is not yet complete. 3180func (page AutomationRulesListPage) NotDone() bool { 3181 return !page.arl.IsEmpty() 3182} 3183 3184// Response returns the raw server response from the last page request. 3185func (page AutomationRulesListPage) Response() AutomationRulesList { 3186 return page.arl 3187} 3188 3189// Values returns the slice of values for the current page or nil if there are no values. 3190func (page AutomationRulesListPage) Values() []AutomationRule { 3191 if page.arl.IsEmpty() { 3192 return nil 3193 } 3194 return *page.arl.Value 3195} 3196 3197// Creates a new instance of the AutomationRulesListPage type. 3198func NewAutomationRulesListPage(cur AutomationRulesList, getNextPage func(context.Context, AutomationRulesList) (AutomationRulesList, error)) AutomationRulesListPage { 3199 return AutomationRulesListPage{ 3200 fn: getNextPage, 3201 arl: cur, 3202 } 3203} 3204 3205// AutomationRuleTriggeringLogic describes automation rule triggering logic 3206type AutomationRuleTriggeringLogic struct { 3207 // IsEnabled - Determines whether the automation rule is enabled or disabled. 3208 IsEnabled *bool `json:"isEnabled,omitempty"` 3209 // ExpirationTimeUtc - Determines when the automation rule should automatically expire and be disabled. 3210 ExpirationTimeUtc *date.Time `json:"expirationTimeUtc,omitempty"` 3211 // TriggersOn - The type of object the automation rule triggers on 3212 TriggersOn *string `json:"triggersOn,omitempty"` 3213 // TriggersWhen - The type of event the automation rule triggers on 3214 TriggersWhen *string `json:"triggersWhen,omitempty"` 3215 // Conditions - The conditions to evaluate to determine if the automation rule should be triggered on a given object 3216 Conditions *[]BasicAutomationRuleCondition `json:"conditions,omitempty"` 3217} 3218 3219// UnmarshalJSON is the custom unmarshaler for AutomationRuleTriggeringLogic struct. 3220func (artl *AutomationRuleTriggeringLogic) UnmarshalJSON(body []byte) error { 3221 var m map[string]*json.RawMessage 3222 err := json.Unmarshal(body, &m) 3223 if err != nil { 3224 return err 3225 } 3226 for k, v := range m { 3227 switch k { 3228 case "isEnabled": 3229 if v != nil { 3230 var isEnabled bool 3231 err = json.Unmarshal(*v, &isEnabled) 3232 if err != nil { 3233 return err 3234 } 3235 artl.IsEnabled = &isEnabled 3236 } 3237 case "expirationTimeUtc": 3238 if v != nil { 3239 var expirationTimeUtc date.Time 3240 err = json.Unmarshal(*v, &expirationTimeUtc) 3241 if err != nil { 3242 return err 3243 } 3244 artl.ExpirationTimeUtc = &expirationTimeUtc 3245 } 3246 case "triggersOn": 3247 if v != nil { 3248 var triggersOn string 3249 err = json.Unmarshal(*v, &triggersOn) 3250 if err != nil { 3251 return err 3252 } 3253 artl.TriggersOn = &triggersOn 3254 } 3255 case "triggersWhen": 3256 if v != nil { 3257 var triggersWhen string 3258 err = json.Unmarshal(*v, &triggersWhen) 3259 if err != nil { 3260 return err 3261 } 3262 artl.TriggersWhen = &triggersWhen 3263 } 3264 case "conditions": 3265 if v != nil { 3266 conditions, err := unmarshalBasicAutomationRuleConditionArray(*v) 3267 if err != nil { 3268 return err 3269 } 3270 artl.Conditions = &conditions 3271 } 3272 } 3273 } 3274 3275 return nil 3276} 3277 3278// AwsCloudTrailCheckRequirements amazon Web Services CloudTrail requirements check request. 3279type AwsCloudTrailCheckRequirements struct { 3280 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 3281 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 3282} 3283 3284// MarshalJSON is the custom marshaler for AwsCloudTrailCheckRequirements. 3285func (actcr AwsCloudTrailCheckRequirements) MarshalJSON() ([]byte, error) { 3286 actcr.Kind = KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail 3287 objectMap := make(map[string]interface{}) 3288 if actcr.Kind != "" { 3289 objectMap["kind"] = actcr.Kind 3290 } 3291 return json.Marshal(objectMap) 3292} 3293 3294// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3295func (actcr AwsCloudTrailCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 3296 return nil, false 3297} 3298 3299// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3300func (actcr AwsCloudTrailCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 3301 return nil, false 3302} 3303 3304// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3305func (actcr AwsCloudTrailCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 3306 return nil, false 3307} 3308 3309// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3310func (actcr AwsCloudTrailCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 3311 return nil, false 3312} 3313 3314// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3315func (actcr AwsCloudTrailCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 3316 return nil, false 3317} 3318 3319// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3320func (actcr AwsCloudTrailCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 3321 return &actcr, true 3322} 3323 3324// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3325func (actcr AwsCloudTrailCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 3326 return nil, false 3327} 3328 3329// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3330func (actcr AwsCloudTrailCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 3331 return nil, false 3332} 3333 3334// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3335func (actcr AwsCloudTrailCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 3336 return nil, false 3337} 3338 3339// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3340func (actcr AwsCloudTrailCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 3341 return nil, false 3342} 3343 3344// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3345func (actcr AwsCloudTrailCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 3346 return nil, false 3347} 3348 3349// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3350func (actcr AwsCloudTrailCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 3351 return nil, false 3352} 3353 3354// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3355func (actcr AwsCloudTrailCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 3356 return nil, false 3357} 3358 3359// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for AwsCloudTrailCheckRequirements. 3360func (actcr AwsCloudTrailCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 3361 return &actcr, true 3362} 3363 3364// AwsCloudTrailDataConnector represents Amazon Web Services CloudTrail data connector. 3365type AwsCloudTrailDataConnector struct { 3366 // AwsCloudTrailDataConnectorProperties - Amazon Web Services CloudTrail data connector properties. 3367 *AwsCloudTrailDataConnectorProperties `json:"properties,omitempty"` 3368 // ID - READ-ONLY; Azure resource Id 3369 ID *string `json:"id,omitempty"` 3370 // Name - READ-ONLY; Azure resource name 3371 Name *string `json:"name,omitempty"` 3372 // Type - READ-ONLY; Azure resource type 3373 Type *string `json:"type,omitempty"` 3374 // Etag - Etag of the azure resource 3375 Etag *string `json:"etag,omitempty"` 3376 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 3377 Kind KindBasicDataConnector `json:"kind,omitempty"` 3378} 3379 3380// MarshalJSON is the custom marshaler for AwsCloudTrailDataConnector. 3381func (actdc AwsCloudTrailDataConnector) MarshalJSON() ([]byte, error) { 3382 actdc.Kind = KindBasicDataConnectorKindAmazonWebServicesCloudTrail 3383 objectMap := make(map[string]interface{}) 3384 if actdc.AwsCloudTrailDataConnectorProperties != nil { 3385 objectMap["properties"] = actdc.AwsCloudTrailDataConnectorProperties 3386 } 3387 if actdc.Etag != nil { 3388 objectMap["etag"] = actdc.Etag 3389 } 3390 if actdc.Kind != "" { 3391 objectMap["kind"] = actdc.Kind 3392 } 3393 return json.Marshal(objectMap) 3394} 3395 3396// AsAADDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3397func (actdc AwsCloudTrailDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 3398 return nil, false 3399} 3400 3401// AsAATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3402func (actdc AwsCloudTrailDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 3403 return nil, false 3404} 3405 3406// AsMSTIDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3407func (actdc AwsCloudTrailDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 3408 return nil, false 3409} 3410 3411// AsMTPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3412func (actdc AwsCloudTrailDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 3413 return nil, false 3414} 3415 3416// AsASCDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3417func (actdc AwsCloudTrailDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 3418 return nil, false 3419} 3420 3421// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3422func (actdc AwsCloudTrailDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 3423 return &actdc, true 3424} 3425 3426// AsDynamics365DataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3427func (actdc AwsCloudTrailDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 3428 return nil, false 3429} 3430 3431// AsMCASDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3432func (actdc AwsCloudTrailDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 3433 return nil, false 3434} 3435 3436// AsMDATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3437func (actdc AwsCloudTrailDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 3438 return nil, false 3439} 3440 3441// AsOfficeATPDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3442func (actdc AwsCloudTrailDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 3443 return nil, false 3444} 3445 3446// AsOfficeDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3447func (actdc AwsCloudTrailDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 3448 return nil, false 3449} 3450 3451// AsTIDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3452func (actdc AwsCloudTrailDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 3453 return nil, false 3454} 3455 3456// AsTiTaxiiDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3457func (actdc AwsCloudTrailDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 3458 return nil, false 3459} 3460 3461// AsDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3462func (actdc AwsCloudTrailDataConnector) AsDataConnector() (*DataConnector, bool) { 3463 return nil, false 3464} 3465 3466// AsBasicDataConnector is the BasicDataConnector implementation for AwsCloudTrailDataConnector. 3467func (actdc AwsCloudTrailDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 3468 return &actdc, true 3469} 3470 3471// UnmarshalJSON is the custom unmarshaler for AwsCloudTrailDataConnector struct. 3472func (actdc *AwsCloudTrailDataConnector) UnmarshalJSON(body []byte) error { 3473 var m map[string]*json.RawMessage 3474 err := json.Unmarshal(body, &m) 3475 if err != nil { 3476 return err 3477 } 3478 for k, v := range m { 3479 switch k { 3480 case "properties": 3481 if v != nil { 3482 var awsCloudTrailDataConnectorProperties AwsCloudTrailDataConnectorProperties 3483 err = json.Unmarshal(*v, &awsCloudTrailDataConnectorProperties) 3484 if err != nil { 3485 return err 3486 } 3487 actdc.AwsCloudTrailDataConnectorProperties = &awsCloudTrailDataConnectorProperties 3488 } 3489 case "id": 3490 if v != nil { 3491 var ID string 3492 err = json.Unmarshal(*v, &ID) 3493 if err != nil { 3494 return err 3495 } 3496 actdc.ID = &ID 3497 } 3498 case "name": 3499 if v != nil { 3500 var name string 3501 err = json.Unmarshal(*v, &name) 3502 if err != nil { 3503 return err 3504 } 3505 actdc.Name = &name 3506 } 3507 case "type": 3508 if v != nil { 3509 var typeVar string 3510 err = json.Unmarshal(*v, &typeVar) 3511 if err != nil { 3512 return err 3513 } 3514 actdc.Type = &typeVar 3515 } 3516 case "etag": 3517 if v != nil { 3518 var etag string 3519 err = json.Unmarshal(*v, &etag) 3520 if err != nil { 3521 return err 3522 } 3523 actdc.Etag = &etag 3524 } 3525 case "kind": 3526 if v != nil { 3527 var kind KindBasicDataConnector 3528 err = json.Unmarshal(*v, &kind) 3529 if err != nil { 3530 return err 3531 } 3532 actdc.Kind = kind 3533 } 3534 } 3535 } 3536 3537 return nil 3538} 3539 3540// AwsCloudTrailDataConnectorDataTypes the available data types for Amazon Web Services CloudTrail data 3541// connector. 3542type AwsCloudTrailDataConnectorDataTypes struct { 3543 // Logs - Logs data type. 3544 Logs *AwsCloudTrailDataConnectorDataTypesLogs `json:"logs,omitempty"` 3545} 3546 3547// AwsCloudTrailDataConnectorDataTypesLogs logs data type. 3548type AwsCloudTrailDataConnectorDataTypesLogs struct { 3549 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 3550 State DataTypeState `json:"state,omitempty"` 3551} 3552 3553// AwsCloudTrailDataConnectorProperties amazon Web Services CloudTrail data connector properties. 3554type AwsCloudTrailDataConnectorProperties struct { 3555 // AwsRoleArn - The Aws Role Arn (with CloudTrailReadOnly policy) that is used to access the Aws account. 3556 AwsRoleArn *string `json:"awsRoleArn,omitempty"` 3557 // DataTypes - The available data types for the connector. 3558 DataTypes *AwsCloudTrailDataConnectorDataTypes `json:"dataTypes,omitempty"` 3559} 3560 3561// AzureResourceEntity represents an azure resource entity. 3562type AzureResourceEntity struct { 3563 // AzureResourceEntityProperties - AzureResource entity properties 3564 *AzureResourceEntityProperties `json:"properties,omitempty"` 3565 // ID - READ-ONLY; Azure resource Id 3566 ID *string `json:"id,omitempty"` 3567 // Name - READ-ONLY; Azure resource name 3568 Name *string `json:"name,omitempty"` 3569 // Type - READ-ONLY; Azure resource type 3570 Type *string `json:"type,omitempty"` 3571 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 3572 Kind KindBasicEntity `json:"kind,omitempty"` 3573} 3574 3575// MarshalJSON is the custom marshaler for AzureResourceEntity. 3576func (are AzureResourceEntity) MarshalJSON() ([]byte, error) { 3577 are.Kind = KindBasicEntityKindAzureResource 3578 objectMap := make(map[string]interface{}) 3579 if are.AzureResourceEntityProperties != nil { 3580 objectMap["properties"] = are.AzureResourceEntityProperties 3581 } 3582 if are.Kind != "" { 3583 objectMap["kind"] = are.Kind 3584 } 3585 return json.Marshal(objectMap) 3586} 3587 3588// AsAccountEntity is the BasicEntity implementation for AzureResourceEntity. 3589func (are AzureResourceEntity) AsAccountEntity() (*AccountEntity, bool) { 3590 return nil, false 3591} 3592 3593// AsAzureResourceEntity is the BasicEntity implementation for AzureResourceEntity. 3594func (are AzureResourceEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 3595 return &are, true 3596} 3597 3598// AsCloudApplicationEntity is the BasicEntity implementation for AzureResourceEntity. 3599func (are AzureResourceEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 3600 return nil, false 3601} 3602 3603// AsDNSEntity is the BasicEntity implementation for AzureResourceEntity. 3604func (are AzureResourceEntity) AsDNSEntity() (*DNSEntity, bool) { 3605 return nil, false 3606} 3607 3608// AsFileEntity is the BasicEntity implementation for AzureResourceEntity. 3609func (are AzureResourceEntity) AsFileEntity() (*FileEntity, bool) { 3610 return nil, false 3611} 3612 3613// AsFileHashEntity is the BasicEntity implementation for AzureResourceEntity. 3614func (are AzureResourceEntity) AsFileHashEntity() (*FileHashEntity, bool) { 3615 return nil, false 3616} 3617 3618// AsHostEntity is the BasicEntity implementation for AzureResourceEntity. 3619func (are AzureResourceEntity) AsHostEntity() (*HostEntity, bool) { 3620 return nil, false 3621} 3622 3623// AsHuntingBookmark is the BasicEntity implementation for AzureResourceEntity. 3624func (are AzureResourceEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 3625 return nil, false 3626} 3627 3628// AsSecurityAlert is the BasicEntity implementation for AzureResourceEntity. 3629func (are AzureResourceEntity) AsSecurityAlert() (*SecurityAlert, bool) { 3630 return nil, false 3631} 3632 3633// AsIPEntity is the BasicEntity implementation for AzureResourceEntity. 3634func (are AzureResourceEntity) AsIPEntity() (*IPEntity, bool) { 3635 return nil, false 3636} 3637 3638// AsMailboxEntity is the BasicEntity implementation for AzureResourceEntity. 3639func (are AzureResourceEntity) AsMailboxEntity() (*MailboxEntity, bool) { 3640 return nil, false 3641} 3642 3643// AsMailClusterEntity is the BasicEntity implementation for AzureResourceEntity. 3644func (are AzureResourceEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 3645 return nil, false 3646} 3647 3648// AsMailMessageEntity is the BasicEntity implementation for AzureResourceEntity. 3649func (are AzureResourceEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 3650 return nil, false 3651} 3652 3653// AsSubmissionMailEntity is the BasicEntity implementation for AzureResourceEntity. 3654func (are AzureResourceEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 3655 return nil, false 3656} 3657 3658// AsMalwareEntity is the BasicEntity implementation for AzureResourceEntity. 3659func (are AzureResourceEntity) AsMalwareEntity() (*MalwareEntity, bool) { 3660 return nil, false 3661} 3662 3663// AsProcessEntity is the BasicEntity implementation for AzureResourceEntity. 3664func (are AzureResourceEntity) AsProcessEntity() (*ProcessEntity, bool) { 3665 return nil, false 3666} 3667 3668// AsRegistryKeyEntity is the BasicEntity implementation for AzureResourceEntity. 3669func (are AzureResourceEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 3670 return nil, false 3671} 3672 3673// AsRegistryValueEntity is the BasicEntity implementation for AzureResourceEntity. 3674func (are AzureResourceEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 3675 return nil, false 3676} 3677 3678// AsSecurityGroupEntity is the BasicEntity implementation for AzureResourceEntity. 3679func (are AzureResourceEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 3680 return nil, false 3681} 3682 3683// AsURLEntity is the BasicEntity implementation for AzureResourceEntity. 3684func (are AzureResourceEntity) AsURLEntity() (*URLEntity, bool) { 3685 return nil, false 3686} 3687 3688// AsIoTDeviceEntity is the BasicEntity implementation for AzureResourceEntity. 3689func (are AzureResourceEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 3690 return nil, false 3691} 3692 3693// AsEntity is the BasicEntity implementation for AzureResourceEntity. 3694func (are AzureResourceEntity) AsEntity() (*Entity, bool) { 3695 return nil, false 3696} 3697 3698// AsBasicEntity is the BasicEntity implementation for AzureResourceEntity. 3699func (are AzureResourceEntity) AsBasicEntity() (BasicEntity, bool) { 3700 return &are, true 3701} 3702 3703// UnmarshalJSON is the custom unmarshaler for AzureResourceEntity struct. 3704func (are *AzureResourceEntity) UnmarshalJSON(body []byte) error { 3705 var m map[string]*json.RawMessage 3706 err := json.Unmarshal(body, &m) 3707 if err != nil { 3708 return err 3709 } 3710 for k, v := range m { 3711 switch k { 3712 case "properties": 3713 if v != nil { 3714 var azureResourceEntityProperties AzureResourceEntityProperties 3715 err = json.Unmarshal(*v, &azureResourceEntityProperties) 3716 if err != nil { 3717 return err 3718 } 3719 are.AzureResourceEntityProperties = &azureResourceEntityProperties 3720 } 3721 case "id": 3722 if v != nil { 3723 var ID string 3724 err = json.Unmarshal(*v, &ID) 3725 if err != nil { 3726 return err 3727 } 3728 are.ID = &ID 3729 } 3730 case "name": 3731 if v != nil { 3732 var name string 3733 err = json.Unmarshal(*v, &name) 3734 if err != nil { 3735 return err 3736 } 3737 are.Name = &name 3738 } 3739 case "type": 3740 if v != nil { 3741 var typeVar string 3742 err = json.Unmarshal(*v, &typeVar) 3743 if err != nil { 3744 return err 3745 } 3746 are.Type = &typeVar 3747 } 3748 case "kind": 3749 if v != nil { 3750 var kind KindBasicEntity 3751 err = json.Unmarshal(*v, &kind) 3752 if err != nil { 3753 return err 3754 } 3755 are.Kind = kind 3756 } 3757 } 3758 } 3759 3760 return nil 3761} 3762 3763// AzureResourceEntityProperties azureResource entity property bag. 3764type AzureResourceEntityProperties struct { 3765 // ResourceID - READ-ONLY; The azure resource id of the resource 3766 ResourceID *string `json:"resourceId,omitempty"` 3767 // SubscriptionID - READ-ONLY; The subscription id of the resource 3768 SubscriptionID *string `json:"subscriptionId,omitempty"` 3769 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 3770 AdditionalData map[string]interface{} `json:"additionalData"` 3771 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 3772 FriendlyName *string `json:"friendlyName,omitempty"` 3773} 3774 3775// MarshalJSON is the custom marshaler for AzureResourceEntityProperties. 3776func (arep AzureResourceEntityProperties) MarshalJSON() ([]byte, error) { 3777 objectMap := make(map[string]interface{}) 3778 return json.Marshal(objectMap) 3779} 3780 3781// Bookmark represents a bookmark in Azure Security Insights. 3782type Bookmark struct { 3783 autorest.Response `json:"-"` 3784 // BookmarkProperties - Bookmark properties 3785 *BookmarkProperties `json:"properties,omitempty"` 3786 // ID - READ-ONLY; Azure resource Id 3787 ID *string `json:"id,omitempty"` 3788 // Name - READ-ONLY; Azure resource name 3789 Name *string `json:"name,omitempty"` 3790 // Type - READ-ONLY; Azure resource type 3791 Type *string `json:"type,omitempty"` 3792 // Etag - Etag of the azure resource 3793 Etag *string `json:"etag,omitempty"` 3794} 3795 3796// MarshalJSON is the custom marshaler for Bookmark. 3797func (b Bookmark) MarshalJSON() ([]byte, error) { 3798 objectMap := make(map[string]interface{}) 3799 if b.BookmarkProperties != nil { 3800 objectMap["properties"] = b.BookmarkProperties 3801 } 3802 if b.Etag != nil { 3803 objectMap["etag"] = b.Etag 3804 } 3805 return json.Marshal(objectMap) 3806} 3807 3808// UnmarshalJSON is the custom unmarshaler for Bookmark struct. 3809func (b *Bookmark) UnmarshalJSON(body []byte) error { 3810 var m map[string]*json.RawMessage 3811 err := json.Unmarshal(body, &m) 3812 if err != nil { 3813 return err 3814 } 3815 for k, v := range m { 3816 switch k { 3817 case "properties": 3818 if v != nil { 3819 var bookmarkProperties BookmarkProperties 3820 err = json.Unmarshal(*v, &bookmarkProperties) 3821 if err != nil { 3822 return err 3823 } 3824 b.BookmarkProperties = &bookmarkProperties 3825 } 3826 case "id": 3827 if v != nil { 3828 var ID string 3829 err = json.Unmarshal(*v, &ID) 3830 if err != nil { 3831 return err 3832 } 3833 b.ID = &ID 3834 } 3835 case "name": 3836 if v != nil { 3837 var name string 3838 err = json.Unmarshal(*v, &name) 3839 if err != nil { 3840 return err 3841 } 3842 b.Name = &name 3843 } 3844 case "type": 3845 if v != nil { 3846 var typeVar string 3847 err = json.Unmarshal(*v, &typeVar) 3848 if err != nil { 3849 return err 3850 } 3851 b.Type = &typeVar 3852 } 3853 case "etag": 3854 if v != nil { 3855 var etag string 3856 err = json.Unmarshal(*v, &etag) 3857 if err != nil { 3858 return err 3859 } 3860 b.Etag = &etag 3861 } 3862 } 3863 } 3864 3865 return nil 3866} 3867 3868// BookmarkExpandParameters the parameters required to execute an expand operation on the given bookmark. 3869type BookmarkExpandParameters struct { 3870 // EndTime - The end date filter, so the only expansion results returned are before this date. 3871 EndTime *date.Time `json:"endTime,omitempty"` 3872 // ExpansionID - The Id of the expansion to perform. 3873 ExpansionID *uuid.UUID `json:"expansionId,omitempty"` 3874 // StartTime - The start date filter, so the only expansion results returned are after this date. 3875 StartTime *date.Time `json:"startTime,omitempty"` 3876} 3877 3878// BookmarkExpandResponse the entity expansion result operation response. 3879type BookmarkExpandResponse struct { 3880 autorest.Response `json:"-"` 3881 // MetaData - The metadata from the expansion operation results. 3882 MetaData *ExpansionResultsMetadata `json:"metaData,omitempty"` 3883 // Value - The expansion result values. 3884 Value *BookmarkExpandResponseValue `json:"value,omitempty"` 3885} 3886 3887// BookmarkExpandResponseValue the expansion result values. 3888type BookmarkExpandResponseValue struct { 3889 // Entities - Array of the expansion result entities. 3890 Entities *[]BasicEntity `json:"entities,omitempty"` 3891 // Edges - Array of expansion result connected entities 3892 Edges *[]ConnectedEntity `json:"edges,omitempty"` 3893} 3894 3895// UnmarshalJSON is the custom unmarshaler for BookmarkExpandResponseValue struct. 3896func (ber *BookmarkExpandResponseValue) UnmarshalJSON(body []byte) error { 3897 var m map[string]*json.RawMessage 3898 err := json.Unmarshal(body, &m) 3899 if err != nil { 3900 return err 3901 } 3902 for k, v := range m { 3903 switch k { 3904 case "entities": 3905 if v != nil { 3906 entities, err := unmarshalBasicEntityArray(*v) 3907 if err != nil { 3908 return err 3909 } 3910 ber.Entities = &entities 3911 } 3912 case "edges": 3913 if v != nil { 3914 var edges []ConnectedEntity 3915 err = json.Unmarshal(*v, &edges) 3916 if err != nil { 3917 return err 3918 } 3919 ber.Edges = &edges 3920 } 3921 } 3922 } 3923 3924 return nil 3925} 3926 3927// BookmarkList list all the bookmarks. 3928type BookmarkList struct { 3929 autorest.Response `json:"-"` 3930 // NextLink - READ-ONLY; URL to fetch the next set of cases. 3931 NextLink *string `json:"nextLink,omitempty"` 3932 // Value - Array of bookmarks. 3933 Value *[]Bookmark `json:"value,omitempty"` 3934} 3935 3936// MarshalJSON is the custom marshaler for BookmarkList. 3937func (bl BookmarkList) MarshalJSON() ([]byte, error) { 3938 objectMap := make(map[string]interface{}) 3939 if bl.Value != nil { 3940 objectMap["value"] = bl.Value 3941 } 3942 return json.Marshal(objectMap) 3943} 3944 3945// BookmarkListIterator provides access to a complete listing of Bookmark values. 3946type BookmarkListIterator struct { 3947 i int 3948 page BookmarkListPage 3949} 3950 3951// NextWithContext advances to the next value. If there was an error making 3952// the request the iterator does not advance and the error is returned. 3953func (iter *BookmarkListIterator) NextWithContext(ctx context.Context) (err error) { 3954 if tracing.IsEnabled() { 3955 ctx = tracing.StartSpan(ctx, fqdn+"/BookmarkListIterator.NextWithContext") 3956 defer func() { 3957 sc := -1 3958 if iter.Response().Response.Response != nil { 3959 sc = iter.Response().Response.Response.StatusCode 3960 } 3961 tracing.EndSpan(ctx, sc, err) 3962 }() 3963 } 3964 iter.i++ 3965 if iter.i < len(iter.page.Values()) { 3966 return nil 3967 } 3968 err = iter.page.NextWithContext(ctx) 3969 if err != nil { 3970 iter.i-- 3971 return err 3972 } 3973 iter.i = 0 3974 return nil 3975} 3976 3977// Next advances to the next value. If there was an error making 3978// the request the iterator does not advance and the error is returned. 3979// Deprecated: Use NextWithContext() instead. 3980func (iter *BookmarkListIterator) Next() error { 3981 return iter.NextWithContext(context.Background()) 3982} 3983 3984// NotDone returns true if the enumeration should be started or is not yet complete. 3985func (iter BookmarkListIterator) NotDone() bool { 3986 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 3987} 3988 3989// Response returns the raw server response from the last page request. 3990func (iter BookmarkListIterator) Response() BookmarkList { 3991 return iter.page.Response() 3992} 3993 3994// Value returns the current value or a zero-initialized value if the 3995// iterator has advanced beyond the end of the collection. 3996func (iter BookmarkListIterator) Value() Bookmark { 3997 if !iter.page.NotDone() { 3998 return Bookmark{} 3999 } 4000 return iter.page.Values()[iter.i] 4001} 4002 4003// Creates a new instance of the BookmarkListIterator type. 4004func NewBookmarkListIterator(page BookmarkListPage) BookmarkListIterator { 4005 return BookmarkListIterator{page: page} 4006} 4007 4008// IsEmpty returns true if the ListResult contains no values. 4009func (bl BookmarkList) IsEmpty() bool { 4010 return bl.Value == nil || len(*bl.Value) == 0 4011} 4012 4013// hasNextLink returns true if the NextLink is not empty. 4014func (bl BookmarkList) hasNextLink() bool { 4015 return bl.NextLink != nil && len(*bl.NextLink) != 0 4016} 4017 4018// bookmarkListPreparer prepares a request to retrieve the next set of results. 4019// It returns nil if no more results exist. 4020func (bl BookmarkList) bookmarkListPreparer(ctx context.Context) (*http.Request, error) { 4021 if !bl.hasNextLink() { 4022 return nil, nil 4023 } 4024 return autorest.Prepare((&http.Request{}).WithContext(ctx), 4025 autorest.AsJSON(), 4026 autorest.AsGet(), 4027 autorest.WithBaseURL(to.String(bl.NextLink))) 4028} 4029 4030// BookmarkListPage contains a page of Bookmark values. 4031type BookmarkListPage struct { 4032 fn func(context.Context, BookmarkList) (BookmarkList, error) 4033 bl BookmarkList 4034} 4035 4036// NextWithContext advances to the next page of values. If there was an error making 4037// the request the page does not advance and the error is returned. 4038func (page *BookmarkListPage) NextWithContext(ctx context.Context) (err error) { 4039 if tracing.IsEnabled() { 4040 ctx = tracing.StartSpan(ctx, fqdn+"/BookmarkListPage.NextWithContext") 4041 defer func() { 4042 sc := -1 4043 if page.Response().Response.Response != nil { 4044 sc = page.Response().Response.Response.StatusCode 4045 } 4046 tracing.EndSpan(ctx, sc, err) 4047 }() 4048 } 4049 for { 4050 next, err := page.fn(ctx, page.bl) 4051 if err != nil { 4052 return err 4053 } 4054 page.bl = next 4055 if !next.hasNextLink() || !next.IsEmpty() { 4056 break 4057 } 4058 } 4059 return nil 4060} 4061 4062// Next advances to the next page of values. If there was an error making 4063// the request the page does not advance and the error is returned. 4064// Deprecated: Use NextWithContext() instead. 4065func (page *BookmarkListPage) Next() error { 4066 return page.NextWithContext(context.Background()) 4067} 4068 4069// NotDone returns true if the page enumeration should be started or is not yet complete. 4070func (page BookmarkListPage) NotDone() bool { 4071 return !page.bl.IsEmpty() 4072} 4073 4074// Response returns the raw server response from the last page request. 4075func (page BookmarkListPage) Response() BookmarkList { 4076 return page.bl 4077} 4078 4079// Values returns the slice of values for the current page or nil if there are no values. 4080func (page BookmarkListPage) Values() []Bookmark { 4081 if page.bl.IsEmpty() { 4082 return nil 4083 } 4084 return *page.bl.Value 4085} 4086 4087// Creates a new instance of the BookmarkListPage type. 4088func NewBookmarkListPage(cur BookmarkList, getNextPage func(context.Context, BookmarkList) (BookmarkList, error)) BookmarkListPage { 4089 return BookmarkListPage{ 4090 fn: getNextPage, 4091 bl: cur, 4092 } 4093} 4094 4095// BookmarkProperties describes bookmark properties 4096type BookmarkProperties struct { 4097 // Created - The time the bookmark was created 4098 Created *date.Time `json:"created,omitempty"` 4099 // CreatedBy - Describes a user that created the bookmark 4100 CreatedBy *UserInfo `json:"createdBy,omitempty"` 4101 // DisplayName - The display name of the bookmark 4102 DisplayName *string `json:"displayName,omitempty"` 4103 // Labels - List of labels relevant to this bookmark 4104 Labels *[]string `json:"labels,omitempty"` 4105 // Notes - The notes of the bookmark 4106 Notes *string `json:"notes,omitempty"` 4107 // Query - The query of the bookmark. 4108 Query *string `json:"query,omitempty"` 4109 // QueryResult - The query result of the bookmark. 4110 QueryResult *string `json:"queryResult,omitempty"` 4111 // Updated - The last time the bookmark was updated 4112 Updated *date.Time `json:"updated,omitempty"` 4113 // UpdatedBy - Describes a user that updated the bookmark 4114 UpdatedBy *UserInfo `json:"updatedBy,omitempty"` 4115 // EventTime - The bookmark event time 4116 EventTime *date.Time `json:"eventTime,omitempty"` 4117 // QueryStartTime - The start time for the query 4118 QueryStartTime *date.Time `json:"queryStartTime,omitempty"` 4119 // QueryEndTime - The end time for the query 4120 QueryEndTime *date.Time `json:"queryEndTime,omitempty"` 4121 // IncidentInfo - Describes an incident that relates to bookmark 4122 IncidentInfo *IncidentInfo `json:"incidentInfo,omitempty"` 4123} 4124 4125// BookmarkTimelineItem represents bookmark timeline item. 4126type BookmarkTimelineItem struct { 4127 // AzureResourceID - The bookmark azure resource id. 4128 AzureResourceID *string `json:"azureResourceId,omitempty"` 4129 // DisplayName - The bookmark display name. 4130 DisplayName *string `json:"displayName,omitempty"` 4131 // Notes - The notes of the bookmark 4132 Notes *string `json:"notes,omitempty"` 4133 // EndTimeUtc - The bookmark end time. 4134 EndTimeUtc *date.Time `json:"endTimeUtc,omitempty"` 4135 // StartTimeUtc - TThe bookmark start time. 4136 StartTimeUtc *date.Time `json:"startTimeUtc,omitempty"` 4137 // EventTime - The bookmark event time. 4138 EventTime *date.Time `json:"eventTime,omitempty"` 4139 // CreatedBy - Describes a user that created the bookmark 4140 CreatedBy *UserInfo `json:"createdBy,omitempty"` 4141 // Labels - List of labels relevant to this bookmark 4142 Labels *[]string `json:"labels,omitempty"` 4143 // Kind - Possible values include: 'KindBasicEntityTimelineItemKindEntityTimelineItem', 'KindBasicEntityTimelineItemKindActivity', 'KindBasicEntityTimelineItemKindSecurityAlert', 'KindBasicEntityTimelineItemKindBookmark' 4144 Kind KindBasicEntityTimelineItem `json:"kind,omitempty"` 4145} 4146 4147// MarshalJSON is the custom marshaler for BookmarkTimelineItem. 4148func (bti BookmarkTimelineItem) MarshalJSON() ([]byte, error) { 4149 bti.Kind = KindBasicEntityTimelineItemKindBookmark 4150 objectMap := make(map[string]interface{}) 4151 if bti.AzureResourceID != nil { 4152 objectMap["azureResourceId"] = bti.AzureResourceID 4153 } 4154 if bti.DisplayName != nil { 4155 objectMap["displayName"] = bti.DisplayName 4156 } 4157 if bti.Notes != nil { 4158 objectMap["notes"] = bti.Notes 4159 } 4160 if bti.EndTimeUtc != nil { 4161 objectMap["endTimeUtc"] = bti.EndTimeUtc 4162 } 4163 if bti.StartTimeUtc != nil { 4164 objectMap["startTimeUtc"] = bti.StartTimeUtc 4165 } 4166 if bti.EventTime != nil { 4167 objectMap["eventTime"] = bti.EventTime 4168 } 4169 if bti.CreatedBy != nil { 4170 objectMap["createdBy"] = bti.CreatedBy 4171 } 4172 if bti.Labels != nil { 4173 objectMap["labels"] = bti.Labels 4174 } 4175 if bti.Kind != "" { 4176 objectMap["kind"] = bti.Kind 4177 } 4178 return json.Marshal(objectMap) 4179} 4180 4181// AsActivityTimelineItem is the BasicEntityTimelineItem implementation for BookmarkTimelineItem. 4182func (bti BookmarkTimelineItem) AsActivityTimelineItem() (*ActivityTimelineItem, bool) { 4183 return nil, false 4184} 4185 4186// AsSecurityAlertTimelineItem is the BasicEntityTimelineItem implementation for BookmarkTimelineItem. 4187func (bti BookmarkTimelineItem) AsSecurityAlertTimelineItem() (*SecurityAlertTimelineItem, bool) { 4188 return nil, false 4189} 4190 4191// AsBookmarkTimelineItem is the BasicEntityTimelineItem implementation for BookmarkTimelineItem. 4192func (bti BookmarkTimelineItem) AsBookmarkTimelineItem() (*BookmarkTimelineItem, bool) { 4193 return &bti, true 4194} 4195 4196// AsEntityTimelineItem is the BasicEntityTimelineItem implementation for BookmarkTimelineItem. 4197func (bti BookmarkTimelineItem) AsEntityTimelineItem() (*EntityTimelineItem, bool) { 4198 return nil, false 4199} 4200 4201// AsBasicEntityTimelineItem is the BasicEntityTimelineItem implementation for BookmarkTimelineItem. 4202func (bti BookmarkTimelineItem) AsBasicEntityTimelineItem() (BasicEntityTimelineItem, bool) { 4203 return &bti, true 4204} 4205 4206// Case represents a case in Azure Security Insights. 4207type Case struct { 4208 autorest.Response `json:"-"` 4209 // CaseProperties - Case properties 4210 *CaseProperties `json:"properties,omitempty"` 4211 // ID - READ-ONLY; Azure resource Id 4212 ID *string `json:"id,omitempty"` 4213 // Name - READ-ONLY; Azure resource name 4214 Name *string `json:"name,omitempty"` 4215 // Type - READ-ONLY; Azure resource type 4216 Type *string `json:"type,omitempty"` 4217 // Etag - Etag of the azure resource 4218 Etag *string `json:"etag,omitempty"` 4219} 4220 4221// MarshalJSON is the custom marshaler for Case. 4222func (c Case) MarshalJSON() ([]byte, error) { 4223 objectMap := make(map[string]interface{}) 4224 if c.CaseProperties != nil { 4225 objectMap["properties"] = c.CaseProperties 4226 } 4227 if c.Etag != nil { 4228 objectMap["etag"] = c.Etag 4229 } 4230 return json.Marshal(objectMap) 4231} 4232 4233// UnmarshalJSON is the custom unmarshaler for Case struct. 4234func (c *Case) UnmarshalJSON(body []byte) error { 4235 var m map[string]*json.RawMessage 4236 err := json.Unmarshal(body, &m) 4237 if err != nil { 4238 return err 4239 } 4240 for k, v := range m { 4241 switch k { 4242 case "properties": 4243 if v != nil { 4244 var caseProperties CaseProperties 4245 err = json.Unmarshal(*v, &caseProperties) 4246 if err != nil { 4247 return err 4248 } 4249 c.CaseProperties = &caseProperties 4250 } 4251 case "id": 4252 if v != nil { 4253 var ID string 4254 err = json.Unmarshal(*v, &ID) 4255 if err != nil { 4256 return err 4257 } 4258 c.ID = &ID 4259 } 4260 case "name": 4261 if v != nil { 4262 var name string 4263 err = json.Unmarshal(*v, &name) 4264 if err != nil { 4265 return err 4266 } 4267 c.Name = &name 4268 } 4269 case "type": 4270 if v != nil { 4271 var typeVar string 4272 err = json.Unmarshal(*v, &typeVar) 4273 if err != nil { 4274 return err 4275 } 4276 c.Type = &typeVar 4277 } 4278 case "etag": 4279 if v != nil { 4280 var etag string 4281 err = json.Unmarshal(*v, &etag) 4282 if err != nil { 4283 return err 4284 } 4285 c.Etag = &etag 4286 } 4287 } 4288 } 4289 4290 return nil 4291} 4292 4293// CaseComment represents a case comment 4294type CaseComment struct { 4295 autorest.Response `json:"-"` 4296 // CaseCommentProperties - Case comment properties 4297 *CaseCommentProperties `json:"properties,omitempty"` 4298 // ID - READ-ONLY; Azure resource Id 4299 ID *string `json:"id,omitempty"` 4300 // Name - READ-ONLY; Azure resource name 4301 Name *string `json:"name,omitempty"` 4302 // Type - READ-ONLY; Azure resource type 4303 Type *string `json:"type,omitempty"` 4304} 4305 4306// MarshalJSON is the custom marshaler for CaseComment. 4307func (cc CaseComment) MarshalJSON() ([]byte, error) { 4308 objectMap := make(map[string]interface{}) 4309 if cc.CaseCommentProperties != nil { 4310 objectMap["properties"] = cc.CaseCommentProperties 4311 } 4312 return json.Marshal(objectMap) 4313} 4314 4315// UnmarshalJSON is the custom unmarshaler for CaseComment struct. 4316func (cc *CaseComment) UnmarshalJSON(body []byte) error { 4317 var m map[string]*json.RawMessage 4318 err := json.Unmarshal(body, &m) 4319 if err != nil { 4320 return err 4321 } 4322 for k, v := range m { 4323 switch k { 4324 case "properties": 4325 if v != nil { 4326 var caseCommentProperties CaseCommentProperties 4327 err = json.Unmarshal(*v, &caseCommentProperties) 4328 if err != nil { 4329 return err 4330 } 4331 cc.CaseCommentProperties = &caseCommentProperties 4332 } 4333 case "id": 4334 if v != nil { 4335 var ID string 4336 err = json.Unmarshal(*v, &ID) 4337 if err != nil { 4338 return err 4339 } 4340 cc.ID = &ID 4341 } 4342 case "name": 4343 if v != nil { 4344 var name string 4345 err = json.Unmarshal(*v, &name) 4346 if err != nil { 4347 return err 4348 } 4349 cc.Name = &name 4350 } 4351 case "type": 4352 if v != nil { 4353 var typeVar string 4354 err = json.Unmarshal(*v, &typeVar) 4355 if err != nil { 4356 return err 4357 } 4358 cc.Type = &typeVar 4359 } 4360 } 4361 } 4362 4363 return nil 4364} 4365 4366// CaseCommentList list of case comments. 4367type CaseCommentList struct { 4368 autorest.Response `json:"-"` 4369 // NextLink - READ-ONLY; URL to fetch the next set of comments. 4370 NextLink *string `json:"nextLink,omitempty"` 4371 // Value - Array of comments. 4372 Value *[]CaseComment `json:"value,omitempty"` 4373} 4374 4375// MarshalJSON is the custom marshaler for CaseCommentList. 4376func (ccl CaseCommentList) MarshalJSON() ([]byte, error) { 4377 objectMap := make(map[string]interface{}) 4378 if ccl.Value != nil { 4379 objectMap["value"] = ccl.Value 4380 } 4381 return json.Marshal(objectMap) 4382} 4383 4384// CaseCommentListIterator provides access to a complete listing of CaseComment values. 4385type CaseCommentListIterator struct { 4386 i int 4387 page CaseCommentListPage 4388} 4389 4390// NextWithContext advances to the next value. If there was an error making 4391// the request the iterator does not advance and the error is returned. 4392func (iter *CaseCommentListIterator) NextWithContext(ctx context.Context) (err error) { 4393 if tracing.IsEnabled() { 4394 ctx = tracing.StartSpan(ctx, fqdn+"/CaseCommentListIterator.NextWithContext") 4395 defer func() { 4396 sc := -1 4397 if iter.Response().Response.Response != nil { 4398 sc = iter.Response().Response.Response.StatusCode 4399 } 4400 tracing.EndSpan(ctx, sc, err) 4401 }() 4402 } 4403 iter.i++ 4404 if iter.i < len(iter.page.Values()) { 4405 return nil 4406 } 4407 err = iter.page.NextWithContext(ctx) 4408 if err != nil { 4409 iter.i-- 4410 return err 4411 } 4412 iter.i = 0 4413 return nil 4414} 4415 4416// Next advances to the next value. If there was an error making 4417// the request the iterator does not advance and the error is returned. 4418// Deprecated: Use NextWithContext() instead. 4419func (iter *CaseCommentListIterator) Next() error { 4420 return iter.NextWithContext(context.Background()) 4421} 4422 4423// NotDone returns true if the enumeration should be started or is not yet complete. 4424func (iter CaseCommentListIterator) NotDone() bool { 4425 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 4426} 4427 4428// Response returns the raw server response from the last page request. 4429func (iter CaseCommentListIterator) Response() CaseCommentList { 4430 return iter.page.Response() 4431} 4432 4433// Value returns the current value or a zero-initialized value if the 4434// iterator has advanced beyond the end of the collection. 4435func (iter CaseCommentListIterator) Value() CaseComment { 4436 if !iter.page.NotDone() { 4437 return CaseComment{} 4438 } 4439 return iter.page.Values()[iter.i] 4440} 4441 4442// Creates a new instance of the CaseCommentListIterator type. 4443func NewCaseCommentListIterator(page CaseCommentListPage) CaseCommentListIterator { 4444 return CaseCommentListIterator{page: page} 4445} 4446 4447// IsEmpty returns true if the ListResult contains no values. 4448func (ccl CaseCommentList) IsEmpty() bool { 4449 return ccl.Value == nil || len(*ccl.Value) == 0 4450} 4451 4452// hasNextLink returns true if the NextLink is not empty. 4453func (ccl CaseCommentList) hasNextLink() bool { 4454 return ccl.NextLink != nil && len(*ccl.NextLink) != 0 4455} 4456 4457// caseCommentListPreparer prepares a request to retrieve the next set of results. 4458// It returns nil if no more results exist. 4459func (ccl CaseCommentList) caseCommentListPreparer(ctx context.Context) (*http.Request, error) { 4460 if !ccl.hasNextLink() { 4461 return nil, nil 4462 } 4463 return autorest.Prepare((&http.Request{}).WithContext(ctx), 4464 autorest.AsJSON(), 4465 autorest.AsGet(), 4466 autorest.WithBaseURL(to.String(ccl.NextLink))) 4467} 4468 4469// CaseCommentListPage contains a page of CaseComment values. 4470type CaseCommentListPage struct { 4471 fn func(context.Context, CaseCommentList) (CaseCommentList, error) 4472 ccl CaseCommentList 4473} 4474 4475// NextWithContext advances to the next page of values. If there was an error making 4476// the request the page does not advance and the error is returned. 4477func (page *CaseCommentListPage) NextWithContext(ctx context.Context) (err error) { 4478 if tracing.IsEnabled() { 4479 ctx = tracing.StartSpan(ctx, fqdn+"/CaseCommentListPage.NextWithContext") 4480 defer func() { 4481 sc := -1 4482 if page.Response().Response.Response != nil { 4483 sc = page.Response().Response.Response.StatusCode 4484 } 4485 tracing.EndSpan(ctx, sc, err) 4486 }() 4487 } 4488 for { 4489 next, err := page.fn(ctx, page.ccl) 4490 if err != nil { 4491 return err 4492 } 4493 page.ccl = next 4494 if !next.hasNextLink() || !next.IsEmpty() { 4495 break 4496 } 4497 } 4498 return nil 4499} 4500 4501// Next advances to the next page of values. If there was an error making 4502// the request the page does not advance and the error is returned. 4503// Deprecated: Use NextWithContext() instead. 4504func (page *CaseCommentListPage) Next() error { 4505 return page.NextWithContext(context.Background()) 4506} 4507 4508// NotDone returns true if the page enumeration should be started or is not yet complete. 4509func (page CaseCommentListPage) NotDone() bool { 4510 return !page.ccl.IsEmpty() 4511} 4512 4513// Response returns the raw server response from the last page request. 4514func (page CaseCommentListPage) Response() CaseCommentList { 4515 return page.ccl 4516} 4517 4518// Values returns the slice of values for the current page or nil if there are no values. 4519func (page CaseCommentListPage) Values() []CaseComment { 4520 if page.ccl.IsEmpty() { 4521 return nil 4522 } 4523 return *page.ccl.Value 4524} 4525 4526// Creates a new instance of the CaseCommentListPage type. 4527func NewCaseCommentListPage(cur CaseCommentList, getNextPage func(context.Context, CaseCommentList) (CaseCommentList, error)) CaseCommentListPage { 4528 return CaseCommentListPage{ 4529 fn: getNextPage, 4530 ccl: cur, 4531 } 4532} 4533 4534// CaseCommentProperties case comment property bag. 4535type CaseCommentProperties struct { 4536 // CreatedTimeUtc - READ-ONLY; The time the comment was created 4537 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 4538 // Message - The comment message 4539 Message *string `json:"message,omitempty"` 4540 // UserInfo - READ-ONLY; Describes the user that created the comment 4541 UserInfo *UserInfo `json:"userInfo,omitempty"` 4542} 4543 4544// MarshalJSON is the custom marshaler for CaseCommentProperties. 4545func (ccp CaseCommentProperties) MarshalJSON() ([]byte, error) { 4546 objectMap := make(map[string]interface{}) 4547 if ccp.Message != nil { 4548 objectMap["message"] = ccp.Message 4549 } 4550 return json.Marshal(objectMap) 4551} 4552 4553// CaseList list all the cases. 4554type CaseList struct { 4555 autorest.Response `json:"-"` 4556 // NextLink - READ-ONLY; URL to fetch the next set of cases. 4557 NextLink *string `json:"nextLink,omitempty"` 4558 // Value - Array of cases. 4559 Value *[]Case `json:"value,omitempty"` 4560} 4561 4562// MarshalJSON is the custom marshaler for CaseList. 4563func (cl CaseList) MarshalJSON() ([]byte, error) { 4564 objectMap := make(map[string]interface{}) 4565 if cl.Value != nil { 4566 objectMap["value"] = cl.Value 4567 } 4568 return json.Marshal(objectMap) 4569} 4570 4571// CaseListIterator provides access to a complete listing of Case values. 4572type CaseListIterator struct { 4573 i int 4574 page CaseListPage 4575} 4576 4577// NextWithContext advances to the next value. If there was an error making 4578// the request the iterator does not advance and the error is returned. 4579func (iter *CaseListIterator) NextWithContext(ctx context.Context) (err error) { 4580 if tracing.IsEnabled() { 4581 ctx = tracing.StartSpan(ctx, fqdn+"/CaseListIterator.NextWithContext") 4582 defer func() { 4583 sc := -1 4584 if iter.Response().Response.Response != nil { 4585 sc = iter.Response().Response.Response.StatusCode 4586 } 4587 tracing.EndSpan(ctx, sc, err) 4588 }() 4589 } 4590 iter.i++ 4591 if iter.i < len(iter.page.Values()) { 4592 return nil 4593 } 4594 err = iter.page.NextWithContext(ctx) 4595 if err != nil { 4596 iter.i-- 4597 return err 4598 } 4599 iter.i = 0 4600 return nil 4601} 4602 4603// Next advances to the next value. If there was an error making 4604// the request the iterator does not advance and the error is returned. 4605// Deprecated: Use NextWithContext() instead. 4606func (iter *CaseListIterator) Next() error { 4607 return iter.NextWithContext(context.Background()) 4608} 4609 4610// NotDone returns true if the enumeration should be started or is not yet complete. 4611func (iter CaseListIterator) NotDone() bool { 4612 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 4613} 4614 4615// Response returns the raw server response from the last page request. 4616func (iter CaseListIterator) Response() CaseList { 4617 return iter.page.Response() 4618} 4619 4620// Value returns the current value or a zero-initialized value if the 4621// iterator has advanced beyond the end of the collection. 4622func (iter CaseListIterator) Value() Case { 4623 if !iter.page.NotDone() { 4624 return Case{} 4625 } 4626 return iter.page.Values()[iter.i] 4627} 4628 4629// Creates a new instance of the CaseListIterator type. 4630func NewCaseListIterator(page CaseListPage) CaseListIterator { 4631 return CaseListIterator{page: page} 4632} 4633 4634// IsEmpty returns true if the ListResult contains no values. 4635func (cl CaseList) IsEmpty() bool { 4636 return cl.Value == nil || len(*cl.Value) == 0 4637} 4638 4639// hasNextLink returns true if the NextLink is not empty. 4640func (cl CaseList) hasNextLink() bool { 4641 return cl.NextLink != nil && len(*cl.NextLink) != 0 4642} 4643 4644// caseListPreparer prepares a request to retrieve the next set of results. 4645// It returns nil if no more results exist. 4646func (cl CaseList) caseListPreparer(ctx context.Context) (*http.Request, error) { 4647 if !cl.hasNextLink() { 4648 return nil, nil 4649 } 4650 return autorest.Prepare((&http.Request{}).WithContext(ctx), 4651 autorest.AsJSON(), 4652 autorest.AsGet(), 4653 autorest.WithBaseURL(to.String(cl.NextLink))) 4654} 4655 4656// CaseListPage contains a page of Case values. 4657type CaseListPage struct { 4658 fn func(context.Context, CaseList) (CaseList, error) 4659 cl CaseList 4660} 4661 4662// NextWithContext advances to the next page of values. If there was an error making 4663// the request the page does not advance and the error is returned. 4664func (page *CaseListPage) NextWithContext(ctx context.Context) (err error) { 4665 if tracing.IsEnabled() { 4666 ctx = tracing.StartSpan(ctx, fqdn+"/CaseListPage.NextWithContext") 4667 defer func() { 4668 sc := -1 4669 if page.Response().Response.Response != nil { 4670 sc = page.Response().Response.Response.StatusCode 4671 } 4672 tracing.EndSpan(ctx, sc, err) 4673 }() 4674 } 4675 for { 4676 next, err := page.fn(ctx, page.cl) 4677 if err != nil { 4678 return err 4679 } 4680 page.cl = next 4681 if !next.hasNextLink() || !next.IsEmpty() { 4682 break 4683 } 4684 } 4685 return nil 4686} 4687 4688// Next advances to the next page of values. If there was an error making 4689// the request the page does not advance and the error is returned. 4690// Deprecated: Use NextWithContext() instead. 4691func (page *CaseListPage) Next() error { 4692 return page.NextWithContext(context.Background()) 4693} 4694 4695// NotDone returns true if the page enumeration should be started or is not yet complete. 4696func (page CaseListPage) NotDone() bool { 4697 return !page.cl.IsEmpty() 4698} 4699 4700// Response returns the raw server response from the last page request. 4701func (page CaseListPage) Response() CaseList { 4702 return page.cl 4703} 4704 4705// Values returns the slice of values for the current page or nil if there are no values. 4706func (page CaseListPage) Values() []Case { 4707 if page.cl.IsEmpty() { 4708 return nil 4709 } 4710 return *page.cl.Value 4711} 4712 4713// Creates a new instance of the CaseListPage type. 4714func NewCaseListPage(cur CaseList, getNextPage func(context.Context, CaseList) (CaseList, error)) CaseListPage { 4715 return CaseListPage{ 4716 fn: getNextPage, 4717 cl: cur, 4718 } 4719} 4720 4721// CaseProperties describes case properties 4722type CaseProperties struct { 4723 // CaseNumber - READ-ONLY; a sequential number 4724 CaseNumber *int32 `json:"caseNumber,omitempty"` 4725 // CloseReason - The reason the case was closed. Possible values include: 'CloseReasonResolved', 'CloseReasonDismissed', 'CloseReasonTruePositive', 'CloseReasonFalsePositive', 'CloseReasonOther' 4726 CloseReason CloseReason `json:"closeReason,omitempty"` 4727 // ClosedReasonText - the case close reason details 4728 ClosedReasonText *string `json:"closedReasonText,omitempty"` 4729 // CreatedTimeUtc - READ-ONLY; The time the case was created 4730 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 4731 // Description - The description of the case 4732 Description *string `json:"description,omitempty"` 4733 // EndTimeUtc - The end time of the case 4734 EndTimeUtc *date.Time `json:"endTimeUtc,omitempty"` 4735 // Labels - List of labels relevant to this case 4736 Labels *[]string `json:"labels,omitempty"` 4737 // LastComment - READ-ONLY; the last comment in the case 4738 LastComment *string `json:"lastComment,omitempty"` 4739 // LastUpdatedTimeUtc - READ-ONLY; The last time the case was updated 4740 LastUpdatedTimeUtc *date.Time `json:"lastUpdatedTimeUtc,omitempty"` 4741 // Metrics - READ-ONLY; Dictionary of metrics, for example the number of alerts in the case 4742 Metrics map[string]*int32 `json:"metrics"` 4743 // Owner - Describes a user that the case is assigned to 4744 Owner *UserInfo `json:"owner,omitempty"` 4745 // RelatedAlertIds - READ-ONLY; List of related alert identifiers 4746 RelatedAlertIds *[]string `json:"relatedAlertIds,omitempty"` 4747 // RelatedAlertProductNames - READ-ONLY; List of related alert product names 4748 RelatedAlertProductNames *[]string `json:"relatedAlertProductNames,omitempty"` 4749 // Tactics - READ-ONLY; The tactics associated with case 4750 Tactics *[]AttackTactic `json:"tactics,omitempty"` 4751 // Severity - The severity of the case. Possible values include: 'CaseSeverityCritical', 'CaseSeverityHigh', 'CaseSeverityMedium', 'CaseSeverityLow', 'CaseSeverityInformational' 4752 Severity CaseSeverity `json:"severity,omitempty"` 4753 // StartTimeUtc - The start time of the case 4754 StartTimeUtc *date.Time `json:"startTimeUtc,omitempty"` 4755 // Status - The status of the case. Possible values include: 'CaseStatusDraft', 'CaseStatusNew', 'CaseStatusInProgress', 'CaseStatusClosed' 4756 Status CaseStatus `json:"status,omitempty"` 4757 // Title - The title of the case 4758 Title *string `json:"title,omitempty"` 4759 // TotalComments - READ-ONLY; the number of total comments in the case 4760 TotalComments *int32 `json:"totalComments,omitempty"` 4761} 4762 4763// MarshalJSON is the custom marshaler for CaseProperties. 4764func (cp CaseProperties) MarshalJSON() ([]byte, error) { 4765 objectMap := make(map[string]interface{}) 4766 if cp.CloseReason != "" { 4767 objectMap["closeReason"] = cp.CloseReason 4768 } 4769 if cp.ClosedReasonText != nil { 4770 objectMap["closedReasonText"] = cp.ClosedReasonText 4771 } 4772 if cp.Description != nil { 4773 objectMap["description"] = cp.Description 4774 } 4775 if cp.EndTimeUtc != nil { 4776 objectMap["endTimeUtc"] = cp.EndTimeUtc 4777 } 4778 if cp.Labels != nil { 4779 objectMap["labels"] = cp.Labels 4780 } 4781 if cp.Owner != nil { 4782 objectMap["owner"] = cp.Owner 4783 } 4784 if cp.Severity != "" { 4785 objectMap["severity"] = cp.Severity 4786 } 4787 if cp.StartTimeUtc != nil { 4788 objectMap["startTimeUtc"] = cp.StartTimeUtc 4789 } 4790 if cp.Status != "" { 4791 objectMap["status"] = cp.Status 4792 } 4793 if cp.Title != nil { 4794 objectMap["title"] = cp.Title 4795 } 4796 return json.Marshal(objectMap) 4797} 4798 4799// CaseRelation represents a case relation 4800type CaseRelation struct { 4801 autorest.Response `json:"-"` 4802 // CaseRelationProperties - Case relation properties 4803 *CaseRelationProperties `json:"properties,omitempty"` 4804 // Kind - READ-ONLY; The type of relation node. Possible values include: 'RelationTypesCasesToBookmarks' 4805 Kind RelationTypes `json:"kind,omitempty"` 4806 // Etag - ETag for relation 4807 Etag *string `json:"etag,omitempty"` 4808 // ID - READ-ONLY; Azure resource Id 4809 ID *string `json:"id,omitempty"` 4810 // Name - READ-ONLY; Azure resource name 4811 Name *string `json:"name,omitempty"` 4812 // Type - READ-ONLY; Azure resource type 4813 Type *string `json:"type,omitempty"` 4814} 4815 4816// MarshalJSON is the custom marshaler for CaseRelation. 4817func (cr CaseRelation) MarshalJSON() ([]byte, error) { 4818 objectMap := make(map[string]interface{}) 4819 if cr.CaseRelationProperties != nil { 4820 objectMap["properties"] = cr.CaseRelationProperties 4821 } 4822 if cr.Etag != nil { 4823 objectMap["etag"] = cr.Etag 4824 } 4825 return json.Marshal(objectMap) 4826} 4827 4828// UnmarshalJSON is the custom unmarshaler for CaseRelation struct. 4829func (cr *CaseRelation) UnmarshalJSON(body []byte) error { 4830 var m map[string]*json.RawMessage 4831 err := json.Unmarshal(body, &m) 4832 if err != nil { 4833 return err 4834 } 4835 for k, v := range m { 4836 switch k { 4837 case "properties": 4838 if v != nil { 4839 var caseRelationProperties CaseRelationProperties 4840 err = json.Unmarshal(*v, &caseRelationProperties) 4841 if err != nil { 4842 return err 4843 } 4844 cr.CaseRelationProperties = &caseRelationProperties 4845 } 4846 case "kind": 4847 if v != nil { 4848 var kind RelationTypes 4849 err = json.Unmarshal(*v, &kind) 4850 if err != nil { 4851 return err 4852 } 4853 cr.Kind = kind 4854 } 4855 case "etag": 4856 if v != nil { 4857 var etag string 4858 err = json.Unmarshal(*v, &etag) 4859 if err != nil { 4860 return err 4861 } 4862 cr.Etag = &etag 4863 } 4864 case "id": 4865 if v != nil { 4866 var ID string 4867 err = json.Unmarshal(*v, &ID) 4868 if err != nil { 4869 return err 4870 } 4871 cr.ID = &ID 4872 } 4873 case "name": 4874 if v != nil { 4875 var name string 4876 err = json.Unmarshal(*v, &name) 4877 if err != nil { 4878 return err 4879 } 4880 cr.Name = &name 4881 } 4882 case "type": 4883 if v != nil { 4884 var typeVar string 4885 err = json.Unmarshal(*v, &typeVar) 4886 if err != nil { 4887 return err 4888 } 4889 cr.Type = &typeVar 4890 } 4891 } 4892 } 4893 4894 return nil 4895} 4896 4897// CaseRelationList list of case relations. 4898type CaseRelationList struct { 4899 autorest.Response `json:"-"` 4900 // NextLink - READ-ONLY; URL to fetch the next set of relations. 4901 NextLink *string `json:"nextLink,omitempty"` 4902 // Value - Array of relations. 4903 Value *[]CaseRelation `json:"value,omitempty"` 4904} 4905 4906// MarshalJSON is the custom marshaler for CaseRelationList. 4907func (crl CaseRelationList) MarshalJSON() ([]byte, error) { 4908 objectMap := make(map[string]interface{}) 4909 if crl.Value != nil { 4910 objectMap["value"] = crl.Value 4911 } 4912 return json.Marshal(objectMap) 4913} 4914 4915// CaseRelationListIterator provides access to a complete listing of CaseRelation values. 4916type CaseRelationListIterator struct { 4917 i int 4918 page CaseRelationListPage 4919} 4920 4921// NextWithContext advances to the next value. If there was an error making 4922// the request the iterator does not advance and the error is returned. 4923func (iter *CaseRelationListIterator) NextWithContext(ctx context.Context) (err error) { 4924 if tracing.IsEnabled() { 4925 ctx = tracing.StartSpan(ctx, fqdn+"/CaseRelationListIterator.NextWithContext") 4926 defer func() { 4927 sc := -1 4928 if iter.Response().Response.Response != nil { 4929 sc = iter.Response().Response.Response.StatusCode 4930 } 4931 tracing.EndSpan(ctx, sc, err) 4932 }() 4933 } 4934 iter.i++ 4935 if iter.i < len(iter.page.Values()) { 4936 return nil 4937 } 4938 err = iter.page.NextWithContext(ctx) 4939 if err != nil { 4940 iter.i-- 4941 return err 4942 } 4943 iter.i = 0 4944 return nil 4945} 4946 4947// Next advances to the next value. If there was an error making 4948// the request the iterator does not advance and the error is returned. 4949// Deprecated: Use NextWithContext() instead. 4950func (iter *CaseRelationListIterator) Next() error { 4951 return iter.NextWithContext(context.Background()) 4952} 4953 4954// NotDone returns true if the enumeration should be started or is not yet complete. 4955func (iter CaseRelationListIterator) NotDone() bool { 4956 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 4957} 4958 4959// Response returns the raw server response from the last page request. 4960func (iter CaseRelationListIterator) Response() CaseRelationList { 4961 return iter.page.Response() 4962} 4963 4964// Value returns the current value or a zero-initialized value if the 4965// iterator has advanced beyond the end of the collection. 4966func (iter CaseRelationListIterator) Value() CaseRelation { 4967 if !iter.page.NotDone() { 4968 return CaseRelation{} 4969 } 4970 return iter.page.Values()[iter.i] 4971} 4972 4973// Creates a new instance of the CaseRelationListIterator type. 4974func NewCaseRelationListIterator(page CaseRelationListPage) CaseRelationListIterator { 4975 return CaseRelationListIterator{page: page} 4976} 4977 4978// IsEmpty returns true if the ListResult contains no values. 4979func (crl CaseRelationList) IsEmpty() bool { 4980 return crl.Value == nil || len(*crl.Value) == 0 4981} 4982 4983// hasNextLink returns true if the NextLink is not empty. 4984func (crl CaseRelationList) hasNextLink() bool { 4985 return crl.NextLink != nil && len(*crl.NextLink) != 0 4986} 4987 4988// caseRelationListPreparer prepares a request to retrieve the next set of results. 4989// It returns nil if no more results exist. 4990func (crl CaseRelationList) caseRelationListPreparer(ctx context.Context) (*http.Request, error) { 4991 if !crl.hasNextLink() { 4992 return nil, nil 4993 } 4994 return autorest.Prepare((&http.Request{}).WithContext(ctx), 4995 autorest.AsJSON(), 4996 autorest.AsGet(), 4997 autorest.WithBaseURL(to.String(crl.NextLink))) 4998} 4999 5000// CaseRelationListPage contains a page of CaseRelation values. 5001type CaseRelationListPage struct { 5002 fn func(context.Context, CaseRelationList) (CaseRelationList, error) 5003 crl CaseRelationList 5004} 5005 5006// NextWithContext advances to the next page of values. If there was an error making 5007// the request the page does not advance and the error is returned. 5008func (page *CaseRelationListPage) NextWithContext(ctx context.Context) (err error) { 5009 if tracing.IsEnabled() { 5010 ctx = tracing.StartSpan(ctx, fqdn+"/CaseRelationListPage.NextWithContext") 5011 defer func() { 5012 sc := -1 5013 if page.Response().Response.Response != nil { 5014 sc = page.Response().Response.Response.StatusCode 5015 } 5016 tracing.EndSpan(ctx, sc, err) 5017 }() 5018 } 5019 for { 5020 next, err := page.fn(ctx, page.crl) 5021 if err != nil { 5022 return err 5023 } 5024 page.crl = next 5025 if !next.hasNextLink() || !next.IsEmpty() { 5026 break 5027 } 5028 } 5029 return nil 5030} 5031 5032// Next advances to the next page of values. If there was an error making 5033// the request the page does not advance and the error is returned. 5034// Deprecated: Use NextWithContext() instead. 5035func (page *CaseRelationListPage) Next() error { 5036 return page.NextWithContext(context.Background()) 5037} 5038 5039// NotDone returns true if the page enumeration should be started or is not yet complete. 5040func (page CaseRelationListPage) NotDone() bool { 5041 return !page.crl.IsEmpty() 5042} 5043 5044// Response returns the raw server response from the last page request. 5045func (page CaseRelationListPage) Response() CaseRelationList { 5046 return page.crl 5047} 5048 5049// Values returns the slice of values for the current page or nil if there are no values. 5050func (page CaseRelationListPage) Values() []CaseRelation { 5051 if page.crl.IsEmpty() { 5052 return nil 5053 } 5054 return *page.crl.Value 5055} 5056 5057// Creates a new instance of the CaseRelationListPage type. 5058func NewCaseRelationListPage(cur CaseRelationList, getNextPage func(context.Context, CaseRelationList) (CaseRelationList, error)) CaseRelationListPage { 5059 return CaseRelationListPage{ 5060 fn: getNextPage, 5061 crl: cur, 5062 } 5063} 5064 5065// CaseRelationProperties case relation properties 5066type CaseRelationProperties struct { 5067 // RelationName - Name of relation 5068 RelationName *string `json:"relationName,omitempty"` 5069 // BookmarkID - The case related bookmark id 5070 BookmarkID *string `json:"bookmarkId,omitempty"` 5071 // CaseIdentifier - The case identifier 5072 CaseIdentifier *string `json:"caseIdentifier,omitempty"` 5073 // BookmarkName - The case related bookmark name 5074 BookmarkName *string `json:"bookmarkName,omitempty"` 5075} 5076 5077// CasesAggregation represents aggregations results for cases. 5078type CasesAggregation struct { 5079 // CasesAggregationProperties - Properties of aggregations results of cases. 5080 *CasesAggregationProperties `json:"properties,omitempty"` 5081 // ID - READ-ONLY; Azure resource Id 5082 ID *string `json:"id,omitempty"` 5083 // Name - READ-ONLY; Azure resource name 5084 Name *string `json:"name,omitempty"` 5085 // Type - READ-ONLY; Azure resource type 5086 Type *string `json:"type,omitempty"` 5087 // Kind - Possible values include: 'KindAggregations', 'KindCasesAggregation' 5088 Kind Kind `json:"kind,omitempty"` 5089} 5090 5091// MarshalJSON is the custom marshaler for CasesAggregation. 5092func (ca CasesAggregation) MarshalJSON() ([]byte, error) { 5093 ca.Kind = KindCasesAggregation 5094 objectMap := make(map[string]interface{}) 5095 if ca.CasesAggregationProperties != nil { 5096 objectMap["properties"] = ca.CasesAggregationProperties 5097 } 5098 if ca.Kind != "" { 5099 objectMap["kind"] = ca.Kind 5100 } 5101 return json.Marshal(objectMap) 5102} 5103 5104// AsCasesAggregation is the BasicAggregations implementation for CasesAggregation. 5105func (ca CasesAggregation) AsCasesAggregation() (*CasesAggregation, bool) { 5106 return &ca, true 5107} 5108 5109// AsAggregations is the BasicAggregations implementation for CasesAggregation. 5110func (ca CasesAggregation) AsAggregations() (*Aggregations, bool) { 5111 return nil, false 5112} 5113 5114// AsBasicAggregations is the BasicAggregations implementation for CasesAggregation. 5115func (ca CasesAggregation) AsBasicAggregations() (BasicAggregations, bool) { 5116 return &ca, true 5117} 5118 5119// UnmarshalJSON is the custom unmarshaler for CasesAggregation struct. 5120func (ca *CasesAggregation) UnmarshalJSON(body []byte) error { 5121 var m map[string]*json.RawMessage 5122 err := json.Unmarshal(body, &m) 5123 if err != nil { 5124 return err 5125 } 5126 for k, v := range m { 5127 switch k { 5128 case "properties": 5129 if v != nil { 5130 var casesAggregationProperties CasesAggregationProperties 5131 err = json.Unmarshal(*v, &casesAggregationProperties) 5132 if err != nil { 5133 return err 5134 } 5135 ca.CasesAggregationProperties = &casesAggregationProperties 5136 } 5137 case "id": 5138 if v != nil { 5139 var ID string 5140 err = json.Unmarshal(*v, &ID) 5141 if err != nil { 5142 return err 5143 } 5144 ca.ID = &ID 5145 } 5146 case "name": 5147 if v != nil { 5148 var name string 5149 err = json.Unmarshal(*v, &name) 5150 if err != nil { 5151 return err 5152 } 5153 ca.Name = &name 5154 } 5155 case "type": 5156 if v != nil { 5157 var typeVar string 5158 err = json.Unmarshal(*v, &typeVar) 5159 if err != nil { 5160 return err 5161 } 5162 ca.Type = &typeVar 5163 } 5164 case "kind": 5165 if v != nil { 5166 var kind Kind 5167 err = json.Unmarshal(*v, &kind) 5168 if err != nil { 5169 return err 5170 } 5171 ca.Kind = kind 5172 } 5173 } 5174 } 5175 5176 return nil 5177} 5178 5179// CasesAggregationBySeverityProperties aggregative results of cases by severity property bag. 5180type CasesAggregationBySeverityProperties struct { 5181 // TotalCriticalSeverity - READ-ONLY; Total amount of open cases with severity Critical 5182 TotalCriticalSeverity *int32 `json:"totalCriticalSeverity,omitempty"` 5183 // TotalHighSeverity - READ-ONLY; Total amount of open cases with severity High 5184 TotalHighSeverity *int32 `json:"totalHighSeverity,omitempty"` 5185 // TotalInformationalSeverity - READ-ONLY; Total amount of open cases with severity Informational 5186 TotalInformationalSeverity *int32 `json:"totalInformationalSeverity,omitempty"` 5187 // TotalLowSeverity - READ-ONLY; Total amount of open cases with severity Low 5188 TotalLowSeverity *int32 `json:"totalLowSeverity,omitempty"` 5189 // TotalMediumSeverity - READ-ONLY; Total amount of open cases with severity medium 5190 TotalMediumSeverity *int32 `json:"totalMediumSeverity,omitempty"` 5191} 5192 5193// MarshalJSON is the custom marshaler for CasesAggregationBySeverityProperties. 5194func (cabsp CasesAggregationBySeverityProperties) MarshalJSON() ([]byte, error) { 5195 objectMap := make(map[string]interface{}) 5196 return json.Marshal(objectMap) 5197} 5198 5199// CasesAggregationByStatusProperties aggregative results of cases by status property bag. 5200type CasesAggregationByStatusProperties struct { 5201 // TotalDismissedStatus - READ-ONLY; Total amount of closed cases with status Dismissed 5202 TotalDismissedStatus *int32 `json:"totalDismissedStatus,omitempty"` 5203 // TotalInProgressStatus - READ-ONLY; Total amount of open cases with status InProgress 5204 TotalInProgressStatus *int32 `json:"totalInProgressStatus,omitempty"` 5205 // TotalNewStatus - READ-ONLY; Total amount of open cases with status New 5206 TotalNewStatus *int32 `json:"totalNewStatus,omitempty"` 5207 // TotalResolvedStatus - READ-ONLY; Total amount of closed cases with status Resolved 5208 TotalResolvedStatus *int32 `json:"totalResolvedStatus,omitempty"` 5209 // TotalFalsePositiveStatus - READ-ONLY; Total amount of closed cases with status Closed and Close reason of False positive 5210 TotalFalsePositiveStatus *int32 `json:"totalFalsePositiveStatus,omitempty"` 5211 // TotalTruePositiveStatus - READ-ONLY; Total amount of closed cases with status Closed and Close reason of True positive 5212 TotalTruePositiveStatus *int32 `json:"totalTruePositiveStatus,omitempty"` 5213} 5214 5215// MarshalJSON is the custom marshaler for CasesAggregationByStatusProperties. 5216func (cabsp CasesAggregationByStatusProperties) MarshalJSON() ([]byte, error) { 5217 objectMap := make(map[string]interface{}) 5218 return json.Marshal(objectMap) 5219} 5220 5221// CasesAggregationProperties aggregative results of cases property bag. 5222type CasesAggregationProperties struct { 5223 // AggregationBySeverity - Aggregations results by case severity. 5224 AggregationBySeverity *CasesAggregationBySeverityProperties `json:"aggregationBySeverity,omitempty"` 5225 // AggregationByStatus - Aggregations results by case status. 5226 AggregationByStatus *CasesAggregationByStatusProperties `json:"aggregationByStatus,omitempty"` 5227} 5228 5229// ClientInfo information on the client (user or application) that made some action 5230type ClientInfo struct { 5231 // Email - The email of the client. 5232 Email *string `json:"email,omitempty"` 5233 // Name - The name of the client. 5234 Name *string `json:"name,omitempty"` 5235 // ObjectID - The object id of the client. 5236 ObjectID *uuid.UUID `json:"objectId,omitempty"` 5237 // UserPrincipalName - The user principal name of the client. 5238 UserPrincipalName *string `json:"userPrincipalName,omitempty"` 5239} 5240 5241// CloudApplicationEntity represents a cloud application entity. 5242type CloudApplicationEntity struct { 5243 // CloudApplicationEntityProperties - CloudApplication entity properties 5244 *CloudApplicationEntityProperties `json:"properties,omitempty"` 5245 // ID - READ-ONLY; Azure resource Id 5246 ID *string `json:"id,omitempty"` 5247 // Name - READ-ONLY; Azure resource name 5248 Name *string `json:"name,omitempty"` 5249 // Type - READ-ONLY; Azure resource type 5250 Type *string `json:"type,omitempty"` 5251 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 5252 Kind KindBasicEntity `json:"kind,omitempty"` 5253} 5254 5255// MarshalJSON is the custom marshaler for CloudApplicationEntity. 5256func (cae CloudApplicationEntity) MarshalJSON() ([]byte, error) { 5257 cae.Kind = KindBasicEntityKindCloudApplication 5258 objectMap := make(map[string]interface{}) 5259 if cae.CloudApplicationEntityProperties != nil { 5260 objectMap["properties"] = cae.CloudApplicationEntityProperties 5261 } 5262 if cae.Kind != "" { 5263 objectMap["kind"] = cae.Kind 5264 } 5265 return json.Marshal(objectMap) 5266} 5267 5268// AsAccountEntity is the BasicEntity implementation for CloudApplicationEntity. 5269func (cae CloudApplicationEntity) AsAccountEntity() (*AccountEntity, bool) { 5270 return nil, false 5271} 5272 5273// AsAzureResourceEntity is the BasicEntity implementation for CloudApplicationEntity. 5274func (cae CloudApplicationEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 5275 return nil, false 5276} 5277 5278// AsCloudApplicationEntity is the BasicEntity implementation for CloudApplicationEntity. 5279func (cae CloudApplicationEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 5280 return &cae, true 5281} 5282 5283// AsDNSEntity is the BasicEntity implementation for CloudApplicationEntity. 5284func (cae CloudApplicationEntity) AsDNSEntity() (*DNSEntity, bool) { 5285 return nil, false 5286} 5287 5288// AsFileEntity is the BasicEntity implementation for CloudApplicationEntity. 5289func (cae CloudApplicationEntity) AsFileEntity() (*FileEntity, bool) { 5290 return nil, false 5291} 5292 5293// AsFileHashEntity is the BasicEntity implementation for CloudApplicationEntity. 5294func (cae CloudApplicationEntity) AsFileHashEntity() (*FileHashEntity, bool) { 5295 return nil, false 5296} 5297 5298// AsHostEntity is the BasicEntity implementation for CloudApplicationEntity. 5299func (cae CloudApplicationEntity) AsHostEntity() (*HostEntity, bool) { 5300 return nil, false 5301} 5302 5303// AsHuntingBookmark is the BasicEntity implementation for CloudApplicationEntity. 5304func (cae CloudApplicationEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 5305 return nil, false 5306} 5307 5308// AsSecurityAlert is the BasicEntity implementation for CloudApplicationEntity. 5309func (cae CloudApplicationEntity) AsSecurityAlert() (*SecurityAlert, bool) { 5310 return nil, false 5311} 5312 5313// AsIPEntity is the BasicEntity implementation for CloudApplicationEntity. 5314func (cae CloudApplicationEntity) AsIPEntity() (*IPEntity, bool) { 5315 return nil, false 5316} 5317 5318// AsMailboxEntity is the BasicEntity implementation for CloudApplicationEntity. 5319func (cae CloudApplicationEntity) AsMailboxEntity() (*MailboxEntity, bool) { 5320 return nil, false 5321} 5322 5323// AsMailClusterEntity is the BasicEntity implementation for CloudApplicationEntity. 5324func (cae CloudApplicationEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 5325 return nil, false 5326} 5327 5328// AsMailMessageEntity is the BasicEntity implementation for CloudApplicationEntity. 5329func (cae CloudApplicationEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 5330 return nil, false 5331} 5332 5333// AsSubmissionMailEntity is the BasicEntity implementation for CloudApplicationEntity. 5334func (cae CloudApplicationEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 5335 return nil, false 5336} 5337 5338// AsMalwareEntity is the BasicEntity implementation for CloudApplicationEntity. 5339func (cae CloudApplicationEntity) AsMalwareEntity() (*MalwareEntity, bool) { 5340 return nil, false 5341} 5342 5343// AsProcessEntity is the BasicEntity implementation for CloudApplicationEntity. 5344func (cae CloudApplicationEntity) AsProcessEntity() (*ProcessEntity, bool) { 5345 return nil, false 5346} 5347 5348// AsRegistryKeyEntity is the BasicEntity implementation for CloudApplicationEntity. 5349func (cae CloudApplicationEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 5350 return nil, false 5351} 5352 5353// AsRegistryValueEntity is the BasicEntity implementation for CloudApplicationEntity. 5354func (cae CloudApplicationEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 5355 return nil, false 5356} 5357 5358// AsSecurityGroupEntity is the BasicEntity implementation for CloudApplicationEntity. 5359func (cae CloudApplicationEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 5360 return nil, false 5361} 5362 5363// AsURLEntity is the BasicEntity implementation for CloudApplicationEntity. 5364func (cae CloudApplicationEntity) AsURLEntity() (*URLEntity, bool) { 5365 return nil, false 5366} 5367 5368// AsIoTDeviceEntity is the BasicEntity implementation for CloudApplicationEntity. 5369func (cae CloudApplicationEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 5370 return nil, false 5371} 5372 5373// AsEntity is the BasicEntity implementation for CloudApplicationEntity. 5374func (cae CloudApplicationEntity) AsEntity() (*Entity, bool) { 5375 return nil, false 5376} 5377 5378// AsBasicEntity is the BasicEntity implementation for CloudApplicationEntity. 5379func (cae CloudApplicationEntity) AsBasicEntity() (BasicEntity, bool) { 5380 return &cae, true 5381} 5382 5383// UnmarshalJSON is the custom unmarshaler for CloudApplicationEntity struct. 5384func (cae *CloudApplicationEntity) UnmarshalJSON(body []byte) error { 5385 var m map[string]*json.RawMessage 5386 err := json.Unmarshal(body, &m) 5387 if err != nil { 5388 return err 5389 } 5390 for k, v := range m { 5391 switch k { 5392 case "properties": 5393 if v != nil { 5394 var cloudApplicationEntityProperties CloudApplicationEntityProperties 5395 err = json.Unmarshal(*v, &cloudApplicationEntityProperties) 5396 if err != nil { 5397 return err 5398 } 5399 cae.CloudApplicationEntityProperties = &cloudApplicationEntityProperties 5400 } 5401 case "id": 5402 if v != nil { 5403 var ID string 5404 err = json.Unmarshal(*v, &ID) 5405 if err != nil { 5406 return err 5407 } 5408 cae.ID = &ID 5409 } 5410 case "name": 5411 if v != nil { 5412 var name string 5413 err = json.Unmarshal(*v, &name) 5414 if err != nil { 5415 return err 5416 } 5417 cae.Name = &name 5418 } 5419 case "type": 5420 if v != nil { 5421 var typeVar string 5422 err = json.Unmarshal(*v, &typeVar) 5423 if err != nil { 5424 return err 5425 } 5426 cae.Type = &typeVar 5427 } 5428 case "kind": 5429 if v != nil { 5430 var kind KindBasicEntity 5431 err = json.Unmarshal(*v, &kind) 5432 if err != nil { 5433 return err 5434 } 5435 cae.Kind = kind 5436 } 5437 } 5438 } 5439 5440 return nil 5441} 5442 5443// CloudApplicationEntityProperties cloudApplication entity property bag. 5444type CloudApplicationEntityProperties struct { 5445 // AppID - READ-ONLY; The technical identifier of the application. 5446 AppID *int32 `json:"appId,omitempty"` 5447 // AppName - READ-ONLY; The name of the related cloud application. 5448 AppName *string `json:"appName,omitempty"` 5449 // InstanceName - READ-ONLY; The user defined instance name of the cloud application. It is often used to distinguish between several applications of the same type that a customer has. 5450 InstanceName *string `json:"instanceName,omitempty"` 5451 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 5452 AdditionalData map[string]interface{} `json:"additionalData"` 5453 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 5454 FriendlyName *string `json:"friendlyName,omitempty"` 5455} 5456 5457// MarshalJSON is the custom marshaler for CloudApplicationEntityProperties. 5458func (caep CloudApplicationEntityProperties) MarshalJSON() ([]byte, error) { 5459 objectMap := make(map[string]interface{}) 5460 return json.Marshal(objectMap) 5461} 5462 5463// CloudError error response structure. 5464type CloudError struct { 5465 // CloudErrorBody - Error data 5466 *CloudErrorBody `json:"error,omitempty"` 5467} 5468 5469// MarshalJSON is the custom marshaler for CloudError. 5470func (ce CloudError) MarshalJSON() ([]byte, error) { 5471 objectMap := make(map[string]interface{}) 5472 if ce.CloudErrorBody != nil { 5473 objectMap["error"] = ce.CloudErrorBody 5474 } 5475 return json.Marshal(objectMap) 5476} 5477 5478// UnmarshalJSON is the custom unmarshaler for CloudError struct. 5479func (ce *CloudError) UnmarshalJSON(body []byte) error { 5480 var m map[string]*json.RawMessage 5481 err := json.Unmarshal(body, &m) 5482 if err != nil { 5483 return err 5484 } 5485 for k, v := range m { 5486 switch k { 5487 case "error": 5488 if v != nil { 5489 var cloudErrorBody CloudErrorBody 5490 err = json.Unmarshal(*v, &cloudErrorBody) 5491 if err != nil { 5492 return err 5493 } 5494 ce.CloudErrorBody = &cloudErrorBody 5495 } 5496 } 5497 } 5498 5499 return nil 5500} 5501 5502// CloudErrorBody error details. 5503type CloudErrorBody struct { 5504 // Code - READ-ONLY; An identifier for the error. Codes are invariant and are intended to be consumed programmatically. 5505 Code *string `json:"code,omitempty"` 5506 // Message - READ-ONLY; A message describing the error, intended to be suitable for display in a user interface. 5507 Message *string `json:"message,omitempty"` 5508} 5509 5510// MarshalJSON is the custom marshaler for CloudErrorBody. 5511func (ceb CloudErrorBody) MarshalJSON() ([]byte, error) { 5512 objectMap := make(map[string]interface{}) 5513 return json.Marshal(objectMap) 5514} 5515 5516// ConnectedEntity expansion result connected entities 5517type ConnectedEntity struct { 5518 // TargetEntityID - Entity Id of the connected entity 5519 TargetEntityID *string `json:"targetEntityId,omitempty"` 5520 // AdditionalData - key-value pairs for a connected entity mapping 5521 AdditionalData interface{} `json:"additionalData,omitempty"` 5522} 5523 5524// BasicDataConnector data connector. 5525type BasicDataConnector interface { 5526 AsAADDataConnector() (*AADDataConnector, bool) 5527 AsAATPDataConnector() (*AATPDataConnector, bool) 5528 AsMSTIDataConnector() (*MSTIDataConnector, bool) 5529 AsMTPDataConnector() (*MTPDataConnector, bool) 5530 AsASCDataConnector() (*ASCDataConnector, bool) 5531 AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) 5532 AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) 5533 AsMCASDataConnector() (*MCASDataConnector, bool) 5534 AsMDATPDataConnector() (*MDATPDataConnector, bool) 5535 AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) 5536 AsOfficeDataConnector() (*OfficeDataConnector, bool) 5537 AsTIDataConnector() (*TIDataConnector, bool) 5538 AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) 5539 AsDataConnector() (*DataConnector, bool) 5540} 5541 5542// DataConnector data connector. 5543type DataConnector struct { 5544 autorest.Response `json:"-"` 5545 // ID - READ-ONLY; Azure resource Id 5546 ID *string `json:"id,omitempty"` 5547 // Name - READ-ONLY; Azure resource name 5548 Name *string `json:"name,omitempty"` 5549 // Type - READ-ONLY; Azure resource type 5550 Type *string `json:"type,omitempty"` 5551 // Etag - Etag of the azure resource 5552 Etag *string `json:"etag,omitempty"` 5553 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 5554 Kind KindBasicDataConnector `json:"kind,omitempty"` 5555} 5556 5557func unmarshalBasicDataConnector(body []byte) (BasicDataConnector, error) { 5558 var m map[string]interface{} 5559 err := json.Unmarshal(body, &m) 5560 if err != nil { 5561 return nil, err 5562 } 5563 5564 switch m["kind"] { 5565 case string(KindBasicDataConnectorKindAzureActiveDirectory): 5566 var adc AADDataConnector 5567 err := json.Unmarshal(body, &adc) 5568 return adc, err 5569 case string(KindBasicDataConnectorKindAzureAdvancedThreatProtection): 5570 var adc AATPDataConnector 5571 err := json.Unmarshal(body, &adc) 5572 return adc, err 5573 case string(KindBasicDataConnectorKindMicrosoftThreatIntelligence): 5574 var mdc MSTIDataConnector 5575 err := json.Unmarshal(body, &mdc) 5576 return mdc, err 5577 case string(KindBasicDataConnectorKindMicrosoftThreatProtection): 5578 var mdc MTPDataConnector 5579 err := json.Unmarshal(body, &mdc) 5580 return mdc, err 5581 case string(KindBasicDataConnectorKindAzureSecurityCenter): 5582 var adc ASCDataConnector 5583 err := json.Unmarshal(body, &adc) 5584 return adc, err 5585 case string(KindBasicDataConnectorKindAmazonWebServicesCloudTrail): 5586 var actdc AwsCloudTrailDataConnector 5587 err := json.Unmarshal(body, &actdc) 5588 return actdc, err 5589 case string(KindBasicDataConnectorKindDynamics365): 5590 var d3dc Dynamics365DataConnector 5591 err := json.Unmarshal(body, &d3dc) 5592 return d3dc, err 5593 case string(KindBasicDataConnectorKindMicrosoftCloudAppSecurity): 5594 var mdc MCASDataConnector 5595 err := json.Unmarshal(body, &mdc) 5596 return mdc, err 5597 case string(KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection): 5598 var mdc MDATPDataConnector 5599 err := json.Unmarshal(body, &mdc) 5600 return mdc, err 5601 case string(KindBasicDataConnectorKindOfficeATP): 5602 var oadc OfficeATPDataConnector 5603 err := json.Unmarshal(body, &oadc) 5604 return oadc, err 5605 case string(KindBasicDataConnectorKindOffice365): 5606 var odc OfficeDataConnector 5607 err := json.Unmarshal(body, &odc) 5608 return odc, err 5609 case string(KindBasicDataConnectorKindThreatIntelligence): 5610 var tdc TIDataConnector 5611 err := json.Unmarshal(body, &tdc) 5612 return tdc, err 5613 case string(KindBasicDataConnectorKindThreatIntelligenceTaxii): 5614 var ttdc TiTaxiiDataConnector 5615 err := json.Unmarshal(body, &ttdc) 5616 return ttdc, err 5617 default: 5618 var dc DataConnector 5619 err := json.Unmarshal(body, &dc) 5620 return dc, err 5621 } 5622} 5623func unmarshalBasicDataConnectorArray(body []byte) ([]BasicDataConnector, error) { 5624 var rawMessages []*json.RawMessage 5625 err := json.Unmarshal(body, &rawMessages) 5626 if err != nil { 5627 return nil, err 5628 } 5629 5630 dcArray := make([]BasicDataConnector, len(rawMessages)) 5631 5632 for index, rawMessage := range rawMessages { 5633 dc, err := unmarshalBasicDataConnector(*rawMessage) 5634 if err != nil { 5635 return nil, err 5636 } 5637 dcArray[index] = dc 5638 } 5639 return dcArray, nil 5640} 5641 5642// MarshalJSON is the custom marshaler for DataConnector. 5643func (dc DataConnector) MarshalJSON() ([]byte, error) { 5644 dc.Kind = KindBasicDataConnectorKindDataConnector 5645 objectMap := make(map[string]interface{}) 5646 if dc.Etag != nil { 5647 objectMap["etag"] = dc.Etag 5648 } 5649 if dc.Kind != "" { 5650 objectMap["kind"] = dc.Kind 5651 } 5652 return json.Marshal(objectMap) 5653} 5654 5655// AsAADDataConnector is the BasicDataConnector implementation for DataConnector. 5656func (dc DataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 5657 return nil, false 5658} 5659 5660// AsAATPDataConnector is the BasicDataConnector implementation for DataConnector. 5661func (dc DataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 5662 return nil, false 5663} 5664 5665// AsMSTIDataConnector is the BasicDataConnector implementation for DataConnector. 5666func (dc DataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 5667 return nil, false 5668} 5669 5670// AsMTPDataConnector is the BasicDataConnector implementation for DataConnector. 5671func (dc DataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 5672 return nil, false 5673} 5674 5675// AsASCDataConnector is the BasicDataConnector implementation for DataConnector. 5676func (dc DataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 5677 return nil, false 5678} 5679 5680// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for DataConnector. 5681func (dc DataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 5682 return nil, false 5683} 5684 5685// AsDynamics365DataConnector is the BasicDataConnector implementation for DataConnector. 5686func (dc DataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 5687 return nil, false 5688} 5689 5690// AsMCASDataConnector is the BasicDataConnector implementation for DataConnector. 5691func (dc DataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 5692 return nil, false 5693} 5694 5695// AsMDATPDataConnector is the BasicDataConnector implementation for DataConnector. 5696func (dc DataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 5697 return nil, false 5698} 5699 5700// AsOfficeATPDataConnector is the BasicDataConnector implementation for DataConnector. 5701func (dc DataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 5702 return nil, false 5703} 5704 5705// AsOfficeDataConnector is the BasicDataConnector implementation for DataConnector. 5706func (dc DataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 5707 return nil, false 5708} 5709 5710// AsTIDataConnector is the BasicDataConnector implementation for DataConnector. 5711func (dc DataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 5712 return nil, false 5713} 5714 5715// AsTiTaxiiDataConnector is the BasicDataConnector implementation for DataConnector. 5716func (dc DataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 5717 return nil, false 5718} 5719 5720// AsDataConnector is the BasicDataConnector implementation for DataConnector. 5721func (dc DataConnector) AsDataConnector() (*DataConnector, bool) { 5722 return &dc, true 5723} 5724 5725// AsBasicDataConnector is the BasicDataConnector implementation for DataConnector. 5726func (dc DataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 5727 return &dc, true 5728} 5729 5730// DataConnectorDataTypeCommon common field for data type in data connectors. 5731type DataConnectorDataTypeCommon struct { 5732 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 5733 State DataTypeState `json:"state,omitempty"` 5734} 5735 5736// DataConnectorKind1 describes an Azure resource with kind. 5737type DataConnectorKind1 struct { 5738 // Kind - The kind of the data connector. Possible values include: 'DataConnectorKindAzureActiveDirectory', 'DataConnectorKindAzureSecurityCenter', 'DataConnectorKindMicrosoftCloudAppSecurity', 'DataConnectorKindThreatIntelligence', 'DataConnectorKindThreatIntelligenceTaxii', 'DataConnectorKindOffice365', 'DataConnectorKindOfficeATP', 'DataConnectorKindAmazonWebServicesCloudTrail', 'DataConnectorKindAzureAdvancedThreatProtection', 'DataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'DataConnectorKindDynamics365', 'DataConnectorKindMicrosoftThreatProtection', 'DataConnectorKindMicrosoftThreatIntelligence' 5739 Kind DataConnectorKind `json:"kind,omitempty"` 5740} 5741 5742// DataConnectorList list all the data connectors. 5743type DataConnectorList struct { 5744 autorest.Response `json:"-"` 5745 // NextLink - READ-ONLY; URL to fetch the next set of data connectors. 5746 NextLink *string `json:"nextLink,omitempty"` 5747 // Value - Array of data connectors. 5748 Value *[]BasicDataConnector `json:"value,omitempty"` 5749} 5750 5751// MarshalJSON is the custom marshaler for DataConnectorList. 5752func (dcl DataConnectorList) MarshalJSON() ([]byte, error) { 5753 objectMap := make(map[string]interface{}) 5754 if dcl.Value != nil { 5755 objectMap["value"] = dcl.Value 5756 } 5757 return json.Marshal(objectMap) 5758} 5759 5760// UnmarshalJSON is the custom unmarshaler for DataConnectorList struct. 5761func (dcl *DataConnectorList) UnmarshalJSON(body []byte) error { 5762 var m map[string]*json.RawMessage 5763 err := json.Unmarshal(body, &m) 5764 if err != nil { 5765 return err 5766 } 5767 for k, v := range m { 5768 switch k { 5769 case "nextLink": 5770 if v != nil { 5771 var nextLink string 5772 err = json.Unmarshal(*v, &nextLink) 5773 if err != nil { 5774 return err 5775 } 5776 dcl.NextLink = &nextLink 5777 } 5778 case "value": 5779 if v != nil { 5780 value, err := unmarshalBasicDataConnectorArray(*v) 5781 if err != nil { 5782 return err 5783 } 5784 dcl.Value = &value 5785 } 5786 } 5787 } 5788 5789 return nil 5790} 5791 5792// DataConnectorListIterator provides access to a complete listing of DataConnector values. 5793type DataConnectorListIterator struct { 5794 i int 5795 page DataConnectorListPage 5796} 5797 5798// NextWithContext advances to the next value. If there was an error making 5799// the request the iterator does not advance and the error is returned. 5800func (iter *DataConnectorListIterator) NextWithContext(ctx context.Context) (err error) { 5801 if tracing.IsEnabled() { 5802 ctx = tracing.StartSpan(ctx, fqdn+"/DataConnectorListIterator.NextWithContext") 5803 defer func() { 5804 sc := -1 5805 if iter.Response().Response.Response != nil { 5806 sc = iter.Response().Response.Response.StatusCode 5807 } 5808 tracing.EndSpan(ctx, sc, err) 5809 }() 5810 } 5811 iter.i++ 5812 if iter.i < len(iter.page.Values()) { 5813 return nil 5814 } 5815 err = iter.page.NextWithContext(ctx) 5816 if err != nil { 5817 iter.i-- 5818 return err 5819 } 5820 iter.i = 0 5821 return nil 5822} 5823 5824// Next advances to the next value. If there was an error making 5825// the request the iterator does not advance and the error is returned. 5826// Deprecated: Use NextWithContext() instead. 5827func (iter *DataConnectorListIterator) Next() error { 5828 return iter.NextWithContext(context.Background()) 5829} 5830 5831// NotDone returns true if the enumeration should be started or is not yet complete. 5832func (iter DataConnectorListIterator) NotDone() bool { 5833 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 5834} 5835 5836// Response returns the raw server response from the last page request. 5837func (iter DataConnectorListIterator) Response() DataConnectorList { 5838 return iter.page.Response() 5839} 5840 5841// Value returns the current value or a zero-initialized value if the 5842// iterator has advanced beyond the end of the collection. 5843func (iter DataConnectorListIterator) Value() BasicDataConnector { 5844 if !iter.page.NotDone() { 5845 return DataConnector{} 5846 } 5847 return iter.page.Values()[iter.i] 5848} 5849 5850// Creates a new instance of the DataConnectorListIterator type. 5851func NewDataConnectorListIterator(page DataConnectorListPage) DataConnectorListIterator { 5852 return DataConnectorListIterator{page: page} 5853} 5854 5855// IsEmpty returns true if the ListResult contains no values. 5856func (dcl DataConnectorList) IsEmpty() bool { 5857 return dcl.Value == nil || len(*dcl.Value) == 0 5858} 5859 5860// hasNextLink returns true if the NextLink is not empty. 5861func (dcl DataConnectorList) hasNextLink() bool { 5862 return dcl.NextLink != nil && len(*dcl.NextLink) != 0 5863} 5864 5865// dataConnectorListPreparer prepares a request to retrieve the next set of results. 5866// It returns nil if no more results exist. 5867func (dcl DataConnectorList) dataConnectorListPreparer(ctx context.Context) (*http.Request, error) { 5868 if !dcl.hasNextLink() { 5869 return nil, nil 5870 } 5871 return autorest.Prepare((&http.Request{}).WithContext(ctx), 5872 autorest.AsJSON(), 5873 autorest.AsGet(), 5874 autorest.WithBaseURL(to.String(dcl.NextLink))) 5875} 5876 5877// DataConnectorListPage contains a page of BasicDataConnector values. 5878type DataConnectorListPage struct { 5879 fn func(context.Context, DataConnectorList) (DataConnectorList, error) 5880 dcl DataConnectorList 5881} 5882 5883// NextWithContext advances to the next page of values. If there was an error making 5884// the request the page does not advance and the error is returned. 5885func (page *DataConnectorListPage) NextWithContext(ctx context.Context) (err error) { 5886 if tracing.IsEnabled() { 5887 ctx = tracing.StartSpan(ctx, fqdn+"/DataConnectorListPage.NextWithContext") 5888 defer func() { 5889 sc := -1 5890 if page.Response().Response.Response != nil { 5891 sc = page.Response().Response.Response.StatusCode 5892 } 5893 tracing.EndSpan(ctx, sc, err) 5894 }() 5895 } 5896 for { 5897 next, err := page.fn(ctx, page.dcl) 5898 if err != nil { 5899 return err 5900 } 5901 page.dcl = next 5902 if !next.hasNextLink() || !next.IsEmpty() { 5903 break 5904 } 5905 } 5906 return nil 5907} 5908 5909// Next advances to the next page of values. If there was an error making 5910// the request the page does not advance and the error is returned. 5911// Deprecated: Use NextWithContext() instead. 5912func (page *DataConnectorListPage) Next() error { 5913 return page.NextWithContext(context.Background()) 5914} 5915 5916// NotDone returns true if the page enumeration should be started or is not yet complete. 5917func (page DataConnectorListPage) NotDone() bool { 5918 return !page.dcl.IsEmpty() 5919} 5920 5921// Response returns the raw server response from the last page request. 5922func (page DataConnectorListPage) Response() DataConnectorList { 5923 return page.dcl 5924} 5925 5926// Values returns the slice of values for the current page or nil if there are no values. 5927func (page DataConnectorListPage) Values() []BasicDataConnector { 5928 if page.dcl.IsEmpty() { 5929 return nil 5930 } 5931 return *page.dcl.Value 5932} 5933 5934// Creates a new instance of the DataConnectorListPage type. 5935func NewDataConnectorListPage(cur DataConnectorList, getNextPage func(context.Context, DataConnectorList) (DataConnectorList, error)) DataConnectorListPage { 5936 return DataConnectorListPage{ 5937 fn: getNextPage, 5938 dcl: cur, 5939 } 5940} 5941 5942// DataConnectorModel ... 5943type DataConnectorModel struct { 5944 autorest.Response `json:"-"` 5945 Value BasicDataConnector `json:"value,omitempty"` 5946} 5947 5948// UnmarshalJSON is the custom unmarshaler for DataConnectorModel struct. 5949func (dcm *DataConnectorModel) UnmarshalJSON(body []byte) error { 5950 dc, err := unmarshalBasicDataConnector(body) 5951 if err != nil { 5952 return err 5953 } 5954 dcm.Value = dc 5955 5956 return nil 5957} 5958 5959// DataConnectorRequirementsState data connector requirements status. 5960type DataConnectorRequirementsState struct { 5961 autorest.Response `json:"-"` 5962 // AuthorizationState - Authorization state for this connector. Possible values include: 'DataConnectorAuthorizationStateValid', 'DataConnectorAuthorizationStateInvalid' 5963 AuthorizationState DataConnectorAuthorizationState `json:"authorizationState,omitempty"` 5964 // LicenseState - License state for this connector. Possible values include: 'DataConnectorLicenseStateValid', 'DataConnectorLicenseStateInvalid', 'DataConnectorLicenseStateUnknown' 5965 LicenseState DataConnectorLicenseState `json:"licenseState,omitempty"` 5966} 5967 5968// BasicDataConnectorsCheckRequirements data connector requirements properties. 5969type BasicDataConnectorsCheckRequirements interface { 5970 AsAADCheckRequirements() (*AADCheckRequirements, bool) 5971 AsAATPCheckRequirements() (*AATPCheckRequirements, bool) 5972 AsMSTICheckRequirements() (*MSTICheckRequirements, bool) 5973 AsMtpCheckRequirements() (*MtpCheckRequirements, bool) 5974 AsASCCheckRequirements() (*ASCCheckRequirements, bool) 5975 AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) 5976 AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) 5977 AsMCASCheckRequirements() (*MCASCheckRequirements, bool) 5978 AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) 5979 AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) 5980 AsTICheckRequirements() (*TICheckRequirements, bool) 5981 AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) 5982 AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) 5983} 5984 5985// DataConnectorsCheckRequirements data connector requirements properties. 5986type DataConnectorsCheckRequirements struct { 5987 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 5988 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 5989} 5990 5991func unmarshalBasicDataConnectorsCheckRequirements(body []byte) (BasicDataConnectorsCheckRequirements, error) { 5992 var m map[string]interface{} 5993 err := json.Unmarshal(body, &m) 5994 if err != nil { 5995 return nil, err 5996 } 5997 5998 switch m["kind"] { 5999 case string(KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory): 6000 var acr AADCheckRequirements 6001 err := json.Unmarshal(body, &acr) 6002 return acr, err 6003 case string(KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection): 6004 var acr AATPCheckRequirements 6005 err := json.Unmarshal(body, &acr) 6006 return acr, err 6007 case string(KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence): 6008 var mcr MSTICheckRequirements 6009 err := json.Unmarshal(body, &mcr) 6010 return mcr, err 6011 case string(KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection): 6012 var mcr MtpCheckRequirements 6013 err := json.Unmarshal(body, &mcr) 6014 return mcr, err 6015 case string(KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter): 6016 var acr ASCCheckRequirements 6017 err := json.Unmarshal(body, &acr) 6018 return acr, err 6019 case string(KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail): 6020 var actcr AwsCloudTrailCheckRequirements 6021 err := json.Unmarshal(body, &actcr) 6022 return actcr, err 6023 case string(KindBasicDataConnectorsCheckRequirementsKindDynamics365): 6024 var d3cr Dynamics365CheckRequirements 6025 err := json.Unmarshal(body, &d3cr) 6026 return d3cr, err 6027 case string(KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity): 6028 var mcr MCASCheckRequirements 6029 err := json.Unmarshal(body, &mcr) 6030 return mcr, err 6031 case string(KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection): 6032 var mcr MDATPCheckRequirements 6033 err := json.Unmarshal(body, &mcr) 6034 return mcr, err 6035 case string(KindBasicDataConnectorsCheckRequirementsKindOfficeATP): 6036 var oacr OfficeATPCheckRequirements 6037 err := json.Unmarshal(body, &oacr) 6038 return oacr, err 6039 case string(KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence): 6040 var tcr TICheckRequirements 6041 err := json.Unmarshal(body, &tcr) 6042 return tcr, err 6043 case string(KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii): 6044 var ttcr TiTaxiiCheckRequirements 6045 err := json.Unmarshal(body, &ttcr) 6046 return ttcr, err 6047 default: 6048 var dccr DataConnectorsCheckRequirements 6049 err := json.Unmarshal(body, &dccr) 6050 return dccr, err 6051 } 6052} 6053func unmarshalBasicDataConnectorsCheckRequirementsArray(body []byte) ([]BasicDataConnectorsCheckRequirements, error) { 6054 var rawMessages []*json.RawMessage 6055 err := json.Unmarshal(body, &rawMessages) 6056 if err != nil { 6057 return nil, err 6058 } 6059 6060 dccrArray := make([]BasicDataConnectorsCheckRequirements, len(rawMessages)) 6061 6062 for index, rawMessage := range rawMessages { 6063 dccr, err := unmarshalBasicDataConnectorsCheckRequirements(*rawMessage) 6064 if err != nil { 6065 return nil, err 6066 } 6067 dccrArray[index] = dccr 6068 } 6069 return dccrArray, nil 6070} 6071 6072// MarshalJSON is the custom marshaler for DataConnectorsCheckRequirements. 6073func (dccr DataConnectorsCheckRequirements) MarshalJSON() ([]byte, error) { 6074 dccr.Kind = KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements 6075 objectMap := make(map[string]interface{}) 6076 if dccr.Kind != "" { 6077 objectMap["kind"] = dccr.Kind 6078 } 6079 return json.Marshal(objectMap) 6080} 6081 6082// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6083func (dccr DataConnectorsCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 6084 return nil, false 6085} 6086 6087// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6088func (dccr DataConnectorsCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 6089 return nil, false 6090} 6091 6092// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6093func (dccr DataConnectorsCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 6094 return nil, false 6095} 6096 6097// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6098func (dccr DataConnectorsCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 6099 return nil, false 6100} 6101 6102// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6103func (dccr DataConnectorsCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 6104 return nil, false 6105} 6106 6107// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6108func (dccr DataConnectorsCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 6109 return nil, false 6110} 6111 6112// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6113func (dccr DataConnectorsCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 6114 return nil, false 6115} 6116 6117// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6118func (dccr DataConnectorsCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 6119 return nil, false 6120} 6121 6122// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6123func (dccr DataConnectorsCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 6124 return nil, false 6125} 6126 6127// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6128func (dccr DataConnectorsCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 6129 return nil, false 6130} 6131 6132// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6133func (dccr DataConnectorsCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 6134 return nil, false 6135} 6136 6137// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6138func (dccr DataConnectorsCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 6139 return nil, false 6140} 6141 6142// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6143func (dccr DataConnectorsCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 6144 return &dccr, true 6145} 6146 6147// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for DataConnectorsCheckRequirements. 6148func (dccr DataConnectorsCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 6149 return &dccr, true 6150} 6151 6152// DataConnectorTenantID properties data connector on tenant level. 6153type DataConnectorTenantID struct { 6154 // TenantID - The tenant id to connect to, and get the data from. 6155 TenantID *string `json:"tenantId,omitempty"` 6156} 6157 6158// DataConnectorWithAlertsProperties data connector properties. 6159type DataConnectorWithAlertsProperties struct { 6160 // DataTypes - The available data types for the connector. 6161 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 6162} 6163 6164// DNSEntity represents a dns entity. 6165type DNSEntity struct { 6166 // DNSEntityProperties - Dns entity properties 6167 *DNSEntityProperties `json:"properties,omitempty"` 6168 // ID - READ-ONLY; Azure resource Id 6169 ID *string `json:"id,omitempty"` 6170 // Name - READ-ONLY; Azure resource name 6171 Name *string `json:"name,omitempty"` 6172 // Type - READ-ONLY; Azure resource type 6173 Type *string `json:"type,omitempty"` 6174 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 6175 Kind KindBasicEntity `json:"kind,omitempty"` 6176} 6177 6178// MarshalJSON is the custom marshaler for DNSEntity. 6179func (de DNSEntity) MarshalJSON() ([]byte, error) { 6180 de.Kind = KindBasicEntityKindDNSResolution 6181 objectMap := make(map[string]interface{}) 6182 if de.DNSEntityProperties != nil { 6183 objectMap["properties"] = de.DNSEntityProperties 6184 } 6185 if de.Kind != "" { 6186 objectMap["kind"] = de.Kind 6187 } 6188 return json.Marshal(objectMap) 6189} 6190 6191// AsAccountEntity is the BasicEntity implementation for DNSEntity. 6192func (de DNSEntity) AsAccountEntity() (*AccountEntity, bool) { 6193 return nil, false 6194} 6195 6196// AsAzureResourceEntity is the BasicEntity implementation for DNSEntity. 6197func (de DNSEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 6198 return nil, false 6199} 6200 6201// AsCloudApplicationEntity is the BasicEntity implementation for DNSEntity. 6202func (de DNSEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 6203 return nil, false 6204} 6205 6206// AsDNSEntity is the BasicEntity implementation for DNSEntity. 6207func (de DNSEntity) AsDNSEntity() (*DNSEntity, bool) { 6208 return &de, true 6209} 6210 6211// AsFileEntity is the BasicEntity implementation for DNSEntity. 6212func (de DNSEntity) AsFileEntity() (*FileEntity, bool) { 6213 return nil, false 6214} 6215 6216// AsFileHashEntity is the BasicEntity implementation for DNSEntity. 6217func (de DNSEntity) AsFileHashEntity() (*FileHashEntity, bool) { 6218 return nil, false 6219} 6220 6221// AsHostEntity is the BasicEntity implementation for DNSEntity. 6222func (de DNSEntity) AsHostEntity() (*HostEntity, bool) { 6223 return nil, false 6224} 6225 6226// AsHuntingBookmark is the BasicEntity implementation for DNSEntity. 6227func (de DNSEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 6228 return nil, false 6229} 6230 6231// AsSecurityAlert is the BasicEntity implementation for DNSEntity. 6232func (de DNSEntity) AsSecurityAlert() (*SecurityAlert, bool) { 6233 return nil, false 6234} 6235 6236// AsIPEntity is the BasicEntity implementation for DNSEntity. 6237func (de DNSEntity) AsIPEntity() (*IPEntity, bool) { 6238 return nil, false 6239} 6240 6241// AsMailboxEntity is the BasicEntity implementation for DNSEntity. 6242func (de DNSEntity) AsMailboxEntity() (*MailboxEntity, bool) { 6243 return nil, false 6244} 6245 6246// AsMailClusterEntity is the BasicEntity implementation for DNSEntity. 6247func (de DNSEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 6248 return nil, false 6249} 6250 6251// AsMailMessageEntity is the BasicEntity implementation for DNSEntity. 6252func (de DNSEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 6253 return nil, false 6254} 6255 6256// AsSubmissionMailEntity is the BasicEntity implementation for DNSEntity. 6257func (de DNSEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 6258 return nil, false 6259} 6260 6261// AsMalwareEntity is the BasicEntity implementation for DNSEntity. 6262func (de DNSEntity) AsMalwareEntity() (*MalwareEntity, bool) { 6263 return nil, false 6264} 6265 6266// AsProcessEntity is the BasicEntity implementation for DNSEntity. 6267func (de DNSEntity) AsProcessEntity() (*ProcessEntity, bool) { 6268 return nil, false 6269} 6270 6271// AsRegistryKeyEntity is the BasicEntity implementation for DNSEntity. 6272func (de DNSEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 6273 return nil, false 6274} 6275 6276// AsRegistryValueEntity is the BasicEntity implementation for DNSEntity. 6277func (de DNSEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 6278 return nil, false 6279} 6280 6281// AsSecurityGroupEntity is the BasicEntity implementation for DNSEntity. 6282func (de DNSEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 6283 return nil, false 6284} 6285 6286// AsURLEntity is the BasicEntity implementation for DNSEntity. 6287func (de DNSEntity) AsURLEntity() (*URLEntity, bool) { 6288 return nil, false 6289} 6290 6291// AsIoTDeviceEntity is the BasicEntity implementation for DNSEntity. 6292func (de DNSEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 6293 return nil, false 6294} 6295 6296// AsEntity is the BasicEntity implementation for DNSEntity. 6297func (de DNSEntity) AsEntity() (*Entity, bool) { 6298 return nil, false 6299} 6300 6301// AsBasicEntity is the BasicEntity implementation for DNSEntity. 6302func (de DNSEntity) AsBasicEntity() (BasicEntity, bool) { 6303 return &de, true 6304} 6305 6306// UnmarshalJSON is the custom unmarshaler for DNSEntity struct. 6307func (de *DNSEntity) UnmarshalJSON(body []byte) error { 6308 var m map[string]*json.RawMessage 6309 err := json.Unmarshal(body, &m) 6310 if err != nil { 6311 return err 6312 } 6313 for k, v := range m { 6314 switch k { 6315 case "properties": 6316 if v != nil { 6317 var DNSEntityProperties DNSEntityProperties 6318 err = json.Unmarshal(*v, &DNSEntityProperties) 6319 if err != nil { 6320 return err 6321 } 6322 de.DNSEntityProperties = &DNSEntityProperties 6323 } 6324 case "id": 6325 if v != nil { 6326 var ID string 6327 err = json.Unmarshal(*v, &ID) 6328 if err != nil { 6329 return err 6330 } 6331 de.ID = &ID 6332 } 6333 case "name": 6334 if v != nil { 6335 var name string 6336 err = json.Unmarshal(*v, &name) 6337 if err != nil { 6338 return err 6339 } 6340 de.Name = &name 6341 } 6342 case "type": 6343 if v != nil { 6344 var typeVar string 6345 err = json.Unmarshal(*v, &typeVar) 6346 if err != nil { 6347 return err 6348 } 6349 de.Type = &typeVar 6350 } 6351 case "kind": 6352 if v != nil { 6353 var kind KindBasicEntity 6354 err = json.Unmarshal(*v, &kind) 6355 if err != nil { 6356 return err 6357 } 6358 de.Kind = kind 6359 } 6360 } 6361 } 6362 6363 return nil 6364} 6365 6366// DNSEntityProperties dns entity property bag. 6367type DNSEntityProperties struct { 6368 // DNSServerIPEntityID - READ-ONLY; An ip entity id for the dns server resolving the request 6369 DNSServerIPEntityID *string `json:"dnsServerIpEntityId,omitempty"` 6370 // DomainName - READ-ONLY; The name of the dns record associated with the alert 6371 DomainName *string `json:"domainName,omitempty"` 6372 // HostIPAddressEntityID - READ-ONLY; An ip entity id for the dns request client 6373 HostIPAddressEntityID *string `json:"hostIpAddressEntityId,omitempty"` 6374 // IPAddressEntityIds - READ-ONLY; Ip entity identifiers for the resolved ip address. 6375 IPAddressEntityIds *[]string `json:"ipAddressEntityIds,omitempty"` 6376 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 6377 AdditionalData map[string]interface{} `json:"additionalData"` 6378 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 6379 FriendlyName *string `json:"friendlyName,omitempty"` 6380} 6381 6382// MarshalJSON is the custom marshaler for DNSEntityProperties. 6383func (dep DNSEntityProperties) MarshalJSON() ([]byte, error) { 6384 objectMap := make(map[string]interface{}) 6385 return json.Marshal(objectMap) 6386} 6387 6388// Dynamics365CheckRequirements represents Dynamics365 requirements check request. 6389type Dynamics365CheckRequirements struct { 6390 // Dynamics365CheckRequirementsProperties - Dynamics365 requirements check properties. 6391 *Dynamics365CheckRequirementsProperties `json:"properties,omitempty"` 6392 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 6393 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 6394} 6395 6396// MarshalJSON is the custom marshaler for Dynamics365CheckRequirements. 6397func (d3cr Dynamics365CheckRequirements) MarshalJSON() ([]byte, error) { 6398 d3cr.Kind = KindBasicDataConnectorsCheckRequirementsKindDynamics365 6399 objectMap := make(map[string]interface{}) 6400 if d3cr.Dynamics365CheckRequirementsProperties != nil { 6401 objectMap["properties"] = d3cr.Dynamics365CheckRequirementsProperties 6402 } 6403 if d3cr.Kind != "" { 6404 objectMap["kind"] = d3cr.Kind 6405 } 6406 return json.Marshal(objectMap) 6407} 6408 6409// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6410func (d3cr Dynamics365CheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 6411 return nil, false 6412} 6413 6414// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6415func (d3cr Dynamics365CheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 6416 return nil, false 6417} 6418 6419// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6420func (d3cr Dynamics365CheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 6421 return nil, false 6422} 6423 6424// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6425func (d3cr Dynamics365CheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 6426 return nil, false 6427} 6428 6429// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6430func (d3cr Dynamics365CheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 6431 return nil, false 6432} 6433 6434// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6435func (d3cr Dynamics365CheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 6436 return nil, false 6437} 6438 6439// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6440func (d3cr Dynamics365CheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 6441 return &d3cr, true 6442} 6443 6444// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6445func (d3cr Dynamics365CheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 6446 return nil, false 6447} 6448 6449// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6450func (d3cr Dynamics365CheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 6451 return nil, false 6452} 6453 6454// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6455func (d3cr Dynamics365CheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 6456 return nil, false 6457} 6458 6459// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6460func (d3cr Dynamics365CheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 6461 return nil, false 6462} 6463 6464// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6465func (d3cr Dynamics365CheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 6466 return nil, false 6467} 6468 6469// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6470func (d3cr Dynamics365CheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 6471 return nil, false 6472} 6473 6474// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for Dynamics365CheckRequirements. 6475func (d3cr Dynamics365CheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 6476 return &d3cr, true 6477} 6478 6479// UnmarshalJSON is the custom unmarshaler for Dynamics365CheckRequirements struct. 6480func (d3cr *Dynamics365CheckRequirements) UnmarshalJSON(body []byte) error { 6481 var m map[string]*json.RawMessage 6482 err := json.Unmarshal(body, &m) 6483 if err != nil { 6484 return err 6485 } 6486 for k, v := range m { 6487 switch k { 6488 case "properties": 6489 if v != nil { 6490 var dynamics365CheckRequirementsProperties Dynamics365CheckRequirementsProperties 6491 err = json.Unmarshal(*v, &dynamics365CheckRequirementsProperties) 6492 if err != nil { 6493 return err 6494 } 6495 d3cr.Dynamics365CheckRequirementsProperties = &dynamics365CheckRequirementsProperties 6496 } 6497 case "kind": 6498 if v != nil { 6499 var kind KindBasicDataConnectorsCheckRequirements 6500 err = json.Unmarshal(*v, &kind) 6501 if err != nil { 6502 return err 6503 } 6504 d3cr.Kind = kind 6505 } 6506 } 6507 } 6508 6509 return nil 6510} 6511 6512// Dynamics365CheckRequirementsProperties dynamics365 requirements check properties. 6513type Dynamics365CheckRequirementsProperties struct { 6514 // TenantID - The tenant id to connect to, and get the data from. 6515 TenantID *string `json:"tenantId,omitempty"` 6516} 6517 6518// Dynamics365DataConnector represents Dynamics365 data connector. 6519type Dynamics365DataConnector struct { 6520 // Dynamics365DataConnectorProperties - Dynamics365 data connector properties. 6521 *Dynamics365DataConnectorProperties `json:"properties,omitempty"` 6522 // ID - READ-ONLY; Azure resource Id 6523 ID *string `json:"id,omitempty"` 6524 // Name - READ-ONLY; Azure resource name 6525 Name *string `json:"name,omitempty"` 6526 // Type - READ-ONLY; Azure resource type 6527 Type *string `json:"type,omitempty"` 6528 // Etag - Etag of the azure resource 6529 Etag *string `json:"etag,omitempty"` 6530 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 6531 Kind KindBasicDataConnector `json:"kind,omitempty"` 6532} 6533 6534// MarshalJSON is the custom marshaler for Dynamics365DataConnector. 6535func (d3dc Dynamics365DataConnector) MarshalJSON() ([]byte, error) { 6536 d3dc.Kind = KindBasicDataConnectorKindDynamics365 6537 objectMap := make(map[string]interface{}) 6538 if d3dc.Dynamics365DataConnectorProperties != nil { 6539 objectMap["properties"] = d3dc.Dynamics365DataConnectorProperties 6540 } 6541 if d3dc.Etag != nil { 6542 objectMap["etag"] = d3dc.Etag 6543 } 6544 if d3dc.Kind != "" { 6545 objectMap["kind"] = d3dc.Kind 6546 } 6547 return json.Marshal(objectMap) 6548} 6549 6550// AsAADDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6551func (d3dc Dynamics365DataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 6552 return nil, false 6553} 6554 6555// AsAATPDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6556func (d3dc Dynamics365DataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 6557 return nil, false 6558} 6559 6560// AsMSTIDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6561func (d3dc Dynamics365DataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 6562 return nil, false 6563} 6564 6565// AsMTPDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6566func (d3dc Dynamics365DataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 6567 return nil, false 6568} 6569 6570// AsASCDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6571func (d3dc Dynamics365DataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 6572 return nil, false 6573} 6574 6575// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6576func (d3dc Dynamics365DataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 6577 return nil, false 6578} 6579 6580// AsDynamics365DataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6581func (d3dc Dynamics365DataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 6582 return &d3dc, true 6583} 6584 6585// AsMCASDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6586func (d3dc Dynamics365DataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 6587 return nil, false 6588} 6589 6590// AsMDATPDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6591func (d3dc Dynamics365DataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 6592 return nil, false 6593} 6594 6595// AsOfficeATPDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6596func (d3dc Dynamics365DataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 6597 return nil, false 6598} 6599 6600// AsOfficeDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6601func (d3dc Dynamics365DataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 6602 return nil, false 6603} 6604 6605// AsTIDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6606func (d3dc Dynamics365DataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 6607 return nil, false 6608} 6609 6610// AsTiTaxiiDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6611func (d3dc Dynamics365DataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 6612 return nil, false 6613} 6614 6615// AsDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6616func (d3dc Dynamics365DataConnector) AsDataConnector() (*DataConnector, bool) { 6617 return nil, false 6618} 6619 6620// AsBasicDataConnector is the BasicDataConnector implementation for Dynamics365DataConnector. 6621func (d3dc Dynamics365DataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 6622 return &d3dc, true 6623} 6624 6625// UnmarshalJSON is the custom unmarshaler for Dynamics365DataConnector struct. 6626func (d3dc *Dynamics365DataConnector) UnmarshalJSON(body []byte) error { 6627 var m map[string]*json.RawMessage 6628 err := json.Unmarshal(body, &m) 6629 if err != nil { 6630 return err 6631 } 6632 for k, v := range m { 6633 switch k { 6634 case "properties": 6635 if v != nil { 6636 var dynamics365DataConnectorProperties Dynamics365DataConnectorProperties 6637 err = json.Unmarshal(*v, &dynamics365DataConnectorProperties) 6638 if err != nil { 6639 return err 6640 } 6641 d3dc.Dynamics365DataConnectorProperties = &dynamics365DataConnectorProperties 6642 } 6643 case "id": 6644 if v != nil { 6645 var ID string 6646 err = json.Unmarshal(*v, &ID) 6647 if err != nil { 6648 return err 6649 } 6650 d3dc.ID = &ID 6651 } 6652 case "name": 6653 if v != nil { 6654 var name string 6655 err = json.Unmarshal(*v, &name) 6656 if err != nil { 6657 return err 6658 } 6659 d3dc.Name = &name 6660 } 6661 case "type": 6662 if v != nil { 6663 var typeVar string 6664 err = json.Unmarshal(*v, &typeVar) 6665 if err != nil { 6666 return err 6667 } 6668 d3dc.Type = &typeVar 6669 } 6670 case "etag": 6671 if v != nil { 6672 var etag string 6673 err = json.Unmarshal(*v, &etag) 6674 if err != nil { 6675 return err 6676 } 6677 d3dc.Etag = &etag 6678 } 6679 case "kind": 6680 if v != nil { 6681 var kind KindBasicDataConnector 6682 err = json.Unmarshal(*v, &kind) 6683 if err != nil { 6684 return err 6685 } 6686 d3dc.Kind = kind 6687 } 6688 } 6689 } 6690 6691 return nil 6692} 6693 6694// Dynamics365DataConnectorDataTypes the available data types for Dynamics365 data connector. 6695type Dynamics365DataConnectorDataTypes struct { 6696 // Dynamics365CdsActivities - Common Data Service data type connection. 6697 Dynamics365CdsActivities *Dynamics365DataConnectorDataTypesDynamics365CdsActivities `json:"dynamics365CdsActivities,omitempty"` 6698} 6699 6700// Dynamics365DataConnectorDataTypesDynamics365CdsActivities common Data Service data type connection. 6701type Dynamics365DataConnectorDataTypesDynamics365CdsActivities struct { 6702 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 6703 State DataTypeState `json:"state,omitempty"` 6704} 6705 6706// Dynamics365DataConnectorProperties dynamics365 data connector properties. 6707type Dynamics365DataConnectorProperties struct { 6708 // DataTypes - The available data types for the connector. 6709 DataTypes *Dynamics365DataConnectorDataTypes `json:"dataTypes,omitempty"` 6710 // TenantID - The tenant id to connect to, and get the data from. 6711 TenantID *string `json:"tenantId,omitempty"` 6712} 6713 6714// BasicEntity specific entity. 6715type BasicEntity interface { 6716 AsAccountEntity() (*AccountEntity, bool) 6717 AsAzureResourceEntity() (*AzureResourceEntity, bool) 6718 AsCloudApplicationEntity() (*CloudApplicationEntity, bool) 6719 AsDNSEntity() (*DNSEntity, bool) 6720 AsFileEntity() (*FileEntity, bool) 6721 AsFileHashEntity() (*FileHashEntity, bool) 6722 AsHostEntity() (*HostEntity, bool) 6723 AsHuntingBookmark() (*HuntingBookmark, bool) 6724 AsSecurityAlert() (*SecurityAlert, bool) 6725 AsIPEntity() (*IPEntity, bool) 6726 AsMailboxEntity() (*MailboxEntity, bool) 6727 AsMailClusterEntity() (*MailClusterEntity, bool) 6728 AsMailMessageEntity() (*MailMessageEntity, bool) 6729 AsSubmissionMailEntity() (*SubmissionMailEntity, bool) 6730 AsMalwareEntity() (*MalwareEntity, bool) 6731 AsProcessEntity() (*ProcessEntity, bool) 6732 AsRegistryKeyEntity() (*RegistryKeyEntity, bool) 6733 AsRegistryValueEntity() (*RegistryValueEntity, bool) 6734 AsSecurityGroupEntity() (*SecurityGroupEntity, bool) 6735 AsURLEntity() (*URLEntity, bool) 6736 AsIoTDeviceEntity() (*IoTDeviceEntity, bool) 6737 AsEntity() (*Entity, bool) 6738} 6739 6740// Entity specific entity. 6741type Entity struct { 6742 autorest.Response `json:"-"` 6743 // ID - READ-ONLY; Azure resource Id 6744 ID *string `json:"id,omitempty"` 6745 // Name - READ-ONLY; Azure resource name 6746 Name *string `json:"name,omitempty"` 6747 // Type - READ-ONLY; Azure resource type 6748 Type *string `json:"type,omitempty"` 6749 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 6750 Kind KindBasicEntity `json:"kind,omitempty"` 6751} 6752 6753func unmarshalBasicEntity(body []byte) (BasicEntity, error) { 6754 var m map[string]interface{} 6755 err := json.Unmarshal(body, &m) 6756 if err != nil { 6757 return nil, err 6758 } 6759 6760 switch m["kind"] { 6761 case string(KindBasicEntityKindAccount): 6762 var ae AccountEntity 6763 err := json.Unmarshal(body, &ae) 6764 return ae, err 6765 case string(KindBasicEntityKindAzureResource): 6766 var are AzureResourceEntity 6767 err := json.Unmarshal(body, &are) 6768 return are, err 6769 case string(KindBasicEntityKindCloudApplication): 6770 var cae CloudApplicationEntity 6771 err := json.Unmarshal(body, &cae) 6772 return cae, err 6773 case string(KindBasicEntityKindDNSResolution): 6774 var de DNSEntity 6775 err := json.Unmarshal(body, &de) 6776 return de, err 6777 case string(KindBasicEntityKindFile): 6778 var fe FileEntity 6779 err := json.Unmarshal(body, &fe) 6780 return fe, err 6781 case string(KindBasicEntityKindFileHash): 6782 var fhe FileHashEntity 6783 err := json.Unmarshal(body, &fhe) 6784 return fhe, err 6785 case string(KindBasicEntityKindHost): 6786 var he HostEntity 6787 err := json.Unmarshal(body, &he) 6788 return he, err 6789 case string(KindBasicEntityKindBookmark): 6790 var hb HuntingBookmark 6791 err := json.Unmarshal(body, &hb) 6792 return hb, err 6793 case string(KindBasicEntityKindSecurityAlert): 6794 var sa SecurityAlert 6795 err := json.Unmarshal(body, &sa) 6796 return sa, err 6797 case string(KindBasicEntityKindIP): 6798 var ie IPEntity 6799 err := json.Unmarshal(body, &ie) 6800 return ie, err 6801 case string(KindBasicEntityKindMailbox): 6802 var me MailboxEntity 6803 err := json.Unmarshal(body, &me) 6804 return me, err 6805 case string(KindBasicEntityKindMailCluster): 6806 var mce MailClusterEntity 6807 err := json.Unmarshal(body, &mce) 6808 return mce, err 6809 case string(KindBasicEntityKindMailMessage): 6810 var mme MailMessageEntity 6811 err := json.Unmarshal(body, &mme) 6812 return mme, err 6813 case string(KindBasicEntityKindSubmissionMail): 6814 var sme SubmissionMailEntity 6815 err := json.Unmarshal(body, &sme) 6816 return sme, err 6817 case string(KindBasicEntityKindMalware): 6818 var me MalwareEntity 6819 err := json.Unmarshal(body, &me) 6820 return me, err 6821 case string(KindBasicEntityKindProcess): 6822 var peVar ProcessEntity 6823 err := json.Unmarshal(body, &peVar) 6824 return peVar, err 6825 case string(KindBasicEntityKindRegistryKey): 6826 var rke RegistryKeyEntity 6827 err := json.Unmarshal(body, &rke) 6828 return rke, err 6829 case string(KindBasicEntityKindRegistryValue): 6830 var rve RegistryValueEntity 6831 err := json.Unmarshal(body, &rve) 6832 return rve, err 6833 case string(KindBasicEntityKindSecurityGroup): 6834 var sge SecurityGroupEntity 6835 err := json.Unmarshal(body, &sge) 6836 return sge, err 6837 case string(KindBasicEntityKindURL): 6838 var ue URLEntity 6839 err := json.Unmarshal(body, &ue) 6840 return ue, err 6841 case string(KindBasicEntityKindIoTDevice): 6842 var itde IoTDeviceEntity 6843 err := json.Unmarshal(body, &itde) 6844 return itde, err 6845 default: 6846 var e Entity 6847 err := json.Unmarshal(body, &e) 6848 return e, err 6849 } 6850} 6851func unmarshalBasicEntityArray(body []byte) ([]BasicEntity, error) { 6852 var rawMessages []*json.RawMessage 6853 err := json.Unmarshal(body, &rawMessages) 6854 if err != nil { 6855 return nil, err 6856 } 6857 6858 eArray := make([]BasicEntity, len(rawMessages)) 6859 6860 for index, rawMessage := range rawMessages { 6861 e, err := unmarshalBasicEntity(*rawMessage) 6862 if err != nil { 6863 return nil, err 6864 } 6865 eArray[index] = e 6866 } 6867 return eArray, nil 6868} 6869 6870// MarshalJSON is the custom marshaler for Entity. 6871func (e Entity) MarshalJSON() ([]byte, error) { 6872 e.Kind = KindBasicEntityKindEntity 6873 objectMap := make(map[string]interface{}) 6874 if e.Kind != "" { 6875 objectMap["kind"] = e.Kind 6876 } 6877 return json.Marshal(objectMap) 6878} 6879 6880// AsAccountEntity is the BasicEntity implementation for Entity. 6881func (e Entity) AsAccountEntity() (*AccountEntity, bool) { 6882 return nil, false 6883} 6884 6885// AsAzureResourceEntity is the BasicEntity implementation for Entity. 6886func (e Entity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 6887 return nil, false 6888} 6889 6890// AsCloudApplicationEntity is the BasicEntity implementation for Entity. 6891func (e Entity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 6892 return nil, false 6893} 6894 6895// AsDNSEntity is the BasicEntity implementation for Entity. 6896func (e Entity) AsDNSEntity() (*DNSEntity, bool) { 6897 return nil, false 6898} 6899 6900// AsFileEntity is the BasicEntity implementation for Entity. 6901func (e Entity) AsFileEntity() (*FileEntity, bool) { 6902 return nil, false 6903} 6904 6905// AsFileHashEntity is the BasicEntity implementation for Entity. 6906func (e Entity) AsFileHashEntity() (*FileHashEntity, bool) { 6907 return nil, false 6908} 6909 6910// AsHostEntity is the BasicEntity implementation for Entity. 6911func (e Entity) AsHostEntity() (*HostEntity, bool) { 6912 return nil, false 6913} 6914 6915// AsHuntingBookmark is the BasicEntity implementation for Entity. 6916func (e Entity) AsHuntingBookmark() (*HuntingBookmark, bool) { 6917 return nil, false 6918} 6919 6920// AsSecurityAlert is the BasicEntity implementation for Entity. 6921func (e Entity) AsSecurityAlert() (*SecurityAlert, bool) { 6922 return nil, false 6923} 6924 6925// AsIPEntity is the BasicEntity implementation for Entity. 6926func (e Entity) AsIPEntity() (*IPEntity, bool) { 6927 return nil, false 6928} 6929 6930// AsMailboxEntity is the BasicEntity implementation for Entity. 6931func (e Entity) AsMailboxEntity() (*MailboxEntity, bool) { 6932 return nil, false 6933} 6934 6935// AsMailClusterEntity is the BasicEntity implementation for Entity. 6936func (e Entity) AsMailClusterEntity() (*MailClusterEntity, bool) { 6937 return nil, false 6938} 6939 6940// AsMailMessageEntity is the BasicEntity implementation for Entity. 6941func (e Entity) AsMailMessageEntity() (*MailMessageEntity, bool) { 6942 return nil, false 6943} 6944 6945// AsSubmissionMailEntity is the BasicEntity implementation for Entity. 6946func (e Entity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 6947 return nil, false 6948} 6949 6950// AsMalwareEntity is the BasicEntity implementation for Entity. 6951func (e Entity) AsMalwareEntity() (*MalwareEntity, bool) { 6952 return nil, false 6953} 6954 6955// AsProcessEntity is the BasicEntity implementation for Entity. 6956func (e Entity) AsProcessEntity() (*ProcessEntity, bool) { 6957 return nil, false 6958} 6959 6960// AsRegistryKeyEntity is the BasicEntity implementation for Entity. 6961func (e Entity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 6962 return nil, false 6963} 6964 6965// AsRegistryValueEntity is the BasicEntity implementation for Entity. 6966func (e Entity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 6967 return nil, false 6968} 6969 6970// AsSecurityGroupEntity is the BasicEntity implementation for Entity. 6971func (e Entity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 6972 return nil, false 6973} 6974 6975// AsURLEntity is the BasicEntity implementation for Entity. 6976func (e Entity) AsURLEntity() (*URLEntity, bool) { 6977 return nil, false 6978} 6979 6980// AsIoTDeviceEntity is the BasicEntity implementation for Entity. 6981func (e Entity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 6982 return nil, false 6983} 6984 6985// AsEntity is the BasicEntity implementation for Entity. 6986func (e Entity) AsEntity() (*Entity, bool) { 6987 return &e, true 6988} 6989 6990// AsBasicEntity is the BasicEntity implementation for Entity. 6991func (e Entity) AsBasicEntity() (BasicEntity, bool) { 6992 return &e, true 6993} 6994 6995// EntityAnalytics settings with single toggle. 6996type EntityAnalytics struct { 6997 // EntityAnalyticsProperties - EntityAnalytics properties 6998 *EntityAnalyticsProperties `json:"properties,omitempty"` 6999 // ID - READ-ONLY; Azure resource Id 7000 ID *string `json:"id,omitempty"` 7001 // Name - READ-ONLY; Azure resource name 7002 Name *string `json:"name,omitempty"` 7003 // Type - READ-ONLY; Azure resource type 7004 Type *string `json:"type,omitempty"` 7005 // Etag - Etag of the azure resource 7006 Etag *string `json:"etag,omitempty"` 7007 // Kind - Possible values include: 'KindBasicSettingsKindSettings', 'KindBasicSettingsKindIPSyncer', 'KindBasicSettingsKindEyesOn', 'KindBasicSettingsKindEntityAnalytics', 'KindBasicSettingsKindUeba' 7008 Kind KindBasicSettings `json:"kind,omitempty"` 7009} 7010 7011// MarshalJSON is the custom marshaler for EntityAnalytics. 7012func (ea EntityAnalytics) MarshalJSON() ([]byte, error) { 7013 ea.Kind = KindBasicSettingsKindEntityAnalytics 7014 objectMap := make(map[string]interface{}) 7015 if ea.EntityAnalyticsProperties != nil { 7016 objectMap["properties"] = ea.EntityAnalyticsProperties 7017 } 7018 if ea.Etag != nil { 7019 objectMap["etag"] = ea.Etag 7020 } 7021 if ea.Kind != "" { 7022 objectMap["kind"] = ea.Kind 7023 } 7024 return json.Marshal(objectMap) 7025} 7026 7027// AsIPSyncer is the BasicSettings implementation for EntityAnalytics. 7028func (ea EntityAnalytics) AsIPSyncer() (*IPSyncer, bool) { 7029 return nil, false 7030} 7031 7032// AsEyesOn is the BasicSettings implementation for EntityAnalytics. 7033func (ea EntityAnalytics) AsEyesOn() (*EyesOn, bool) { 7034 return nil, false 7035} 7036 7037// AsEntityAnalytics is the BasicSettings implementation for EntityAnalytics. 7038func (ea EntityAnalytics) AsEntityAnalytics() (*EntityAnalytics, bool) { 7039 return &ea, true 7040} 7041 7042// AsUeba is the BasicSettings implementation for EntityAnalytics. 7043func (ea EntityAnalytics) AsUeba() (*Ueba, bool) { 7044 return nil, false 7045} 7046 7047// AsSettings is the BasicSettings implementation for EntityAnalytics. 7048func (ea EntityAnalytics) AsSettings() (*Settings, bool) { 7049 return nil, false 7050} 7051 7052// AsBasicSettings is the BasicSettings implementation for EntityAnalytics. 7053func (ea EntityAnalytics) AsBasicSettings() (BasicSettings, bool) { 7054 return &ea, true 7055} 7056 7057// UnmarshalJSON is the custom unmarshaler for EntityAnalytics struct. 7058func (ea *EntityAnalytics) UnmarshalJSON(body []byte) error { 7059 var m map[string]*json.RawMessage 7060 err := json.Unmarshal(body, &m) 7061 if err != nil { 7062 return err 7063 } 7064 for k, v := range m { 7065 switch k { 7066 case "properties": 7067 if v != nil { 7068 var entityAnalyticsProperties EntityAnalyticsProperties 7069 err = json.Unmarshal(*v, &entityAnalyticsProperties) 7070 if err != nil { 7071 return err 7072 } 7073 ea.EntityAnalyticsProperties = &entityAnalyticsProperties 7074 } 7075 case "id": 7076 if v != nil { 7077 var ID string 7078 err = json.Unmarshal(*v, &ID) 7079 if err != nil { 7080 return err 7081 } 7082 ea.ID = &ID 7083 } 7084 case "name": 7085 if v != nil { 7086 var name string 7087 err = json.Unmarshal(*v, &name) 7088 if err != nil { 7089 return err 7090 } 7091 ea.Name = &name 7092 } 7093 case "type": 7094 if v != nil { 7095 var typeVar string 7096 err = json.Unmarshal(*v, &typeVar) 7097 if err != nil { 7098 return err 7099 } 7100 ea.Type = &typeVar 7101 } 7102 case "etag": 7103 if v != nil { 7104 var etag string 7105 err = json.Unmarshal(*v, &etag) 7106 if err != nil { 7107 return err 7108 } 7109 ea.Etag = &etag 7110 } 7111 case "kind": 7112 if v != nil { 7113 var kind KindBasicSettings 7114 err = json.Unmarshal(*v, &kind) 7115 if err != nil { 7116 return err 7117 } 7118 ea.Kind = kind 7119 } 7120 } 7121 } 7122 7123 return nil 7124} 7125 7126// EntityAnalyticsProperties entityAnalytics property bag. 7127type EntityAnalyticsProperties struct { 7128 // IsEnabled - READ-ONLY; Determines whether the setting is enable or disabled. 7129 IsEnabled *bool `json:"isEnabled,omitempty"` 7130} 7131 7132// MarshalJSON is the custom marshaler for EntityAnalyticsProperties. 7133func (eap EntityAnalyticsProperties) MarshalJSON() ([]byte, error) { 7134 objectMap := make(map[string]interface{}) 7135 return json.Marshal(objectMap) 7136} 7137 7138// EntityCommonProperties entity common property bag. 7139type EntityCommonProperties struct { 7140 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 7141 AdditionalData map[string]interface{} `json:"additionalData"` 7142 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 7143 FriendlyName *string `json:"friendlyName,omitempty"` 7144} 7145 7146// MarshalJSON is the custom marshaler for EntityCommonProperties. 7147func (ecp EntityCommonProperties) MarshalJSON() ([]byte, error) { 7148 objectMap := make(map[string]interface{}) 7149 return json.Marshal(objectMap) 7150} 7151 7152// EntityEdges the edge that connects the entity to the other entity. 7153type EntityEdges struct { 7154 // TargetEntityID - The target entity Id. 7155 TargetEntityID *string `json:"targetEntityId,omitempty"` 7156 // AdditionalData - A bag of custom fields that should be part of the entity and will be presented to the user. 7157 AdditionalData map[string]interface{} `json:"additionalData"` 7158} 7159 7160// MarshalJSON is the custom marshaler for EntityEdges. 7161func (ee EntityEdges) MarshalJSON() ([]byte, error) { 7162 objectMap := make(map[string]interface{}) 7163 if ee.TargetEntityID != nil { 7164 objectMap["targetEntityId"] = ee.TargetEntityID 7165 } 7166 if ee.AdditionalData != nil { 7167 objectMap["additionalData"] = ee.AdditionalData 7168 } 7169 return json.Marshal(objectMap) 7170} 7171 7172// EntityExpandParameters the parameters required to execute an expand operation on the given entity. 7173type EntityExpandParameters struct { 7174 // EndTime - The end date filter, so the only expansion results returned are before this date. 7175 EndTime *date.Time `json:"endTime,omitempty"` 7176 // ExpansionID - The Id of the expansion to perform. 7177 ExpansionID *uuid.UUID `json:"expansionId,omitempty"` 7178 // StartTime - The start date filter, so the only expansion results returned are after this date. 7179 StartTime *date.Time `json:"startTime,omitempty"` 7180} 7181 7182// EntityExpandResponse the entity expansion result operation response. 7183type EntityExpandResponse struct { 7184 autorest.Response `json:"-"` 7185 // MetaData - The metadata from the expansion operation results. 7186 MetaData *ExpansionResultsMetadata `json:"metaData,omitempty"` 7187 // Value - The expansion result values. 7188 Value *EntityExpandResponseValue `json:"value,omitempty"` 7189} 7190 7191// EntityExpandResponseValue the expansion result values. 7192type EntityExpandResponseValue struct { 7193 // Entities - Array of the expansion result entities. 7194 Entities *[]BasicEntity `json:"entities,omitempty"` 7195 // Edges - Array of edges that connects the entity to the list of entities. 7196 Edges *[]EntityEdges `json:"edges,omitempty"` 7197} 7198 7199// UnmarshalJSON is the custom unmarshaler for EntityExpandResponseValue struct. 7200func (eer *EntityExpandResponseValue) UnmarshalJSON(body []byte) error { 7201 var m map[string]*json.RawMessage 7202 err := json.Unmarshal(body, &m) 7203 if err != nil { 7204 return err 7205 } 7206 for k, v := range m { 7207 switch k { 7208 case "entities": 7209 if v != nil { 7210 entities, err := unmarshalBasicEntityArray(*v) 7211 if err != nil { 7212 return err 7213 } 7214 eer.Entities = &entities 7215 } 7216 case "edges": 7217 if v != nil { 7218 var edges []EntityEdges 7219 err = json.Unmarshal(*v, &edges) 7220 if err != nil { 7221 return err 7222 } 7223 eer.Edges = &edges 7224 } 7225 } 7226 } 7227 7228 return nil 7229} 7230 7231// EntityGetInsightsParameters the parameters required to execute insights operation on the given entity. 7232type EntityGetInsightsParameters struct { 7233 // StartTime - The start timeline date, so the results returned are after this date. 7234 StartTime *date.Time `json:"startTime,omitempty"` 7235 // EndTime - The end timeline date, so the results returned are before this date. 7236 EndTime *date.Time `json:"endTime,omitempty"` 7237 // AddDefaultExtendedTimeRange - Indicates if query time range should be extended with default time range of the query. Default value is false 7238 AddDefaultExtendedTimeRange *bool `json:"addDefaultExtendedTimeRange,omitempty"` 7239 // InsightQueryIds - List of Insights Query Id. If empty, default value is all insights of this entity 7240 InsightQueryIds *[]uuid.UUID `json:"insightQueryIds,omitempty"` 7241} 7242 7243// EntityGetInsightsResponse the Get Insights result operation response. 7244type EntityGetInsightsResponse struct { 7245 autorest.Response `json:"-"` 7246 // MetaData - The metadata from the get insights operation results. 7247 MetaData *GetInsightsResultsMetadata `json:"metaData,omitempty"` 7248 // Value - The insights result values. 7249 Value *[]EntityInsightItem `json:"value,omitempty"` 7250} 7251 7252// EntityInsightItem entity insight Item. 7253type EntityInsightItem struct { 7254 // QueryID - The query id of the insight 7255 QueryID *string `json:"queryId,omitempty"` 7256 // QueryTimeInterval - The Time interval that the query actually executed on. 7257 QueryTimeInterval *EntityInsightItemQueryTimeInterval `json:"queryTimeInterval,omitempty"` 7258 // TableQueryResults - Query results for table insights query. 7259 TableQueryResults *InsightsTableResult `json:"tableQueryResults,omitempty"` 7260 // ChartQueryResults - Query results for table insights query. 7261 ChartQueryResults *[]InsightsTableResult `json:"chartQueryResults,omitempty"` 7262} 7263 7264// EntityInsightItemQueryTimeInterval the Time interval that the query actually executed on. 7265type EntityInsightItemQueryTimeInterval struct { 7266 // StartTime - Insight query start time 7267 StartTime *date.Time `json:"startTime,omitempty"` 7268 // EndTime - Insight query end time 7269 EndTime *date.Time `json:"endTime,omitempty"` 7270} 7271 7272// EntityKind1 describes an entity with kind. 7273type EntityKind1 struct { 7274 // Kind - The kind of the entity. Possible values include: 'EntityKindAccount', 'EntityKindHost', 'EntityKindFile', 'EntityKindAzureResource', 'EntityKindCloudApplication', 'EntityKindDNSResolution', 'EntityKindFileHash', 'EntityKindIP', 'EntityKindMalware', 'EntityKindProcess', 'EntityKindRegistryKey', 'EntityKindRegistryValue', 'EntityKindSecurityGroup', 'EntityKindURL', 'EntityKindIoTDevice', 'EntityKindSecurityAlert', 'EntityKindBookmark', 'EntityKindMailCluster', 'EntityKindMailMessage', 'EntityKindMailbox', 'EntityKindSubmissionMail' 7275 Kind EntityKind `json:"kind,omitempty"` 7276} 7277 7278// EntityList list of all the entities. 7279type EntityList struct { 7280 autorest.Response `json:"-"` 7281 // NextLink - READ-ONLY; URL to fetch the next set of entities. 7282 NextLink *string `json:"nextLink,omitempty"` 7283 // Value - Array of entities. 7284 Value *[]BasicEntity `json:"value,omitempty"` 7285} 7286 7287// MarshalJSON is the custom marshaler for EntityList. 7288func (el EntityList) MarshalJSON() ([]byte, error) { 7289 objectMap := make(map[string]interface{}) 7290 if el.Value != nil { 7291 objectMap["value"] = el.Value 7292 } 7293 return json.Marshal(objectMap) 7294} 7295 7296// UnmarshalJSON is the custom unmarshaler for EntityList struct. 7297func (el *EntityList) UnmarshalJSON(body []byte) error { 7298 var m map[string]*json.RawMessage 7299 err := json.Unmarshal(body, &m) 7300 if err != nil { 7301 return err 7302 } 7303 for k, v := range m { 7304 switch k { 7305 case "nextLink": 7306 if v != nil { 7307 var nextLink string 7308 err = json.Unmarshal(*v, &nextLink) 7309 if err != nil { 7310 return err 7311 } 7312 el.NextLink = &nextLink 7313 } 7314 case "value": 7315 if v != nil { 7316 value, err := unmarshalBasicEntityArray(*v) 7317 if err != nil { 7318 return err 7319 } 7320 el.Value = &value 7321 } 7322 } 7323 } 7324 7325 return nil 7326} 7327 7328// EntityListIterator provides access to a complete listing of Entity values. 7329type EntityListIterator struct { 7330 i int 7331 page EntityListPage 7332} 7333 7334// NextWithContext advances to the next value. If there was an error making 7335// the request the iterator does not advance and the error is returned. 7336func (iter *EntityListIterator) NextWithContext(ctx context.Context) (err error) { 7337 if tracing.IsEnabled() { 7338 ctx = tracing.StartSpan(ctx, fqdn+"/EntityListIterator.NextWithContext") 7339 defer func() { 7340 sc := -1 7341 if iter.Response().Response.Response != nil { 7342 sc = iter.Response().Response.Response.StatusCode 7343 } 7344 tracing.EndSpan(ctx, sc, err) 7345 }() 7346 } 7347 iter.i++ 7348 if iter.i < len(iter.page.Values()) { 7349 return nil 7350 } 7351 err = iter.page.NextWithContext(ctx) 7352 if err != nil { 7353 iter.i-- 7354 return err 7355 } 7356 iter.i = 0 7357 return nil 7358} 7359 7360// Next advances to the next value. If there was an error making 7361// the request the iterator does not advance and the error is returned. 7362// Deprecated: Use NextWithContext() instead. 7363func (iter *EntityListIterator) Next() error { 7364 return iter.NextWithContext(context.Background()) 7365} 7366 7367// NotDone returns true if the enumeration should be started or is not yet complete. 7368func (iter EntityListIterator) NotDone() bool { 7369 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 7370} 7371 7372// Response returns the raw server response from the last page request. 7373func (iter EntityListIterator) Response() EntityList { 7374 return iter.page.Response() 7375} 7376 7377// Value returns the current value or a zero-initialized value if the 7378// iterator has advanced beyond the end of the collection. 7379func (iter EntityListIterator) Value() BasicEntity { 7380 if !iter.page.NotDone() { 7381 return Entity{} 7382 } 7383 return iter.page.Values()[iter.i] 7384} 7385 7386// Creates a new instance of the EntityListIterator type. 7387func NewEntityListIterator(page EntityListPage) EntityListIterator { 7388 return EntityListIterator{page: page} 7389} 7390 7391// IsEmpty returns true if the ListResult contains no values. 7392func (el EntityList) IsEmpty() bool { 7393 return el.Value == nil || len(*el.Value) == 0 7394} 7395 7396// hasNextLink returns true if the NextLink is not empty. 7397func (el EntityList) hasNextLink() bool { 7398 return el.NextLink != nil && len(*el.NextLink) != 0 7399} 7400 7401// entityListPreparer prepares a request to retrieve the next set of results. 7402// It returns nil if no more results exist. 7403func (el EntityList) entityListPreparer(ctx context.Context) (*http.Request, error) { 7404 if !el.hasNextLink() { 7405 return nil, nil 7406 } 7407 return autorest.Prepare((&http.Request{}).WithContext(ctx), 7408 autorest.AsJSON(), 7409 autorest.AsGet(), 7410 autorest.WithBaseURL(to.String(el.NextLink))) 7411} 7412 7413// EntityListPage contains a page of BasicEntity values. 7414type EntityListPage struct { 7415 fn func(context.Context, EntityList) (EntityList, error) 7416 el EntityList 7417} 7418 7419// NextWithContext advances to the next page of values. If there was an error making 7420// the request the page does not advance and the error is returned. 7421func (page *EntityListPage) NextWithContext(ctx context.Context) (err error) { 7422 if tracing.IsEnabled() { 7423 ctx = tracing.StartSpan(ctx, fqdn+"/EntityListPage.NextWithContext") 7424 defer func() { 7425 sc := -1 7426 if page.Response().Response.Response != nil { 7427 sc = page.Response().Response.Response.StatusCode 7428 } 7429 tracing.EndSpan(ctx, sc, err) 7430 }() 7431 } 7432 for { 7433 next, err := page.fn(ctx, page.el) 7434 if err != nil { 7435 return err 7436 } 7437 page.el = next 7438 if !next.hasNextLink() || !next.IsEmpty() { 7439 break 7440 } 7441 } 7442 return nil 7443} 7444 7445// Next advances to the next page of values. If there was an error making 7446// the request the page does not advance and the error is returned. 7447// Deprecated: Use NextWithContext() instead. 7448func (page *EntityListPage) Next() error { 7449 return page.NextWithContext(context.Background()) 7450} 7451 7452// NotDone returns true if the page enumeration should be started or is not yet complete. 7453func (page EntityListPage) NotDone() bool { 7454 return !page.el.IsEmpty() 7455} 7456 7457// Response returns the raw server response from the last page request. 7458func (page EntityListPage) Response() EntityList { 7459 return page.el 7460} 7461 7462// Values returns the slice of values for the current page or nil if there are no values. 7463func (page EntityListPage) Values() []BasicEntity { 7464 if page.el.IsEmpty() { 7465 return nil 7466 } 7467 return *page.el.Value 7468} 7469 7470// Creates a new instance of the EntityListPage type. 7471func NewEntityListPage(cur EntityList, getNextPage func(context.Context, EntityList) (EntityList, error)) EntityListPage { 7472 return EntityListPage{ 7473 fn: getNextPage, 7474 el: cur, 7475 } 7476} 7477 7478// EntityModel ... 7479type EntityModel struct { 7480 autorest.Response `json:"-"` 7481 Value BasicEntity `json:"value,omitempty"` 7482} 7483 7484// UnmarshalJSON is the custom unmarshaler for EntityModel struct. 7485func (em *EntityModel) UnmarshalJSON(body []byte) error { 7486 e, err := unmarshalBasicEntity(body) 7487 if err != nil { 7488 return err 7489 } 7490 em.Value = e 7491 7492 return nil 7493} 7494 7495// BasicEntityQuery specific entity query. 7496type BasicEntityQuery interface { 7497 AsExpansionEntityQuery() (*ExpansionEntityQuery, bool) 7498 AsEntityQuery() (*EntityQuery, bool) 7499} 7500 7501// EntityQuery specific entity query. 7502type EntityQuery struct { 7503 autorest.Response `json:"-"` 7504 // ID - READ-ONLY; Azure resource Id 7505 ID *string `json:"id,omitempty"` 7506 // Name - READ-ONLY; Azure resource name 7507 Name *string `json:"name,omitempty"` 7508 // Type - READ-ONLY; Azure resource type 7509 Type *string `json:"type,omitempty"` 7510 // Etag - Etag of the azure resource 7511 Etag *string `json:"etag,omitempty"` 7512 // Kind - Possible values include: 'KindBasicEntityQueryKindEntityQuery', 'KindBasicEntityQueryKindExpansion' 7513 Kind KindBasicEntityQuery `json:"kind,omitempty"` 7514} 7515 7516func unmarshalBasicEntityQuery(body []byte) (BasicEntityQuery, error) { 7517 var m map[string]interface{} 7518 err := json.Unmarshal(body, &m) 7519 if err != nil { 7520 return nil, err 7521 } 7522 7523 switch m["kind"] { 7524 case string(KindBasicEntityQueryKindExpansion): 7525 var eeq ExpansionEntityQuery 7526 err := json.Unmarshal(body, &eeq) 7527 return eeq, err 7528 default: 7529 var eq EntityQuery 7530 err := json.Unmarshal(body, &eq) 7531 return eq, err 7532 } 7533} 7534func unmarshalBasicEntityQueryArray(body []byte) ([]BasicEntityQuery, error) { 7535 var rawMessages []*json.RawMessage 7536 err := json.Unmarshal(body, &rawMessages) 7537 if err != nil { 7538 return nil, err 7539 } 7540 7541 eqArray := make([]BasicEntityQuery, len(rawMessages)) 7542 7543 for index, rawMessage := range rawMessages { 7544 eq, err := unmarshalBasicEntityQuery(*rawMessage) 7545 if err != nil { 7546 return nil, err 7547 } 7548 eqArray[index] = eq 7549 } 7550 return eqArray, nil 7551} 7552 7553// MarshalJSON is the custom marshaler for EntityQuery. 7554func (eq EntityQuery) MarshalJSON() ([]byte, error) { 7555 eq.Kind = KindBasicEntityQueryKindEntityQuery 7556 objectMap := make(map[string]interface{}) 7557 if eq.Etag != nil { 7558 objectMap["etag"] = eq.Etag 7559 } 7560 if eq.Kind != "" { 7561 objectMap["kind"] = eq.Kind 7562 } 7563 return json.Marshal(objectMap) 7564} 7565 7566// AsExpansionEntityQuery is the BasicEntityQuery implementation for EntityQuery. 7567func (eq EntityQuery) AsExpansionEntityQuery() (*ExpansionEntityQuery, bool) { 7568 return nil, false 7569} 7570 7571// AsEntityQuery is the BasicEntityQuery implementation for EntityQuery. 7572func (eq EntityQuery) AsEntityQuery() (*EntityQuery, bool) { 7573 return &eq, true 7574} 7575 7576// AsBasicEntityQuery is the BasicEntityQuery implementation for EntityQuery. 7577func (eq EntityQuery) AsBasicEntityQuery() (BasicEntityQuery, bool) { 7578 return &eq, true 7579} 7580 7581// EntityQueryItem an abstract Query item for entity 7582type EntityQueryItem struct { 7583 // ID - READ-ONLY; Query Template ARM ID 7584 ID *string `json:"id,omitempty"` 7585 // Name - Query Template ARM Name 7586 Name *string `json:"name,omitempty"` 7587 // Type - ARM Type 7588 Type *string `json:"type,omitempty"` 7589 // Kind - The kind of the entity query. Possible values include: 'EntityQueryKindExpansion', 'EntityQueryKindInsight' 7590 Kind EntityQueryKind `json:"kind,omitempty"` 7591} 7592 7593// MarshalJSON is the custom marshaler for EntityQueryItem. 7594func (eqi EntityQueryItem) MarshalJSON() ([]byte, error) { 7595 objectMap := make(map[string]interface{}) 7596 if eqi.Name != nil { 7597 objectMap["name"] = eqi.Name 7598 } 7599 if eqi.Type != nil { 7600 objectMap["type"] = eqi.Type 7601 } 7602 if eqi.Kind != "" { 7603 objectMap["kind"] = eqi.Kind 7604 } 7605 return json.Marshal(objectMap) 7606} 7607 7608// EntityQueryItemProperties an properties abstract Query item for entity 7609type EntityQueryItemProperties struct { 7610 // DataTypes - Data types for template 7611 DataTypes *[]EntityQueryItemPropertiesDataTypesItem `json:"dataTypes,omitempty"` 7612 // InputEntityType - The type of the entity. Possible values include: 'EntityTypeAccount', 'EntityTypeHost', 'EntityTypeFile', 'EntityTypeAzureResource', 'EntityTypeCloudApplication', 'EntityTypeDNS', 'EntityTypeFileHash', 'EntityTypeIP', 'EntityTypeMalware', 'EntityTypeProcess', 'EntityTypeRegistryKey', 'EntityTypeRegistryValue', 'EntityTypeSecurityGroup', 'EntityTypeURL', 'EntityTypeIoTDevice', 'EntityTypeSecurityAlert', 'EntityTypeHuntingBookmark', 'EntityTypeMailCluster', 'EntityTypeMailMessage', 'EntityTypeMailbox', 'EntityTypeSubmissionMail' 7613 InputEntityType EntityType `json:"inputEntityType,omitempty"` 7614 // RequiredInputFieldsSets - Data types for template 7615 RequiredInputFieldsSets *[][]string `json:"requiredInputFieldsSets,omitempty"` 7616 // EntitiesFilter - The query applied only to entities matching to all filters 7617 EntitiesFilter interface{} `json:"entitiesFilter,omitempty"` 7618} 7619 7620// EntityQueryItemPropertiesDataTypesItem ... 7621type EntityQueryItemPropertiesDataTypesItem struct { 7622 // DataType - Data type name 7623 DataType *string `json:"dataType,omitempty"` 7624} 7625 7626// EntityQueryKind1 describes an Entity query resource with kind. 7627type EntityQueryKind1 struct { 7628 // Kind - The kind of the entity query. Possible values include: 'EntityQueryKindExpansion', 'EntityQueryKindInsight' 7629 Kind EntityQueryKind `json:"kind,omitempty"` 7630} 7631 7632// EntityQueryList list of all the entity queries. 7633type EntityQueryList struct { 7634 autorest.Response `json:"-"` 7635 // NextLink - READ-ONLY; URL to fetch the next set of entity queries. 7636 NextLink *string `json:"nextLink,omitempty"` 7637 // Value - Array of entity queries. 7638 Value *[]BasicEntityQuery `json:"value,omitempty"` 7639} 7640 7641// MarshalJSON is the custom marshaler for EntityQueryList. 7642func (eql EntityQueryList) MarshalJSON() ([]byte, error) { 7643 objectMap := make(map[string]interface{}) 7644 if eql.Value != nil { 7645 objectMap["value"] = eql.Value 7646 } 7647 return json.Marshal(objectMap) 7648} 7649 7650// UnmarshalJSON is the custom unmarshaler for EntityQueryList struct. 7651func (eql *EntityQueryList) UnmarshalJSON(body []byte) error { 7652 var m map[string]*json.RawMessage 7653 err := json.Unmarshal(body, &m) 7654 if err != nil { 7655 return err 7656 } 7657 for k, v := range m { 7658 switch k { 7659 case "nextLink": 7660 if v != nil { 7661 var nextLink string 7662 err = json.Unmarshal(*v, &nextLink) 7663 if err != nil { 7664 return err 7665 } 7666 eql.NextLink = &nextLink 7667 } 7668 case "value": 7669 if v != nil { 7670 value, err := unmarshalBasicEntityQueryArray(*v) 7671 if err != nil { 7672 return err 7673 } 7674 eql.Value = &value 7675 } 7676 } 7677 } 7678 7679 return nil 7680} 7681 7682// EntityQueryListIterator provides access to a complete listing of EntityQuery values. 7683type EntityQueryListIterator struct { 7684 i int 7685 page EntityQueryListPage 7686} 7687 7688// NextWithContext advances to the next value. If there was an error making 7689// the request the iterator does not advance and the error is returned. 7690func (iter *EntityQueryListIterator) NextWithContext(ctx context.Context) (err error) { 7691 if tracing.IsEnabled() { 7692 ctx = tracing.StartSpan(ctx, fqdn+"/EntityQueryListIterator.NextWithContext") 7693 defer func() { 7694 sc := -1 7695 if iter.Response().Response.Response != nil { 7696 sc = iter.Response().Response.Response.StatusCode 7697 } 7698 tracing.EndSpan(ctx, sc, err) 7699 }() 7700 } 7701 iter.i++ 7702 if iter.i < len(iter.page.Values()) { 7703 return nil 7704 } 7705 err = iter.page.NextWithContext(ctx) 7706 if err != nil { 7707 iter.i-- 7708 return err 7709 } 7710 iter.i = 0 7711 return nil 7712} 7713 7714// Next advances to the next value. If there was an error making 7715// the request the iterator does not advance and the error is returned. 7716// Deprecated: Use NextWithContext() instead. 7717func (iter *EntityQueryListIterator) Next() error { 7718 return iter.NextWithContext(context.Background()) 7719} 7720 7721// NotDone returns true if the enumeration should be started or is not yet complete. 7722func (iter EntityQueryListIterator) NotDone() bool { 7723 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 7724} 7725 7726// Response returns the raw server response from the last page request. 7727func (iter EntityQueryListIterator) Response() EntityQueryList { 7728 return iter.page.Response() 7729} 7730 7731// Value returns the current value or a zero-initialized value if the 7732// iterator has advanced beyond the end of the collection. 7733func (iter EntityQueryListIterator) Value() BasicEntityQuery { 7734 if !iter.page.NotDone() { 7735 return EntityQuery{} 7736 } 7737 return iter.page.Values()[iter.i] 7738} 7739 7740// Creates a new instance of the EntityQueryListIterator type. 7741func NewEntityQueryListIterator(page EntityQueryListPage) EntityQueryListIterator { 7742 return EntityQueryListIterator{page: page} 7743} 7744 7745// IsEmpty returns true if the ListResult contains no values. 7746func (eql EntityQueryList) IsEmpty() bool { 7747 return eql.Value == nil || len(*eql.Value) == 0 7748} 7749 7750// hasNextLink returns true if the NextLink is not empty. 7751func (eql EntityQueryList) hasNextLink() bool { 7752 return eql.NextLink != nil && len(*eql.NextLink) != 0 7753} 7754 7755// entityQueryListPreparer prepares a request to retrieve the next set of results. 7756// It returns nil if no more results exist. 7757func (eql EntityQueryList) entityQueryListPreparer(ctx context.Context) (*http.Request, error) { 7758 if !eql.hasNextLink() { 7759 return nil, nil 7760 } 7761 return autorest.Prepare((&http.Request{}).WithContext(ctx), 7762 autorest.AsJSON(), 7763 autorest.AsGet(), 7764 autorest.WithBaseURL(to.String(eql.NextLink))) 7765} 7766 7767// EntityQueryListPage contains a page of BasicEntityQuery values. 7768type EntityQueryListPage struct { 7769 fn func(context.Context, EntityQueryList) (EntityQueryList, error) 7770 eql EntityQueryList 7771} 7772 7773// NextWithContext advances to the next page of values. If there was an error making 7774// the request the page does not advance and the error is returned. 7775func (page *EntityQueryListPage) NextWithContext(ctx context.Context) (err error) { 7776 if tracing.IsEnabled() { 7777 ctx = tracing.StartSpan(ctx, fqdn+"/EntityQueryListPage.NextWithContext") 7778 defer func() { 7779 sc := -1 7780 if page.Response().Response.Response != nil { 7781 sc = page.Response().Response.Response.StatusCode 7782 } 7783 tracing.EndSpan(ctx, sc, err) 7784 }() 7785 } 7786 for { 7787 next, err := page.fn(ctx, page.eql) 7788 if err != nil { 7789 return err 7790 } 7791 page.eql = next 7792 if !next.hasNextLink() || !next.IsEmpty() { 7793 break 7794 } 7795 } 7796 return nil 7797} 7798 7799// Next advances to the next page of values. If there was an error making 7800// the request the page does not advance and the error is returned. 7801// Deprecated: Use NextWithContext() instead. 7802func (page *EntityQueryListPage) Next() error { 7803 return page.NextWithContext(context.Background()) 7804} 7805 7806// NotDone returns true if the page enumeration should be started or is not yet complete. 7807func (page EntityQueryListPage) NotDone() bool { 7808 return !page.eql.IsEmpty() 7809} 7810 7811// Response returns the raw server response from the last page request. 7812func (page EntityQueryListPage) Response() EntityQueryList { 7813 return page.eql 7814} 7815 7816// Values returns the slice of values for the current page or nil if there are no values. 7817func (page EntityQueryListPage) Values() []BasicEntityQuery { 7818 if page.eql.IsEmpty() { 7819 return nil 7820 } 7821 return *page.eql.Value 7822} 7823 7824// Creates a new instance of the EntityQueryListPage type. 7825func NewEntityQueryListPage(cur EntityQueryList, getNextPage func(context.Context, EntityQueryList) (EntityQueryList, error)) EntityQueryListPage { 7826 return EntityQueryListPage{ 7827 fn: getNextPage, 7828 eql: cur, 7829 } 7830} 7831 7832// EntityQueryModel ... 7833type EntityQueryModel struct { 7834 autorest.Response `json:"-"` 7835 Value BasicEntityQuery `json:"value,omitempty"` 7836} 7837 7838// UnmarshalJSON is the custom unmarshaler for EntityQueryModel struct. 7839func (eqm *EntityQueryModel) UnmarshalJSON(body []byte) error { 7840 eq, err := unmarshalBasicEntityQuery(body) 7841 if err != nil { 7842 return err 7843 } 7844 eqm.Value = eq 7845 7846 return nil 7847} 7848 7849// BasicEntityTimelineItem entity timeline Item. 7850type BasicEntityTimelineItem interface { 7851 AsActivityTimelineItem() (*ActivityTimelineItem, bool) 7852 AsSecurityAlertTimelineItem() (*SecurityAlertTimelineItem, bool) 7853 AsBookmarkTimelineItem() (*BookmarkTimelineItem, bool) 7854 AsEntityTimelineItem() (*EntityTimelineItem, bool) 7855} 7856 7857// EntityTimelineItem entity timeline Item. 7858type EntityTimelineItem struct { 7859 // Kind - Possible values include: 'KindBasicEntityTimelineItemKindEntityTimelineItem', 'KindBasicEntityTimelineItemKindActivity', 'KindBasicEntityTimelineItemKindSecurityAlert', 'KindBasicEntityTimelineItemKindBookmark' 7860 Kind KindBasicEntityTimelineItem `json:"kind,omitempty"` 7861} 7862 7863func unmarshalBasicEntityTimelineItem(body []byte) (BasicEntityTimelineItem, error) { 7864 var m map[string]interface{} 7865 err := json.Unmarshal(body, &m) 7866 if err != nil { 7867 return nil, err 7868 } 7869 7870 switch m["kind"] { 7871 case string(KindBasicEntityTimelineItemKindActivity): 7872 var ati ActivityTimelineItem 7873 err := json.Unmarshal(body, &ati) 7874 return ati, err 7875 case string(KindBasicEntityTimelineItemKindSecurityAlert): 7876 var sati SecurityAlertTimelineItem 7877 err := json.Unmarshal(body, &sati) 7878 return sati, err 7879 case string(KindBasicEntityTimelineItemKindBookmark): 7880 var bti BookmarkTimelineItem 7881 err := json.Unmarshal(body, &bti) 7882 return bti, err 7883 default: 7884 var eti EntityTimelineItem 7885 err := json.Unmarshal(body, &eti) 7886 return eti, err 7887 } 7888} 7889func unmarshalBasicEntityTimelineItemArray(body []byte) ([]BasicEntityTimelineItem, error) { 7890 var rawMessages []*json.RawMessage 7891 err := json.Unmarshal(body, &rawMessages) 7892 if err != nil { 7893 return nil, err 7894 } 7895 7896 etiArray := make([]BasicEntityTimelineItem, len(rawMessages)) 7897 7898 for index, rawMessage := range rawMessages { 7899 eti, err := unmarshalBasicEntityTimelineItem(*rawMessage) 7900 if err != nil { 7901 return nil, err 7902 } 7903 etiArray[index] = eti 7904 } 7905 return etiArray, nil 7906} 7907 7908// MarshalJSON is the custom marshaler for EntityTimelineItem. 7909func (eti EntityTimelineItem) MarshalJSON() ([]byte, error) { 7910 eti.Kind = KindBasicEntityTimelineItemKindEntityTimelineItem 7911 objectMap := make(map[string]interface{}) 7912 if eti.Kind != "" { 7913 objectMap["kind"] = eti.Kind 7914 } 7915 return json.Marshal(objectMap) 7916} 7917 7918// AsActivityTimelineItem is the BasicEntityTimelineItem implementation for EntityTimelineItem. 7919func (eti EntityTimelineItem) AsActivityTimelineItem() (*ActivityTimelineItem, bool) { 7920 return nil, false 7921} 7922 7923// AsSecurityAlertTimelineItem is the BasicEntityTimelineItem implementation for EntityTimelineItem. 7924func (eti EntityTimelineItem) AsSecurityAlertTimelineItem() (*SecurityAlertTimelineItem, bool) { 7925 return nil, false 7926} 7927 7928// AsBookmarkTimelineItem is the BasicEntityTimelineItem implementation for EntityTimelineItem. 7929func (eti EntityTimelineItem) AsBookmarkTimelineItem() (*BookmarkTimelineItem, bool) { 7930 return nil, false 7931} 7932 7933// AsEntityTimelineItem is the BasicEntityTimelineItem implementation for EntityTimelineItem. 7934func (eti EntityTimelineItem) AsEntityTimelineItem() (*EntityTimelineItem, bool) { 7935 return &eti, true 7936} 7937 7938// AsBasicEntityTimelineItem is the BasicEntityTimelineItem implementation for EntityTimelineItem. 7939func (eti EntityTimelineItem) AsBasicEntityTimelineItem() (BasicEntityTimelineItem, bool) { 7940 return &eti, true 7941} 7942 7943// EntityTimelineParameters the parameters required to execute s timeline operation on the given entity. 7944type EntityTimelineParameters struct { 7945 // Kinds - Array of timeline Item kinds. 7946 Kinds *[]EntityTimelineKind `json:"kinds,omitempty"` 7947 // StartTime - The start timeline date, so the results returned are after this date. 7948 StartTime *date.Time `json:"startTime,omitempty"` 7949 // EndTime - The end timeline date, so the results returned are before this date. 7950 EndTime *date.Time `json:"endTime,omitempty"` 7951 // NumberOfBucket - The number of bucket for timeline queries aggregation. 7952 NumberOfBucket *int32 `json:"numberOfBucket,omitempty"` 7953} 7954 7955// EntityTimelineResponse the entity timeline result operation response. 7956type EntityTimelineResponse struct { 7957 autorest.Response `json:"-"` 7958 // MetaData - The metadata from the timeline operation results. 7959 MetaData *TimelineResultsMetadata `json:"metaData,omitempty"` 7960 // Value - The timeline result values. 7961 Value *[]BasicEntityTimelineItem `json:"value,omitempty"` 7962} 7963 7964// UnmarshalJSON is the custom unmarshaler for EntityTimelineResponse struct. 7965func (etr *EntityTimelineResponse) UnmarshalJSON(body []byte) error { 7966 var m map[string]*json.RawMessage 7967 err := json.Unmarshal(body, &m) 7968 if err != nil { 7969 return err 7970 } 7971 for k, v := range m { 7972 switch k { 7973 case "metaData": 7974 if v != nil { 7975 var metaData TimelineResultsMetadata 7976 err = json.Unmarshal(*v, &metaData) 7977 if err != nil { 7978 return err 7979 } 7980 etr.MetaData = &metaData 7981 } 7982 case "value": 7983 if v != nil { 7984 value, err := unmarshalBasicEntityTimelineItemArray(*v) 7985 if err != nil { 7986 return err 7987 } 7988 etr.Value = &value 7989 } 7990 } 7991 } 7992 7993 return nil 7994} 7995 7996// EventGroupingSettings event grouping settings property bag. 7997type EventGroupingSettings struct { 7998 // AggregationKind - Possible values include: 'EventGroupingAggregationKindSingleAlert', 'EventGroupingAggregationKindAlertPerResult' 7999 AggregationKind EventGroupingAggregationKind `json:"aggregationKind,omitempty"` 8000} 8001 8002// ExpansionEntityQueriesProperties describes expansion entity query properties 8003type ExpansionEntityQueriesProperties struct { 8004 // DataSources - List of the data sources that are required to run the query 8005 DataSources *[]string `json:"dataSources,omitempty"` 8006 // DisplayName - The query display name 8007 DisplayName *string `json:"displayName,omitempty"` 8008 // InputEntityType - The type of the query's source entity. Possible values include: 'EntityTypeAccount', 'EntityTypeHost', 'EntityTypeFile', 'EntityTypeAzureResource', 'EntityTypeCloudApplication', 'EntityTypeDNS', 'EntityTypeFileHash', 'EntityTypeIP', 'EntityTypeMalware', 'EntityTypeProcess', 'EntityTypeRegistryKey', 'EntityTypeRegistryValue', 'EntityTypeSecurityGroup', 'EntityTypeURL', 'EntityTypeIoTDevice', 'EntityTypeSecurityAlert', 'EntityTypeHuntingBookmark', 'EntityTypeMailCluster', 'EntityTypeMailMessage', 'EntityTypeMailbox', 'EntityTypeSubmissionMail' 8009 InputEntityType EntityType `json:"inputEntityType,omitempty"` 8010 // InputFields - List of the fields of the source entity that are required to run the query 8011 InputFields *[]string `json:"inputFields,omitempty"` 8012 // OutputEntityTypes - List of the desired output types to be constructed from the result 8013 OutputEntityTypes *[]EntityType `json:"outputEntityTypes,omitempty"` 8014 // QueryTemplate - The template query string to be parsed and formatted 8015 QueryTemplate *string `json:"queryTemplate,omitempty"` 8016} 8017 8018// ExpansionEntityQuery represents Expansion entity query. 8019type ExpansionEntityQuery struct { 8020 // ExpansionEntityQueriesProperties - Expansion entity query properties 8021 *ExpansionEntityQueriesProperties `json:"properties,omitempty"` 8022 // ID - READ-ONLY; Azure resource Id 8023 ID *string `json:"id,omitempty"` 8024 // Name - READ-ONLY; Azure resource name 8025 Name *string `json:"name,omitempty"` 8026 // Type - READ-ONLY; Azure resource type 8027 Type *string `json:"type,omitempty"` 8028 // Etag - Etag of the azure resource 8029 Etag *string `json:"etag,omitempty"` 8030 // Kind - Possible values include: 'KindBasicEntityQueryKindEntityQuery', 'KindBasicEntityQueryKindExpansion' 8031 Kind KindBasicEntityQuery `json:"kind,omitempty"` 8032} 8033 8034// MarshalJSON is the custom marshaler for ExpansionEntityQuery. 8035func (eeq ExpansionEntityQuery) MarshalJSON() ([]byte, error) { 8036 eeq.Kind = KindBasicEntityQueryKindExpansion 8037 objectMap := make(map[string]interface{}) 8038 if eeq.ExpansionEntityQueriesProperties != nil { 8039 objectMap["properties"] = eeq.ExpansionEntityQueriesProperties 8040 } 8041 if eeq.Etag != nil { 8042 objectMap["etag"] = eeq.Etag 8043 } 8044 if eeq.Kind != "" { 8045 objectMap["kind"] = eeq.Kind 8046 } 8047 return json.Marshal(objectMap) 8048} 8049 8050// AsExpansionEntityQuery is the BasicEntityQuery implementation for ExpansionEntityQuery. 8051func (eeq ExpansionEntityQuery) AsExpansionEntityQuery() (*ExpansionEntityQuery, bool) { 8052 return &eeq, true 8053} 8054 8055// AsEntityQuery is the BasicEntityQuery implementation for ExpansionEntityQuery. 8056func (eeq ExpansionEntityQuery) AsEntityQuery() (*EntityQuery, bool) { 8057 return nil, false 8058} 8059 8060// AsBasicEntityQuery is the BasicEntityQuery implementation for ExpansionEntityQuery. 8061func (eeq ExpansionEntityQuery) AsBasicEntityQuery() (BasicEntityQuery, bool) { 8062 return &eeq, true 8063} 8064 8065// UnmarshalJSON is the custom unmarshaler for ExpansionEntityQuery struct. 8066func (eeq *ExpansionEntityQuery) UnmarshalJSON(body []byte) error { 8067 var m map[string]*json.RawMessage 8068 err := json.Unmarshal(body, &m) 8069 if err != nil { 8070 return err 8071 } 8072 for k, v := range m { 8073 switch k { 8074 case "properties": 8075 if v != nil { 8076 var expansionEntityQueriesProperties ExpansionEntityQueriesProperties 8077 err = json.Unmarshal(*v, &expansionEntityQueriesProperties) 8078 if err != nil { 8079 return err 8080 } 8081 eeq.ExpansionEntityQueriesProperties = &expansionEntityQueriesProperties 8082 } 8083 case "id": 8084 if v != nil { 8085 var ID string 8086 err = json.Unmarshal(*v, &ID) 8087 if err != nil { 8088 return err 8089 } 8090 eeq.ID = &ID 8091 } 8092 case "name": 8093 if v != nil { 8094 var name string 8095 err = json.Unmarshal(*v, &name) 8096 if err != nil { 8097 return err 8098 } 8099 eeq.Name = &name 8100 } 8101 case "type": 8102 if v != nil { 8103 var typeVar string 8104 err = json.Unmarshal(*v, &typeVar) 8105 if err != nil { 8106 return err 8107 } 8108 eeq.Type = &typeVar 8109 } 8110 case "etag": 8111 if v != nil { 8112 var etag string 8113 err = json.Unmarshal(*v, &etag) 8114 if err != nil { 8115 return err 8116 } 8117 eeq.Etag = &etag 8118 } 8119 case "kind": 8120 if v != nil { 8121 var kind KindBasicEntityQuery 8122 err = json.Unmarshal(*v, &kind) 8123 if err != nil { 8124 return err 8125 } 8126 eeq.Kind = kind 8127 } 8128 } 8129 } 8130 8131 return nil 8132} 8133 8134// ExpansionResultAggregation information of a specific aggregation in the expansion result. 8135type ExpansionResultAggregation struct { 8136 // AggregationType - The common type of the aggregation. (for e.g. entity field name) 8137 AggregationType *string `json:"aggregationType,omitempty"` 8138 // Count - Total number of aggregations of the given kind (and aggregationType if given) in the expansion result. 8139 Count *int32 `json:"count,omitempty"` 8140 // DisplayName - The display name of the aggregation by type. 8141 DisplayName *string `json:"displayName,omitempty"` 8142 // EntityKind - The kind of the aggregated entity. Possible values include: 'EntityKindAccount', 'EntityKindHost', 'EntityKindFile', 'EntityKindAzureResource', 'EntityKindCloudApplication', 'EntityKindDNSResolution', 'EntityKindFileHash', 'EntityKindIP', 'EntityKindMalware', 'EntityKindProcess', 'EntityKindRegistryKey', 'EntityKindRegistryValue', 'EntityKindSecurityGroup', 'EntityKindURL', 'EntityKindIoTDevice', 'EntityKindSecurityAlert', 'EntityKindBookmark', 'EntityKindMailCluster', 'EntityKindMailMessage', 'EntityKindMailbox', 'EntityKindSubmissionMail' 8143 EntityKind EntityKind `json:"entityKind,omitempty"` 8144} 8145 8146// ExpansionResultsMetadata expansion result metadata. 8147type ExpansionResultsMetadata struct { 8148 // Aggregations - Information of the aggregated nodes in the expansion result. 8149 Aggregations *[]ExpansionResultAggregation `json:"aggregations,omitempty"` 8150} 8151 8152// EyesOn settings with single toggle. 8153type EyesOn struct { 8154 // EyesOnSettingsProperties - EyesOn properties 8155 *EyesOnSettingsProperties `json:"properties,omitempty"` 8156 // ID - READ-ONLY; Azure resource Id 8157 ID *string `json:"id,omitempty"` 8158 // Name - READ-ONLY; Azure resource name 8159 Name *string `json:"name,omitempty"` 8160 // Type - READ-ONLY; Azure resource type 8161 Type *string `json:"type,omitempty"` 8162 // Etag - Etag of the azure resource 8163 Etag *string `json:"etag,omitempty"` 8164 // Kind - Possible values include: 'KindBasicSettingsKindSettings', 'KindBasicSettingsKindIPSyncer', 'KindBasicSettingsKindEyesOn', 'KindBasicSettingsKindEntityAnalytics', 'KindBasicSettingsKindUeba' 8165 Kind KindBasicSettings `json:"kind,omitempty"` 8166} 8167 8168// MarshalJSON is the custom marshaler for EyesOn. 8169func (eo EyesOn) MarshalJSON() ([]byte, error) { 8170 eo.Kind = KindBasicSettingsKindEyesOn 8171 objectMap := make(map[string]interface{}) 8172 if eo.EyesOnSettingsProperties != nil { 8173 objectMap["properties"] = eo.EyesOnSettingsProperties 8174 } 8175 if eo.Etag != nil { 8176 objectMap["etag"] = eo.Etag 8177 } 8178 if eo.Kind != "" { 8179 objectMap["kind"] = eo.Kind 8180 } 8181 return json.Marshal(objectMap) 8182} 8183 8184// AsIPSyncer is the BasicSettings implementation for EyesOn. 8185func (eo EyesOn) AsIPSyncer() (*IPSyncer, bool) { 8186 return nil, false 8187} 8188 8189// AsEyesOn is the BasicSettings implementation for EyesOn. 8190func (eo EyesOn) AsEyesOn() (*EyesOn, bool) { 8191 return &eo, true 8192} 8193 8194// AsEntityAnalytics is the BasicSettings implementation for EyesOn. 8195func (eo EyesOn) AsEntityAnalytics() (*EntityAnalytics, bool) { 8196 return nil, false 8197} 8198 8199// AsUeba is the BasicSettings implementation for EyesOn. 8200func (eo EyesOn) AsUeba() (*Ueba, bool) { 8201 return nil, false 8202} 8203 8204// AsSettings is the BasicSettings implementation for EyesOn. 8205func (eo EyesOn) AsSettings() (*Settings, bool) { 8206 return nil, false 8207} 8208 8209// AsBasicSettings is the BasicSettings implementation for EyesOn. 8210func (eo EyesOn) AsBasicSettings() (BasicSettings, bool) { 8211 return &eo, true 8212} 8213 8214// UnmarshalJSON is the custom unmarshaler for EyesOn struct. 8215func (eo *EyesOn) UnmarshalJSON(body []byte) error { 8216 var m map[string]*json.RawMessage 8217 err := json.Unmarshal(body, &m) 8218 if err != nil { 8219 return err 8220 } 8221 for k, v := range m { 8222 switch k { 8223 case "properties": 8224 if v != nil { 8225 var eyesOnSettingsProperties EyesOnSettingsProperties 8226 err = json.Unmarshal(*v, &eyesOnSettingsProperties) 8227 if err != nil { 8228 return err 8229 } 8230 eo.EyesOnSettingsProperties = &eyesOnSettingsProperties 8231 } 8232 case "id": 8233 if v != nil { 8234 var ID string 8235 err = json.Unmarshal(*v, &ID) 8236 if err != nil { 8237 return err 8238 } 8239 eo.ID = &ID 8240 } 8241 case "name": 8242 if v != nil { 8243 var name string 8244 err = json.Unmarshal(*v, &name) 8245 if err != nil { 8246 return err 8247 } 8248 eo.Name = &name 8249 } 8250 case "type": 8251 if v != nil { 8252 var typeVar string 8253 err = json.Unmarshal(*v, &typeVar) 8254 if err != nil { 8255 return err 8256 } 8257 eo.Type = &typeVar 8258 } 8259 case "etag": 8260 if v != nil { 8261 var etag string 8262 err = json.Unmarshal(*v, &etag) 8263 if err != nil { 8264 return err 8265 } 8266 eo.Etag = &etag 8267 } 8268 case "kind": 8269 if v != nil { 8270 var kind KindBasicSettings 8271 err = json.Unmarshal(*v, &kind) 8272 if err != nil { 8273 return err 8274 } 8275 eo.Kind = kind 8276 } 8277 } 8278 } 8279 8280 return nil 8281} 8282 8283// EyesOnSettingsProperties eyesOn property bag. 8284type EyesOnSettingsProperties struct { 8285 // IsEnabled - READ-ONLY; Determines whether the setting is enable or disabled. 8286 IsEnabled *bool `json:"isEnabled,omitempty"` 8287} 8288 8289// MarshalJSON is the custom marshaler for EyesOnSettingsProperties. 8290func (eosp EyesOnSettingsProperties) MarshalJSON() ([]byte, error) { 8291 objectMap := make(map[string]interface{}) 8292 return json.Marshal(objectMap) 8293} 8294 8295// FileEntity represents a file entity. 8296type FileEntity struct { 8297 // FileEntityProperties - File entity properties 8298 *FileEntityProperties `json:"properties,omitempty"` 8299 // ID - READ-ONLY; Azure resource Id 8300 ID *string `json:"id,omitempty"` 8301 // Name - READ-ONLY; Azure resource name 8302 Name *string `json:"name,omitempty"` 8303 // Type - READ-ONLY; Azure resource type 8304 Type *string `json:"type,omitempty"` 8305 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 8306 Kind KindBasicEntity `json:"kind,omitempty"` 8307} 8308 8309// MarshalJSON is the custom marshaler for FileEntity. 8310func (fe FileEntity) MarshalJSON() ([]byte, error) { 8311 fe.Kind = KindBasicEntityKindFile 8312 objectMap := make(map[string]interface{}) 8313 if fe.FileEntityProperties != nil { 8314 objectMap["properties"] = fe.FileEntityProperties 8315 } 8316 if fe.Kind != "" { 8317 objectMap["kind"] = fe.Kind 8318 } 8319 return json.Marshal(objectMap) 8320} 8321 8322// AsAccountEntity is the BasicEntity implementation for FileEntity. 8323func (fe FileEntity) AsAccountEntity() (*AccountEntity, bool) { 8324 return nil, false 8325} 8326 8327// AsAzureResourceEntity is the BasicEntity implementation for FileEntity. 8328func (fe FileEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 8329 return nil, false 8330} 8331 8332// AsCloudApplicationEntity is the BasicEntity implementation for FileEntity. 8333func (fe FileEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 8334 return nil, false 8335} 8336 8337// AsDNSEntity is the BasicEntity implementation for FileEntity. 8338func (fe FileEntity) AsDNSEntity() (*DNSEntity, bool) { 8339 return nil, false 8340} 8341 8342// AsFileEntity is the BasicEntity implementation for FileEntity. 8343func (fe FileEntity) AsFileEntity() (*FileEntity, bool) { 8344 return &fe, true 8345} 8346 8347// AsFileHashEntity is the BasicEntity implementation for FileEntity. 8348func (fe FileEntity) AsFileHashEntity() (*FileHashEntity, bool) { 8349 return nil, false 8350} 8351 8352// AsHostEntity is the BasicEntity implementation for FileEntity. 8353func (fe FileEntity) AsHostEntity() (*HostEntity, bool) { 8354 return nil, false 8355} 8356 8357// AsHuntingBookmark is the BasicEntity implementation for FileEntity. 8358func (fe FileEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 8359 return nil, false 8360} 8361 8362// AsSecurityAlert is the BasicEntity implementation for FileEntity. 8363func (fe FileEntity) AsSecurityAlert() (*SecurityAlert, bool) { 8364 return nil, false 8365} 8366 8367// AsIPEntity is the BasicEntity implementation for FileEntity. 8368func (fe FileEntity) AsIPEntity() (*IPEntity, bool) { 8369 return nil, false 8370} 8371 8372// AsMailboxEntity is the BasicEntity implementation for FileEntity. 8373func (fe FileEntity) AsMailboxEntity() (*MailboxEntity, bool) { 8374 return nil, false 8375} 8376 8377// AsMailClusterEntity is the BasicEntity implementation for FileEntity. 8378func (fe FileEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 8379 return nil, false 8380} 8381 8382// AsMailMessageEntity is the BasicEntity implementation for FileEntity. 8383func (fe FileEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 8384 return nil, false 8385} 8386 8387// AsSubmissionMailEntity is the BasicEntity implementation for FileEntity. 8388func (fe FileEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 8389 return nil, false 8390} 8391 8392// AsMalwareEntity is the BasicEntity implementation for FileEntity. 8393func (fe FileEntity) AsMalwareEntity() (*MalwareEntity, bool) { 8394 return nil, false 8395} 8396 8397// AsProcessEntity is the BasicEntity implementation for FileEntity. 8398func (fe FileEntity) AsProcessEntity() (*ProcessEntity, bool) { 8399 return nil, false 8400} 8401 8402// AsRegistryKeyEntity is the BasicEntity implementation for FileEntity. 8403func (fe FileEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 8404 return nil, false 8405} 8406 8407// AsRegistryValueEntity is the BasicEntity implementation for FileEntity. 8408func (fe FileEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 8409 return nil, false 8410} 8411 8412// AsSecurityGroupEntity is the BasicEntity implementation for FileEntity. 8413func (fe FileEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 8414 return nil, false 8415} 8416 8417// AsURLEntity is the BasicEntity implementation for FileEntity. 8418func (fe FileEntity) AsURLEntity() (*URLEntity, bool) { 8419 return nil, false 8420} 8421 8422// AsIoTDeviceEntity is the BasicEntity implementation for FileEntity. 8423func (fe FileEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 8424 return nil, false 8425} 8426 8427// AsEntity is the BasicEntity implementation for FileEntity. 8428func (fe FileEntity) AsEntity() (*Entity, bool) { 8429 return nil, false 8430} 8431 8432// AsBasicEntity is the BasicEntity implementation for FileEntity. 8433func (fe FileEntity) AsBasicEntity() (BasicEntity, bool) { 8434 return &fe, true 8435} 8436 8437// UnmarshalJSON is the custom unmarshaler for FileEntity struct. 8438func (fe *FileEntity) UnmarshalJSON(body []byte) error { 8439 var m map[string]*json.RawMessage 8440 err := json.Unmarshal(body, &m) 8441 if err != nil { 8442 return err 8443 } 8444 for k, v := range m { 8445 switch k { 8446 case "properties": 8447 if v != nil { 8448 var fileEntityProperties FileEntityProperties 8449 err = json.Unmarshal(*v, &fileEntityProperties) 8450 if err != nil { 8451 return err 8452 } 8453 fe.FileEntityProperties = &fileEntityProperties 8454 } 8455 case "id": 8456 if v != nil { 8457 var ID string 8458 err = json.Unmarshal(*v, &ID) 8459 if err != nil { 8460 return err 8461 } 8462 fe.ID = &ID 8463 } 8464 case "name": 8465 if v != nil { 8466 var name string 8467 err = json.Unmarshal(*v, &name) 8468 if err != nil { 8469 return err 8470 } 8471 fe.Name = &name 8472 } 8473 case "type": 8474 if v != nil { 8475 var typeVar string 8476 err = json.Unmarshal(*v, &typeVar) 8477 if err != nil { 8478 return err 8479 } 8480 fe.Type = &typeVar 8481 } 8482 case "kind": 8483 if v != nil { 8484 var kind KindBasicEntity 8485 err = json.Unmarshal(*v, &kind) 8486 if err != nil { 8487 return err 8488 } 8489 fe.Kind = kind 8490 } 8491 } 8492 } 8493 8494 return nil 8495} 8496 8497// FileEntityProperties file entity property bag. 8498type FileEntityProperties struct { 8499 // Directory - READ-ONLY; The full path to the file. 8500 Directory *string `json:"directory,omitempty"` 8501 // FileHashEntityIds - READ-ONLY; The file hash entity identifiers associated with this file 8502 FileHashEntityIds *[]string `json:"fileHashEntityIds,omitempty"` 8503 // FileName - READ-ONLY; The file name without path (some alerts might not include path). 8504 FileName *string `json:"fileName,omitempty"` 8505 // HostEntityID - READ-ONLY; The Host entity id which the file belongs to 8506 HostEntityID *string `json:"hostEntityId,omitempty"` 8507 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 8508 AdditionalData map[string]interface{} `json:"additionalData"` 8509 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 8510 FriendlyName *string `json:"friendlyName,omitempty"` 8511} 8512 8513// MarshalJSON is the custom marshaler for FileEntityProperties. 8514func (fep FileEntityProperties) MarshalJSON() ([]byte, error) { 8515 objectMap := make(map[string]interface{}) 8516 return json.Marshal(objectMap) 8517} 8518 8519// FileHashEntity represents a file hash entity. 8520type FileHashEntity struct { 8521 // FileHashEntityProperties - FileHash entity properties 8522 *FileHashEntityProperties `json:"properties,omitempty"` 8523 // ID - READ-ONLY; Azure resource Id 8524 ID *string `json:"id,omitempty"` 8525 // Name - READ-ONLY; Azure resource name 8526 Name *string `json:"name,omitempty"` 8527 // Type - READ-ONLY; Azure resource type 8528 Type *string `json:"type,omitempty"` 8529 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 8530 Kind KindBasicEntity `json:"kind,omitempty"` 8531} 8532 8533// MarshalJSON is the custom marshaler for FileHashEntity. 8534func (fhe FileHashEntity) MarshalJSON() ([]byte, error) { 8535 fhe.Kind = KindBasicEntityKindFileHash 8536 objectMap := make(map[string]interface{}) 8537 if fhe.FileHashEntityProperties != nil { 8538 objectMap["properties"] = fhe.FileHashEntityProperties 8539 } 8540 if fhe.Kind != "" { 8541 objectMap["kind"] = fhe.Kind 8542 } 8543 return json.Marshal(objectMap) 8544} 8545 8546// AsAccountEntity is the BasicEntity implementation for FileHashEntity. 8547func (fhe FileHashEntity) AsAccountEntity() (*AccountEntity, bool) { 8548 return nil, false 8549} 8550 8551// AsAzureResourceEntity is the BasicEntity implementation for FileHashEntity. 8552func (fhe FileHashEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 8553 return nil, false 8554} 8555 8556// AsCloudApplicationEntity is the BasicEntity implementation for FileHashEntity. 8557func (fhe FileHashEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 8558 return nil, false 8559} 8560 8561// AsDNSEntity is the BasicEntity implementation for FileHashEntity. 8562func (fhe FileHashEntity) AsDNSEntity() (*DNSEntity, bool) { 8563 return nil, false 8564} 8565 8566// AsFileEntity is the BasicEntity implementation for FileHashEntity. 8567func (fhe FileHashEntity) AsFileEntity() (*FileEntity, bool) { 8568 return nil, false 8569} 8570 8571// AsFileHashEntity is the BasicEntity implementation for FileHashEntity. 8572func (fhe FileHashEntity) AsFileHashEntity() (*FileHashEntity, bool) { 8573 return &fhe, true 8574} 8575 8576// AsHostEntity is the BasicEntity implementation for FileHashEntity. 8577func (fhe FileHashEntity) AsHostEntity() (*HostEntity, bool) { 8578 return nil, false 8579} 8580 8581// AsHuntingBookmark is the BasicEntity implementation for FileHashEntity. 8582func (fhe FileHashEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 8583 return nil, false 8584} 8585 8586// AsSecurityAlert is the BasicEntity implementation for FileHashEntity. 8587func (fhe FileHashEntity) AsSecurityAlert() (*SecurityAlert, bool) { 8588 return nil, false 8589} 8590 8591// AsIPEntity is the BasicEntity implementation for FileHashEntity. 8592func (fhe FileHashEntity) AsIPEntity() (*IPEntity, bool) { 8593 return nil, false 8594} 8595 8596// AsMailboxEntity is the BasicEntity implementation for FileHashEntity. 8597func (fhe FileHashEntity) AsMailboxEntity() (*MailboxEntity, bool) { 8598 return nil, false 8599} 8600 8601// AsMailClusterEntity is the BasicEntity implementation for FileHashEntity. 8602func (fhe FileHashEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 8603 return nil, false 8604} 8605 8606// AsMailMessageEntity is the BasicEntity implementation for FileHashEntity. 8607func (fhe FileHashEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 8608 return nil, false 8609} 8610 8611// AsSubmissionMailEntity is the BasicEntity implementation for FileHashEntity. 8612func (fhe FileHashEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 8613 return nil, false 8614} 8615 8616// AsMalwareEntity is the BasicEntity implementation for FileHashEntity. 8617func (fhe FileHashEntity) AsMalwareEntity() (*MalwareEntity, bool) { 8618 return nil, false 8619} 8620 8621// AsProcessEntity is the BasicEntity implementation for FileHashEntity. 8622func (fhe FileHashEntity) AsProcessEntity() (*ProcessEntity, bool) { 8623 return nil, false 8624} 8625 8626// AsRegistryKeyEntity is the BasicEntity implementation for FileHashEntity. 8627func (fhe FileHashEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 8628 return nil, false 8629} 8630 8631// AsRegistryValueEntity is the BasicEntity implementation for FileHashEntity. 8632func (fhe FileHashEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 8633 return nil, false 8634} 8635 8636// AsSecurityGroupEntity is the BasicEntity implementation for FileHashEntity. 8637func (fhe FileHashEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 8638 return nil, false 8639} 8640 8641// AsURLEntity is the BasicEntity implementation for FileHashEntity. 8642func (fhe FileHashEntity) AsURLEntity() (*URLEntity, bool) { 8643 return nil, false 8644} 8645 8646// AsIoTDeviceEntity is the BasicEntity implementation for FileHashEntity. 8647func (fhe FileHashEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 8648 return nil, false 8649} 8650 8651// AsEntity is the BasicEntity implementation for FileHashEntity. 8652func (fhe FileHashEntity) AsEntity() (*Entity, bool) { 8653 return nil, false 8654} 8655 8656// AsBasicEntity is the BasicEntity implementation for FileHashEntity. 8657func (fhe FileHashEntity) AsBasicEntity() (BasicEntity, bool) { 8658 return &fhe, true 8659} 8660 8661// UnmarshalJSON is the custom unmarshaler for FileHashEntity struct. 8662func (fhe *FileHashEntity) UnmarshalJSON(body []byte) error { 8663 var m map[string]*json.RawMessage 8664 err := json.Unmarshal(body, &m) 8665 if err != nil { 8666 return err 8667 } 8668 for k, v := range m { 8669 switch k { 8670 case "properties": 8671 if v != nil { 8672 var fileHashEntityProperties FileHashEntityProperties 8673 err = json.Unmarshal(*v, &fileHashEntityProperties) 8674 if err != nil { 8675 return err 8676 } 8677 fhe.FileHashEntityProperties = &fileHashEntityProperties 8678 } 8679 case "id": 8680 if v != nil { 8681 var ID string 8682 err = json.Unmarshal(*v, &ID) 8683 if err != nil { 8684 return err 8685 } 8686 fhe.ID = &ID 8687 } 8688 case "name": 8689 if v != nil { 8690 var name string 8691 err = json.Unmarshal(*v, &name) 8692 if err != nil { 8693 return err 8694 } 8695 fhe.Name = &name 8696 } 8697 case "type": 8698 if v != nil { 8699 var typeVar string 8700 err = json.Unmarshal(*v, &typeVar) 8701 if err != nil { 8702 return err 8703 } 8704 fhe.Type = &typeVar 8705 } 8706 case "kind": 8707 if v != nil { 8708 var kind KindBasicEntity 8709 err = json.Unmarshal(*v, &kind) 8710 if err != nil { 8711 return err 8712 } 8713 fhe.Kind = kind 8714 } 8715 } 8716 } 8717 8718 return nil 8719} 8720 8721// FileHashEntityProperties fileHash entity property bag. 8722type FileHashEntityProperties struct { 8723 // Algorithm - READ-ONLY; The hash algorithm type. Possible values include: 'FileHashAlgorithmUnknown', 'FileHashAlgorithmMD5', 'FileHashAlgorithmSHA1', 'FileHashAlgorithmSHA256', 'FileHashAlgorithmSHA256AC' 8724 Algorithm FileHashAlgorithm `json:"algorithm,omitempty"` 8725 // HashValue - READ-ONLY; The file hash value. 8726 HashValue *string `json:"hashValue,omitempty"` 8727 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 8728 AdditionalData map[string]interface{} `json:"additionalData"` 8729 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 8730 FriendlyName *string `json:"friendlyName,omitempty"` 8731} 8732 8733// MarshalJSON is the custom marshaler for FileHashEntityProperties. 8734func (fhep FileHashEntityProperties) MarshalJSON() ([]byte, error) { 8735 objectMap := make(map[string]interface{}) 8736 return json.Marshal(objectMap) 8737} 8738 8739// FusionAlertRule represents Fusion alert rule. 8740type FusionAlertRule struct { 8741 // FusionAlertRuleProperties - Fusion alert rule properties 8742 *FusionAlertRuleProperties `json:"properties,omitempty"` 8743 // ID - READ-ONLY; Azure resource Id 8744 ID *string `json:"id,omitempty"` 8745 // Name - READ-ONLY; Azure resource name 8746 Name *string `json:"name,omitempty"` 8747 // Type - READ-ONLY; Azure resource type 8748 Type *string `json:"type,omitempty"` 8749 // Etag - Etag of the azure resource 8750 Etag *string `json:"etag,omitempty"` 8751 // Kind - Possible values include: 'KindBasicAlertRuleKindAlertRule', 'KindBasicAlertRuleKindMLBehaviorAnalytics', 'KindBasicAlertRuleKindFusion', 'KindBasicAlertRuleKindThreatIntelligence', 'KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleKindScheduled' 8752 Kind KindBasicAlertRule `json:"kind,omitempty"` 8753} 8754 8755// MarshalJSON is the custom marshaler for FusionAlertRule. 8756func (far FusionAlertRule) MarshalJSON() ([]byte, error) { 8757 far.Kind = KindBasicAlertRuleKindFusion 8758 objectMap := make(map[string]interface{}) 8759 if far.FusionAlertRuleProperties != nil { 8760 objectMap["properties"] = far.FusionAlertRuleProperties 8761 } 8762 if far.Etag != nil { 8763 objectMap["etag"] = far.Etag 8764 } 8765 if far.Kind != "" { 8766 objectMap["kind"] = far.Kind 8767 } 8768 return json.Marshal(objectMap) 8769} 8770 8771// AsMLBehaviorAnalyticsAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8772func (far FusionAlertRule) AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) { 8773 return nil, false 8774} 8775 8776// AsFusionAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8777func (far FusionAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 8778 return &far, true 8779} 8780 8781// AsThreatIntelligenceAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8782func (far FusionAlertRule) AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) { 8783 return nil, false 8784} 8785 8786// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8787func (far FusionAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 8788 return nil, false 8789} 8790 8791// AsScheduledAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8792func (far FusionAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 8793 return nil, false 8794} 8795 8796// AsAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8797func (far FusionAlertRule) AsAlertRule() (*AlertRule, bool) { 8798 return nil, false 8799} 8800 8801// AsBasicAlertRule is the BasicAlertRule implementation for FusionAlertRule. 8802func (far FusionAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 8803 return &far, true 8804} 8805 8806// UnmarshalJSON is the custom unmarshaler for FusionAlertRule struct. 8807func (far *FusionAlertRule) UnmarshalJSON(body []byte) error { 8808 var m map[string]*json.RawMessage 8809 err := json.Unmarshal(body, &m) 8810 if err != nil { 8811 return err 8812 } 8813 for k, v := range m { 8814 switch k { 8815 case "properties": 8816 if v != nil { 8817 var fusionAlertRuleProperties FusionAlertRuleProperties 8818 err = json.Unmarshal(*v, &fusionAlertRuleProperties) 8819 if err != nil { 8820 return err 8821 } 8822 far.FusionAlertRuleProperties = &fusionAlertRuleProperties 8823 } 8824 case "id": 8825 if v != nil { 8826 var ID string 8827 err = json.Unmarshal(*v, &ID) 8828 if err != nil { 8829 return err 8830 } 8831 far.ID = &ID 8832 } 8833 case "name": 8834 if v != nil { 8835 var name string 8836 err = json.Unmarshal(*v, &name) 8837 if err != nil { 8838 return err 8839 } 8840 far.Name = &name 8841 } 8842 case "type": 8843 if v != nil { 8844 var typeVar string 8845 err = json.Unmarshal(*v, &typeVar) 8846 if err != nil { 8847 return err 8848 } 8849 far.Type = &typeVar 8850 } 8851 case "etag": 8852 if v != nil { 8853 var etag string 8854 err = json.Unmarshal(*v, &etag) 8855 if err != nil { 8856 return err 8857 } 8858 far.Etag = &etag 8859 } 8860 case "kind": 8861 if v != nil { 8862 var kind KindBasicAlertRule 8863 err = json.Unmarshal(*v, &kind) 8864 if err != nil { 8865 return err 8866 } 8867 far.Kind = kind 8868 } 8869 } 8870 } 8871 8872 return nil 8873} 8874 8875// FusionAlertRuleProperties fusion alert rule base property bag. 8876type FusionAlertRuleProperties struct { 8877 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 8878 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 8879 // Description - READ-ONLY; The description of the alert rule. 8880 Description *string `json:"description,omitempty"` 8881 // DisplayName - READ-ONLY; The display name for alerts created by this alert rule. 8882 DisplayName *string `json:"displayName,omitempty"` 8883 // Enabled - Determines whether this alert rule is enabled or disabled. 8884 Enabled *bool `json:"enabled,omitempty"` 8885 // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified. 8886 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 8887 // Severity - READ-ONLY; The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 8888 Severity AlertSeverity `json:"severity,omitempty"` 8889 // Tactics - READ-ONLY; The tactics of the alert rule 8890 Tactics *[]AttackTactic `json:"tactics,omitempty"` 8891} 8892 8893// MarshalJSON is the custom marshaler for FusionAlertRuleProperties. 8894func (farp FusionAlertRuleProperties) MarshalJSON() ([]byte, error) { 8895 objectMap := make(map[string]interface{}) 8896 if farp.AlertRuleTemplateName != nil { 8897 objectMap["alertRuleTemplateName"] = farp.AlertRuleTemplateName 8898 } 8899 if farp.Enabled != nil { 8900 objectMap["enabled"] = farp.Enabled 8901 } 8902 return json.Marshal(objectMap) 8903} 8904 8905// FusionAlertRuleTemplate represents Fusion alert rule template. 8906type FusionAlertRuleTemplate struct { 8907 // FusionAlertRuleTemplateProperties - Fusion alert rule template properties 8908 *FusionAlertRuleTemplateProperties `json:"properties,omitempty"` 8909 // ID - READ-ONLY; Azure resource Id 8910 ID *string `json:"id,omitempty"` 8911 // Name - READ-ONLY; Azure resource name 8912 Name *string `json:"name,omitempty"` 8913 // Type - READ-ONLY; Azure resource type 8914 Type *string `json:"type,omitempty"` 8915 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindMLBehaviorAnalytics', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindThreatIntelligence', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 8916 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 8917} 8918 8919// MarshalJSON is the custom marshaler for FusionAlertRuleTemplate. 8920func (fart FusionAlertRuleTemplate) MarshalJSON() ([]byte, error) { 8921 fart.Kind = KindBasicAlertRuleTemplateKindFusion 8922 objectMap := make(map[string]interface{}) 8923 if fart.FusionAlertRuleTemplateProperties != nil { 8924 objectMap["properties"] = fart.FusionAlertRuleTemplateProperties 8925 } 8926 if fart.Kind != "" { 8927 objectMap["kind"] = fart.Kind 8928 } 8929 return json.Marshal(objectMap) 8930} 8931 8932// AsMLBehaviorAnalyticsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8933func (fart FusionAlertRuleTemplate) AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) { 8934 return nil, false 8935} 8936 8937// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8938func (fart FusionAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 8939 return &fart, true 8940} 8941 8942// AsThreatIntelligenceAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8943func (fart FusionAlertRuleTemplate) AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) { 8944 return nil, false 8945} 8946 8947// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8948func (fart FusionAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 8949 return nil, false 8950} 8951 8952// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8953func (fart FusionAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 8954 return nil, false 8955} 8956 8957// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8958func (fart FusionAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 8959 return nil, false 8960} 8961 8962// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for FusionAlertRuleTemplate. 8963func (fart FusionAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 8964 return &fart, true 8965} 8966 8967// UnmarshalJSON is the custom unmarshaler for FusionAlertRuleTemplate struct. 8968func (fart *FusionAlertRuleTemplate) UnmarshalJSON(body []byte) error { 8969 var m map[string]*json.RawMessage 8970 err := json.Unmarshal(body, &m) 8971 if err != nil { 8972 return err 8973 } 8974 for k, v := range m { 8975 switch k { 8976 case "properties": 8977 if v != nil { 8978 var fusionAlertRuleTemplateProperties FusionAlertRuleTemplateProperties 8979 err = json.Unmarshal(*v, &fusionAlertRuleTemplateProperties) 8980 if err != nil { 8981 return err 8982 } 8983 fart.FusionAlertRuleTemplateProperties = &fusionAlertRuleTemplateProperties 8984 } 8985 case "id": 8986 if v != nil { 8987 var ID string 8988 err = json.Unmarshal(*v, &ID) 8989 if err != nil { 8990 return err 8991 } 8992 fart.ID = &ID 8993 } 8994 case "name": 8995 if v != nil { 8996 var name string 8997 err = json.Unmarshal(*v, &name) 8998 if err != nil { 8999 return err 9000 } 9001 fart.Name = &name 9002 } 9003 case "type": 9004 if v != nil { 9005 var typeVar string 9006 err = json.Unmarshal(*v, &typeVar) 9007 if err != nil { 9008 return err 9009 } 9010 fart.Type = &typeVar 9011 } 9012 case "kind": 9013 if v != nil { 9014 var kind KindBasicAlertRuleTemplate 9015 err = json.Unmarshal(*v, &kind) 9016 if err != nil { 9017 return err 9018 } 9019 fart.Kind = kind 9020 } 9021 } 9022 } 9023 9024 return nil 9025} 9026 9027// FusionAlertRuleTemplateProperties fusion alert rule template properties 9028type FusionAlertRuleTemplateProperties struct { 9029 // Severity - The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 9030 Severity AlertSeverity `json:"severity,omitempty"` 9031 // Tactics - The tactics of the alert rule template 9032 Tactics *[]AttackTactic `json:"tactics,omitempty"` 9033 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 9034 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 9035 // LastUpdatedDateUTC - READ-ONLY; The last time that this alert rule template has been updated. 9036 LastUpdatedDateUTC *date.Time `json:"lastUpdatedDateUTC,omitempty"` 9037 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 9038 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 9039 // Description - The description of the alert rule template. 9040 Description *string `json:"description,omitempty"` 9041 // DisplayName - The display name for alert rule template. 9042 DisplayName *string `json:"displayName,omitempty"` 9043 // RequiredDataConnectors - The required data sources for this template 9044 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 9045 // Status - The alert rule template status. Possible values include: 'TemplateStatusInstalled', 'TemplateStatusAvailable', 'TemplateStatusNotAvailable' 9046 Status TemplateStatus `json:"status,omitempty"` 9047} 9048 9049// MarshalJSON is the custom marshaler for FusionAlertRuleTemplateProperties. 9050func (fart FusionAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 9051 objectMap := make(map[string]interface{}) 9052 if fart.Severity != "" { 9053 objectMap["severity"] = fart.Severity 9054 } 9055 if fart.Tactics != nil { 9056 objectMap["tactics"] = fart.Tactics 9057 } 9058 if fart.AlertRulesCreatedByTemplateCount != nil { 9059 objectMap["alertRulesCreatedByTemplateCount"] = fart.AlertRulesCreatedByTemplateCount 9060 } 9061 if fart.Description != nil { 9062 objectMap["description"] = fart.Description 9063 } 9064 if fart.DisplayName != nil { 9065 objectMap["displayName"] = fart.DisplayName 9066 } 9067 if fart.RequiredDataConnectors != nil { 9068 objectMap["requiredDataConnectors"] = fart.RequiredDataConnectors 9069 } 9070 if fart.Status != "" { 9071 objectMap["status"] = fart.Status 9072 } 9073 return json.Marshal(objectMap) 9074} 9075 9076// GeoLocation the geo-location context attached to the ip entity 9077type GeoLocation struct { 9078 // Asn - READ-ONLY; Autonomous System Number 9079 Asn *int32 `json:"asn,omitempty"` 9080 // City - READ-ONLY; City name 9081 City *string `json:"city,omitempty"` 9082 // CountryCode - READ-ONLY; The country code according to ISO 3166 format 9083 CountryCode *string `json:"countryCode,omitempty"` 9084 // CountryName - READ-ONLY; Country name according to ISO 3166 Alpha 2: the lowercase of the English Short Name 9085 CountryName *string `json:"countryName,omitempty"` 9086 // Latitude - READ-ONLY; The longitude of the identified location, expressed as a floating point number with range of -180 to 180, with positive numbers representing East and negative numbers representing West. Latitude and longitude are derived from the city or postal code. 9087 Latitude *float64 `json:"latitude,omitempty"` 9088 // Longitude - READ-ONLY; The latitude of the identified location, expressed as a floating point number with range of - 90 to 90, with positive numbers representing North and negative numbers representing South. Latitude and longitude are derived from the city or postal code. 9089 Longitude *float64 `json:"longitude,omitempty"` 9090 // State - READ-ONLY; State name 9091 State *string `json:"state,omitempty"` 9092} 9093 9094// MarshalJSON is the custom marshaler for GeoLocation. 9095func (gl GeoLocation) MarshalJSON() ([]byte, error) { 9096 objectMap := make(map[string]interface{}) 9097 return json.Marshal(objectMap) 9098} 9099 9100// GetInsightsError getInsights Query Errors. 9101type GetInsightsError struct { 9102 // Kind - the query kind 9103 Kind *string `json:"kind,omitempty"` 9104 // QueryID - the query id 9105 QueryID *string `json:"queryId,omitempty"` 9106 // ErrorMessage - the error message 9107 ErrorMessage *string `json:"errorMessage,omitempty"` 9108} 9109 9110// GetInsightsResultsMetadata get Insights result metadata. 9111type GetInsightsResultsMetadata struct { 9112 // TotalCount - the total items found for the insights request 9113 TotalCount *int32 `json:"totalCount,omitempty"` 9114 // Errors - information about the failed queries 9115 Errors *[]GetInsightsError `json:"errors,omitempty"` 9116} 9117 9118// GetQueriesResponse retrieve queries for entity result operation response. 9119type GetQueriesResponse struct { 9120 autorest.Response `json:"-"` 9121 // Value - The query result values. 9122 Value *[]EntityQueryItem `json:"value,omitempty"` 9123} 9124 9125// GroupingConfiguration grouping configuration property bag. 9126type GroupingConfiguration struct { 9127 // Enabled - Grouping enabled 9128 Enabled *bool `json:"enabled,omitempty"` 9129 // ReopenClosedIncident - Re-open closed matching incidents 9130 ReopenClosedIncident *bool `json:"reopenClosedIncident,omitempty"` 9131 // LookbackDuration - Limit the group to alerts created within the lookback duration (in ISO 8601 duration format) 9132 LookbackDuration *string `json:"lookbackDuration,omitempty"` 9133 // EntitiesMatchingMethod - Grouping matching method. Possible values include: 'EntitiesMatchingMethodAll', 'EntitiesMatchingMethodNone', 'EntitiesMatchingMethodCustom' 9134 EntitiesMatchingMethod EntitiesMatchingMethod `json:"entitiesMatchingMethod,omitempty"` 9135 // GroupByEntities - A list of entity types to group by (when entitiesMatchingMethod is Custom) 9136 GroupByEntities *[]GroupingEntityType `json:"groupByEntities,omitempty"` 9137} 9138 9139// HostEntity represents a host entity. 9140type HostEntity struct { 9141 // HostEntityProperties - Host entity properties 9142 *HostEntityProperties `json:"properties,omitempty"` 9143 // ID - READ-ONLY; Azure resource Id 9144 ID *string `json:"id,omitempty"` 9145 // Name - READ-ONLY; Azure resource name 9146 Name *string `json:"name,omitempty"` 9147 // Type - READ-ONLY; Azure resource type 9148 Type *string `json:"type,omitempty"` 9149 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 9150 Kind KindBasicEntity `json:"kind,omitempty"` 9151} 9152 9153// MarshalJSON is the custom marshaler for HostEntity. 9154func (he HostEntity) MarshalJSON() ([]byte, error) { 9155 he.Kind = KindBasicEntityKindHost 9156 objectMap := make(map[string]interface{}) 9157 if he.HostEntityProperties != nil { 9158 objectMap["properties"] = he.HostEntityProperties 9159 } 9160 if he.Kind != "" { 9161 objectMap["kind"] = he.Kind 9162 } 9163 return json.Marshal(objectMap) 9164} 9165 9166// AsAccountEntity is the BasicEntity implementation for HostEntity. 9167func (he HostEntity) AsAccountEntity() (*AccountEntity, bool) { 9168 return nil, false 9169} 9170 9171// AsAzureResourceEntity is the BasicEntity implementation for HostEntity. 9172func (he HostEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 9173 return nil, false 9174} 9175 9176// AsCloudApplicationEntity is the BasicEntity implementation for HostEntity. 9177func (he HostEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 9178 return nil, false 9179} 9180 9181// AsDNSEntity is the BasicEntity implementation for HostEntity. 9182func (he HostEntity) AsDNSEntity() (*DNSEntity, bool) { 9183 return nil, false 9184} 9185 9186// AsFileEntity is the BasicEntity implementation for HostEntity. 9187func (he HostEntity) AsFileEntity() (*FileEntity, bool) { 9188 return nil, false 9189} 9190 9191// AsFileHashEntity is the BasicEntity implementation for HostEntity. 9192func (he HostEntity) AsFileHashEntity() (*FileHashEntity, bool) { 9193 return nil, false 9194} 9195 9196// AsHostEntity is the BasicEntity implementation for HostEntity. 9197func (he HostEntity) AsHostEntity() (*HostEntity, bool) { 9198 return &he, true 9199} 9200 9201// AsHuntingBookmark is the BasicEntity implementation for HostEntity. 9202func (he HostEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 9203 return nil, false 9204} 9205 9206// AsSecurityAlert is the BasicEntity implementation for HostEntity. 9207func (he HostEntity) AsSecurityAlert() (*SecurityAlert, bool) { 9208 return nil, false 9209} 9210 9211// AsIPEntity is the BasicEntity implementation for HostEntity. 9212func (he HostEntity) AsIPEntity() (*IPEntity, bool) { 9213 return nil, false 9214} 9215 9216// AsMailboxEntity is the BasicEntity implementation for HostEntity. 9217func (he HostEntity) AsMailboxEntity() (*MailboxEntity, bool) { 9218 return nil, false 9219} 9220 9221// AsMailClusterEntity is the BasicEntity implementation for HostEntity. 9222func (he HostEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 9223 return nil, false 9224} 9225 9226// AsMailMessageEntity is the BasicEntity implementation for HostEntity. 9227func (he HostEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 9228 return nil, false 9229} 9230 9231// AsSubmissionMailEntity is the BasicEntity implementation for HostEntity. 9232func (he HostEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 9233 return nil, false 9234} 9235 9236// AsMalwareEntity is the BasicEntity implementation for HostEntity. 9237func (he HostEntity) AsMalwareEntity() (*MalwareEntity, bool) { 9238 return nil, false 9239} 9240 9241// AsProcessEntity is the BasicEntity implementation for HostEntity. 9242func (he HostEntity) AsProcessEntity() (*ProcessEntity, bool) { 9243 return nil, false 9244} 9245 9246// AsRegistryKeyEntity is the BasicEntity implementation for HostEntity. 9247func (he HostEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 9248 return nil, false 9249} 9250 9251// AsRegistryValueEntity is the BasicEntity implementation for HostEntity. 9252func (he HostEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 9253 return nil, false 9254} 9255 9256// AsSecurityGroupEntity is the BasicEntity implementation for HostEntity. 9257func (he HostEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 9258 return nil, false 9259} 9260 9261// AsURLEntity is the BasicEntity implementation for HostEntity. 9262func (he HostEntity) AsURLEntity() (*URLEntity, bool) { 9263 return nil, false 9264} 9265 9266// AsIoTDeviceEntity is the BasicEntity implementation for HostEntity. 9267func (he HostEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 9268 return nil, false 9269} 9270 9271// AsEntity is the BasicEntity implementation for HostEntity. 9272func (he HostEntity) AsEntity() (*Entity, bool) { 9273 return nil, false 9274} 9275 9276// AsBasicEntity is the BasicEntity implementation for HostEntity. 9277func (he HostEntity) AsBasicEntity() (BasicEntity, bool) { 9278 return &he, true 9279} 9280 9281// UnmarshalJSON is the custom unmarshaler for HostEntity struct. 9282func (he *HostEntity) UnmarshalJSON(body []byte) error { 9283 var m map[string]*json.RawMessage 9284 err := json.Unmarshal(body, &m) 9285 if err != nil { 9286 return err 9287 } 9288 for k, v := range m { 9289 switch k { 9290 case "properties": 9291 if v != nil { 9292 var hostEntityProperties HostEntityProperties 9293 err = json.Unmarshal(*v, &hostEntityProperties) 9294 if err != nil { 9295 return err 9296 } 9297 he.HostEntityProperties = &hostEntityProperties 9298 } 9299 case "id": 9300 if v != nil { 9301 var ID string 9302 err = json.Unmarshal(*v, &ID) 9303 if err != nil { 9304 return err 9305 } 9306 he.ID = &ID 9307 } 9308 case "name": 9309 if v != nil { 9310 var name string 9311 err = json.Unmarshal(*v, &name) 9312 if err != nil { 9313 return err 9314 } 9315 he.Name = &name 9316 } 9317 case "type": 9318 if v != nil { 9319 var typeVar string 9320 err = json.Unmarshal(*v, &typeVar) 9321 if err != nil { 9322 return err 9323 } 9324 he.Type = &typeVar 9325 } 9326 case "kind": 9327 if v != nil { 9328 var kind KindBasicEntity 9329 err = json.Unmarshal(*v, &kind) 9330 if err != nil { 9331 return err 9332 } 9333 he.Kind = kind 9334 } 9335 } 9336 } 9337 9338 return nil 9339} 9340 9341// HostEntityProperties host entity property bag. 9342type HostEntityProperties struct { 9343 // AzureID - READ-ONLY; The azure resource id of the VM. 9344 AzureID *string `json:"azureID,omitempty"` 9345 // DNSDomain - READ-ONLY; The DNS domain that this host belongs to. Should contain the compete DNS suffix for the domain 9346 DNSDomain *string `json:"dnsDomain,omitempty"` 9347 // HostName - READ-ONLY; The hostname without the domain suffix. 9348 HostName *string `json:"hostName,omitempty"` 9349 // IsDomainJoined - READ-ONLY; Determines whether this host belongs to a domain. 9350 IsDomainJoined *bool `json:"isDomainJoined,omitempty"` 9351 // NetBiosName - READ-ONLY; The host name (pre-windows2000). 9352 NetBiosName *string `json:"netBiosName,omitempty"` 9353 // NtDomain - READ-ONLY; The NT domain that this host belongs to. 9354 NtDomain *string `json:"ntDomain,omitempty"` 9355 // OmsAgentID - READ-ONLY; The OMS agent id, if the host has OMS agent installed. 9356 OmsAgentID *string `json:"omsAgentID,omitempty"` 9357 // OsFamily - The operating system type. Possible values include: 'OSFamilyLinux', 'OSFamilyWindows', 'OSFamilyAndroid', 'OSFamilyIOS', 'OSFamilyUnknown' 9358 OsFamily OSFamily `json:"osFamily,omitempty"` 9359 // OsVersion - READ-ONLY; A free text representation of the operating system. This field is meant to hold specific versions the are more fine grained than OSFamily or future values not supported by OSFamily enumeration 9360 OsVersion *string `json:"osVersion,omitempty"` 9361 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 9362 AdditionalData map[string]interface{} `json:"additionalData"` 9363 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 9364 FriendlyName *string `json:"friendlyName,omitempty"` 9365} 9366 9367// MarshalJSON is the custom marshaler for HostEntityProperties. 9368func (hep HostEntityProperties) MarshalJSON() ([]byte, error) { 9369 objectMap := make(map[string]interface{}) 9370 if hep.OsFamily != "" { 9371 objectMap["osFamily"] = hep.OsFamily 9372 } 9373 return json.Marshal(objectMap) 9374} 9375 9376// HuntingBookmark represents a Hunting bookmark entity. 9377type HuntingBookmark struct { 9378 // HuntingBookmarkProperties - HuntingBookmark entity properties 9379 *HuntingBookmarkProperties `json:"properties,omitempty"` 9380 // ID - READ-ONLY; Azure resource Id 9381 ID *string `json:"id,omitempty"` 9382 // Name - READ-ONLY; Azure resource name 9383 Name *string `json:"name,omitempty"` 9384 // Type - READ-ONLY; Azure resource type 9385 Type *string `json:"type,omitempty"` 9386 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 9387 Kind KindBasicEntity `json:"kind,omitempty"` 9388} 9389 9390// MarshalJSON is the custom marshaler for HuntingBookmark. 9391func (hb HuntingBookmark) MarshalJSON() ([]byte, error) { 9392 hb.Kind = KindBasicEntityKindBookmark 9393 objectMap := make(map[string]interface{}) 9394 if hb.HuntingBookmarkProperties != nil { 9395 objectMap["properties"] = hb.HuntingBookmarkProperties 9396 } 9397 if hb.Kind != "" { 9398 objectMap["kind"] = hb.Kind 9399 } 9400 return json.Marshal(objectMap) 9401} 9402 9403// AsAccountEntity is the BasicEntity implementation for HuntingBookmark. 9404func (hb HuntingBookmark) AsAccountEntity() (*AccountEntity, bool) { 9405 return nil, false 9406} 9407 9408// AsAzureResourceEntity is the BasicEntity implementation for HuntingBookmark. 9409func (hb HuntingBookmark) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 9410 return nil, false 9411} 9412 9413// AsCloudApplicationEntity is the BasicEntity implementation for HuntingBookmark. 9414func (hb HuntingBookmark) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 9415 return nil, false 9416} 9417 9418// AsDNSEntity is the BasicEntity implementation for HuntingBookmark. 9419func (hb HuntingBookmark) AsDNSEntity() (*DNSEntity, bool) { 9420 return nil, false 9421} 9422 9423// AsFileEntity is the BasicEntity implementation for HuntingBookmark. 9424func (hb HuntingBookmark) AsFileEntity() (*FileEntity, bool) { 9425 return nil, false 9426} 9427 9428// AsFileHashEntity is the BasicEntity implementation for HuntingBookmark. 9429func (hb HuntingBookmark) AsFileHashEntity() (*FileHashEntity, bool) { 9430 return nil, false 9431} 9432 9433// AsHostEntity is the BasicEntity implementation for HuntingBookmark. 9434func (hb HuntingBookmark) AsHostEntity() (*HostEntity, bool) { 9435 return nil, false 9436} 9437 9438// AsHuntingBookmark is the BasicEntity implementation for HuntingBookmark. 9439func (hb HuntingBookmark) AsHuntingBookmark() (*HuntingBookmark, bool) { 9440 return &hb, true 9441} 9442 9443// AsSecurityAlert is the BasicEntity implementation for HuntingBookmark. 9444func (hb HuntingBookmark) AsSecurityAlert() (*SecurityAlert, bool) { 9445 return nil, false 9446} 9447 9448// AsIPEntity is the BasicEntity implementation for HuntingBookmark. 9449func (hb HuntingBookmark) AsIPEntity() (*IPEntity, bool) { 9450 return nil, false 9451} 9452 9453// AsMailboxEntity is the BasicEntity implementation for HuntingBookmark. 9454func (hb HuntingBookmark) AsMailboxEntity() (*MailboxEntity, bool) { 9455 return nil, false 9456} 9457 9458// AsMailClusterEntity is the BasicEntity implementation for HuntingBookmark. 9459func (hb HuntingBookmark) AsMailClusterEntity() (*MailClusterEntity, bool) { 9460 return nil, false 9461} 9462 9463// AsMailMessageEntity is the BasicEntity implementation for HuntingBookmark. 9464func (hb HuntingBookmark) AsMailMessageEntity() (*MailMessageEntity, bool) { 9465 return nil, false 9466} 9467 9468// AsSubmissionMailEntity is the BasicEntity implementation for HuntingBookmark. 9469func (hb HuntingBookmark) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 9470 return nil, false 9471} 9472 9473// AsMalwareEntity is the BasicEntity implementation for HuntingBookmark. 9474func (hb HuntingBookmark) AsMalwareEntity() (*MalwareEntity, bool) { 9475 return nil, false 9476} 9477 9478// AsProcessEntity is the BasicEntity implementation for HuntingBookmark. 9479func (hb HuntingBookmark) AsProcessEntity() (*ProcessEntity, bool) { 9480 return nil, false 9481} 9482 9483// AsRegistryKeyEntity is the BasicEntity implementation for HuntingBookmark. 9484func (hb HuntingBookmark) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 9485 return nil, false 9486} 9487 9488// AsRegistryValueEntity is the BasicEntity implementation for HuntingBookmark. 9489func (hb HuntingBookmark) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 9490 return nil, false 9491} 9492 9493// AsSecurityGroupEntity is the BasicEntity implementation for HuntingBookmark. 9494func (hb HuntingBookmark) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 9495 return nil, false 9496} 9497 9498// AsURLEntity is the BasicEntity implementation for HuntingBookmark. 9499func (hb HuntingBookmark) AsURLEntity() (*URLEntity, bool) { 9500 return nil, false 9501} 9502 9503// AsIoTDeviceEntity is the BasicEntity implementation for HuntingBookmark. 9504func (hb HuntingBookmark) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 9505 return nil, false 9506} 9507 9508// AsEntity is the BasicEntity implementation for HuntingBookmark. 9509func (hb HuntingBookmark) AsEntity() (*Entity, bool) { 9510 return nil, false 9511} 9512 9513// AsBasicEntity is the BasicEntity implementation for HuntingBookmark. 9514func (hb HuntingBookmark) AsBasicEntity() (BasicEntity, bool) { 9515 return &hb, true 9516} 9517 9518// UnmarshalJSON is the custom unmarshaler for HuntingBookmark struct. 9519func (hb *HuntingBookmark) UnmarshalJSON(body []byte) error { 9520 var m map[string]*json.RawMessage 9521 err := json.Unmarshal(body, &m) 9522 if err != nil { 9523 return err 9524 } 9525 for k, v := range m { 9526 switch k { 9527 case "properties": 9528 if v != nil { 9529 var huntingBookmarkProperties HuntingBookmarkProperties 9530 err = json.Unmarshal(*v, &huntingBookmarkProperties) 9531 if err != nil { 9532 return err 9533 } 9534 hb.HuntingBookmarkProperties = &huntingBookmarkProperties 9535 } 9536 case "id": 9537 if v != nil { 9538 var ID string 9539 err = json.Unmarshal(*v, &ID) 9540 if err != nil { 9541 return err 9542 } 9543 hb.ID = &ID 9544 } 9545 case "name": 9546 if v != nil { 9547 var name string 9548 err = json.Unmarshal(*v, &name) 9549 if err != nil { 9550 return err 9551 } 9552 hb.Name = &name 9553 } 9554 case "type": 9555 if v != nil { 9556 var typeVar string 9557 err = json.Unmarshal(*v, &typeVar) 9558 if err != nil { 9559 return err 9560 } 9561 hb.Type = &typeVar 9562 } 9563 case "kind": 9564 if v != nil { 9565 var kind KindBasicEntity 9566 err = json.Unmarshal(*v, &kind) 9567 if err != nil { 9568 return err 9569 } 9570 hb.Kind = kind 9571 } 9572 } 9573 } 9574 9575 return nil 9576} 9577 9578// HuntingBookmarkProperties describes bookmark properties 9579type HuntingBookmarkProperties struct { 9580 // Created - The time the bookmark was created 9581 Created *date.Time `json:"created,omitempty"` 9582 // CreatedBy - Describes a user that created the bookmark 9583 CreatedBy *UserInfo `json:"createdBy,omitempty"` 9584 // DisplayName - The display name of the bookmark 9585 DisplayName *string `json:"displayName,omitempty"` 9586 // EventTime - The time of the event 9587 EventTime *date.Time `json:"eventTime,omitempty"` 9588 // Labels - List of labels relevant to this bookmark 9589 Labels *[]string `json:"labels,omitempty"` 9590 // Notes - The notes of the bookmark 9591 Notes *string `json:"notes,omitempty"` 9592 // Query - The query of the bookmark. 9593 Query *string `json:"query,omitempty"` 9594 // QueryResult - The query result of the bookmark. 9595 QueryResult *string `json:"queryResult,omitempty"` 9596 // Updated - The last time the bookmark was updated 9597 Updated *date.Time `json:"updated,omitempty"` 9598 // UpdatedBy - Describes a user that updated the bookmark 9599 UpdatedBy *UserInfo `json:"updatedBy,omitempty"` 9600 // IncidentInfo - Describes an incident that relates to bookmark 9601 IncidentInfo *IncidentInfo `json:"incidentInfo,omitempty"` 9602 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 9603 AdditionalData map[string]interface{} `json:"additionalData"` 9604 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 9605 FriendlyName *string `json:"friendlyName,omitempty"` 9606} 9607 9608// MarshalJSON is the custom marshaler for HuntingBookmarkProperties. 9609func (hbp HuntingBookmarkProperties) MarshalJSON() ([]byte, error) { 9610 objectMap := make(map[string]interface{}) 9611 if hbp.Created != nil { 9612 objectMap["created"] = hbp.Created 9613 } 9614 if hbp.CreatedBy != nil { 9615 objectMap["createdBy"] = hbp.CreatedBy 9616 } 9617 if hbp.DisplayName != nil { 9618 objectMap["displayName"] = hbp.DisplayName 9619 } 9620 if hbp.EventTime != nil { 9621 objectMap["eventTime"] = hbp.EventTime 9622 } 9623 if hbp.Labels != nil { 9624 objectMap["labels"] = hbp.Labels 9625 } 9626 if hbp.Notes != nil { 9627 objectMap["notes"] = hbp.Notes 9628 } 9629 if hbp.Query != nil { 9630 objectMap["query"] = hbp.Query 9631 } 9632 if hbp.QueryResult != nil { 9633 objectMap["queryResult"] = hbp.QueryResult 9634 } 9635 if hbp.Updated != nil { 9636 objectMap["updated"] = hbp.Updated 9637 } 9638 if hbp.UpdatedBy != nil { 9639 objectMap["updatedBy"] = hbp.UpdatedBy 9640 } 9641 if hbp.IncidentInfo != nil { 9642 objectMap["incidentInfo"] = hbp.IncidentInfo 9643 } 9644 return json.Marshal(objectMap) 9645} 9646 9647// Incident represents an incident in Azure Security Insights. 9648type Incident struct { 9649 autorest.Response `json:"-"` 9650 // IncidentProperties - Incident properties 9651 *IncidentProperties `json:"properties,omitempty"` 9652 // ID - READ-ONLY; Azure resource Id 9653 ID *string `json:"id,omitempty"` 9654 // Name - READ-ONLY; Azure resource name 9655 Name *string `json:"name,omitempty"` 9656 // Type - READ-ONLY; Azure resource type 9657 Type *string `json:"type,omitempty"` 9658 // Etag - Etag of the azure resource 9659 Etag *string `json:"etag,omitempty"` 9660} 9661 9662// MarshalJSON is the custom marshaler for Incident. 9663func (i Incident) MarshalJSON() ([]byte, error) { 9664 objectMap := make(map[string]interface{}) 9665 if i.IncidentProperties != nil { 9666 objectMap["properties"] = i.IncidentProperties 9667 } 9668 if i.Etag != nil { 9669 objectMap["etag"] = i.Etag 9670 } 9671 return json.Marshal(objectMap) 9672} 9673 9674// UnmarshalJSON is the custom unmarshaler for Incident struct. 9675func (i *Incident) UnmarshalJSON(body []byte) error { 9676 var m map[string]*json.RawMessage 9677 err := json.Unmarshal(body, &m) 9678 if err != nil { 9679 return err 9680 } 9681 for k, v := range m { 9682 switch k { 9683 case "properties": 9684 if v != nil { 9685 var incidentProperties IncidentProperties 9686 err = json.Unmarshal(*v, &incidentProperties) 9687 if err != nil { 9688 return err 9689 } 9690 i.IncidentProperties = &incidentProperties 9691 } 9692 case "id": 9693 if v != nil { 9694 var ID string 9695 err = json.Unmarshal(*v, &ID) 9696 if err != nil { 9697 return err 9698 } 9699 i.ID = &ID 9700 } 9701 case "name": 9702 if v != nil { 9703 var name string 9704 err = json.Unmarshal(*v, &name) 9705 if err != nil { 9706 return err 9707 } 9708 i.Name = &name 9709 } 9710 case "type": 9711 if v != nil { 9712 var typeVar string 9713 err = json.Unmarshal(*v, &typeVar) 9714 if err != nil { 9715 return err 9716 } 9717 i.Type = &typeVar 9718 } 9719 case "etag": 9720 if v != nil { 9721 var etag string 9722 err = json.Unmarshal(*v, &etag) 9723 if err != nil { 9724 return err 9725 } 9726 i.Etag = &etag 9727 } 9728 } 9729 } 9730 9731 return nil 9732} 9733 9734// IncidentAdditionalData incident additional data property bag. 9735type IncidentAdditionalData struct { 9736 // AlertsCount - READ-ONLY; The number of alerts in the incident 9737 AlertsCount *int32 `json:"alertsCount,omitempty"` 9738 // BookmarksCount - READ-ONLY; The number of bookmarks in the incident 9739 BookmarksCount *int32 `json:"bookmarksCount,omitempty"` 9740 // CommentsCount - READ-ONLY; The number of comments in the incident 9741 CommentsCount *int32 `json:"commentsCount,omitempty"` 9742 // AlertProductNames - READ-ONLY; List of product names of alerts in the incident 9743 AlertProductNames *[]string `json:"alertProductNames,omitempty"` 9744 // Tactics - READ-ONLY; The tactics associated with incident 9745 Tactics *[]AttackTactic `json:"tactics,omitempty"` 9746} 9747 9748// MarshalJSON is the custom marshaler for IncidentAdditionalData. 9749func (iad IncidentAdditionalData) MarshalJSON() ([]byte, error) { 9750 objectMap := make(map[string]interface{}) 9751 return json.Marshal(objectMap) 9752} 9753 9754// IncidentAlertList list of incident alerts. 9755type IncidentAlertList struct { 9756 autorest.Response `json:"-"` 9757 // Value - Array of incident alerts. 9758 Value *[]SecurityAlert `json:"value,omitempty"` 9759} 9760 9761// IncidentBookmarkList list of incident bookmarks. 9762type IncidentBookmarkList struct { 9763 autorest.Response `json:"-"` 9764 // Value - Array of incident bookmarks. 9765 Value *[]HuntingBookmark `json:"value,omitempty"` 9766} 9767 9768// IncidentComment represents an incident comment 9769type IncidentComment struct { 9770 autorest.Response `json:"-"` 9771 // IncidentCommentProperties - Incident comment properties 9772 *IncidentCommentProperties `json:"properties,omitempty"` 9773 // ID - READ-ONLY; Azure resource Id 9774 ID *string `json:"id,omitempty"` 9775 // Name - READ-ONLY; Azure resource name 9776 Name *string `json:"name,omitempty"` 9777 // Type - READ-ONLY; Azure resource type 9778 Type *string `json:"type,omitempty"` 9779 // Etag - Etag of the azure resource 9780 Etag *string `json:"etag,omitempty"` 9781} 9782 9783// MarshalJSON is the custom marshaler for IncidentComment. 9784func (ic IncidentComment) MarshalJSON() ([]byte, error) { 9785 objectMap := make(map[string]interface{}) 9786 if ic.IncidentCommentProperties != nil { 9787 objectMap["properties"] = ic.IncidentCommentProperties 9788 } 9789 if ic.Etag != nil { 9790 objectMap["etag"] = ic.Etag 9791 } 9792 return json.Marshal(objectMap) 9793} 9794 9795// UnmarshalJSON is the custom unmarshaler for IncidentComment struct. 9796func (ic *IncidentComment) UnmarshalJSON(body []byte) error { 9797 var m map[string]*json.RawMessage 9798 err := json.Unmarshal(body, &m) 9799 if err != nil { 9800 return err 9801 } 9802 for k, v := range m { 9803 switch k { 9804 case "properties": 9805 if v != nil { 9806 var incidentCommentProperties IncidentCommentProperties 9807 err = json.Unmarshal(*v, &incidentCommentProperties) 9808 if err != nil { 9809 return err 9810 } 9811 ic.IncidentCommentProperties = &incidentCommentProperties 9812 } 9813 case "id": 9814 if v != nil { 9815 var ID string 9816 err = json.Unmarshal(*v, &ID) 9817 if err != nil { 9818 return err 9819 } 9820 ic.ID = &ID 9821 } 9822 case "name": 9823 if v != nil { 9824 var name string 9825 err = json.Unmarshal(*v, &name) 9826 if err != nil { 9827 return err 9828 } 9829 ic.Name = &name 9830 } 9831 case "type": 9832 if v != nil { 9833 var typeVar string 9834 err = json.Unmarshal(*v, &typeVar) 9835 if err != nil { 9836 return err 9837 } 9838 ic.Type = &typeVar 9839 } 9840 case "etag": 9841 if v != nil { 9842 var etag string 9843 err = json.Unmarshal(*v, &etag) 9844 if err != nil { 9845 return err 9846 } 9847 ic.Etag = &etag 9848 } 9849 } 9850 } 9851 9852 return nil 9853} 9854 9855// IncidentCommentList list of incident comments. 9856type IncidentCommentList struct { 9857 autorest.Response `json:"-"` 9858 // NextLink - READ-ONLY; URL to fetch the next set of comments. 9859 NextLink *string `json:"nextLink,omitempty"` 9860 // Value - Array of comments. 9861 Value *[]IncidentComment `json:"value,omitempty"` 9862} 9863 9864// MarshalJSON is the custom marshaler for IncidentCommentList. 9865func (icl IncidentCommentList) MarshalJSON() ([]byte, error) { 9866 objectMap := make(map[string]interface{}) 9867 if icl.Value != nil { 9868 objectMap["value"] = icl.Value 9869 } 9870 return json.Marshal(objectMap) 9871} 9872 9873// IncidentCommentListIterator provides access to a complete listing of IncidentComment values. 9874type IncidentCommentListIterator struct { 9875 i int 9876 page IncidentCommentListPage 9877} 9878 9879// NextWithContext advances to the next value. If there was an error making 9880// the request the iterator does not advance and the error is returned. 9881func (iter *IncidentCommentListIterator) NextWithContext(ctx context.Context) (err error) { 9882 if tracing.IsEnabled() { 9883 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentCommentListIterator.NextWithContext") 9884 defer func() { 9885 sc := -1 9886 if iter.Response().Response.Response != nil { 9887 sc = iter.Response().Response.Response.StatusCode 9888 } 9889 tracing.EndSpan(ctx, sc, err) 9890 }() 9891 } 9892 iter.i++ 9893 if iter.i < len(iter.page.Values()) { 9894 return nil 9895 } 9896 err = iter.page.NextWithContext(ctx) 9897 if err != nil { 9898 iter.i-- 9899 return err 9900 } 9901 iter.i = 0 9902 return nil 9903} 9904 9905// Next advances to the next value. If there was an error making 9906// the request the iterator does not advance and the error is returned. 9907// Deprecated: Use NextWithContext() instead. 9908func (iter *IncidentCommentListIterator) Next() error { 9909 return iter.NextWithContext(context.Background()) 9910} 9911 9912// NotDone returns true if the enumeration should be started or is not yet complete. 9913func (iter IncidentCommentListIterator) NotDone() bool { 9914 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 9915} 9916 9917// Response returns the raw server response from the last page request. 9918func (iter IncidentCommentListIterator) Response() IncidentCommentList { 9919 return iter.page.Response() 9920} 9921 9922// Value returns the current value or a zero-initialized value if the 9923// iterator has advanced beyond the end of the collection. 9924func (iter IncidentCommentListIterator) Value() IncidentComment { 9925 if !iter.page.NotDone() { 9926 return IncidentComment{} 9927 } 9928 return iter.page.Values()[iter.i] 9929} 9930 9931// Creates a new instance of the IncidentCommentListIterator type. 9932func NewIncidentCommentListIterator(page IncidentCommentListPage) IncidentCommentListIterator { 9933 return IncidentCommentListIterator{page: page} 9934} 9935 9936// IsEmpty returns true if the ListResult contains no values. 9937func (icl IncidentCommentList) IsEmpty() bool { 9938 return icl.Value == nil || len(*icl.Value) == 0 9939} 9940 9941// hasNextLink returns true if the NextLink is not empty. 9942func (icl IncidentCommentList) hasNextLink() bool { 9943 return icl.NextLink != nil && len(*icl.NextLink) != 0 9944} 9945 9946// incidentCommentListPreparer prepares a request to retrieve the next set of results. 9947// It returns nil if no more results exist. 9948func (icl IncidentCommentList) incidentCommentListPreparer(ctx context.Context) (*http.Request, error) { 9949 if !icl.hasNextLink() { 9950 return nil, nil 9951 } 9952 return autorest.Prepare((&http.Request{}).WithContext(ctx), 9953 autorest.AsJSON(), 9954 autorest.AsGet(), 9955 autorest.WithBaseURL(to.String(icl.NextLink))) 9956} 9957 9958// IncidentCommentListPage contains a page of IncidentComment values. 9959type IncidentCommentListPage struct { 9960 fn func(context.Context, IncidentCommentList) (IncidentCommentList, error) 9961 icl IncidentCommentList 9962} 9963 9964// NextWithContext advances to the next page of values. If there was an error making 9965// the request the page does not advance and the error is returned. 9966func (page *IncidentCommentListPage) NextWithContext(ctx context.Context) (err error) { 9967 if tracing.IsEnabled() { 9968 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentCommentListPage.NextWithContext") 9969 defer func() { 9970 sc := -1 9971 if page.Response().Response.Response != nil { 9972 sc = page.Response().Response.Response.StatusCode 9973 } 9974 tracing.EndSpan(ctx, sc, err) 9975 }() 9976 } 9977 for { 9978 next, err := page.fn(ctx, page.icl) 9979 if err != nil { 9980 return err 9981 } 9982 page.icl = next 9983 if !next.hasNextLink() || !next.IsEmpty() { 9984 break 9985 } 9986 } 9987 return nil 9988} 9989 9990// Next advances to the next page of values. If there was an error making 9991// the request the page does not advance and the error is returned. 9992// Deprecated: Use NextWithContext() instead. 9993func (page *IncidentCommentListPage) Next() error { 9994 return page.NextWithContext(context.Background()) 9995} 9996 9997// NotDone returns true if the page enumeration should be started or is not yet complete. 9998func (page IncidentCommentListPage) NotDone() bool { 9999 return !page.icl.IsEmpty() 10000} 10001 10002// Response returns the raw server response from the last page request. 10003func (page IncidentCommentListPage) Response() IncidentCommentList { 10004 return page.icl 10005} 10006 10007// Values returns the slice of values for the current page or nil if there are no values. 10008func (page IncidentCommentListPage) Values() []IncidentComment { 10009 if page.icl.IsEmpty() { 10010 return nil 10011 } 10012 return *page.icl.Value 10013} 10014 10015// Creates a new instance of the IncidentCommentListPage type. 10016func NewIncidentCommentListPage(cur IncidentCommentList, getNextPage func(context.Context, IncidentCommentList) (IncidentCommentList, error)) IncidentCommentListPage { 10017 return IncidentCommentListPage{ 10018 fn: getNextPage, 10019 icl: cur, 10020 } 10021} 10022 10023// IncidentCommentProperties incident comment property bag. 10024type IncidentCommentProperties struct { 10025 // CreatedTimeUtc - READ-ONLY; The time the comment was created 10026 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 10027 // LastModifiedTimeUtc - READ-ONLY; The time the comment was updated 10028 LastModifiedTimeUtc *date.Time `json:"lastModifiedTimeUtc,omitempty"` 10029 // Message - The comment message 10030 Message *string `json:"message,omitempty"` 10031 // Author - READ-ONLY; Describes the client that created the comment 10032 Author *ClientInfo `json:"author,omitempty"` 10033} 10034 10035// MarshalJSON is the custom marshaler for IncidentCommentProperties. 10036func (icp IncidentCommentProperties) MarshalJSON() ([]byte, error) { 10037 objectMap := make(map[string]interface{}) 10038 if icp.Message != nil { 10039 objectMap["message"] = icp.Message 10040 } 10041 return json.Marshal(objectMap) 10042} 10043 10044// IncidentConfiguration incident Configuration property bag. 10045type IncidentConfiguration struct { 10046 // CreateIncident - Create incidents from alerts triggered by this analytics rule 10047 CreateIncident *bool `json:"createIncident,omitempty"` 10048 // GroupingConfiguration - Set how the alerts that are triggered by this analytics rule, are grouped into incidents 10049 GroupingConfiguration *GroupingConfiguration `json:"groupingConfiguration,omitempty"` 10050} 10051 10052// IncidentEntitiesResponse the incident related entities response. 10053type IncidentEntitiesResponse struct { 10054 autorest.Response `json:"-"` 10055 // Entities - Array of the incident related entities. 10056 Entities *[]BasicEntity `json:"entities,omitempty"` 10057 // MetaData - The metadata from the incident related entities results. 10058 MetaData *[]IncidentEntitiesResultsMetadata `json:"metaData,omitempty"` 10059} 10060 10061// UnmarshalJSON is the custom unmarshaler for IncidentEntitiesResponse struct. 10062func (ier *IncidentEntitiesResponse) UnmarshalJSON(body []byte) error { 10063 var m map[string]*json.RawMessage 10064 err := json.Unmarshal(body, &m) 10065 if err != nil { 10066 return err 10067 } 10068 for k, v := range m { 10069 switch k { 10070 case "entities": 10071 if v != nil { 10072 entities, err := unmarshalBasicEntityArray(*v) 10073 if err != nil { 10074 return err 10075 } 10076 ier.Entities = &entities 10077 } 10078 case "metaData": 10079 if v != nil { 10080 var metaData []IncidentEntitiesResultsMetadata 10081 err = json.Unmarshal(*v, &metaData) 10082 if err != nil { 10083 return err 10084 } 10085 ier.MetaData = &metaData 10086 } 10087 } 10088 } 10089 10090 return nil 10091} 10092 10093// IncidentEntitiesResultsMetadata information of a specific aggregation in the incident related entities 10094// result. 10095type IncidentEntitiesResultsMetadata struct { 10096 // Count - Total number of aggregations of the given kind in the incident related entities result. 10097 Count *int32 `json:"count,omitempty"` 10098 // EntityKind - The kind of the aggregated entity. Possible values include: 'EntityKindAccount', 'EntityKindHost', 'EntityKindFile', 'EntityKindAzureResource', 'EntityKindCloudApplication', 'EntityKindDNSResolution', 'EntityKindFileHash', 'EntityKindIP', 'EntityKindMalware', 'EntityKindProcess', 'EntityKindRegistryKey', 'EntityKindRegistryValue', 'EntityKindSecurityGroup', 'EntityKindURL', 'EntityKindIoTDevice', 'EntityKindSecurityAlert', 'EntityKindBookmark', 'EntityKindMailCluster', 'EntityKindMailMessage', 'EntityKindMailbox', 'EntityKindSubmissionMail' 10099 EntityKind EntityKind `json:"entityKind,omitempty"` 10100} 10101 10102// IncidentInfo describes related incident information for the bookmark 10103type IncidentInfo struct { 10104 // IncidentID - Incident Id 10105 IncidentID *string `json:"incidentId,omitempty"` 10106 // Severity - The severity of the incident. Possible values include: 'CaseSeverityCritical', 'CaseSeverityHigh', 'CaseSeverityMedium', 'CaseSeverityLow', 'CaseSeverityInformational' 10107 Severity CaseSeverity `json:"severity,omitempty"` 10108 // Title - The title of the incident 10109 Title *string `json:"title,omitempty"` 10110 // RelationName - Relation Name 10111 RelationName *string `json:"relationName,omitempty"` 10112} 10113 10114// IncidentLabel represents an incident label 10115type IncidentLabel struct { 10116 // LabelName - The name of the label 10117 LabelName *string `json:"labelName,omitempty"` 10118 // LabelType - READ-ONLY; The type of the label. Possible values include: 'IncidentLabelTypeUser', 'IncidentLabelTypeSystem' 10119 LabelType IncidentLabelType `json:"labelType,omitempty"` 10120} 10121 10122// MarshalJSON is the custom marshaler for IncidentLabel. 10123func (il IncidentLabel) MarshalJSON() ([]byte, error) { 10124 objectMap := make(map[string]interface{}) 10125 if il.LabelName != nil { 10126 objectMap["labelName"] = il.LabelName 10127 } 10128 return json.Marshal(objectMap) 10129} 10130 10131// IncidentList list all the incidents. 10132type IncidentList struct { 10133 autorest.Response `json:"-"` 10134 // NextLink - READ-ONLY; URL to fetch the next set of incidents. 10135 NextLink *string `json:"nextLink,omitempty"` 10136 // Value - Array of incidents. 10137 Value *[]Incident `json:"value,omitempty"` 10138} 10139 10140// MarshalJSON is the custom marshaler for IncidentList. 10141func (il IncidentList) MarshalJSON() ([]byte, error) { 10142 objectMap := make(map[string]interface{}) 10143 if il.Value != nil { 10144 objectMap["value"] = il.Value 10145 } 10146 return json.Marshal(objectMap) 10147} 10148 10149// IncidentListIterator provides access to a complete listing of Incident values. 10150type IncidentListIterator struct { 10151 i int 10152 page IncidentListPage 10153} 10154 10155// NextWithContext advances to the next value. If there was an error making 10156// the request the iterator does not advance and the error is returned. 10157func (iter *IncidentListIterator) NextWithContext(ctx context.Context) (err error) { 10158 if tracing.IsEnabled() { 10159 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentListIterator.NextWithContext") 10160 defer func() { 10161 sc := -1 10162 if iter.Response().Response.Response != nil { 10163 sc = iter.Response().Response.Response.StatusCode 10164 } 10165 tracing.EndSpan(ctx, sc, err) 10166 }() 10167 } 10168 iter.i++ 10169 if iter.i < len(iter.page.Values()) { 10170 return nil 10171 } 10172 err = iter.page.NextWithContext(ctx) 10173 if err != nil { 10174 iter.i-- 10175 return err 10176 } 10177 iter.i = 0 10178 return nil 10179} 10180 10181// Next advances to the next value. If there was an error making 10182// the request the iterator does not advance and the error is returned. 10183// Deprecated: Use NextWithContext() instead. 10184func (iter *IncidentListIterator) Next() error { 10185 return iter.NextWithContext(context.Background()) 10186} 10187 10188// NotDone returns true if the enumeration should be started or is not yet complete. 10189func (iter IncidentListIterator) NotDone() bool { 10190 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 10191} 10192 10193// Response returns the raw server response from the last page request. 10194func (iter IncidentListIterator) Response() IncidentList { 10195 return iter.page.Response() 10196} 10197 10198// Value returns the current value or a zero-initialized value if the 10199// iterator has advanced beyond the end of the collection. 10200func (iter IncidentListIterator) Value() Incident { 10201 if !iter.page.NotDone() { 10202 return Incident{} 10203 } 10204 return iter.page.Values()[iter.i] 10205} 10206 10207// Creates a new instance of the IncidentListIterator type. 10208func NewIncidentListIterator(page IncidentListPage) IncidentListIterator { 10209 return IncidentListIterator{page: page} 10210} 10211 10212// IsEmpty returns true if the ListResult contains no values. 10213func (il IncidentList) IsEmpty() bool { 10214 return il.Value == nil || len(*il.Value) == 0 10215} 10216 10217// hasNextLink returns true if the NextLink is not empty. 10218func (il IncidentList) hasNextLink() bool { 10219 return il.NextLink != nil && len(*il.NextLink) != 0 10220} 10221 10222// incidentListPreparer prepares a request to retrieve the next set of results. 10223// It returns nil if no more results exist. 10224func (il IncidentList) incidentListPreparer(ctx context.Context) (*http.Request, error) { 10225 if !il.hasNextLink() { 10226 return nil, nil 10227 } 10228 return autorest.Prepare((&http.Request{}).WithContext(ctx), 10229 autorest.AsJSON(), 10230 autorest.AsGet(), 10231 autorest.WithBaseURL(to.String(il.NextLink))) 10232} 10233 10234// IncidentListPage contains a page of Incident values. 10235type IncidentListPage struct { 10236 fn func(context.Context, IncidentList) (IncidentList, error) 10237 il IncidentList 10238} 10239 10240// NextWithContext advances to the next page of values. If there was an error making 10241// the request the page does not advance and the error is returned. 10242func (page *IncidentListPage) NextWithContext(ctx context.Context) (err error) { 10243 if tracing.IsEnabled() { 10244 ctx = tracing.StartSpan(ctx, fqdn+"/IncidentListPage.NextWithContext") 10245 defer func() { 10246 sc := -1 10247 if page.Response().Response.Response != nil { 10248 sc = page.Response().Response.Response.StatusCode 10249 } 10250 tracing.EndSpan(ctx, sc, err) 10251 }() 10252 } 10253 for { 10254 next, err := page.fn(ctx, page.il) 10255 if err != nil { 10256 return err 10257 } 10258 page.il = next 10259 if !next.hasNextLink() || !next.IsEmpty() { 10260 break 10261 } 10262 } 10263 return nil 10264} 10265 10266// Next advances to the next page of values. If there was an error making 10267// the request the page does not advance and the error is returned. 10268// Deprecated: Use NextWithContext() instead. 10269func (page *IncidentListPage) Next() error { 10270 return page.NextWithContext(context.Background()) 10271} 10272 10273// NotDone returns true if the page enumeration should be started or is not yet complete. 10274func (page IncidentListPage) NotDone() bool { 10275 return !page.il.IsEmpty() 10276} 10277 10278// Response returns the raw server response from the last page request. 10279func (page IncidentListPage) Response() IncidentList { 10280 return page.il 10281} 10282 10283// Values returns the slice of values for the current page or nil if there are no values. 10284func (page IncidentListPage) Values() []Incident { 10285 if page.il.IsEmpty() { 10286 return nil 10287 } 10288 return *page.il.Value 10289} 10290 10291// Creates a new instance of the IncidentListPage type. 10292func NewIncidentListPage(cur IncidentList, getNextPage func(context.Context, IncidentList) (IncidentList, error)) IncidentListPage { 10293 return IncidentListPage{ 10294 fn: getNextPage, 10295 il: cur, 10296 } 10297} 10298 10299// IncidentOwnerInfo information on the user an incident is assigned to 10300type IncidentOwnerInfo struct { 10301 // Email - The email of the user the incident is assigned to. 10302 Email *string `json:"email,omitempty"` 10303 // AssignedTo - The name of the user the incident is assigned to. 10304 AssignedTo *string `json:"assignedTo,omitempty"` 10305 // ObjectID - The object id of the user the incident is assigned to. 10306 ObjectID *uuid.UUID `json:"objectId,omitempty"` 10307 // UserPrincipalName - The user principal name of the user the incident is assigned to. 10308 UserPrincipalName *string `json:"userPrincipalName,omitempty"` 10309} 10310 10311// IncidentProperties describes incident properties 10312type IncidentProperties struct { 10313 // AdditionalData - READ-ONLY; Additional data on the incident 10314 AdditionalData *IncidentAdditionalData `json:"additionalData,omitempty"` 10315 // Classification - The reason the incident was closed. Possible values include: 'IncidentClassificationUndetermined', 'IncidentClassificationTruePositive', 'IncidentClassificationBenignPositive', 'IncidentClassificationFalsePositive' 10316 Classification IncidentClassification `json:"classification,omitempty"` 10317 // ClassificationComment - Describes the reason the incident was closed 10318 ClassificationComment *string `json:"classificationComment,omitempty"` 10319 // ClassificationReason - The classification reason the incident was closed with. Possible values include: 'IncidentClassificationReasonSuspiciousActivity', 'IncidentClassificationReasonSuspiciousButExpected', 'IncidentClassificationReasonIncorrectAlertLogic', 'IncidentClassificationReasonInaccurateData' 10320 ClassificationReason IncidentClassificationReason `json:"classificationReason,omitempty"` 10321 // CreatedTimeUtc - READ-ONLY; The time the incident was created 10322 CreatedTimeUtc *date.Time `json:"createdTimeUtc,omitempty"` 10323 // Description - The description of the incident 10324 Description *string `json:"description,omitempty"` 10325 // FirstActivityTimeUtc - The time of the first activity in the incident 10326 FirstActivityTimeUtc *date.Time `json:"firstActivityTimeUtc,omitempty"` 10327 // IncidentURL - READ-ONLY; The deep-link url to the incident in Azure portal 10328 IncidentURL *string `json:"incidentUrl,omitempty"` 10329 // IncidentNumber - READ-ONLY; A sequential number 10330 IncidentNumber *int32 `json:"incidentNumber,omitempty"` 10331 // Labels - List of labels relevant to this incident 10332 Labels *[]IncidentLabel `json:"labels,omitempty"` 10333 // ProviderName - The name of the source provider that generated the incident 10334 ProviderName *string `json:"providerName,omitempty"` 10335 // ProviderIncidentID - The incident ID assigned by the incident provider 10336 ProviderIncidentID *string `json:"providerIncidentId,omitempty"` 10337 // LastActivityTimeUtc - The time of the last activity in the incident 10338 LastActivityTimeUtc *date.Time `json:"lastActivityTimeUtc,omitempty"` 10339 // LastModifiedTimeUtc - READ-ONLY; The last time the incident was updated 10340 LastModifiedTimeUtc *date.Time `json:"lastModifiedTimeUtc,omitempty"` 10341 // Owner - Describes a user that the incident is assigned to 10342 Owner *IncidentOwnerInfo `json:"owner,omitempty"` 10343 // RelatedAnalyticRuleIds - READ-ONLY; List of resource ids of Analytic rules related to the incident 10344 RelatedAnalyticRuleIds *[]string `json:"relatedAnalyticRuleIds,omitempty"` 10345 // Severity - The severity of the incident. Possible values include: 'IncidentSeverityHigh', 'IncidentSeverityMedium', 'IncidentSeverityLow', 'IncidentSeverityInformational' 10346 Severity IncidentSeverity `json:"severity,omitempty"` 10347 // Status - The status of the incident. Possible values include: 'IncidentStatusNew', 'IncidentStatusActive', 'IncidentStatusClosed' 10348 Status IncidentStatus `json:"status,omitempty"` 10349 // Title - The title of the incident 10350 Title *string `json:"title,omitempty"` 10351} 10352 10353// MarshalJSON is the custom marshaler for IncidentProperties. 10354func (IP IncidentProperties) MarshalJSON() ([]byte, error) { 10355 objectMap := make(map[string]interface{}) 10356 if IP.Classification != "" { 10357 objectMap["classification"] = IP.Classification 10358 } 10359 if IP.ClassificationComment != nil { 10360 objectMap["classificationComment"] = IP.ClassificationComment 10361 } 10362 if IP.ClassificationReason != "" { 10363 objectMap["classificationReason"] = IP.ClassificationReason 10364 } 10365 if IP.Description != nil { 10366 objectMap["description"] = IP.Description 10367 } 10368 if IP.FirstActivityTimeUtc != nil { 10369 objectMap["firstActivityTimeUtc"] = IP.FirstActivityTimeUtc 10370 } 10371 if IP.Labels != nil { 10372 objectMap["labels"] = IP.Labels 10373 } 10374 if IP.ProviderName != nil { 10375 objectMap["providerName"] = IP.ProviderName 10376 } 10377 if IP.ProviderIncidentID != nil { 10378 objectMap["providerIncidentId"] = IP.ProviderIncidentID 10379 } 10380 if IP.LastActivityTimeUtc != nil { 10381 objectMap["lastActivityTimeUtc"] = IP.LastActivityTimeUtc 10382 } 10383 if IP.Owner != nil { 10384 objectMap["owner"] = IP.Owner 10385 } 10386 if IP.Severity != "" { 10387 objectMap["severity"] = IP.Severity 10388 } 10389 if IP.Status != "" { 10390 objectMap["status"] = IP.Status 10391 } 10392 if IP.Title != nil { 10393 objectMap["title"] = IP.Title 10394 } 10395 return json.Marshal(objectMap) 10396} 10397 10398// InsightQueryItem represents Insight Query. 10399type InsightQueryItem struct { 10400 // Properties - Properties bag for InsightQueryItem 10401 Properties *InsightQueryItemProperties `json:"properties,omitempty"` 10402 // ID - READ-ONLY; Query Template ARM ID 10403 ID *string `json:"id,omitempty"` 10404 // Name - Query Template ARM Name 10405 Name *string `json:"name,omitempty"` 10406 // Type - ARM Type 10407 Type *string `json:"type,omitempty"` 10408 // Kind - The kind of the entity query. Possible values include: 'EntityQueryKindExpansion', 'EntityQueryKindInsight' 10409 Kind EntityQueryKind `json:"kind,omitempty"` 10410} 10411 10412// MarshalJSON is the custom marshaler for InsightQueryItem. 10413func (iqi InsightQueryItem) MarshalJSON() ([]byte, error) { 10414 objectMap := make(map[string]interface{}) 10415 if iqi.Properties != nil { 10416 objectMap["properties"] = iqi.Properties 10417 } 10418 if iqi.Name != nil { 10419 objectMap["name"] = iqi.Name 10420 } 10421 if iqi.Type != nil { 10422 objectMap["type"] = iqi.Type 10423 } 10424 if iqi.Kind != "" { 10425 objectMap["kind"] = iqi.Kind 10426 } 10427 return json.Marshal(objectMap) 10428} 10429 10430// InsightQueryItemProperties represents Insight Query. 10431type InsightQueryItemProperties struct { 10432 // DisplayName - The insight display name. 10433 DisplayName *string `json:"displayName,omitempty"` 10434 // Description - The insight description. 10435 Description *string `json:"description,omitempty"` 10436 // BaseQuery - The base query of the insight. 10437 BaseQuery *string `json:"baseQuery,omitempty"` 10438 // TableQuery - The insight table query. 10439 TableQuery *InsightQueryItemPropertiesTableQuery `json:"tableQuery,omitempty"` 10440 // ChartQuery - The insight chart query. 10441 ChartQuery interface{} `json:"chartQuery,omitempty"` 10442 // AdditionalQuery - The activity query definitions. 10443 AdditionalQuery *InsightQueryItemPropertiesAdditionalQuery `json:"additionalQuery,omitempty"` 10444 // DefaultTimeRange - The insight chart query. 10445 DefaultTimeRange *InsightQueryItemPropertiesDefaultTimeRange `json:"defaultTimeRange,omitempty"` 10446 // ReferenceTimeRange - The insight chart query. 10447 ReferenceTimeRange *InsightQueryItemPropertiesReferenceTimeRange `json:"referenceTimeRange,omitempty"` 10448 // DataTypes - Data types for template 10449 DataTypes *[]EntityQueryItemPropertiesDataTypesItem `json:"dataTypes,omitempty"` 10450 // InputEntityType - The type of the entity. Possible values include: 'EntityTypeAccount', 'EntityTypeHost', 'EntityTypeFile', 'EntityTypeAzureResource', 'EntityTypeCloudApplication', 'EntityTypeDNS', 'EntityTypeFileHash', 'EntityTypeIP', 'EntityTypeMalware', 'EntityTypeProcess', 'EntityTypeRegistryKey', 'EntityTypeRegistryValue', 'EntityTypeSecurityGroup', 'EntityTypeURL', 'EntityTypeIoTDevice', 'EntityTypeSecurityAlert', 'EntityTypeHuntingBookmark', 'EntityTypeMailCluster', 'EntityTypeMailMessage', 'EntityTypeMailbox', 'EntityTypeSubmissionMail' 10451 InputEntityType EntityType `json:"inputEntityType,omitempty"` 10452 // RequiredInputFieldsSets - Data types for template 10453 RequiredInputFieldsSets *[][]string `json:"requiredInputFieldsSets,omitempty"` 10454 // EntitiesFilter - The query applied only to entities matching to all filters 10455 EntitiesFilter interface{} `json:"entitiesFilter,omitempty"` 10456} 10457 10458// InsightQueryItemPropertiesAdditionalQuery the activity query definitions. 10459type InsightQueryItemPropertiesAdditionalQuery struct { 10460 // Query - The insight query. 10461 Query *string `json:"query,omitempty"` 10462 // Text - The insight text. 10463 Text *string `json:"text,omitempty"` 10464} 10465 10466// InsightQueryItemPropertiesDefaultTimeRange the insight chart query. 10467type InsightQueryItemPropertiesDefaultTimeRange struct { 10468 // BeforeRange - The padding for the start time of the query. 10469 BeforeRange *string `json:"beforeRange,omitempty"` 10470 // AfterRange - The padding for the end time of the query. 10471 AfterRange *string `json:"afterRange,omitempty"` 10472} 10473 10474// InsightQueryItemPropertiesReferenceTimeRange the insight chart query. 10475type InsightQueryItemPropertiesReferenceTimeRange struct { 10476 // BeforeRange - Additional query time for looking back. 10477 BeforeRange *string `json:"beforeRange,omitempty"` 10478} 10479 10480// InsightQueryItemPropertiesTableQuery the insight table query. 10481type InsightQueryItemPropertiesTableQuery struct { 10482 // ColumnsDefinitions - List of insight column definitions. 10483 ColumnsDefinitions *[]InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem `json:"columnsDefinitions,omitempty"` 10484 // QueriesDefinitions - List of insight queries definitions. 10485 QueriesDefinitions *[]InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem `json:"queriesDefinitions,omitempty"` 10486} 10487 10488// InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem ... 10489type InsightQueryItemPropertiesTableQueryColumnsDefinitionsItem struct { 10490 // Header - Insight column header. 10491 Header *string `json:"header,omitempty"` 10492 // OutputType - Insights Column type. Possible values include: 'OutputTypeNumber', 'OutputTypeString', 'OutputTypeDate', 'OutputTypeEntity' 10493 OutputType OutputType `json:"outputType,omitempty"` 10494 // SupportDeepLink - Is query supports deep-link. 10495 SupportDeepLink *bool `json:"supportDeepLink,omitempty"` 10496} 10497 10498// InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem ... 10499type InsightQueryItemPropertiesTableQueryQueriesDefinitionsItem struct { 10500 // Filter - Insight column header. 10501 Filter *string `json:"filter,omitempty"` 10502 // Summarize - Insight column header. 10503 Summarize *string `json:"summarize,omitempty"` 10504 // Project - Insight column header. 10505 Project *string `json:"project,omitempty"` 10506 // LinkColumnsDefinitions - Insight column header. 10507 LinkColumnsDefinitions *[]InsightQueryItemPropertiesTableQueryQueriesDefinitionsItemLinkColumnsDefinitionsItem `json:"linkColumnsDefinitions,omitempty"` 10508} 10509 10510// InsightQueryItemPropertiesTableQueryQueriesDefinitionsItemLinkColumnsDefinitionsItem ... 10511type InsightQueryItemPropertiesTableQueryQueriesDefinitionsItemLinkColumnsDefinitionsItem struct { 10512 // ProjectedName - Insight Link Definition Projected Name. 10513 ProjectedName *string `json:"projectedName,omitempty"` 10514 // Query - Insight Link Definition Query. 10515 Query *string `json:"Query,omitempty"` 10516} 10517 10518// InsightsTableResult query results for table insights query. 10519type InsightsTableResult struct { 10520 // Columns - Columns Metadata of the table 10521 Columns *[]InsightsTableResultColumnsItem `json:"columns,omitempty"` 10522 // Rows - Rows data of the table 10523 Rows *[][]string `json:"rows,omitempty"` 10524} 10525 10526// InsightsTableResultColumnsItem ... 10527type InsightsTableResultColumnsItem struct { 10528 // Type - the type of the colum 10529 Type *string `json:"type,omitempty"` 10530 // Name - the name of the colum 10531 Name *string `json:"name,omitempty"` 10532} 10533 10534// IoTDeviceEntity represents an IoT device entity. 10535type IoTDeviceEntity struct { 10536 // IoTDeviceEntityProperties - IoTDevice entity properties 10537 *IoTDeviceEntityProperties `json:"properties,omitempty"` 10538 // ID - READ-ONLY; Azure resource Id 10539 ID *string `json:"id,omitempty"` 10540 // Name - READ-ONLY; Azure resource name 10541 Name *string `json:"name,omitempty"` 10542 // Type - READ-ONLY; Azure resource type 10543 Type *string `json:"type,omitempty"` 10544 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 10545 Kind KindBasicEntity `json:"kind,omitempty"` 10546} 10547 10548// MarshalJSON is the custom marshaler for IoTDeviceEntity. 10549func (itde IoTDeviceEntity) MarshalJSON() ([]byte, error) { 10550 itde.Kind = KindBasicEntityKindIoTDevice 10551 objectMap := make(map[string]interface{}) 10552 if itde.IoTDeviceEntityProperties != nil { 10553 objectMap["properties"] = itde.IoTDeviceEntityProperties 10554 } 10555 if itde.Kind != "" { 10556 objectMap["kind"] = itde.Kind 10557 } 10558 return json.Marshal(objectMap) 10559} 10560 10561// AsAccountEntity is the BasicEntity implementation for IoTDeviceEntity. 10562func (itde IoTDeviceEntity) AsAccountEntity() (*AccountEntity, bool) { 10563 return nil, false 10564} 10565 10566// AsAzureResourceEntity is the BasicEntity implementation for IoTDeviceEntity. 10567func (itde IoTDeviceEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 10568 return nil, false 10569} 10570 10571// AsCloudApplicationEntity is the BasicEntity implementation for IoTDeviceEntity. 10572func (itde IoTDeviceEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 10573 return nil, false 10574} 10575 10576// AsDNSEntity is the BasicEntity implementation for IoTDeviceEntity. 10577func (itde IoTDeviceEntity) AsDNSEntity() (*DNSEntity, bool) { 10578 return nil, false 10579} 10580 10581// AsFileEntity is the BasicEntity implementation for IoTDeviceEntity. 10582func (itde IoTDeviceEntity) AsFileEntity() (*FileEntity, bool) { 10583 return nil, false 10584} 10585 10586// AsFileHashEntity is the BasicEntity implementation for IoTDeviceEntity. 10587func (itde IoTDeviceEntity) AsFileHashEntity() (*FileHashEntity, bool) { 10588 return nil, false 10589} 10590 10591// AsHostEntity is the BasicEntity implementation for IoTDeviceEntity. 10592func (itde IoTDeviceEntity) AsHostEntity() (*HostEntity, bool) { 10593 return nil, false 10594} 10595 10596// AsHuntingBookmark is the BasicEntity implementation for IoTDeviceEntity. 10597func (itde IoTDeviceEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 10598 return nil, false 10599} 10600 10601// AsSecurityAlert is the BasicEntity implementation for IoTDeviceEntity. 10602func (itde IoTDeviceEntity) AsSecurityAlert() (*SecurityAlert, bool) { 10603 return nil, false 10604} 10605 10606// AsIPEntity is the BasicEntity implementation for IoTDeviceEntity. 10607func (itde IoTDeviceEntity) AsIPEntity() (*IPEntity, bool) { 10608 return nil, false 10609} 10610 10611// AsMailboxEntity is the BasicEntity implementation for IoTDeviceEntity. 10612func (itde IoTDeviceEntity) AsMailboxEntity() (*MailboxEntity, bool) { 10613 return nil, false 10614} 10615 10616// AsMailClusterEntity is the BasicEntity implementation for IoTDeviceEntity. 10617func (itde IoTDeviceEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 10618 return nil, false 10619} 10620 10621// AsMailMessageEntity is the BasicEntity implementation for IoTDeviceEntity. 10622func (itde IoTDeviceEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 10623 return nil, false 10624} 10625 10626// AsSubmissionMailEntity is the BasicEntity implementation for IoTDeviceEntity. 10627func (itde IoTDeviceEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 10628 return nil, false 10629} 10630 10631// AsMalwareEntity is the BasicEntity implementation for IoTDeviceEntity. 10632func (itde IoTDeviceEntity) AsMalwareEntity() (*MalwareEntity, bool) { 10633 return nil, false 10634} 10635 10636// AsProcessEntity is the BasicEntity implementation for IoTDeviceEntity. 10637func (itde IoTDeviceEntity) AsProcessEntity() (*ProcessEntity, bool) { 10638 return nil, false 10639} 10640 10641// AsRegistryKeyEntity is the BasicEntity implementation for IoTDeviceEntity. 10642func (itde IoTDeviceEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 10643 return nil, false 10644} 10645 10646// AsRegistryValueEntity is the BasicEntity implementation for IoTDeviceEntity. 10647func (itde IoTDeviceEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 10648 return nil, false 10649} 10650 10651// AsSecurityGroupEntity is the BasicEntity implementation for IoTDeviceEntity. 10652func (itde IoTDeviceEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 10653 return nil, false 10654} 10655 10656// AsURLEntity is the BasicEntity implementation for IoTDeviceEntity. 10657func (itde IoTDeviceEntity) AsURLEntity() (*URLEntity, bool) { 10658 return nil, false 10659} 10660 10661// AsIoTDeviceEntity is the BasicEntity implementation for IoTDeviceEntity. 10662func (itde IoTDeviceEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 10663 return &itde, true 10664} 10665 10666// AsEntity is the BasicEntity implementation for IoTDeviceEntity. 10667func (itde IoTDeviceEntity) AsEntity() (*Entity, bool) { 10668 return nil, false 10669} 10670 10671// AsBasicEntity is the BasicEntity implementation for IoTDeviceEntity. 10672func (itde IoTDeviceEntity) AsBasicEntity() (BasicEntity, bool) { 10673 return &itde, true 10674} 10675 10676// UnmarshalJSON is the custom unmarshaler for IoTDeviceEntity struct. 10677func (itde *IoTDeviceEntity) UnmarshalJSON(body []byte) error { 10678 var m map[string]*json.RawMessage 10679 err := json.Unmarshal(body, &m) 10680 if err != nil { 10681 return err 10682 } 10683 for k, v := range m { 10684 switch k { 10685 case "properties": 10686 if v != nil { 10687 var ioTDeviceEntityProperties IoTDeviceEntityProperties 10688 err = json.Unmarshal(*v, &ioTDeviceEntityProperties) 10689 if err != nil { 10690 return err 10691 } 10692 itde.IoTDeviceEntityProperties = &ioTDeviceEntityProperties 10693 } 10694 case "id": 10695 if v != nil { 10696 var ID string 10697 err = json.Unmarshal(*v, &ID) 10698 if err != nil { 10699 return err 10700 } 10701 itde.ID = &ID 10702 } 10703 case "name": 10704 if v != nil { 10705 var name string 10706 err = json.Unmarshal(*v, &name) 10707 if err != nil { 10708 return err 10709 } 10710 itde.Name = &name 10711 } 10712 case "type": 10713 if v != nil { 10714 var typeVar string 10715 err = json.Unmarshal(*v, &typeVar) 10716 if err != nil { 10717 return err 10718 } 10719 itde.Type = &typeVar 10720 } 10721 case "kind": 10722 if v != nil { 10723 var kind KindBasicEntity 10724 err = json.Unmarshal(*v, &kind) 10725 if err != nil { 10726 return err 10727 } 10728 itde.Kind = kind 10729 } 10730 } 10731 } 10732 10733 return nil 10734} 10735 10736// IoTDeviceEntityProperties ioTDevice entity property bag. 10737type IoTDeviceEntityProperties struct { 10738 // DeviceID - READ-ONLY; The ID of the IoT Device in the IoT Hub 10739 DeviceID *string `json:"deviceId,omitempty"` 10740 // DeviceName - READ-ONLY; The friendly name of the device 10741 DeviceName *string `json:"deviceName,omitempty"` 10742 // Source - READ-ONLY; The source of the device 10743 Source *string `json:"source,omitempty"` 10744 // IotSecurityAgentID - READ-ONLY; The ID of the security agent running on the device 10745 IotSecurityAgentID *uuid.UUID `json:"iotSecurityAgentId,omitempty"` 10746 // DeviceType - READ-ONLY; The type of the device 10747 DeviceType *string `json:"deviceType,omitempty"` 10748 // Vendor - READ-ONLY; The vendor of the device 10749 Vendor *string `json:"vendor,omitempty"` 10750 // EdgeID - READ-ONLY; The ID of the edge device 10751 EdgeID *string `json:"edgeId,omitempty"` 10752 // MacAddress - READ-ONLY; The MAC address of the device 10753 MacAddress *string `json:"macAddress,omitempty"` 10754 // Model - READ-ONLY; The model of the device 10755 Model *string `json:"model,omitempty"` 10756 // SerialNumber - READ-ONLY; The serial number of the device 10757 SerialNumber *string `json:"serialNumber,omitempty"` 10758 // FirmwareVersion - READ-ONLY; The firmware version of the device 10759 FirmwareVersion *string `json:"firmwareVersion,omitempty"` 10760 // OperatingSystem - READ-ONLY; The operating system of the device 10761 OperatingSystem *string `json:"operatingSystem,omitempty"` 10762 // IotHubEntityID - READ-ONLY; The AzureResource entity id of the IoT Hub 10763 IotHubEntityID *string `json:"iotHubEntityId,omitempty"` 10764 // HostEntityID - READ-ONLY; The Host entity id of this device 10765 HostEntityID *string `json:"hostEntityId,omitempty"` 10766 // IPAddressEntityID - READ-ONLY; The IP entity if of this device 10767 IPAddressEntityID *string `json:"ipAddressEntityId,omitempty"` 10768 // ThreatIntelligence - READ-ONLY; A list of TI contexts attached to the IoTDevice entity. 10769 ThreatIntelligence *[]ThreatIntelligence `json:"threatIntelligence,omitempty"` 10770 // Protocols - READ-ONLY; A list of protocols of the IoTDevice entity. 10771 Protocols *[]string `json:"protocols,omitempty"` 10772 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 10773 AdditionalData map[string]interface{} `json:"additionalData"` 10774 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 10775 FriendlyName *string `json:"friendlyName,omitempty"` 10776} 10777 10778// MarshalJSON is the custom marshaler for IoTDeviceEntityProperties. 10779func (itdep IoTDeviceEntityProperties) MarshalJSON() ([]byte, error) { 10780 objectMap := make(map[string]interface{}) 10781 return json.Marshal(objectMap) 10782} 10783 10784// IPEntity represents an ip entity. 10785type IPEntity struct { 10786 // IPEntityProperties - Ip entity properties 10787 *IPEntityProperties `json:"properties,omitempty"` 10788 // ID - READ-ONLY; Azure resource Id 10789 ID *string `json:"id,omitempty"` 10790 // Name - READ-ONLY; Azure resource name 10791 Name *string `json:"name,omitempty"` 10792 // Type - READ-ONLY; Azure resource type 10793 Type *string `json:"type,omitempty"` 10794 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 10795 Kind KindBasicEntity `json:"kind,omitempty"` 10796} 10797 10798// MarshalJSON is the custom marshaler for IPEntity. 10799func (ie IPEntity) MarshalJSON() ([]byte, error) { 10800 ie.Kind = KindBasicEntityKindIP 10801 objectMap := make(map[string]interface{}) 10802 if ie.IPEntityProperties != nil { 10803 objectMap["properties"] = ie.IPEntityProperties 10804 } 10805 if ie.Kind != "" { 10806 objectMap["kind"] = ie.Kind 10807 } 10808 return json.Marshal(objectMap) 10809} 10810 10811// AsAccountEntity is the BasicEntity implementation for IPEntity. 10812func (ie IPEntity) AsAccountEntity() (*AccountEntity, bool) { 10813 return nil, false 10814} 10815 10816// AsAzureResourceEntity is the BasicEntity implementation for IPEntity. 10817func (ie IPEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 10818 return nil, false 10819} 10820 10821// AsCloudApplicationEntity is the BasicEntity implementation for IPEntity. 10822func (ie IPEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 10823 return nil, false 10824} 10825 10826// AsDNSEntity is the BasicEntity implementation for IPEntity. 10827func (ie IPEntity) AsDNSEntity() (*DNSEntity, bool) { 10828 return nil, false 10829} 10830 10831// AsFileEntity is the BasicEntity implementation for IPEntity. 10832func (ie IPEntity) AsFileEntity() (*FileEntity, bool) { 10833 return nil, false 10834} 10835 10836// AsFileHashEntity is the BasicEntity implementation for IPEntity. 10837func (ie IPEntity) AsFileHashEntity() (*FileHashEntity, bool) { 10838 return nil, false 10839} 10840 10841// AsHostEntity is the BasicEntity implementation for IPEntity. 10842func (ie IPEntity) AsHostEntity() (*HostEntity, bool) { 10843 return nil, false 10844} 10845 10846// AsHuntingBookmark is the BasicEntity implementation for IPEntity. 10847func (ie IPEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 10848 return nil, false 10849} 10850 10851// AsSecurityAlert is the BasicEntity implementation for IPEntity. 10852func (ie IPEntity) AsSecurityAlert() (*SecurityAlert, bool) { 10853 return nil, false 10854} 10855 10856// AsIPEntity is the BasicEntity implementation for IPEntity. 10857func (ie IPEntity) AsIPEntity() (*IPEntity, bool) { 10858 return &ie, true 10859} 10860 10861// AsMailboxEntity is the BasicEntity implementation for IPEntity. 10862func (ie IPEntity) AsMailboxEntity() (*MailboxEntity, bool) { 10863 return nil, false 10864} 10865 10866// AsMailClusterEntity is the BasicEntity implementation for IPEntity. 10867func (ie IPEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 10868 return nil, false 10869} 10870 10871// AsMailMessageEntity is the BasicEntity implementation for IPEntity. 10872func (ie IPEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 10873 return nil, false 10874} 10875 10876// AsSubmissionMailEntity is the BasicEntity implementation for IPEntity. 10877func (ie IPEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 10878 return nil, false 10879} 10880 10881// AsMalwareEntity is the BasicEntity implementation for IPEntity. 10882func (ie IPEntity) AsMalwareEntity() (*MalwareEntity, bool) { 10883 return nil, false 10884} 10885 10886// AsProcessEntity is the BasicEntity implementation for IPEntity. 10887func (ie IPEntity) AsProcessEntity() (*ProcessEntity, bool) { 10888 return nil, false 10889} 10890 10891// AsRegistryKeyEntity is the BasicEntity implementation for IPEntity. 10892func (ie IPEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 10893 return nil, false 10894} 10895 10896// AsRegistryValueEntity is the BasicEntity implementation for IPEntity. 10897func (ie IPEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 10898 return nil, false 10899} 10900 10901// AsSecurityGroupEntity is the BasicEntity implementation for IPEntity. 10902func (ie IPEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 10903 return nil, false 10904} 10905 10906// AsURLEntity is the BasicEntity implementation for IPEntity. 10907func (ie IPEntity) AsURLEntity() (*URLEntity, bool) { 10908 return nil, false 10909} 10910 10911// AsIoTDeviceEntity is the BasicEntity implementation for IPEntity. 10912func (ie IPEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 10913 return nil, false 10914} 10915 10916// AsEntity is the BasicEntity implementation for IPEntity. 10917func (ie IPEntity) AsEntity() (*Entity, bool) { 10918 return nil, false 10919} 10920 10921// AsBasicEntity is the BasicEntity implementation for IPEntity. 10922func (ie IPEntity) AsBasicEntity() (BasicEntity, bool) { 10923 return &ie, true 10924} 10925 10926// UnmarshalJSON is the custom unmarshaler for IPEntity struct. 10927func (ie *IPEntity) UnmarshalJSON(body []byte) error { 10928 var m map[string]*json.RawMessage 10929 err := json.Unmarshal(body, &m) 10930 if err != nil { 10931 return err 10932 } 10933 for k, v := range m { 10934 switch k { 10935 case "properties": 10936 if v != nil { 10937 var IPEntityProperties IPEntityProperties 10938 err = json.Unmarshal(*v, &IPEntityProperties) 10939 if err != nil { 10940 return err 10941 } 10942 ie.IPEntityProperties = &IPEntityProperties 10943 } 10944 case "id": 10945 if v != nil { 10946 var ID string 10947 err = json.Unmarshal(*v, &ID) 10948 if err != nil { 10949 return err 10950 } 10951 ie.ID = &ID 10952 } 10953 case "name": 10954 if v != nil { 10955 var name string 10956 err = json.Unmarshal(*v, &name) 10957 if err != nil { 10958 return err 10959 } 10960 ie.Name = &name 10961 } 10962 case "type": 10963 if v != nil { 10964 var typeVar string 10965 err = json.Unmarshal(*v, &typeVar) 10966 if err != nil { 10967 return err 10968 } 10969 ie.Type = &typeVar 10970 } 10971 case "kind": 10972 if v != nil { 10973 var kind KindBasicEntity 10974 err = json.Unmarshal(*v, &kind) 10975 if err != nil { 10976 return err 10977 } 10978 ie.Kind = kind 10979 } 10980 } 10981 } 10982 10983 return nil 10984} 10985 10986// IPEntityProperties ip entity property bag. 10987type IPEntityProperties struct { 10988 // Address - READ-ONLY; The IP address as string, e.g. 127.0.0.1 (either in Ipv4 or Ipv6) 10989 Address *string `json:"address,omitempty"` 10990 // Location - The geo-location context attached to the ip entity 10991 Location *GeoLocation `json:"location,omitempty"` 10992 // ThreatIntelligence - READ-ONLY; A list of TI contexts attached to the ip entity. 10993 ThreatIntelligence *[]ThreatIntelligence `json:"threatIntelligence,omitempty"` 10994 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 10995 AdditionalData map[string]interface{} `json:"additionalData"` 10996 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 10997 FriendlyName *string `json:"friendlyName,omitempty"` 10998} 10999 11000// MarshalJSON is the custom marshaler for IPEntityProperties. 11001func (iep IPEntityProperties) MarshalJSON() ([]byte, error) { 11002 objectMap := make(map[string]interface{}) 11003 if iep.Location != nil { 11004 objectMap["location"] = iep.Location 11005 } 11006 return json.Marshal(objectMap) 11007} 11008 11009// IPSyncer settings with single toggle. 11010type IPSyncer struct { 11011 // IPSyncerSettingsProperties - IPSyncer properties 11012 *IPSyncerSettingsProperties `json:"properties,omitempty"` 11013 // ID - READ-ONLY; Azure resource Id 11014 ID *string `json:"id,omitempty"` 11015 // Name - READ-ONLY; Azure resource name 11016 Name *string `json:"name,omitempty"` 11017 // Type - READ-ONLY; Azure resource type 11018 Type *string `json:"type,omitempty"` 11019 // Etag - Etag of the azure resource 11020 Etag *string `json:"etag,omitempty"` 11021 // Kind - Possible values include: 'KindBasicSettingsKindSettings', 'KindBasicSettingsKindIPSyncer', 'KindBasicSettingsKindEyesOn', 'KindBasicSettingsKindEntityAnalytics', 'KindBasicSettingsKindUeba' 11022 Kind KindBasicSettings `json:"kind,omitempty"` 11023} 11024 11025// MarshalJSON is the custom marshaler for IPSyncer. 11026func (is IPSyncer) MarshalJSON() ([]byte, error) { 11027 is.Kind = KindBasicSettingsKindIPSyncer 11028 objectMap := make(map[string]interface{}) 11029 if is.IPSyncerSettingsProperties != nil { 11030 objectMap["properties"] = is.IPSyncerSettingsProperties 11031 } 11032 if is.Etag != nil { 11033 objectMap["etag"] = is.Etag 11034 } 11035 if is.Kind != "" { 11036 objectMap["kind"] = is.Kind 11037 } 11038 return json.Marshal(objectMap) 11039} 11040 11041// AsIPSyncer is the BasicSettings implementation for IPSyncer. 11042func (is IPSyncer) AsIPSyncer() (*IPSyncer, bool) { 11043 return &is, true 11044} 11045 11046// AsEyesOn is the BasicSettings implementation for IPSyncer. 11047func (is IPSyncer) AsEyesOn() (*EyesOn, bool) { 11048 return nil, false 11049} 11050 11051// AsEntityAnalytics is the BasicSettings implementation for IPSyncer. 11052func (is IPSyncer) AsEntityAnalytics() (*EntityAnalytics, bool) { 11053 return nil, false 11054} 11055 11056// AsUeba is the BasicSettings implementation for IPSyncer. 11057func (is IPSyncer) AsUeba() (*Ueba, bool) { 11058 return nil, false 11059} 11060 11061// AsSettings is the BasicSettings implementation for IPSyncer. 11062func (is IPSyncer) AsSettings() (*Settings, bool) { 11063 return nil, false 11064} 11065 11066// AsBasicSettings is the BasicSettings implementation for IPSyncer. 11067func (is IPSyncer) AsBasicSettings() (BasicSettings, bool) { 11068 return &is, true 11069} 11070 11071// UnmarshalJSON is the custom unmarshaler for IPSyncer struct. 11072func (is *IPSyncer) UnmarshalJSON(body []byte) error { 11073 var m map[string]*json.RawMessage 11074 err := json.Unmarshal(body, &m) 11075 if err != nil { 11076 return err 11077 } 11078 for k, v := range m { 11079 switch k { 11080 case "properties": 11081 if v != nil { 11082 var IPSyncerSettingsProperties IPSyncerSettingsProperties 11083 err = json.Unmarshal(*v, &IPSyncerSettingsProperties) 11084 if err != nil { 11085 return err 11086 } 11087 is.IPSyncerSettingsProperties = &IPSyncerSettingsProperties 11088 } 11089 case "id": 11090 if v != nil { 11091 var ID string 11092 err = json.Unmarshal(*v, &ID) 11093 if err != nil { 11094 return err 11095 } 11096 is.ID = &ID 11097 } 11098 case "name": 11099 if v != nil { 11100 var name string 11101 err = json.Unmarshal(*v, &name) 11102 if err != nil { 11103 return err 11104 } 11105 is.Name = &name 11106 } 11107 case "type": 11108 if v != nil { 11109 var typeVar string 11110 err = json.Unmarshal(*v, &typeVar) 11111 if err != nil { 11112 return err 11113 } 11114 is.Type = &typeVar 11115 } 11116 case "etag": 11117 if v != nil { 11118 var etag string 11119 err = json.Unmarshal(*v, &etag) 11120 if err != nil { 11121 return err 11122 } 11123 is.Etag = &etag 11124 } 11125 case "kind": 11126 if v != nil { 11127 var kind KindBasicSettings 11128 err = json.Unmarshal(*v, &kind) 11129 if err != nil { 11130 return err 11131 } 11132 is.Kind = kind 11133 } 11134 } 11135 } 11136 11137 return nil 11138} 11139 11140// IPSyncerSettingsProperties iPSyncer property bag. 11141type IPSyncerSettingsProperties struct { 11142 // IsEnabled - READ-ONLY; Determines whether the setting is enable or disabled. 11143 IsEnabled *bool `json:"isEnabled,omitempty"` 11144} 11145 11146// MarshalJSON is the custom marshaler for IPSyncerSettingsProperties. 11147func (issp IPSyncerSettingsProperties) MarshalJSON() ([]byte, error) { 11148 objectMap := make(map[string]interface{}) 11149 return json.Marshal(objectMap) 11150} 11151 11152// MailboxEntity represents a mailbox entity. 11153type MailboxEntity struct { 11154 // MailboxEntityProperties - Mailbox entity properties 11155 *MailboxEntityProperties `json:"properties,omitempty"` 11156 // ID - READ-ONLY; Azure resource Id 11157 ID *string `json:"id,omitempty"` 11158 // Name - READ-ONLY; Azure resource name 11159 Name *string `json:"name,omitempty"` 11160 // Type - READ-ONLY; Azure resource type 11161 Type *string `json:"type,omitempty"` 11162 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 11163 Kind KindBasicEntity `json:"kind,omitempty"` 11164} 11165 11166// MarshalJSON is the custom marshaler for MailboxEntity. 11167func (me MailboxEntity) MarshalJSON() ([]byte, error) { 11168 me.Kind = KindBasicEntityKindMailbox 11169 objectMap := make(map[string]interface{}) 11170 if me.MailboxEntityProperties != nil { 11171 objectMap["properties"] = me.MailboxEntityProperties 11172 } 11173 if me.Kind != "" { 11174 objectMap["kind"] = me.Kind 11175 } 11176 return json.Marshal(objectMap) 11177} 11178 11179// AsAccountEntity is the BasicEntity implementation for MailboxEntity. 11180func (me MailboxEntity) AsAccountEntity() (*AccountEntity, bool) { 11181 return nil, false 11182} 11183 11184// AsAzureResourceEntity is the BasicEntity implementation for MailboxEntity. 11185func (me MailboxEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 11186 return nil, false 11187} 11188 11189// AsCloudApplicationEntity is the BasicEntity implementation for MailboxEntity. 11190func (me MailboxEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 11191 return nil, false 11192} 11193 11194// AsDNSEntity is the BasicEntity implementation for MailboxEntity. 11195func (me MailboxEntity) AsDNSEntity() (*DNSEntity, bool) { 11196 return nil, false 11197} 11198 11199// AsFileEntity is the BasicEntity implementation for MailboxEntity. 11200func (me MailboxEntity) AsFileEntity() (*FileEntity, bool) { 11201 return nil, false 11202} 11203 11204// AsFileHashEntity is the BasicEntity implementation for MailboxEntity. 11205func (me MailboxEntity) AsFileHashEntity() (*FileHashEntity, bool) { 11206 return nil, false 11207} 11208 11209// AsHostEntity is the BasicEntity implementation for MailboxEntity. 11210func (me MailboxEntity) AsHostEntity() (*HostEntity, bool) { 11211 return nil, false 11212} 11213 11214// AsHuntingBookmark is the BasicEntity implementation for MailboxEntity. 11215func (me MailboxEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 11216 return nil, false 11217} 11218 11219// AsSecurityAlert is the BasicEntity implementation for MailboxEntity. 11220func (me MailboxEntity) AsSecurityAlert() (*SecurityAlert, bool) { 11221 return nil, false 11222} 11223 11224// AsIPEntity is the BasicEntity implementation for MailboxEntity. 11225func (me MailboxEntity) AsIPEntity() (*IPEntity, bool) { 11226 return nil, false 11227} 11228 11229// AsMailboxEntity is the BasicEntity implementation for MailboxEntity. 11230func (me MailboxEntity) AsMailboxEntity() (*MailboxEntity, bool) { 11231 return &me, true 11232} 11233 11234// AsMailClusterEntity is the BasicEntity implementation for MailboxEntity. 11235func (me MailboxEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 11236 return nil, false 11237} 11238 11239// AsMailMessageEntity is the BasicEntity implementation for MailboxEntity. 11240func (me MailboxEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 11241 return nil, false 11242} 11243 11244// AsSubmissionMailEntity is the BasicEntity implementation for MailboxEntity. 11245func (me MailboxEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 11246 return nil, false 11247} 11248 11249// AsMalwareEntity is the BasicEntity implementation for MailboxEntity. 11250func (me MailboxEntity) AsMalwareEntity() (*MalwareEntity, bool) { 11251 return nil, false 11252} 11253 11254// AsProcessEntity is the BasicEntity implementation for MailboxEntity. 11255func (me MailboxEntity) AsProcessEntity() (*ProcessEntity, bool) { 11256 return nil, false 11257} 11258 11259// AsRegistryKeyEntity is the BasicEntity implementation for MailboxEntity. 11260func (me MailboxEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 11261 return nil, false 11262} 11263 11264// AsRegistryValueEntity is the BasicEntity implementation for MailboxEntity. 11265func (me MailboxEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 11266 return nil, false 11267} 11268 11269// AsSecurityGroupEntity is the BasicEntity implementation for MailboxEntity. 11270func (me MailboxEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 11271 return nil, false 11272} 11273 11274// AsURLEntity is the BasicEntity implementation for MailboxEntity. 11275func (me MailboxEntity) AsURLEntity() (*URLEntity, bool) { 11276 return nil, false 11277} 11278 11279// AsIoTDeviceEntity is the BasicEntity implementation for MailboxEntity. 11280func (me MailboxEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 11281 return nil, false 11282} 11283 11284// AsEntity is the BasicEntity implementation for MailboxEntity. 11285func (me MailboxEntity) AsEntity() (*Entity, bool) { 11286 return nil, false 11287} 11288 11289// AsBasicEntity is the BasicEntity implementation for MailboxEntity. 11290func (me MailboxEntity) AsBasicEntity() (BasicEntity, bool) { 11291 return &me, true 11292} 11293 11294// UnmarshalJSON is the custom unmarshaler for MailboxEntity struct. 11295func (me *MailboxEntity) UnmarshalJSON(body []byte) error { 11296 var m map[string]*json.RawMessage 11297 err := json.Unmarshal(body, &m) 11298 if err != nil { 11299 return err 11300 } 11301 for k, v := range m { 11302 switch k { 11303 case "properties": 11304 if v != nil { 11305 var mailboxEntityProperties MailboxEntityProperties 11306 err = json.Unmarshal(*v, &mailboxEntityProperties) 11307 if err != nil { 11308 return err 11309 } 11310 me.MailboxEntityProperties = &mailboxEntityProperties 11311 } 11312 case "id": 11313 if v != nil { 11314 var ID string 11315 err = json.Unmarshal(*v, &ID) 11316 if err != nil { 11317 return err 11318 } 11319 me.ID = &ID 11320 } 11321 case "name": 11322 if v != nil { 11323 var name string 11324 err = json.Unmarshal(*v, &name) 11325 if err != nil { 11326 return err 11327 } 11328 me.Name = &name 11329 } 11330 case "type": 11331 if v != nil { 11332 var typeVar string 11333 err = json.Unmarshal(*v, &typeVar) 11334 if err != nil { 11335 return err 11336 } 11337 me.Type = &typeVar 11338 } 11339 case "kind": 11340 if v != nil { 11341 var kind KindBasicEntity 11342 err = json.Unmarshal(*v, &kind) 11343 if err != nil { 11344 return err 11345 } 11346 me.Kind = kind 11347 } 11348 } 11349 } 11350 11351 return nil 11352} 11353 11354// MailboxEntityProperties mailbox entity property bag. 11355type MailboxEntityProperties struct { 11356 // MailboxPrimaryAddress - READ-ONLY; The mailbox's primary address 11357 MailboxPrimaryAddress *string `json:"mailboxPrimaryAddress,omitempty"` 11358 // DisplayName - READ-ONLY; The mailbox's display name 11359 DisplayName *string `json:"displayName,omitempty"` 11360 // Upn - READ-ONLY; The mailbox's UPN 11361 Upn *string `json:"upn,omitempty"` 11362 // ExternalDirectoryObjectID - READ-ONLY; The AzureAD identifier of mailbox. Similar to AadUserId in account entity but this property is specific to mailbox object on office side 11363 ExternalDirectoryObjectID *uuid.UUID `json:"externalDirectoryObjectId,omitempty"` 11364 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 11365 AdditionalData map[string]interface{} `json:"additionalData"` 11366 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 11367 FriendlyName *string `json:"friendlyName,omitempty"` 11368} 11369 11370// MarshalJSON is the custom marshaler for MailboxEntityProperties. 11371func (mep MailboxEntityProperties) MarshalJSON() ([]byte, error) { 11372 objectMap := make(map[string]interface{}) 11373 return json.Marshal(objectMap) 11374} 11375 11376// MailClusterEntity represents a mail cluster entity. 11377type MailClusterEntity struct { 11378 // MailClusterEntityProperties - Mail cluster entity properties 11379 *MailClusterEntityProperties `json:"properties,omitempty"` 11380 // ID - READ-ONLY; Azure resource Id 11381 ID *string `json:"id,omitempty"` 11382 // Name - READ-ONLY; Azure resource name 11383 Name *string `json:"name,omitempty"` 11384 // Type - READ-ONLY; Azure resource type 11385 Type *string `json:"type,omitempty"` 11386 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 11387 Kind KindBasicEntity `json:"kind,omitempty"` 11388} 11389 11390// MarshalJSON is the custom marshaler for MailClusterEntity. 11391func (mce MailClusterEntity) MarshalJSON() ([]byte, error) { 11392 mce.Kind = KindBasicEntityKindMailCluster 11393 objectMap := make(map[string]interface{}) 11394 if mce.MailClusterEntityProperties != nil { 11395 objectMap["properties"] = mce.MailClusterEntityProperties 11396 } 11397 if mce.Kind != "" { 11398 objectMap["kind"] = mce.Kind 11399 } 11400 return json.Marshal(objectMap) 11401} 11402 11403// AsAccountEntity is the BasicEntity implementation for MailClusterEntity. 11404func (mce MailClusterEntity) AsAccountEntity() (*AccountEntity, bool) { 11405 return nil, false 11406} 11407 11408// AsAzureResourceEntity is the BasicEntity implementation for MailClusterEntity. 11409func (mce MailClusterEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 11410 return nil, false 11411} 11412 11413// AsCloudApplicationEntity is the BasicEntity implementation for MailClusterEntity. 11414func (mce MailClusterEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 11415 return nil, false 11416} 11417 11418// AsDNSEntity is the BasicEntity implementation for MailClusterEntity. 11419func (mce MailClusterEntity) AsDNSEntity() (*DNSEntity, bool) { 11420 return nil, false 11421} 11422 11423// AsFileEntity is the BasicEntity implementation for MailClusterEntity. 11424func (mce MailClusterEntity) AsFileEntity() (*FileEntity, bool) { 11425 return nil, false 11426} 11427 11428// AsFileHashEntity is the BasicEntity implementation for MailClusterEntity. 11429func (mce MailClusterEntity) AsFileHashEntity() (*FileHashEntity, bool) { 11430 return nil, false 11431} 11432 11433// AsHostEntity is the BasicEntity implementation for MailClusterEntity. 11434func (mce MailClusterEntity) AsHostEntity() (*HostEntity, bool) { 11435 return nil, false 11436} 11437 11438// AsHuntingBookmark is the BasicEntity implementation for MailClusterEntity. 11439func (mce MailClusterEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 11440 return nil, false 11441} 11442 11443// AsSecurityAlert is the BasicEntity implementation for MailClusterEntity. 11444func (mce MailClusterEntity) AsSecurityAlert() (*SecurityAlert, bool) { 11445 return nil, false 11446} 11447 11448// AsIPEntity is the BasicEntity implementation for MailClusterEntity. 11449func (mce MailClusterEntity) AsIPEntity() (*IPEntity, bool) { 11450 return nil, false 11451} 11452 11453// AsMailboxEntity is the BasicEntity implementation for MailClusterEntity. 11454func (mce MailClusterEntity) AsMailboxEntity() (*MailboxEntity, bool) { 11455 return nil, false 11456} 11457 11458// AsMailClusterEntity is the BasicEntity implementation for MailClusterEntity. 11459func (mce MailClusterEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 11460 return &mce, true 11461} 11462 11463// AsMailMessageEntity is the BasicEntity implementation for MailClusterEntity. 11464func (mce MailClusterEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 11465 return nil, false 11466} 11467 11468// AsSubmissionMailEntity is the BasicEntity implementation for MailClusterEntity. 11469func (mce MailClusterEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 11470 return nil, false 11471} 11472 11473// AsMalwareEntity is the BasicEntity implementation for MailClusterEntity. 11474func (mce MailClusterEntity) AsMalwareEntity() (*MalwareEntity, bool) { 11475 return nil, false 11476} 11477 11478// AsProcessEntity is the BasicEntity implementation for MailClusterEntity. 11479func (mce MailClusterEntity) AsProcessEntity() (*ProcessEntity, bool) { 11480 return nil, false 11481} 11482 11483// AsRegistryKeyEntity is the BasicEntity implementation for MailClusterEntity. 11484func (mce MailClusterEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 11485 return nil, false 11486} 11487 11488// AsRegistryValueEntity is the BasicEntity implementation for MailClusterEntity. 11489func (mce MailClusterEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 11490 return nil, false 11491} 11492 11493// AsSecurityGroupEntity is the BasicEntity implementation for MailClusterEntity. 11494func (mce MailClusterEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 11495 return nil, false 11496} 11497 11498// AsURLEntity is the BasicEntity implementation for MailClusterEntity. 11499func (mce MailClusterEntity) AsURLEntity() (*URLEntity, bool) { 11500 return nil, false 11501} 11502 11503// AsIoTDeviceEntity is the BasicEntity implementation for MailClusterEntity. 11504func (mce MailClusterEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 11505 return nil, false 11506} 11507 11508// AsEntity is the BasicEntity implementation for MailClusterEntity. 11509func (mce MailClusterEntity) AsEntity() (*Entity, bool) { 11510 return nil, false 11511} 11512 11513// AsBasicEntity is the BasicEntity implementation for MailClusterEntity. 11514func (mce MailClusterEntity) AsBasicEntity() (BasicEntity, bool) { 11515 return &mce, true 11516} 11517 11518// UnmarshalJSON is the custom unmarshaler for MailClusterEntity struct. 11519func (mce *MailClusterEntity) UnmarshalJSON(body []byte) error { 11520 var m map[string]*json.RawMessage 11521 err := json.Unmarshal(body, &m) 11522 if err != nil { 11523 return err 11524 } 11525 for k, v := range m { 11526 switch k { 11527 case "properties": 11528 if v != nil { 11529 var mailClusterEntityProperties MailClusterEntityProperties 11530 err = json.Unmarshal(*v, &mailClusterEntityProperties) 11531 if err != nil { 11532 return err 11533 } 11534 mce.MailClusterEntityProperties = &mailClusterEntityProperties 11535 } 11536 case "id": 11537 if v != nil { 11538 var ID string 11539 err = json.Unmarshal(*v, &ID) 11540 if err != nil { 11541 return err 11542 } 11543 mce.ID = &ID 11544 } 11545 case "name": 11546 if v != nil { 11547 var name string 11548 err = json.Unmarshal(*v, &name) 11549 if err != nil { 11550 return err 11551 } 11552 mce.Name = &name 11553 } 11554 case "type": 11555 if v != nil { 11556 var typeVar string 11557 err = json.Unmarshal(*v, &typeVar) 11558 if err != nil { 11559 return err 11560 } 11561 mce.Type = &typeVar 11562 } 11563 case "kind": 11564 if v != nil { 11565 var kind KindBasicEntity 11566 err = json.Unmarshal(*v, &kind) 11567 if err != nil { 11568 return err 11569 } 11570 mce.Kind = kind 11571 } 11572 } 11573 } 11574 11575 return nil 11576} 11577 11578// MailClusterEntityProperties mail cluster entity property bag. 11579type MailClusterEntityProperties struct { 11580 // NetworkMessageIds - READ-ONLY; The mail message IDs that are part of the mail cluster 11581 NetworkMessageIds *[]string `json:"networkMessageIds,omitempty"` 11582 // CountByDeliveryStatus - READ-ONLY; Count of mail messages by DeliveryStatus string representation 11583 CountByDeliveryStatus interface{} `json:"countByDeliveryStatus,omitempty"` 11584 // CountByThreatType - READ-ONLY; Count of mail messages by ThreatType string representation 11585 CountByThreatType interface{} `json:"countByThreatType,omitempty"` 11586 // CountByProtectionStatus - READ-ONLY; Count of mail messages by ProtectionStatus string representation 11587 CountByProtectionStatus interface{} `json:"countByProtectionStatus,omitempty"` 11588 // Threats - READ-ONLY; The threats of mail messages that are part of the mail cluster 11589 Threats *[]string `json:"threats,omitempty"` 11590 // Query - READ-ONLY; The query that was used to identify the messages of the mail cluster 11591 Query *string `json:"query,omitempty"` 11592 // QueryTime - READ-ONLY; The query time 11593 QueryTime *date.Time `json:"queryTime,omitempty"` 11594 // MailCount - READ-ONLY; The number of mail messages that are part of the mail cluster 11595 MailCount *int32 `json:"mailCount,omitempty"` 11596 // IsVolumeAnomaly - READ-ONLY; Is this a volume anomaly mail cluster 11597 IsVolumeAnomaly *bool `json:"isVolumeAnomaly,omitempty"` 11598 // Source - READ-ONLY; The source of the mail cluster (default is 'O365 ATP') 11599 Source *string `json:"source,omitempty"` 11600 // ClusterSourceIdentifier - READ-ONLY; The id of the cluster source 11601 ClusterSourceIdentifier *string `json:"clusterSourceIdentifier,omitempty"` 11602 // ClusterSourceType - READ-ONLY; The type of the cluster source 11603 ClusterSourceType *string `json:"clusterSourceType,omitempty"` 11604 // ClusterQueryStartTime - READ-ONLY; The cluster query start time 11605 ClusterQueryStartTime *date.Time `json:"clusterQueryStartTime,omitempty"` 11606 // ClusterQueryEndTime - READ-ONLY; The cluster query end time 11607 ClusterQueryEndTime *date.Time `json:"clusterQueryEndTime,omitempty"` 11608 // ClusterGroup - READ-ONLY; The cluster group 11609 ClusterGroup *string `json:"clusterGroup,omitempty"` 11610 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 11611 AdditionalData map[string]interface{} `json:"additionalData"` 11612 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 11613 FriendlyName *string `json:"friendlyName,omitempty"` 11614} 11615 11616// MarshalJSON is the custom marshaler for MailClusterEntityProperties. 11617func (mcep MailClusterEntityProperties) MarshalJSON() ([]byte, error) { 11618 objectMap := make(map[string]interface{}) 11619 return json.Marshal(objectMap) 11620} 11621 11622// MailMessageEntity represents a mail message entity. 11623type MailMessageEntity struct { 11624 // MailMessageEntityProperties - Mail message entity properties 11625 *MailMessageEntityProperties `json:"properties,omitempty"` 11626 // ID - READ-ONLY; Azure resource Id 11627 ID *string `json:"id,omitempty"` 11628 // Name - READ-ONLY; Azure resource name 11629 Name *string `json:"name,omitempty"` 11630 // Type - READ-ONLY; Azure resource type 11631 Type *string `json:"type,omitempty"` 11632 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 11633 Kind KindBasicEntity `json:"kind,omitempty"` 11634} 11635 11636// MarshalJSON is the custom marshaler for MailMessageEntity. 11637func (mme MailMessageEntity) MarshalJSON() ([]byte, error) { 11638 mme.Kind = KindBasicEntityKindMailMessage 11639 objectMap := make(map[string]interface{}) 11640 if mme.MailMessageEntityProperties != nil { 11641 objectMap["properties"] = mme.MailMessageEntityProperties 11642 } 11643 if mme.Kind != "" { 11644 objectMap["kind"] = mme.Kind 11645 } 11646 return json.Marshal(objectMap) 11647} 11648 11649// AsAccountEntity is the BasicEntity implementation for MailMessageEntity. 11650func (mme MailMessageEntity) AsAccountEntity() (*AccountEntity, bool) { 11651 return nil, false 11652} 11653 11654// AsAzureResourceEntity is the BasicEntity implementation for MailMessageEntity. 11655func (mme MailMessageEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 11656 return nil, false 11657} 11658 11659// AsCloudApplicationEntity is the BasicEntity implementation for MailMessageEntity. 11660func (mme MailMessageEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 11661 return nil, false 11662} 11663 11664// AsDNSEntity is the BasicEntity implementation for MailMessageEntity. 11665func (mme MailMessageEntity) AsDNSEntity() (*DNSEntity, bool) { 11666 return nil, false 11667} 11668 11669// AsFileEntity is the BasicEntity implementation for MailMessageEntity. 11670func (mme MailMessageEntity) AsFileEntity() (*FileEntity, bool) { 11671 return nil, false 11672} 11673 11674// AsFileHashEntity is the BasicEntity implementation for MailMessageEntity. 11675func (mme MailMessageEntity) AsFileHashEntity() (*FileHashEntity, bool) { 11676 return nil, false 11677} 11678 11679// AsHostEntity is the BasicEntity implementation for MailMessageEntity. 11680func (mme MailMessageEntity) AsHostEntity() (*HostEntity, bool) { 11681 return nil, false 11682} 11683 11684// AsHuntingBookmark is the BasicEntity implementation for MailMessageEntity. 11685func (mme MailMessageEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 11686 return nil, false 11687} 11688 11689// AsSecurityAlert is the BasicEntity implementation for MailMessageEntity. 11690func (mme MailMessageEntity) AsSecurityAlert() (*SecurityAlert, bool) { 11691 return nil, false 11692} 11693 11694// AsIPEntity is the BasicEntity implementation for MailMessageEntity. 11695func (mme MailMessageEntity) AsIPEntity() (*IPEntity, bool) { 11696 return nil, false 11697} 11698 11699// AsMailboxEntity is the BasicEntity implementation for MailMessageEntity. 11700func (mme MailMessageEntity) AsMailboxEntity() (*MailboxEntity, bool) { 11701 return nil, false 11702} 11703 11704// AsMailClusterEntity is the BasicEntity implementation for MailMessageEntity. 11705func (mme MailMessageEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 11706 return nil, false 11707} 11708 11709// AsMailMessageEntity is the BasicEntity implementation for MailMessageEntity. 11710func (mme MailMessageEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 11711 return &mme, true 11712} 11713 11714// AsSubmissionMailEntity is the BasicEntity implementation for MailMessageEntity. 11715func (mme MailMessageEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 11716 return nil, false 11717} 11718 11719// AsMalwareEntity is the BasicEntity implementation for MailMessageEntity. 11720func (mme MailMessageEntity) AsMalwareEntity() (*MalwareEntity, bool) { 11721 return nil, false 11722} 11723 11724// AsProcessEntity is the BasicEntity implementation for MailMessageEntity. 11725func (mme MailMessageEntity) AsProcessEntity() (*ProcessEntity, bool) { 11726 return nil, false 11727} 11728 11729// AsRegistryKeyEntity is the BasicEntity implementation for MailMessageEntity. 11730func (mme MailMessageEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 11731 return nil, false 11732} 11733 11734// AsRegistryValueEntity is the BasicEntity implementation for MailMessageEntity. 11735func (mme MailMessageEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 11736 return nil, false 11737} 11738 11739// AsSecurityGroupEntity is the BasicEntity implementation for MailMessageEntity. 11740func (mme MailMessageEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 11741 return nil, false 11742} 11743 11744// AsURLEntity is the BasicEntity implementation for MailMessageEntity. 11745func (mme MailMessageEntity) AsURLEntity() (*URLEntity, bool) { 11746 return nil, false 11747} 11748 11749// AsIoTDeviceEntity is the BasicEntity implementation for MailMessageEntity. 11750func (mme MailMessageEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 11751 return nil, false 11752} 11753 11754// AsEntity is the BasicEntity implementation for MailMessageEntity. 11755func (mme MailMessageEntity) AsEntity() (*Entity, bool) { 11756 return nil, false 11757} 11758 11759// AsBasicEntity is the BasicEntity implementation for MailMessageEntity. 11760func (mme MailMessageEntity) AsBasicEntity() (BasicEntity, bool) { 11761 return &mme, true 11762} 11763 11764// UnmarshalJSON is the custom unmarshaler for MailMessageEntity struct. 11765func (mme *MailMessageEntity) UnmarshalJSON(body []byte) error { 11766 var m map[string]*json.RawMessage 11767 err := json.Unmarshal(body, &m) 11768 if err != nil { 11769 return err 11770 } 11771 for k, v := range m { 11772 switch k { 11773 case "properties": 11774 if v != nil { 11775 var mailMessageEntityProperties MailMessageEntityProperties 11776 err = json.Unmarshal(*v, &mailMessageEntityProperties) 11777 if err != nil { 11778 return err 11779 } 11780 mme.MailMessageEntityProperties = &mailMessageEntityProperties 11781 } 11782 case "id": 11783 if v != nil { 11784 var ID string 11785 err = json.Unmarshal(*v, &ID) 11786 if err != nil { 11787 return err 11788 } 11789 mme.ID = &ID 11790 } 11791 case "name": 11792 if v != nil { 11793 var name string 11794 err = json.Unmarshal(*v, &name) 11795 if err != nil { 11796 return err 11797 } 11798 mme.Name = &name 11799 } 11800 case "type": 11801 if v != nil { 11802 var typeVar string 11803 err = json.Unmarshal(*v, &typeVar) 11804 if err != nil { 11805 return err 11806 } 11807 mme.Type = &typeVar 11808 } 11809 case "kind": 11810 if v != nil { 11811 var kind KindBasicEntity 11812 err = json.Unmarshal(*v, &kind) 11813 if err != nil { 11814 return err 11815 } 11816 mme.Kind = kind 11817 } 11818 } 11819 } 11820 11821 return nil 11822} 11823 11824// MailMessageEntityProperties mail message entity property bag. 11825type MailMessageEntityProperties struct { 11826 // FileEntityIds - READ-ONLY; The File entity ids of this mail message's attachments 11827 FileEntityIds *[]string `json:"fileEntityIds,omitempty"` 11828 // Recipient - READ-ONLY; The recipient of this mail message. Note that in case of multiple recipients the mail message is forked and each copy has one recipient 11829 Recipient *string `json:"recipient,omitempty"` 11830 // Urls - READ-ONLY; The Urls contained in this mail message 11831 Urls *[]string `json:"urls,omitempty"` 11832 // Threats - READ-ONLY; The threats of this mail message 11833 Threats *[]string `json:"threats,omitempty"` 11834 // P1Sender - READ-ONLY; The p1 sender's email address 11835 P1Sender *string `json:"p1Sender,omitempty"` 11836 // P1SenderDisplayName - READ-ONLY; The p1 sender's display name 11837 P1SenderDisplayName *string `json:"p1SenderDisplayName,omitempty"` 11838 // P1SenderDomain - READ-ONLY; The p1 sender's domain 11839 P1SenderDomain *string `json:"p1SenderDomain,omitempty"` 11840 // SenderIP - READ-ONLY; The sender's IP address 11841 SenderIP *string `json:"senderIP,omitempty"` 11842 // P2Sender - READ-ONLY; The p2 sender's email address 11843 P2Sender *string `json:"p2Sender,omitempty"` 11844 // P2SenderDisplayName - READ-ONLY; The p2 sender's display name 11845 P2SenderDisplayName *string `json:"p2SenderDisplayName,omitempty"` 11846 // P2SenderDomain - READ-ONLY; The p2 sender's domain 11847 P2SenderDomain *string `json:"p2SenderDomain,omitempty"` 11848 // ReceiveDate - READ-ONLY; The receive date of this message 11849 ReceiveDate *date.Time `json:"receiveDate,omitempty"` 11850 // NetworkMessageID - READ-ONLY; The network message id of this mail message 11851 NetworkMessageID *uuid.UUID `json:"networkMessageId,omitempty"` 11852 // InternetMessageID - READ-ONLY; The internet message id of this mail message 11853 InternetMessageID *string `json:"internetMessageId,omitempty"` 11854 // Subject - READ-ONLY; The subject of this mail message 11855 Subject *string `json:"subject,omitempty"` 11856 // Language - READ-ONLY; The language of this mail message 11857 Language *string `json:"language,omitempty"` 11858 // ThreatDetectionMethods - READ-ONLY; The threat detection methods 11859 ThreatDetectionMethods *[]string `json:"threatDetectionMethods,omitempty"` 11860 // BodyFingerprintBin1 - The bodyFingerprintBin1 11861 BodyFingerprintBin1 *int32 `json:"bodyFingerprintBin1,omitempty"` 11862 // BodyFingerprintBin2 - The bodyFingerprintBin2 11863 BodyFingerprintBin2 *int32 `json:"bodyFingerprintBin2,omitempty"` 11864 // BodyFingerprintBin3 - The bodyFingerprintBin3 11865 BodyFingerprintBin3 *int32 `json:"bodyFingerprintBin3,omitempty"` 11866 // BodyFingerprintBin4 - The bodyFingerprintBin4 11867 BodyFingerprintBin4 *int32 `json:"bodyFingerprintBin4,omitempty"` 11868 // BodyFingerprintBin5 - The bodyFingerprintBin5 11869 BodyFingerprintBin5 *int32 `json:"bodyFingerprintBin5,omitempty"` 11870 // AntispamDirection - The directionality of this mail message. Possible values include: 'AntispamMailDirectionUnknown', 'AntispamMailDirectionInbound', 'AntispamMailDirectionOutbound', 'AntispamMailDirectionIntraorg' 11871 AntispamDirection AntispamMailDirection `json:"antispamDirection,omitempty"` 11872 // DeliveryAction - The delivery action of this mail message like Delivered, Blocked, Replaced etc. Possible values include: 'DeliveryActionUnknown', 'DeliveryActionDeliveredAsSpam', 'DeliveryActionDelivered', 'DeliveryActionBlocked', 'DeliveryActionReplaced' 11873 DeliveryAction DeliveryAction `json:"deliveryAction,omitempty"` 11874 // DeliveryLocation - The delivery location of this mail message like Inbox, JunkFolder etc. Possible values include: 'DeliveryLocationUnknown', 'DeliveryLocationInbox', 'DeliveryLocationJunkFolder', 'DeliveryLocationDeletedFolder', 'DeliveryLocationQuarantine', 'DeliveryLocationExternal', 'DeliveryLocationFailed', 'DeliveryLocationDropped', 'DeliveryLocationForwarded' 11875 DeliveryLocation DeliveryLocation `json:"deliveryLocation,omitempty"` 11876 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 11877 AdditionalData map[string]interface{} `json:"additionalData"` 11878 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 11879 FriendlyName *string `json:"friendlyName,omitempty"` 11880} 11881 11882// MarshalJSON is the custom marshaler for MailMessageEntityProperties. 11883func (mmep MailMessageEntityProperties) MarshalJSON() ([]byte, error) { 11884 objectMap := make(map[string]interface{}) 11885 if mmep.BodyFingerprintBin1 != nil { 11886 objectMap["bodyFingerprintBin1"] = mmep.BodyFingerprintBin1 11887 } 11888 if mmep.BodyFingerprintBin2 != nil { 11889 objectMap["bodyFingerprintBin2"] = mmep.BodyFingerprintBin2 11890 } 11891 if mmep.BodyFingerprintBin3 != nil { 11892 objectMap["bodyFingerprintBin3"] = mmep.BodyFingerprintBin3 11893 } 11894 if mmep.BodyFingerprintBin4 != nil { 11895 objectMap["bodyFingerprintBin4"] = mmep.BodyFingerprintBin4 11896 } 11897 if mmep.BodyFingerprintBin5 != nil { 11898 objectMap["bodyFingerprintBin5"] = mmep.BodyFingerprintBin5 11899 } 11900 if mmep.AntispamDirection != "" { 11901 objectMap["antispamDirection"] = mmep.AntispamDirection 11902 } 11903 if mmep.DeliveryAction != "" { 11904 objectMap["deliveryAction"] = mmep.DeliveryAction 11905 } 11906 if mmep.DeliveryLocation != "" { 11907 objectMap["deliveryLocation"] = mmep.DeliveryLocation 11908 } 11909 return json.Marshal(objectMap) 11910} 11911 11912// MalwareEntity represents a malware entity. 11913type MalwareEntity struct { 11914 // MalwareEntityProperties - File entity properties 11915 *MalwareEntityProperties `json:"properties,omitempty"` 11916 // ID - READ-ONLY; Azure resource Id 11917 ID *string `json:"id,omitempty"` 11918 // Name - READ-ONLY; Azure resource name 11919 Name *string `json:"name,omitempty"` 11920 // Type - READ-ONLY; Azure resource type 11921 Type *string `json:"type,omitempty"` 11922 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 11923 Kind KindBasicEntity `json:"kind,omitempty"` 11924} 11925 11926// MarshalJSON is the custom marshaler for MalwareEntity. 11927func (me MalwareEntity) MarshalJSON() ([]byte, error) { 11928 me.Kind = KindBasicEntityKindMalware 11929 objectMap := make(map[string]interface{}) 11930 if me.MalwareEntityProperties != nil { 11931 objectMap["properties"] = me.MalwareEntityProperties 11932 } 11933 if me.Kind != "" { 11934 objectMap["kind"] = me.Kind 11935 } 11936 return json.Marshal(objectMap) 11937} 11938 11939// AsAccountEntity is the BasicEntity implementation for MalwareEntity. 11940func (me MalwareEntity) AsAccountEntity() (*AccountEntity, bool) { 11941 return nil, false 11942} 11943 11944// AsAzureResourceEntity is the BasicEntity implementation for MalwareEntity. 11945func (me MalwareEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 11946 return nil, false 11947} 11948 11949// AsCloudApplicationEntity is the BasicEntity implementation for MalwareEntity. 11950func (me MalwareEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 11951 return nil, false 11952} 11953 11954// AsDNSEntity is the BasicEntity implementation for MalwareEntity. 11955func (me MalwareEntity) AsDNSEntity() (*DNSEntity, bool) { 11956 return nil, false 11957} 11958 11959// AsFileEntity is the BasicEntity implementation for MalwareEntity. 11960func (me MalwareEntity) AsFileEntity() (*FileEntity, bool) { 11961 return nil, false 11962} 11963 11964// AsFileHashEntity is the BasicEntity implementation for MalwareEntity. 11965func (me MalwareEntity) AsFileHashEntity() (*FileHashEntity, bool) { 11966 return nil, false 11967} 11968 11969// AsHostEntity is the BasicEntity implementation for MalwareEntity. 11970func (me MalwareEntity) AsHostEntity() (*HostEntity, bool) { 11971 return nil, false 11972} 11973 11974// AsHuntingBookmark is the BasicEntity implementation for MalwareEntity. 11975func (me MalwareEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 11976 return nil, false 11977} 11978 11979// AsSecurityAlert is the BasicEntity implementation for MalwareEntity. 11980func (me MalwareEntity) AsSecurityAlert() (*SecurityAlert, bool) { 11981 return nil, false 11982} 11983 11984// AsIPEntity is the BasicEntity implementation for MalwareEntity. 11985func (me MalwareEntity) AsIPEntity() (*IPEntity, bool) { 11986 return nil, false 11987} 11988 11989// AsMailboxEntity is the BasicEntity implementation for MalwareEntity. 11990func (me MalwareEntity) AsMailboxEntity() (*MailboxEntity, bool) { 11991 return nil, false 11992} 11993 11994// AsMailClusterEntity is the BasicEntity implementation for MalwareEntity. 11995func (me MalwareEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 11996 return nil, false 11997} 11998 11999// AsMailMessageEntity is the BasicEntity implementation for MalwareEntity. 12000func (me MalwareEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 12001 return nil, false 12002} 12003 12004// AsSubmissionMailEntity is the BasicEntity implementation for MalwareEntity. 12005func (me MalwareEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 12006 return nil, false 12007} 12008 12009// AsMalwareEntity is the BasicEntity implementation for MalwareEntity. 12010func (me MalwareEntity) AsMalwareEntity() (*MalwareEntity, bool) { 12011 return &me, true 12012} 12013 12014// AsProcessEntity is the BasicEntity implementation for MalwareEntity. 12015func (me MalwareEntity) AsProcessEntity() (*ProcessEntity, bool) { 12016 return nil, false 12017} 12018 12019// AsRegistryKeyEntity is the BasicEntity implementation for MalwareEntity. 12020func (me MalwareEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 12021 return nil, false 12022} 12023 12024// AsRegistryValueEntity is the BasicEntity implementation for MalwareEntity. 12025func (me MalwareEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 12026 return nil, false 12027} 12028 12029// AsSecurityGroupEntity is the BasicEntity implementation for MalwareEntity. 12030func (me MalwareEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 12031 return nil, false 12032} 12033 12034// AsURLEntity is the BasicEntity implementation for MalwareEntity. 12035func (me MalwareEntity) AsURLEntity() (*URLEntity, bool) { 12036 return nil, false 12037} 12038 12039// AsIoTDeviceEntity is the BasicEntity implementation for MalwareEntity. 12040func (me MalwareEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 12041 return nil, false 12042} 12043 12044// AsEntity is the BasicEntity implementation for MalwareEntity. 12045func (me MalwareEntity) AsEntity() (*Entity, bool) { 12046 return nil, false 12047} 12048 12049// AsBasicEntity is the BasicEntity implementation for MalwareEntity. 12050func (me MalwareEntity) AsBasicEntity() (BasicEntity, bool) { 12051 return &me, true 12052} 12053 12054// UnmarshalJSON is the custom unmarshaler for MalwareEntity struct. 12055func (me *MalwareEntity) UnmarshalJSON(body []byte) error { 12056 var m map[string]*json.RawMessage 12057 err := json.Unmarshal(body, &m) 12058 if err != nil { 12059 return err 12060 } 12061 for k, v := range m { 12062 switch k { 12063 case "properties": 12064 if v != nil { 12065 var malwareEntityProperties MalwareEntityProperties 12066 err = json.Unmarshal(*v, &malwareEntityProperties) 12067 if err != nil { 12068 return err 12069 } 12070 me.MalwareEntityProperties = &malwareEntityProperties 12071 } 12072 case "id": 12073 if v != nil { 12074 var ID string 12075 err = json.Unmarshal(*v, &ID) 12076 if err != nil { 12077 return err 12078 } 12079 me.ID = &ID 12080 } 12081 case "name": 12082 if v != nil { 12083 var name string 12084 err = json.Unmarshal(*v, &name) 12085 if err != nil { 12086 return err 12087 } 12088 me.Name = &name 12089 } 12090 case "type": 12091 if v != nil { 12092 var typeVar string 12093 err = json.Unmarshal(*v, &typeVar) 12094 if err != nil { 12095 return err 12096 } 12097 me.Type = &typeVar 12098 } 12099 case "kind": 12100 if v != nil { 12101 var kind KindBasicEntity 12102 err = json.Unmarshal(*v, &kind) 12103 if err != nil { 12104 return err 12105 } 12106 me.Kind = kind 12107 } 12108 } 12109 } 12110 12111 return nil 12112} 12113 12114// MalwareEntityProperties malware entity property bag. 12115type MalwareEntityProperties struct { 12116 // Category - READ-ONLY; The malware category by the vendor, e.g. Trojan 12117 Category *string `json:"category,omitempty"` 12118 // FileEntityIds - READ-ONLY; List of linked file entity identifiers on which the malware was found 12119 FileEntityIds *[]string `json:"fileEntityIds,omitempty"` 12120 // MalwareName - READ-ONLY; The malware name by the vendor, e.g. Win32/Toga!rfn 12121 MalwareName *string `json:"malwareName,omitempty"` 12122 // ProcessEntityIds - READ-ONLY; List of linked process entity identifiers on which the malware was found. 12123 ProcessEntityIds *[]string `json:"processEntityIds,omitempty"` 12124 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 12125 AdditionalData map[string]interface{} `json:"additionalData"` 12126 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 12127 FriendlyName *string `json:"friendlyName,omitempty"` 12128} 12129 12130// MarshalJSON is the custom marshaler for MalwareEntityProperties. 12131func (mep MalwareEntityProperties) MarshalJSON() ([]byte, error) { 12132 objectMap := make(map[string]interface{}) 12133 return json.Marshal(objectMap) 12134} 12135 12136// MCASCheckRequirements represents MCAS (Microsoft Cloud App Security) requirements check request. 12137type MCASCheckRequirements struct { 12138 // MCASCheckRequirementsProperties - MCAS (Microsoft Cloud App Security) requirements check properties. 12139 *MCASCheckRequirementsProperties `json:"properties,omitempty"` 12140 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 12141 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 12142} 12143 12144// MarshalJSON is the custom marshaler for MCASCheckRequirements. 12145func (mcr MCASCheckRequirements) MarshalJSON() ([]byte, error) { 12146 mcr.Kind = KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity 12147 objectMap := make(map[string]interface{}) 12148 if mcr.MCASCheckRequirementsProperties != nil { 12149 objectMap["properties"] = mcr.MCASCheckRequirementsProperties 12150 } 12151 if mcr.Kind != "" { 12152 objectMap["kind"] = mcr.Kind 12153 } 12154 return json.Marshal(objectMap) 12155} 12156 12157// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12158func (mcr MCASCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 12159 return nil, false 12160} 12161 12162// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12163func (mcr MCASCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 12164 return nil, false 12165} 12166 12167// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12168func (mcr MCASCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 12169 return nil, false 12170} 12171 12172// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12173func (mcr MCASCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 12174 return nil, false 12175} 12176 12177// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12178func (mcr MCASCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 12179 return nil, false 12180} 12181 12182// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12183func (mcr MCASCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 12184 return nil, false 12185} 12186 12187// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12188func (mcr MCASCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 12189 return nil, false 12190} 12191 12192// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12193func (mcr MCASCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 12194 return &mcr, true 12195} 12196 12197// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12198func (mcr MCASCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 12199 return nil, false 12200} 12201 12202// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12203func (mcr MCASCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 12204 return nil, false 12205} 12206 12207// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12208func (mcr MCASCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 12209 return nil, false 12210} 12211 12212// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12213func (mcr MCASCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 12214 return nil, false 12215} 12216 12217// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12218func (mcr MCASCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 12219 return nil, false 12220} 12221 12222// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MCASCheckRequirements. 12223func (mcr MCASCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 12224 return &mcr, true 12225} 12226 12227// UnmarshalJSON is the custom unmarshaler for MCASCheckRequirements struct. 12228func (mcr *MCASCheckRequirements) UnmarshalJSON(body []byte) error { 12229 var m map[string]*json.RawMessage 12230 err := json.Unmarshal(body, &m) 12231 if err != nil { 12232 return err 12233 } 12234 for k, v := range m { 12235 switch k { 12236 case "properties": 12237 if v != nil { 12238 var mCASCheckRequirementsProperties MCASCheckRequirementsProperties 12239 err = json.Unmarshal(*v, &mCASCheckRequirementsProperties) 12240 if err != nil { 12241 return err 12242 } 12243 mcr.MCASCheckRequirementsProperties = &mCASCheckRequirementsProperties 12244 } 12245 case "kind": 12246 if v != nil { 12247 var kind KindBasicDataConnectorsCheckRequirements 12248 err = json.Unmarshal(*v, &kind) 12249 if err != nil { 12250 return err 12251 } 12252 mcr.Kind = kind 12253 } 12254 } 12255 } 12256 12257 return nil 12258} 12259 12260// MCASCheckRequirementsProperties MCAS (Microsoft Cloud App Security) requirements check properties. 12261type MCASCheckRequirementsProperties struct { 12262 // TenantID - The tenant id to connect to, and get the data from. 12263 TenantID *string `json:"tenantId,omitempty"` 12264} 12265 12266// MCASDataConnector represents MCAS (Microsoft Cloud App Security) data connector. 12267type MCASDataConnector struct { 12268 // MCASDataConnectorProperties - MCAS (Microsoft Cloud App Security) data connector properties. 12269 *MCASDataConnectorProperties `json:"properties,omitempty"` 12270 // ID - READ-ONLY; Azure resource Id 12271 ID *string `json:"id,omitempty"` 12272 // Name - READ-ONLY; Azure resource name 12273 Name *string `json:"name,omitempty"` 12274 // Type - READ-ONLY; Azure resource type 12275 Type *string `json:"type,omitempty"` 12276 // Etag - Etag of the azure resource 12277 Etag *string `json:"etag,omitempty"` 12278 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 12279 Kind KindBasicDataConnector `json:"kind,omitempty"` 12280} 12281 12282// MarshalJSON is the custom marshaler for MCASDataConnector. 12283func (mdc MCASDataConnector) MarshalJSON() ([]byte, error) { 12284 mdc.Kind = KindBasicDataConnectorKindMicrosoftCloudAppSecurity 12285 objectMap := make(map[string]interface{}) 12286 if mdc.MCASDataConnectorProperties != nil { 12287 objectMap["properties"] = mdc.MCASDataConnectorProperties 12288 } 12289 if mdc.Etag != nil { 12290 objectMap["etag"] = mdc.Etag 12291 } 12292 if mdc.Kind != "" { 12293 objectMap["kind"] = mdc.Kind 12294 } 12295 return json.Marshal(objectMap) 12296} 12297 12298// AsAADDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12299func (mdc MCASDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 12300 return nil, false 12301} 12302 12303// AsAATPDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12304func (mdc MCASDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 12305 return nil, false 12306} 12307 12308// AsMSTIDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12309func (mdc MCASDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 12310 return nil, false 12311} 12312 12313// AsMTPDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12314func (mdc MCASDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 12315 return nil, false 12316} 12317 12318// AsASCDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12319func (mdc MCASDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 12320 return nil, false 12321} 12322 12323// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12324func (mdc MCASDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 12325 return nil, false 12326} 12327 12328// AsDynamics365DataConnector is the BasicDataConnector implementation for MCASDataConnector. 12329func (mdc MCASDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 12330 return nil, false 12331} 12332 12333// AsMCASDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12334func (mdc MCASDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 12335 return &mdc, true 12336} 12337 12338// AsMDATPDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12339func (mdc MCASDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 12340 return nil, false 12341} 12342 12343// AsOfficeATPDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12344func (mdc MCASDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 12345 return nil, false 12346} 12347 12348// AsOfficeDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12349func (mdc MCASDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 12350 return nil, false 12351} 12352 12353// AsTIDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12354func (mdc MCASDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 12355 return nil, false 12356} 12357 12358// AsTiTaxiiDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12359func (mdc MCASDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 12360 return nil, false 12361} 12362 12363// AsDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12364func (mdc MCASDataConnector) AsDataConnector() (*DataConnector, bool) { 12365 return nil, false 12366} 12367 12368// AsBasicDataConnector is the BasicDataConnector implementation for MCASDataConnector. 12369func (mdc MCASDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 12370 return &mdc, true 12371} 12372 12373// UnmarshalJSON is the custom unmarshaler for MCASDataConnector struct. 12374func (mdc *MCASDataConnector) UnmarshalJSON(body []byte) error { 12375 var m map[string]*json.RawMessage 12376 err := json.Unmarshal(body, &m) 12377 if err != nil { 12378 return err 12379 } 12380 for k, v := range m { 12381 switch k { 12382 case "properties": 12383 if v != nil { 12384 var mCASDataConnectorProperties MCASDataConnectorProperties 12385 err = json.Unmarshal(*v, &mCASDataConnectorProperties) 12386 if err != nil { 12387 return err 12388 } 12389 mdc.MCASDataConnectorProperties = &mCASDataConnectorProperties 12390 } 12391 case "id": 12392 if v != nil { 12393 var ID string 12394 err = json.Unmarshal(*v, &ID) 12395 if err != nil { 12396 return err 12397 } 12398 mdc.ID = &ID 12399 } 12400 case "name": 12401 if v != nil { 12402 var name string 12403 err = json.Unmarshal(*v, &name) 12404 if err != nil { 12405 return err 12406 } 12407 mdc.Name = &name 12408 } 12409 case "type": 12410 if v != nil { 12411 var typeVar string 12412 err = json.Unmarshal(*v, &typeVar) 12413 if err != nil { 12414 return err 12415 } 12416 mdc.Type = &typeVar 12417 } 12418 case "etag": 12419 if v != nil { 12420 var etag string 12421 err = json.Unmarshal(*v, &etag) 12422 if err != nil { 12423 return err 12424 } 12425 mdc.Etag = &etag 12426 } 12427 case "kind": 12428 if v != nil { 12429 var kind KindBasicDataConnector 12430 err = json.Unmarshal(*v, &kind) 12431 if err != nil { 12432 return err 12433 } 12434 mdc.Kind = kind 12435 } 12436 } 12437 } 12438 12439 return nil 12440} 12441 12442// MCASDataConnectorDataTypes the available data types for MCAS (Microsoft Cloud App Security) data 12443// connector. 12444type MCASDataConnectorDataTypes struct { 12445 // DiscoveryLogs - Discovery log data type connection. 12446 DiscoveryLogs *MCASDataConnectorDataTypesDiscoveryLogs `json:"discoveryLogs,omitempty"` 12447 // Alerts - Alerts data type connection. 12448 Alerts *AlertsDataTypeOfDataConnectorAlerts `json:"alerts,omitempty"` 12449} 12450 12451// MCASDataConnectorDataTypesDiscoveryLogs discovery log data type connection. 12452type MCASDataConnectorDataTypesDiscoveryLogs struct { 12453 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 12454 State DataTypeState `json:"state,omitempty"` 12455} 12456 12457// MCASDataConnectorProperties MCAS (Microsoft Cloud App Security) data connector properties. 12458type MCASDataConnectorProperties struct { 12459 // DataTypes - The available data types for the connector. 12460 DataTypes *MCASDataConnectorDataTypes `json:"dataTypes,omitempty"` 12461 // TenantID - The tenant id to connect to, and get the data from. 12462 TenantID *string `json:"tenantId,omitempty"` 12463} 12464 12465// MDATPCheckRequirements represents MDATP (Microsoft Defender Advanced Threat Protection) requirements 12466// check request. 12467type MDATPCheckRequirements struct { 12468 // MDATPCheckRequirementsProperties - MDATP (Microsoft Defender Advanced Threat Protection) requirements check properties. 12469 *MDATPCheckRequirementsProperties `json:"properties,omitempty"` 12470 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 12471 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 12472} 12473 12474// MarshalJSON is the custom marshaler for MDATPCheckRequirements. 12475func (mcr MDATPCheckRequirements) MarshalJSON() ([]byte, error) { 12476 mcr.Kind = KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection 12477 objectMap := make(map[string]interface{}) 12478 if mcr.MDATPCheckRequirementsProperties != nil { 12479 objectMap["properties"] = mcr.MDATPCheckRequirementsProperties 12480 } 12481 if mcr.Kind != "" { 12482 objectMap["kind"] = mcr.Kind 12483 } 12484 return json.Marshal(objectMap) 12485} 12486 12487// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12488func (mcr MDATPCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 12489 return nil, false 12490} 12491 12492// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12493func (mcr MDATPCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 12494 return nil, false 12495} 12496 12497// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12498func (mcr MDATPCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 12499 return nil, false 12500} 12501 12502// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12503func (mcr MDATPCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 12504 return nil, false 12505} 12506 12507// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12508func (mcr MDATPCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 12509 return nil, false 12510} 12511 12512// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12513func (mcr MDATPCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 12514 return nil, false 12515} 12516 12517// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12518func (mcr MDATPCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 12519 return nil, false 12520} 12521 12522// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12523func (mcr MDATPCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 12524 return nil, false 12525} 12526 12527// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12528func (mcr MDATPCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 12529 return &mcr, true 12530} 12531 12532// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12533func (mcr MDATPCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 12534 return nil, false 12535} 12536 12537// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12538func (mcr MDATPCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 12539 return nil, false 12540} 12541 12542// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12543func (mcr MDATPCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 12544 return nil, false 12545} 12546 12547// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12548func (mcr MDATPCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 12549 return nil, false 12550} 12551 12552// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MDATPCheckRequirements. 12553func (mcr MDATPCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 12554 return &mcr, true 12555} 12556 12557// UnmarshalJSON is the custom unmarshaler for MDATPCheckRequirements struct. 12558func (mcr *MDATPCheckRequirements) UnmarshalJSON(body []byte) error { 12559 var m map[string]*json.RawMessage 12560 err := json.Unmarshal(body, &m) 12561 if err != nil { 12562 return err 12563 } 12564 for k, v := range m { 12565 switch k { 12566 case "properties": 12567 if v != nil { 12568 var mDATPCheckRequirementsProperties MDATPCheckRequirementsProperties 12569 err = json.Unmarshal(*v, &mDATPCheckRequirementsProperties) 12570 if err != nil { 12571 return err 12572 } 12573 mcr.MDATPCheckRequirementsProperties = &mDATPCheckRequirementsProperties 12574 } 12575 case "kind": 12576 if v != nil { 12577 var kind KindBasicDataConnectorsCheckRequirements 12578 err = json.Unmarshal(*v, &kind) 12579 if err != nil { 12580 return err 12581 } 12582 mcr.Kind = kind 12583 } 12584 } 12585 } 12586 12587 return nil 12588} 12589 12590// MDATPCheckRequirementsProperties MDATP (Microsoft Defender Advanced Threat Protection) requirements 12591// check properties. 12592type MDATPCheckRequirementsProperties struct { 12593 // TenantID - The tenant id to connect to, and get the data from. 12594 TenantID *string `json:"tenantId,omitempty"` 12595} 12596 12597// MDATPDataConnector represents MDATP (Microsoft Defender Advanced Threat Protection) data connector. 12598type MDATPDataConnector struct { 12599 // MDATPDataConnectorProperties - MDATP (Microsoft Defender Advanced Threat Protection) data connector properties. 12600 *MDATPDataConnectorProperties `json:"properties,omitempty"` 12601 // ID - READ-ONLY; Azure resource Id 12602 ID *string `json:"id,omitempty"` 12603 // Name - READ-ONLY; Azure resource name 12604 Name *string `json:"name,omitempty"` 12605 // Type - READ-ONLY; Azure resource type 12606 Type *string `json:"type,omitempty"` 12607 // Etag - Etag of the azure resource 12608 Etag *string `json:"etag,omitempty"` 12609 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 12610 Kind KindBasicDataConnector `json:"kind,omitempty"` 12611} 12612 12613// MarshalJSON is the custom marshaler for MDATPDataConnector. 12614func (mdc MDATPDataConnector) MarshalJSON() ([]byte, error) { 12615 mdc.Kind = KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection 12616 objectMap := make(map[string]interface{}) 12617 if mdc.MDATPDataConnectorProperties != nil { 12618 objectMap["properties"] = mdc.MDATPDataConnectorProperties 12619 } 12620 if mdc.Etag != nil { 12621 objectMap["etag"] = mdc.Etag 12622 } 12623 if mdc.Kind != "" { 12624 objectMap["kind"] = mdc.Kind 12625 } 12626 return json.Marshal(objectMap) 12627} 12628 12629// AsAADDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12630func (mdc MDATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 12631 return nil, false 12632} 12633 12634// AsAATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12635func (mdc MDATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 12636 return nil, false 12637} 12638 12639// AsMSTIDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12640func (mdc MDATPDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 12641 return nil, false 12642} 12643 12644// AsMTPDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12645func (mdc MDATPDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 12646 return nil, false 12647} 12648 12649// AsASCDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12650func (mdc MDATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 12651 return nil, false 12652} 12653 12654// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12655func (mdc MDATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 12656 return nil, false 12657} 12658 12659// AsDynamics365DataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12660func (mdc MDATPDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 12661 return nil, false 12662} 12663 12664// AsMCASDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12665func (mdc MDATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 12666 return nil, false 12667} 12668 12669// AsMDATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12670func (mdc MDATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 12671 return &mdc, true 12672} 12673 12674// AsOfficeATPDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12675func (mdc MDATPDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 12676 return nil, false 12677} 12678 12679// AsOfficeDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12680func (mdc MDATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 12681 return nil, false 12682} 12683 12684// AsTIDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12685func (mdc MDATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 12686 return nil, false 12687} 12688 12689// AsTiTaxiiDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12690func (mdc MDATPDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 12691 return nil, false 12692} 12693 12694// AsDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12695func (mdc MDATPDataConnector) AsDataConnector() (*DataConnector, bool) { 12696 return nil, false 12697} 12698 12699// AsBasicDataConnector is the BasicDataConnector implementation for MDATPDataConnector. 12700func (mdc MDATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 12701 return &mdc, true 12702} 12703 12704// UnmarshalJSON is the custom unmarshaler for MDATPDataConnector struct. 12705func (mdc *MDATPDataConnector) UnmarshalJSON(body []byte) error { 12706 var m map[string]*json.RawMessage 12707 err := json.Unmarshal(body, &m) 12708 if err != nil { 12709 return err 12710 } 12711 for k, v := range m { 12712 switch k { 12713 case "properties": 12714 if v != nil { 12715 var mDATPDataConnectorProperties MDATPDataConnectorProperties 12716 err = json.Unmarshal(*v, &mDATPDataConnectorProperties) 12717 if err != nil { 12718 return err 12719 } 12720 mdc.MDATPDataConnectorProperties = &mDATPDataConnectorProperties 12721 } 12722 case "id": 12723 if v != nil { 12724 var ID string 12725 err = json.Unmarshal(*v, &ID) 12726 if err != nil { 12727 return err 12728 } 12729 mdc.ID = &ID 12730 } 12731 case "name": 12732 if v != nil { 12733 var name string 12734 err = json.Unmarshal(*v, &name) 12735 if err != nil { 12736 return err 12737 } 12738 mdc.Name = &name 12739 } 12740 case "type": 12741 if v != nil { 12742 var typeVar string 12743 err = json.Unmarshal(*v, &typeVar) 12744 if err != nil { 12745 return err 12746 } 12747 mdc.Type = &typeVar 12748 } 12749 case "etag": 12750 if v != nil { 12751 var etag string 12752 err = json.Unmarshal(*v, &etag) 12753 if err != nil { 12754 return err 12755 } 12756 mdc.Etag = &etag 12757 } 12758 case "kind": 12759 if v != nil { 12760 var kind KindBasicDataConnector 12761 err = json.Unmarshal(*v, &kind) 12762 if err != nil { 12763 return err 12764 } 12765 mdc.Kind = kind 12766 } 12767 } 12768 } 12769 12770 return nil 12771} 12772 12773// MDATPDataConnectorProperties MDATP (Microsoft Defender Advanced Threat Protection) data connector 12774// properties. 12775type MDATPDataConnectorProperties struct { 12776 // TenantID - The tenant id to connect to, and get the data from. 12777 TenantID *string `json:"tenantId,omitempty"` 12778 // DataTypes - The available data types for the connector. 12779 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 12780} 12781 12782// MicrosoftSecurityIncidentCreationAlertRule represents MicrosoftSecurityIncidentCreation rule. 12783type MicrosoftSecurityIncidentCreationAlertRule struct { 12784 // MicrosoftSecurityIncidentCreationAlertRuleProperties - MicrosoftSecurityIncidentCreation rule properties 12785 *MicrosoftSecurityIncidentCreationAlertRuleProperties `json:"properties,omitempty"` 12786 // ID - READ-ONLY; Azure resource Id 12787 ID *string `json:"id,omitempty"` 12788 // Name - READ-ONLY; Azure resource name 12789 Name *string `json:"name,omitempty"` 12790 // Type - READ-ONLY; Azure resource type 12791 Type *string `json:"type,omitempty"` 12792 // Etag - Etag of the azure resource 12793 Etag *string `json:"etag,omitempty"` 12794 // Kind - Possible values include: 'KindBasicAlertRuleKindAlertRule', 'KindBasicAlertRuleKindMLBehaviorAnalytics', 'KindBasicAlertRuleKindFusion', 'KindBasicAlertRuleKindThreatIntelligence', 'KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleKindScheduled' 12795 Kind KindBasicAlertRule `json:"kind,omitempty"` 12796} 12797 12798// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRule. 12799func (msicar MicrosoftSecurityIncidentCreationAlertRule) MarshalJSON() ([]byte, error) { 12800 msicar.Kind = KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation 12801 objectMap := make(map[string]interface{}) 12802 if msicar.MicrosoftSecurityIncidentCreationAlertRuleProperties != nil { 12803 objectMap["properties"] = msicar.MicrosoftSecurityIncidentCreationAlertRuleProperties 12804 } 12805 if msicar.Etag != nil { 12806 objectMap["etag"] = msicar.Etag 12807 } 12808 if msicar.Kind != "" { 12809 objectMap["kind"] = msicar.Kind 12810 } 12811 return json.Marshal(objectMap) 12812} 12813 12814// AsMLBehaviorAnalyticsAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12815func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) { 12816 return nil, false 12817} 12818 12819// AsFusionAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12820func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 12821 return nil, false 12822} 12823 12824// AsThreatIntelligenceAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12825func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) { 12826 return nil, false 12827} 12828 12829// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12830func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 12831 return &msicar, true 12832} 12833 12834// AsScheduledAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12835func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 12836 return nil, false 12837} 12838 12839// AsAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12840func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsAlertRule() (*AlertRule, bool) { 12841 return nil, false 12842} 12843 12844// AsBasicAlertRule is the BasicAlertRule implementation for MicrosoftSecurityIncidentCreationAlertRule. 12845func (msicar MicrosoftSecurityIncidentCreationAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 12846 return &msicar, true 12847} 12848 12849// UnmarshalJSON is the custom unmarshaler for MicrosoftSecurityIncidentCreationAlertRule struct. 12850func (msicar *MicrosoftSecurityIncidentCreationAlertRule) UnmarshalJSON(body []byte) error { 12851 var m map[string]*json.RawMessage 12852 err := json.Unmarshal(body, &m) 12853 if err != nil { 12854 return err 12855 } 12856 for k, v := range m { 12857 switch k { 12858 case "properties": 12859 if v != nil { 12860 var microsoftSecurityIncidentCreationAlertRuleProperties MicrosoftSecurityIncidentCreationAlertRuleProperties 12861 err = json.Unmarshal(*v, µsoftSecurityIncidentCreationAlertRuleProperties) 12862 if err != nil { 12863 return err 12864 } 12865 msicar.MicrosoftSecurityIncidentCreationAlertRuleProperties = µsoftSecurityIncidentCreationAlertRuleProperties 12866 } 12867 case "id": 12868 if v != nil { 12869 var ID string 12870 err = json.Unmarshal(*v, &ID) 12871 if err != nil { 12872 return err 12873 } 12874 msicar.ID = &ID 12875 } 12876 case "name": 12877 if v != nil { 12878 var name string 12879 err = json.Unmarshal(*v, &name) 12880 if err != nil { 12881 return err 12882 } 12883 msicar.Name = &name 12884 } 12885 case "type": 12886 if v != nil { 12887 var typeVar string 12888 err = json.Unmarshal(*v, &typeVar) 12889 if err != nil { 12890 return err 12891 } 12892 msicar.Type = &typeVar 12893 } 12894 case "etag": 12895 if v != nil { 12896 var etag string 12897 err = json.Unmarshal(*v, &etag) 12898 if err != nil { 12899 return err 12900 } 12901 msicar.Etag = &etag 12902 } 12903 case "kind": 12904 if v != nil { 12905 var kind KindBasicAlertRule 12906 err = json.Unmarshal(*v, &kind) 12907 if err != nil { 12908 return err 12909 } 12910 msicar.Kind = kind 12911 } 12912 } 12913 } 12914 12915 return nil 12916} 12917 12918// MicrosoftSecurityIncidentCreationAlertRuleCommonProperties microsoftSecurityIncidentCreation rule common 12919// property bag. 12920type MicrosoftSecurityIncidentCreationAlertRuleCommonProperties struct { 12921 // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated 12922 DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"` 12923 // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated 12924 DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"` 12925 // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftSecurityProductNameMicrosoftCloudAppSecurity', 'MicrosoftSecurityProductNameAzureSecurityCenter', 'MicrosoftSecurityProductNameAzureAdvancedThreatProtection', 'MicrosoftSecurityProductNameAzureActiveDirectoryIdentityProtection', 'MicrosoftSecurityProductNameAzureSecurityCenterforIoT', 'MicrosoftSecurityProductNameOffice365AdvancedThreatProtection', 'MicrosoftSecurityProductNameMicrosoftDefenderAdvancedThreatProtection' 12926 ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"` 12927 // SeveritiesFilter - the alerts' severities on which the cases will be generated 12928 SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"` 12929} 12930 12931// MicrosoftSecurityIncidentCreationAlertRuleProperties microsoftSecurityIncidentCreation rule property 12932// bag. 12933type MicrosoftSecurityIncidentCreationAlertRuleProperties struct { 12934 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 12935 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 12936 // Description - The description of the alert rule. 12937 Description *string `json:"description,omitempty"` 12938 // DisplayName - The display name for alerts created by this alert rule. 12939 DisplayName *string `json:"displayName,omitempty"` 12940 // Enabled - Determines whether this alert rule is enabled or disabled. 12941 Enabled *bool `json:"enabled,omitempty"` 12942 // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified. 12943 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 12944 // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated 12945 DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"` 12946 // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated 12947 DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"` 12948 // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftSecurityProductNameMicrosoftCloudAppSecurity', 'MicrosoftSecurityProductNameAzureSecurityCenter', 'MicrosoftSecurityProductNameAzureAdvancedThreatProtection', 'MicrosoftSecurityProductNameAzureActiveDirectoryIdentityProtection', 'MicrosoftSecurityProductNameAzureSecurityCenterforIoT', 'MicrosoftSecurityProductNameOffice365AdvancedThreatProtection', 'MicrosoftSecurityProductNameMicrosoftDefenderAdvancedThreatProtection' 12949 ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"` 12950 // SeveritiesFilter - the alerts' severities on which the cases will be generated 12951 SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"` 12952} 12953 12954// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleProperties. 12955func (msicarp MicrosoftSecurityIncidentCreationAlertRuleProperties) MarshalJSON() ([]byte, error) { 12956 objectMap := make(map[string]interface{}) 12957 if msicarp.AlertRuleTemplateName != nil { 12958 objectMap["alertRuleTemplateName"] = msicarp.AlertRuleTemplateName 12959 } 12960 if msicarp.Description != nil { 12961 objectMap["description"] = msicarp.Description 12962 } 12963 if msicarp.DisplayName != nil { 12964 objectMap["displayName"] = msicarp.DisplayName 12965 } 12966 if msicarp.Enabled != nil { 12967 objectMap["enabled"] = msicarp.Enabled 12968 } 12969 if msicarp.DisplayNamesFilter != nil { 12970 objectMap["displayNamesFilter"] = msicarp.DisplayNamesFilter 12971 } 12972 if msicarp.DisplayNamesExcludeFilter != nil { 12973 objectMap["displayNamesExcludeFilter"] = msicarp.DisplayNamesExcludeFilter 12974 } 12975 if msicarp.ProductFilter != "" { 12976 objectMap["productFilter"] = msicarp.ProductFilter 12977 } 12978 if msicarp.SeveritiesFilter != nil { 12979 objectMap["severitiesFilter"] = msicarp.SeveritiesFilter 12980 } 12981 return json.Marshal(objectMap) 12982} 12983 12984// MicrosoftSecurityIncidentCreationAlertRuleTemplate represents MicrosoftSecurityIncidentCreation rule 12985// template. 12986type MicrosoftSecurityIncidentCreationAlertRuleTemplate struct { 12987 // MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties - MicrosoftSecurityIncidentCreation rule template properties 12988 *MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties `json:"properties,omitempty"` 12989 // ID - READ-ONLY; Azure resource Id 12990 ID *string `json:"id,omitempty"` 12991 // Name - READ-ONLY; Azure resource name 12992 Name *string `json:"name,omitempty"` 12993 // Type - READ-ONLY; Azure resource type 12994 Type *string `json:"type,omitempty"` 12995 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindMLBehaviorAnalytics', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindThreatIntelligence', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 12996 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 12997} 12998 12999// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13000func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) MarshalJSON() ([]byte, error) { 13001 msicart.Kind = KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation 13002 objectMap := make(map[string]interface{}) 13003 if msicart.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties != nil { 13004 objectMap["properties"] = msicart.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties 13005 } 13006 if msicart.Kind != "" { 13007 objectMap["kind"] = msicart.Kind 13008 } 13009 return json.Marshal(objectMap) 13010} 13011 13012// AsMLBehaviorAnalyticsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13013func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) { 13014 return nil, false 13015} 13016 13017// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13018func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 13019 return nil, false 13020} 13021 13022// AsThreatIntelligenceAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13023func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) { 13024 return nil, false 13025} 13026 13027// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13028func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 13029 return &msicart, true 13030} 13031 13032// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13033func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 13034 return nil, false 13035} 13036 13037// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13038func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 13039 return nil, false 13040} 13041 13042// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MicrosoftSecurityIncidentCreationAlertRuleTemplate. 13043func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 13044 return &msicart, true 13045} 13046 13047// UnmarshalJSON is the custom unmarshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplate struct. 13048func (msicart *MicrosoftSecurityIncidentCreationAlertRuleTemplate) UnmarshalJSON(body []byte) error { 13049 var m map[string]*json.RawMessage 13050 err := json.Unmarshal(body, &m) 13051 if err != nil { 13052 return err 13053 } 13054 for k, v := range m { 13055 switch k { 13056 case "properties": 13057 if v != nil { 13058 var microsoftSecurityIncidentCreationAlertRuleTemplateProperties MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties 13059 err = json.Unmarshal(*v, µsoftSecurityIncidentCreationAlertRuleTemplateProperties) 13060 if err != nil { 13061 return err 13062 } 13063 msicart.MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties = µsoftSecurityIncidentCreationAlertRuleTemplateProperties 13064 } 13065 case "id": 13066 if v != nil { 13067 var ID string 13068 err = json.Unmarshal(*v, &ID) 13069 if err != nil { 13070 return err 13071 } 13072 msicart.ID = &ID 13073 } 13074 case "name": 13075 if v != nil { 13076 var name string 13077 err = json.Unmarshal(*v, &name) 13078 if err != nil { 13079 return err 13080 } 13081 msicart.Name = &name 13082 } 13083 case "type": 13084 if v != nil { 13085 var typeVar string 13086 err = json.Unmarshal(*v, &typeVar) 13087 if err != nil { 13088 return err 13089 } 13090 msicart.Type = &typeVar 13091 } 13092 case "kind": 13093 if v != nil { 13094 var kind KindBasicAlertRuleTemplate 13095 err = json.Unmarshal(*v, &kind) 13096 if err != nil { 13097 return err 13098 } 13099 msicart.Kind = kind 13100 } 13101 } 13102 } 13103 13104 return nil 13105} 13106 13107// MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties microsoftSecurityIncidentCreation rule 13108// template properties 13109type MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties struct { 13110 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 13111 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 13112 // LastUpdatedDateUTC - READ-ONLY; The last time that this alert rule template has been updated. 13113 LastUpdatedDateUTC *date.Time `json:"lastUpdatedDateUTC,omitempty"` 13114 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 13115 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 13116 // Description - The description of the alert rule template. 13117 Description *string `json:"description,omitempty"` 13118 // DisplayName - The display name for alert rule template. 13119 DisplayName *string `json:"displayName,omitempty"` 13120 // RequiredDataConnectors - The required data sources for this template 13121 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 13122 // Status - The alert rule template status. Possible values include: 'TemplateStatusInstalled', 'TemplateStatusAvailable', 'TemplateStatusNotAvailable' 13123 Status TemplateStatus `json:"status,omitempty"` 13124 // DisplayNamesFilter - the alerts' displayNames on which the cases will be generated 13125 DisplayNamesFilter *[]string `json:"displayNamesFilter,omitempty"` 13126 // DisplayNamesExcludeFilter - the alerts' displayNames on which the cases will not be generated 13127 DisplayNamesExcludeFilter *[]string `json:"displayNamesExcludeFilter,omitempty"` 13128 // ProductFilter - The alerts' productName on which the cases will be generated. Possible values include: 'MicrosoftSecurityProductNameMicrosoftCloudAppSecurity', 'MicrosoftSecurityProductNameAzureSecurityCenter', 'MicrosoftSecurityProductNameAzureAdvancedThreatProtection', 'MicrosoftSecurityProductNameAzureActiveDirectoryIdentityProtection', 'MicrosoftSecurityProductNameAzureSecurityCenterforIoT', 'MicrosoftSecurityProductNameOffice365AdvancedThreatProtection', 'MicrosoftSecurityProductNameMicrosoftDefenderAdvancedThreatProtection' 13129 ProductFilter MicrosoftSecurityProductName `json:"productFilter,omitempty"` 13130 // SeveritiesFilter - the alerts' severities on which the cases will be generated 13131 SeveritiesFilter *[]AlertSeverity `json:"severitiesFilter,omitempty"` 13132} 13133 13134// MarshalJSON is the custom marshaler for MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties. 13135func (msicart MicrosoftSecurityIncidentCreationAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 13136 objectMap := make(map[string]interface{}) 13137 if msicart.AlertRulesCreatedByTemplateCount != nil { 13138 objectMap["alertRulesCreatedByTemplateCount"] = msicart.AlertRulesCreatedByTemplateCount 13139 } 13140 if msicart.Description != nil { 13141 objectMap["description"] = msicart.Description 13142 } 13143 if msicart.DisplayName != nil { 13144 objectMap["displayName"] = msicart.DisplayName 13145 } 13146 if msicart.RequiredDataConnectors != nil { 13147 objectMap["requiredDataConnectors"] = msicart.RequiredDataConnectors 13148 } 13149 if msicart.Status != "" { 13150 objectMap["status"] = msicart.Status 13151 } 13152 if msicart.DisplayNamesFilter != nil { 13153 objectMap["displayNamesFilter"] = msicart.DisplayNamesFilter 13154 } 13155 if msicart.DisplayNamesExcludeFilter != nil { 13156 objectMap["displayNamesExcludeFilter"] = msicart.DisplayNamesExcludeFilter 13157 } 13158 if msicart.ProductFilter != "" { 13159 objectMap["productFilter"] = msicart.ProductFilter 13160 } 13161 if msicart.SeveritiesFilter != nil { 13162 objectMap["severitiesFilter"] = msicart.SeveritiesFilter 13163 } 13164 return json.Marshal(objectMap) 13165} 13166 13167// MLBehaviorAnalyticsAlertRule represents MLBehaviorAnalytics alert rule. 13168type MLBehaviorAnalyticsAlertRule struct { 13169 // MLBehaviorAnalyticsAlertRuleProperties - MLBehaviorAnalytics alert rule properties 13170 *MLBehaviorAnalyticsAlertRuleProperties `json:"properties,omitempty"` 13171 // ID - READ-ONLY; Azure resource Id 13172 ID *string `json:"id,omitempty"` 13173 // Name - READ-ONLY; Azure resource name 13174 Name *string `json:"name,omitempty"` 13175 // Type - READ-ONLY; Azure resource type 13176 Type *string `json:"type,omitempty"` 13177 // Etag - Etag of the azure resource 13178 Etag *string `json:"etag,omitempty"` 13179 // Kind - Possible values include: 'KindBasicAlertRuleKindAlertRule', 'KindBasicAlertRuleKindMLBehaviorAnalytics', 'KindBasicAlertRuleKindFusion', 'KindBasicAlertRuleKindThreatIntelligence', 'KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleKindScheduled' 13180 Kind KindBasicAlertRule `json:"kind,omitempty"` 13181} 13182 13183// MarshalJSON is the custom marshaler for MLBehaviorAnalyticsAlertRule. 13184func (mbaar MLBehaviorAnalyticsAlertRule) MarshalJSON() ([]byte, error) { 13185 mbaar.Kind = KindBasicAlertRuleKindMLBehaviorAnalytics 13186 objectMap := make(map[string]interface{}) 13187 if mbaar.MLBehaviorAnalyticsAlertRuleProperties != nil { 13188 objectMap["properties"] = mbaar.MLBehaviorAnalyticsAlertRuleProperties 13189 } 13190 if mbaar.Etag != nil { 13191 objectMap["etag"] = mbaar.Etag 13192 } 13193 if mbaar.Kind != "" { 13194 objectMap["kind"] = mbaar.Kind 13195 } 13196 return json.Marshal(objectMap) 13197} 13198 13199// AsMLBehaviorAnalyticsAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13200func (mbaar MLBehaviorAnalyticsAlertRule) AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) { 13201 return &mbaar, true 13202} 13203 13204// AsFusionAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13205func (mbaar MLBehaviorAnalyticsAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 13206 return nil, false 13207} 13208 13209// AsThreatIntelligenceAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13210func (mbaar MLBehaviorAnalyticsAlertRule) AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) { 13211 return nil, false 13212} 13213 13214// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13215func (mbaar MLBehaviorAnalyticsAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 13216 return nil, false 13217} 13218 13219// AsScheduledAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13220func (mbaar MLBehaviorAnalyticsAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 13221 return nil, false 13222} 13223 13224// AsAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13225func (mbaar MLBehaviorAnalyticsAlertRule) AsAlertRule() (*AlertRule, bool) { 13226 return nil, false 13227} 13228 13229// AsBasicAlertRule is the BasicAlertRule implementation for MLBehaviorAnalyticsAlertRule. 13230func (mbaar MLBehaviorAnalyticsAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 13231 return &mbaar, true 13232} 13233 13234// UnmarshalJSON is the custom unmarshaler for MLBehaviorAnalyticsAlertRule struct. 13235func (mbaar *MLBehaviorAnalyticsAlertRule) UnmarshalJSON(body []byte) error { 13236 var m map[string]*json.RawMessage 13237 err := json.Unmarshal(body, &m) 13238 if err != nil { 13239 return err 13240 } 13241 for k, v := range m { 13242 switch k { 13243 case "properties": 13244 if v != nil { 13245 var mLBehaviorAnalyticsAlertRuleProperties MLBehaviorAnalyticsAlertRuleProperties 13246 err = json.Unmarshal(*v, &mLBehaviorAnalyticsAlertRuleProperties) 13247 if err != nil { 13248 return err 13249 } 13250 mbaar.MLBehaviorAnalyticsAlertRuleProperties = &mLBehaviorAnalyticsAlertRuleProperties 13251 } 13252 case "id": 13253 if v != nil { 13254 var ID string 13255 err = json.Unmarshal(*v, &ID) 13256 if err != nil { 13257 return err 13258 } 13259 mbaar.ID = &ID 13260 } 13261 case "name": 13262 if v != nil { 13263 var name string 13264 err = json.Unmarshal(*v, &name) 13265 if err != nil { 13266 return err 13267 } 13268 mbaar.Name = &name 13269 } 13270 case "type": 13271 if v != nil { 13272 var typeVar string 13273 err = json.Unmarshal(*v, &typeVar) 13274 if err != nil { 13275 return err 13276 } 13277 mbaar.Type = &typeVar 13278 } 13279 case "etag": 13280 if v != nil { 13281 var etag string 13282 err = json.Unmarshal(*v, &etag) 13283 if err != nil { 13284 return err 13285 } 13286 mbaar.Etag = &etag 13287 } 13288 case "kind": 13289 if v != nil { 13290 var kind KindBasicAlertRule 13291 err = json.Unmarshal(*v, &kind) 13292 if err != nil { 13293 return err 13294 } 13295 mbaar.Kind = kind 13296 } 13297 } 13298 } 13299 13300 return nil 13301} 13302 13303// MLBehaviorAnalyticsAlertRuleProperties mLBehaviorAnalytics alert rule base property bag. 13304type MLBehaviorAnalyticsAlertRuleProperties struct { 13305 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 13306 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 13307 // Description - READ-ONLY; The description of the alert rule. 13308 Description *string `json:"description,omitempty"` 13309 // DisplayName - READ-ONLY; The display name for alerts created by this alert rule. 13310 DisplayName *string `json:"displayName,omitempty"` 13311 // Enabled - Determines whether this alert rule is enabled or disabled. 13312 Enabled *bool `json:"enabled,omitempty"` 13313 // LastModifiedUtc - READ-ONLY; The last time that this alert rule has been modified. 13314 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 13315 // Severity - READ-ONLY; The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 13316 Severity AlertSeverity `json:"severity,omitempty"` 13317 // Tactics - READ-ONLY; The tactics of the alert rule 13318 Tactics *[]AttackTactic `json:"tactics,omitempty"` 13319} 13320 13321// MarshalJSON is the custom marshaler for MLBehaviorAnalyticsAlertRuleProperties. 13322func (mbaarp MLBehaviorAnalyticsAlertRuleProperties) MarshalJSON() ([]byte, error) { 13323 objectMap := make(map[string]interface{}) 13324 if mbaarp.AlertRuleTemplateName != nil { 13325 objectMap["alertRuleTemplateName"] = mbaarp.AlertRuleTemplateName 13326 } 13327 if mbaarp.Enabled != nil { 13328 objectMap["enabled"] = mbaarp.Enabled 13329 } 13330 return json.Marshal(objectMap) 13331} 13332 13333// MLBehaviorAnalyticsAlertRuleTemplate represents MLBehaviorAnalytics alert rule template. 13334type MLBehaviorAnalyticsAlertRuleTemplate struct { 13335 // MLBehaviorAnalyticsAlertRuleTemplateProperties - MLBehaviorAnalytics alert rule template properties. 13336 *MLBehaviorAnalyticsAlertRuleTemplateProperties `json:"properties,omitempty"` 13337 // ID - READ-ONLY; Azure resource Id 13338 ID *string `json:"id,omitempty"` 13339 // Name - READ-ONLY; Azure resource name 13340 Name *string `json:"name,omitempty"` 13341 // Type - READ-ONLY; Azure resource type 13342 Type *string `json:"type,omitempty"` 13343 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindMLBehaviorAnalytics', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindThreatIntelligence', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 13344 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 13345} 13346 13347// MarshalJSON is the custom marshaler for MLBehaviorAnalyticsAlertRuleTemplate. 13348func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) MarshalJSON() ([]byte, error) { 13349 mbaart.Kind = KindBasicAlertRuleTemplateKindMLBehaviorAnalytics 13350 objectMap := make(map[string]interface{}) 13351 if mbaart.MLBehaviorAnalyticsAlertRuleTemplateProperties != nil { 13352 objectMap["properties"] = mbaart.MLBehaviorAnalyticsAlertRuleTemplateProperties 13353 } 13354 if mbaart.Kind != "" { 13355 objectMap["kind"] = mbaart.Kind 13356 } 13357 return json.Marshal(objectMap) 13358} 13359 13360// AsMLBehaviorAnalyticsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13361func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) { 13362 return &mbaart, true 13363} 13364 13365// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13366func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 13367 return nil, false 13368} 13369 13370// AsThreatIntelligenceAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13371func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) { 13372 return nil, false 13373} 13374 13375// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13376func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 13377 return nil, false 13378} 13379 13380// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13381func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 13382 return nil, false 13383} 13384 13385// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13386func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 13387 return nil, false 13388} 13389 13390// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for MLBehaviorAnalyticsAlertRuleTemplate. 13391func (mbaart MLBehaviorAnalyticsAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 13392 return &mbaart, true 13393} 13394 13395// UnmarshalJSON is the custom unmarshaler for MLBehaviorAnalyticsAlertRuleTemplate struct. 13396func (mbaart *MLBehaviorAnalyticsAlertRuleTemplate) UnmarshalJSON(body []byte) error { 13397 var m map[string]*json.RawMessage 13398 err := json.Unmarshal(body, &m) 13399 if err != nil { 13400 return err 13401 } 13402 for k, v := range m { 13403 switch k { 13404 case "properties": 13405 if v != nil { 13406 var mLBehaviorAnalyticsAlertRuleTemplateProperties MLBehaviorAnalyticsAlertRuleTemplateProperties 13407 err = json.Unmarshal(*v, &mLBehaviorAnalyticsAlertRuleTemplateProperties) 13408 if err != nil { 13409 return err 13410 } 13411 mbaart.MLBehaviorAnalyticsAlertRuleTemplateProperties = &mLBehaviorAnalyticsAlertRuleTemplateProperties 13412 } 13413 case "id": 13414 if v != nil { 13415 var ID string 13416 err = json.Unmarshal(*v, &ID) 13417 if err != nil { 13418 return err 13419 } 13420 mbaart.ID = &ID 13421 } 13422 case "name": 13423 if v != nil { 13424 var name string 13425 err = json.Unmarshal(*v, &name) 13426 if err != nil { 13427 return err 13428 } 13429 mbaart.Name = &name 13430 } 13431 case "type": 13432 if v != nil { 13433 var typeVar string 13434 err = json.Unmarshal(*v, &typeVar) 13435 if err != nil { 13436 return err 13437 } 13438 mbaart.Type = &typeVar 13439 } 13440 case "kind": 13441 if v != nil { 13442 var kind KindBasicAlertRuleTemplate 13443 err = json.Unmarshal(*v, &kind) 13444 if err != nil { 13445 return err 13446 } 13447 mbaart.Kind = kind 13448 } 13449 } 13450 } 13451 13452 return nil 13453} 13454 13455// MLBehaviorAnalyticsAlertRuleTemplateProperties mLBehaviorAnalytics alert rule template properties. 13456type MLBehaviorAnalyticsAlertRuleTemplateProperties struct { 13457 // Severity - The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 13458 Severity AlertSeverity `json:"severity,omitempty"` 13459 // Tactics - The tactics of the alert rule template. 13460 Tactics *[]AttackTactic `json:"tactics,omitempty"` 13461 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 13462 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 13463 // LastUpdatedDateUTC - READ-ONLY; The last time that this alert rule template has been updated. 13464 LastUpdatedDateUTC *date.Time `json:"lastUpdatedDateUTC,omitempty"` 13465 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 13466 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 13467 // Description - The description of the alert rule template. 13468 Description *string `json:"description,omitempty"` 13469 // DisplayName - The display name for alert rule template. 13470 DisplayName *string `json:"displayName,omitempty"` 13471 // RequiredDataConnectors - The required data sources for this template 13472 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 13473 // Status - The alert rule template status. Possible values include: 'TemplateStatusInstalled', 'TemplateStatusAvailable', 'TemplateStatusNotAvailable' 13474 Status TemplateStatus `json:"status,omitempty"` 13475} 13476 13477// MarshalJSON is the custom marshaler for MLBehaviorAnalyticsAlertRuleTemplateProperties. 13478func (mbaart MLBehaviorAnalyticsAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 13479 objectMap := make(map[string]interface{}) 13480 if mbaart.Severity != "" { 13481 objectMap["severity"] = mbaart.Severity 13482 } 13483 if mbaart.Tactics != nil { 13484 objectMap["tactics"] = mbaart.Tactics 13485 } 13486 if mbaart.AlertRulesCreatedByTemplateCount != nil { 13487 objectMap["alertRulesCreatedByTemplateCount"] = mbaart.AlertRulesCreatedByTemplateCount 13488 } 13489 if mbaart.Description != nil { 13490 objectMap["description"] = mbaart.Description 13491 } 13492 if mbaart.DisplayName != nil { 13493 objectMap["displayName"] = mbaart.DisplayName 13494 } 13495 if mbaart.RequiredDataConnectors != nil { 13496 objectMap["requiredDataConnectors"] = mbaart.RequiredDataConnectors 13497 } 13498 if mbaart.Status != "" { 13499 objectMap["status"] = mbaart.Status 13500 } 13501 return json.Marshal(objectMap) 13502} 13503 13504// MSTICheckRequirements represents Microsoft Threat Intelligence requirements check request. 13505type MSTICheckRequirements struct { 13506 // MSTICheckRequirementsProperties - Microsoft Threat Intelligence requirements check properties. 13507 *MSTICheckRequirementsProperties `json:"properties,omitempty"` 13508 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 13509 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 13510} 13511 13512// MarshalJSON is the custom marshaler for MSTICheckRequirements. 13513func (mcr MSTICheckRequirements) MarshalJSON() ([]byte, error) { 13514 mcr.Kind = KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence 13515 objectMap := make(map[string]interface{}) 13516 if mcr.MSTICheckRequirementsProperties != nil { 13517 objectMap["properties"] = mcr.MSTICheckRequirementsProperties 13518 } 13519 if mcr.Kind != "" { 13520 objectMap["kind"] = mcr.Kind 13521 } 13522 return json.Marshal(objectMap) 13523} 13524 13525// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13526func (mcr MSTICheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 13527 return nil, false 13528} 13529 13530// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13531func (mcr MSTICheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 13532 return nil, false 13533} 13534 13535// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13536func (mcr MSTICheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 13537 return &mcr, true 13538} 13539 13540// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13541func (mcr MSTICheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 13542 return nil, false 13543} 13544 13545// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13546func (mcr MSTICheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 13547 return nil, false 13548} 13549 13550// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13551func (mcr MSTICheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 13552 return nil, false 13553} 13554 13555// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13556func (mcr MSTICheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 13557 return nil, false 13558} 13559 13560// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13561func (mcr MSTICheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 13562 return nil, false 13563} 13564 13565// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13566func (mcr MSTICheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 13567 return nil, false 13568} 13569 13570// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13571func (mcr MSTICheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 13572 return nil, false 13573} 13574 13575// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13576func (mcr MSTICheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 13577 return nil, false 13578} 13579 13580// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13581func (mcr MSTICheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 13582 return nil, false 13583} 13584 13585// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13586func (mcr MSTICheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 13587 return nil, false 13588} 13589 13590// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MSTICheckRequirements. 13591func (mcr MSTICheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 13592 return &mcr, true 13593} 13594 13595// UnmarshalJSON is the custom unmarshaler for MSTICheckRequirements struct. 13596func (mcr *MSTICheckRequirements) UnmarshalJSON(body []byte) error { 13597 var m map[string]*json.RawMessage 13598 err := json.Unmarshal(body, &m) 13599 if err != nil { 13600 return err 13601 } 13602 for k, v := range m { 13603 switch k { 13604 case "properties": 13605 if v != nil { 13606 var mSTICheckRequirementsProperties MSTICheckRequirementsProperties 13607 err = json.Unmarshal(*v, &mSTICheckRequirementsProperties) 13608 if err != nil { 13609 return err 13610 } 13611 mcr.MSTICheckRequirementsProperties = &mSTICheckRequirementsProperties 13612 } 13613 case "kind": 13614 if v != nil { 13615 var kind KindBasicDataConnectorsCheckRequirements 13616 err = json.Unmarshal(*v, &kind) 13617 if err != nil { 13618 return err 13619 } 13620 mcr.Kind = kind 13621 } 13622 } 13623 } 13624 13625 return nil 13626} 13627 13628// MSTICheckRequirementsProperties microsoft Threat Intelligence requirements check properties. 13629type MSTICheckRequirementsProperties struct { 13630 // TenantID - The tenant id to connect to, and get the data from. 13631 TenantID *string `json:"tenantId,omitempty"` 13632} 13633 13634// MSTIDataConnector represents Microsoft Threat Intelligence data connector. 13635type MSTIDataConnector struct { 13636 // MSTIDataConnectorProperties - Microsoft Threat Intelligence data connector properties. 13637 *MSTIDataConnectorProperties `json:"properties,omitempty"` 13638 // ID - READ-ONLY; Azure resource Id 13639 ID *string `json:"id,omitempty"` 13640 // Name - READ-ONLY; Azure resource name 13641 Name *string `json:"name,omitempty"` 13642 // Type - READ-ONLY; Azure resource type 13643 Type *string `json:"type,omitempty"` 13644 // Etag - Etag of the azure resource 13645 Etag *string `json:"etag,omitempty"` 13646 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 13647 Kind KindBasicDataConnector `json:"kind,omitempty"` 13648} 13649 13650// MarshalJSON is the custom marshaler for MSTIDataConnector. 13651func (mdc MSTIDataConnector) MarshalJSON() ([]byte, error) { 13652 mdc.Kind = KindBasicDataConnectorKindMicrosoftThreatIntelligence 13653 objectMap := make(map[string]interface{}) 13654 if mdc.MSTIDataConnectorProperties != nil { 13655 objectMap["properties"] = mdc.MSTIDataConnectorProperties 13656 } 13657 if mdc.Etag != nil { 13658 objectMap["etag"] = mdc.Etag 13659 } 13660 if mdc.Kind != "" { 13661 objectMap["kind"] = mdc.Kind 13662 } 13663 return json.Marshal(objectMap) 13664} 13665 13666// AsAADDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13667func (mdc MSTIDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 13668 return nil, false 13669} 13670 13671// AsAATPDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13672func (mdc MSTIDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 13673 return nil, false 13674} 13675 13676// AsMSTIDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13677func (mdc MSTIDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 13678 return &mdc, true 13679} 13680 13681// AsMTPDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13682func (mdc MSTIDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 13683 return nil, false 13684} 13685 13686// AsASCDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13687func (mdc MSTIDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 13688 return nil, false 13689} 13690 13691// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13692func (mdc MSTIDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 13693 return nil, false 13694} 13695 13696// AsDynamics365DataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13697func (mdc MSTIDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 13698 return nil, false 13699} 13700 13701// AsMCASDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13702func (mdc MSTIDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 13703 return nil, false 13704} 13705 13706// AsMDATPDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13707func (mdc MSTIDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 13708 return nil, false 13709} 13710 13711// AsOfficeATPDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13712func (mdc MSTIDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 13713 return nil, false 13714} 13715 13716// AsOfficeDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13717func (mdc MSTIDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 13718 return nil, false 13719} 13720 13721// AsTIDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13722func (mdc MSTIDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 13723 return nil, false 13724} 13725 13726// AsTiTaxiiDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13727func (mdc MSTIDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 13728 return nil, false 13729} 13730 13731// AsDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13732func (mdc MSTIDataConnector) AsDataConnector() (*DataConnector, bool) { 13733 return nil, false 13734} 13735 13736// AsBasicDataConnector is the BasicDataConnector implementation for MSTIDataConnector. 13737func (mdc MSTIDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 13738 return &mdc, true 13739} 13740 13741// UnmarshalJSON is the custom unmarshaler for MSTIDataConnector struct. 13742func (mdc *MSTIDataConnector) UnmarshalJSON(body []byte) error { 13743 var m map[string]*json.RawMessage 13744 err := json.Unmarshal(body, &m) 13745 if err != nil { 13746 return err 13747 } 13748 for k, v := range m { 13749 switch k { 13750 case "properties": 13751 if v != nil { 13752 var mSTIDataConnectorProperties MSTIDataConnectorProperties 13753 err = json.Unmarshal(*v, &mSTIDataConnectorProperties) 13754 if err != nil { 13755 return err 13756 } 13757 mdc.MSTIDataConnectorProperties = &mSTIDataConnectorProperties 13758 } 13759 case "id": 13760 if v != nil { 13761 var ID string 13762 err = json.Unmarshal(*v, &ID) 13763 if err != nil { 13764 return err 13765 } 13766 mdc.ID = &ID 13767 } 13768 case "name": 13769 if v != nil { 13770 var name string 13771 err = json.Unmarshal(*v, &name) 13772 if err != nil { 13773 return err 13774 } 13775 mdc.Name = &name 13776 } 13777 case "type": 13778 if v != nil { 13779 var typeVar string 13780 err = json.Unmarshal(*v, &typeVar) 13781 if err != nil { 13782 return err 13783 } 13784 mdc.Type = &typeVar 13785 } 13786 case "etag": 13787 if v != nil { 13788 var etag string 13789 err = json.Unmarshal(*v, &etag) 13790 if err != nil { 13791 return err 13792 } 13793 mdc.Etag = &etag 13794 } 13795 case "kind": 13796 if v != nil { 13797 var kind KindBasicDataConnector 13798 err = json.Unmarshal(*v, &kind) 13799 if err != nil { 13800 return err 13801 } 13802 mdc.Kind = kind 13803 } 13804 } 13805 } 13806 13807 return nil 13808} 13809 13810// MSTIDataConnectorDataTypes the available data types for Microsoft Threat Intelligence Platforms data 13811// connector. 13812type MSTIDataConnectorDataTypes struct { 13813 // BingSafetyPhishingURL - Data type for Microsoft Threat Intelligence Platforms data connector. 13814 BingSafetyPhishingURL *MSTIDataConnectorDataTypesBingSafetyPhishingURL `json:"bingSafetyPhishingURL,omitempty"` 13815 // MicrosoftEmergingThreatFeed - Data type for Microsoft Threat Intelligence Platforms data connector. 13816 MicrosoftEmergingThreatFeed *MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed `json:"microsoftEmergingThreatFeed,omitempty"` 13817} 13818 13819// MSTIDataConnectorDataTypesBingSafetyPhishingURL data type for Microsoft Threat Intelligence Platforms 13820// data connector. 13821type MSTIDataConnectorDataTypesBingSafetyPhishingURL struct { 13822 // LookbackPeriod - lookback period 13823 LookbackPeriod *string `json:"lookbackPeriod,omitempty"` 13824 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 13825 State DataTypeState `json:"state,omitempty"` 13826} 13827 13828// MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed data type for Microsoft Threat Intelligence 13829// Platforms data connector. 13830type MSTIDataConnectorDataTypesMicrosoftEmergingThreatFeed struct { 13831 // LookbackPeriod - lookback period 13832 LookbackPeriod *string `json:"lookbackPeriod,omitempty"` 13833 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 13834 State DataTypeState `json:"state,omitempty"` 13835} 13836 13837// MSTIDataConnectorProperties microsoft Threat Intelligence data connector properties. 13838type MSTIDataConnectorProperties struct { 13839 // DataTypes - The available data types for the connector. 13840 DataTypes *MSTIDataConnectorDataTypes `json:"dataTypes,omitempty"` 13841 // TenantID - The tenant id to connect to, and get the data from. 13842 TenantID *string `json:"tenantId,omitempty"` 13843} 13844 13845// MtpCheckRequirements represents MTP (Microsoft Threat Protection) requirements check request. 13846type MtpCheckRequirements struct { 13847 // MTPCheckRequirementsProperties - MTP (Microsoft Threat Protection) requirements check properties. 13848 *MTPCheckRequirementsProperties `json:"properties,omitempty"` 13849 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 13850 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 13851} 13852 13853// MarshalJSON is the custom marshaler for MtpCheckRequirements. 13854func (mcr MtpCheckRequirements) MarshalJSON() ([]byte, error) { 13855 mcr.Kind = KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection 13856 objectMap := make(map[string]interface{}) 13857 if mcr.MTPCheckRequirementsProperties != nil { 13858 objectMap["properties"] = mcr.MTPCheckRequirementsProperties 13859 } 13860 if mcr.Kind != "" { 13861 objectMap["kind"] = mcr.Kind 13862 } 13863 return json.Marshal(objectMap) 13864} 13865 13866// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13867func (mcr MtpCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 13868 return nil, false 13869} 13870 13871// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13872func (mcr MtpCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 13873 return nil, false 13874} 13875 13876// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13877func (mcr MtpCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 13878 return nil, false 13879} 13880 13881// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13882func (mcr MtpCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 13883 return &mcr, true 13884} 13885 13886// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13887func (mcr MtpCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 13888 return nil, false 13889} 13890 13891// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13892func (mcr MtpCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 13893 return nil, false 13894} 13895 13896// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13897func (mcr MtpCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 13898 return nil, false 13899} 13900 13901// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13902func (mcr MtpCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 13903 return nil, false 13904} 13905 13906// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13907func (mcr MtpCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 13908 return nil, false 13909} 13910 13911// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13912func (mcr MtpCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 13913 return nil, false 13914} 13915 13916// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13917func (mcr MtpCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 13918 return nil, false 13919} 13920 13921// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13922func (mcr MtpCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 13923 return nil, false 13924} 13925 13926// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13927func (mcr MtpCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 13928 return nil, false 13929} 13930 13931// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for MtpCheckRequirements. 13932func (mcr MtpCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 13933 return &mcr, true 13934} 13935 13936// UnmarshalJSON is the custom unmarshaler for MtpCheckRequirements struct. 13937func (mcr *MtpCheckRequirements) UnmarshalJSON(body []byte) error { 13938 var m map[string]*json.RawMessage 13939 err := json.Unmarshal(body, &m) 13940 if err != nil { 13941 return err 13942 } 13943 for k, v := range m { 13944 switch k { 13945 case "properties": 13946 if v != nil { 13947 var mTPCheckRequirementsProperties MTPCheckRequirementsProperties 13948 err = json.Unmarshal(*v, &mTPCheckRequirementsProperties) 13949 if err != nil { 13950 return err 13951 } 13952 mcr.MTPCheckRequirementsProperties = &mTPCheckRequirementsProperties 13953 } 13954 case "kind": 13955 if v != nil { 13956 var kind KindBasicDataConnectorsCheckRequirements 13957 err = json.Unmarshal(*v, &kind) 13958 if err != nil { 13959 return err 13960 } 13961 mcr.Kind = kind 13962 } 13963 } 13964 } 13965 13966 return nil 13967} 13968 13969// MTPCheckRequirementsProperties MTP (Microsoft Threat Protection) requirements check properties. 13970type MTPCheckRequirementsProperties struct { 13971 // TenantID - The tenant id to connect to, and get the data from. 13972 TenantID *string `json:"tenantId,omitempty"` 13973} 13974 13975// MTPDataConnector represents MTP (Microsoft Threat Protection) data connector. 13976type MTPDataConnector struct { 13977 // MTPDataConnectorProperties - MTP (Microsoft Threat Protection) data connector properties. 13978 *MTPDataConnectorProperties `json:"properties,omitempty"` 13979 // ID - READ-ONLY; Azure resource Id 13980 ID *string `json:"id,omitempty"` 13981 // Name - READ-ONLY; Azure resource name 13982 Name *string `json:"name,omitempty"` 13983 // Type - READ-ONLY; Azure resource type 13984 Type *string `json:"type,omitempty"` 13985 // Etag - Etag of the azure resource 13986 Etag *string `json:"etag,omitempty"` 13987 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 13988 Kind KindBasicDataConnector `json:"kind,omitempty"` 13989} 13990 13991// MarshalJSON is the custom marshaler for MTPDataConnector. 13992func (mdc MTPDataConnector) MarshalJSON() ([]byte, error) { 13993 mdc.Kind = KindBasicDataConnectorKindMicrosoftThreatProtection 13994 objectMap := make(map[string]interface{}) 13995 if mdc.MTPDataConnectorProperties != nil { 13996 objectMap["properties"] = mdc.MTPDataConnectorProperties 13997 } 13998 if mdc.Etag != nil { 13999 objectMap["etag"] = mdc.Etag 14000 } 14001 if mdc.Kind != "" { 14002 objectMap["kind"] = mdc.Kind 14003 } 14004 return json.Marshal(objectMap) 14005} 14006 14007// AsAADDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14008func (mdc MTPDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 14009 return nil, false 14010} 14011 14012// AsAATPDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14013func (mdc MTPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 14014 return nil, false 14015} 14016 14017// AsMSTIDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14018func (mdc MTPDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 14019 return nil, false 14020} 14021 14022// AsMTPDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14023func (mdc MTPDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 14024 return &mdc, true 14025} 14026 14027// AsASCDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14028func (mdc MTPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 14029 return nil, false 14030} 14031 14032// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14033func (mdc MTPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 14034 return nil, false 14035} 14036 14037// AsDynamics365DataConnector is the BasicDataConnector implementation for MTPDataConnector. 14038func (mdc MTPDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 14039 return nil, false 14040} 14041 14042// AsMCASDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14043func (mdc MTPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 14044 return nil, false 14045} 14046 14047// AsMDATPDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14048func (mdc MTPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 14049 return nil, false 14050} 14051 14052// AsOfficeATPDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14053func (mdc MTPDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 14054 return nil, false 14055} 14056 14057// AsOfficeDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14058func (mdc MTPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 14059 return nil, false 14060} 14061 14062// AsTIDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14063func (mdc MTPDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 14064 return nil, false 14065} 14066 14067// AsTiTaxiiDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14068func (mdc MTPDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 14069 return nil, false 14070} 14071 14072// AsDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14073func (mdc MTPDataConnector) AsDataConnector() (*DataConnector, bool) { 14074 return nil, false 14075} 14076 14077// AsBasicDataConnector is the BasicDataConnector implementation for MTPDataConnector. 14078func (mdc MTPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 14079 return &mdc, true 14080} 14081 14082// UnmarshalJSON is the custom unmarshaler for MTPDataConnector struct. 14083func (mdc *MTPDataConnector) UnmarshalJSON(body []byte) error { 14084 var m map[string]*json.RawMessage 14085 err := json.Unmarshal(body, &m) 14086 if err != nil { 14087 return err 14088 } 14089 for k, v := range m { 14090 switch k { 14091 case "properties": 14092 if v != nil { 14093 var mTPDataConnectorProperties MTPDataConnectorProperties 14094 err = json.Unmarshal(*v, &mTPDataConnectorProperties) 14095 if err != nil { 14096 return err 14097 } 14098 mdc.MTPDataConnectorProperties = &mTPDataConnectorProperties 14099 } 14100 case "id": 14101 if v != nil { 14102 var ID string 14103 err = json.Unmarshal(*v, &ID) 14104 if err != nil { 14105 return err 14106 } 14107 mdc.ID = &ID 14108 } 14109 case "name": 14110 if v != nil { 14111 var name string 14112 err = json.Unmarshal(*v, &name) 14113 if err != nil { 14114 return err 14115 } 14116 mdc.Name = &name 14117 } 14118 case "type": 14119 if v != nil { 14120 var typeVar string 14121 err = json.Unmarshal(*v, &typeVar) 14122 if err != nil { 14123 return err 14124 } 14125 mdc.Type = &typeVar 14126 } 14127 case "etag": 14128 if v != nil { 14129 var etag string 14130 err = json.Unmarshal(*v, &etag) 14131 if err != nil { 14132 return err 14133 } 14134 mdc.Etag = &etag 14135 } 14136 case "kind": 14137 if v != nil { 14138 var kind KindBasicDataConnector 14139 err = json.Unmarshal(*v, &kind) 14140 if err != nil { 14141 return err 14142 } 14143 mdc.Kind = kind 14144 } 14145 } 14146 } 14147 14148 return nil 14149} 14150 14151// MTPDataConnectorDataTypes the available data types for Microsoft Threat Protection Platforms data 14152// connector. 14153type MTPDataConnectorDataTypes struct { 14154 // Incidents - Data type for Microsoft Threat Protection Platforms data connector. 14155 Incidents *MTPDataConnectorDataTypesIncidents `json:"incidents,omitempty"` 14156} 14157 14158// MTPDataConnectorDataTypesIncidents data type for Microsoft Threat Protection Platforms data connector. 14159type MTPDataConnectorDataTypesIncidents struct { 14160 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 14161 State DataTypeState `json:"state,omitempty"` 14162} 14163 14164// MTPDataConnectorProperties MTP (Microsoft Threat Protection) data connector properties. 14165type MTPDataConnectorProperties struct { 14166 // DataTypes - The available data types for the connector. 14167 DataTypes *MTPDataConnectorDataTypes `json:"dataTypes,omitempty"` 14168 // TenantID - The tenant id to connect to, and get the data from. 14169 TenantID *string `json:"tenantId,omitempty"` 14170} 14171 14172// OfficeATPCheckRequirements represents OfficeATP (Office 365 Advanced Threat Protection) requirements 14173// check request. 14174type OfficeATPCheckRequirements struct { 14175 // OfficeATPCheckRequirementsProperties - OfficeATP (Office 365 Advanced Threat Protection) requirements check properties. 14176 *OfficeATPCheckRequirementsProperties `json:"properties,omitempty"` 14177 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 14178 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 14179} 14180 14181// MarshalJSON is the custom marshaler for OfficeATPCheckRequirements. 14182func (oacr OfficeATPCheckRequirements) MarshalJSON() ([]byte, error) { 14183 oacr.Kind = KindBasicDataConnectorsCheckRequirementsKindOfficeATP 14184 objectMap := make(map[string]interface{}) 14185 if oacr.OfficeATPCheckRequirementsProperties != nil { 14186 objectMap["properties"] = oacr.OfficeATPCheckRequirementsProperties 14187 } 14188 if oacr.Kind != "" { 14189 objectMap["kind"] = oacr.Kind 14190 } 14191 return json.Marshal(objectMap) 14192} 14193 14194// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14195func (oacr OfficeATPCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 14196 return nil, false 14197} 14198 14199// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14200func (oacr OfficeATPCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 14201 return nil, false 14202} 14203 14204// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14205func (oacr OfficeATPCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 14206 return nil, false 14207} 14208 14209// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14210func (oacr OfficeATPCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 14211 return nil, false 14212} 14213 14214// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14215func (oacr OfficeATPCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 14216 return nil, false 14217} 14218 14219// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14220func (oacr OfficeATPCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 14221 return nil, false 14222} 14223 14224// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14225func (oacr OfficeATPCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 14226 return nil, false 14227} 14228 14229// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14230func (oacr OfficeATPCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 14231 return nil, false 14232} 14233 14234// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14235func (oacr OfficeATPCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 14236 return nil, false 14237} 14238 14239// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14240func (oacr OfficeATPCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 14241 return &oacr, true 14242} 14243 14244// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14245func (oacr OfficeATPCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 14246 return nil, false 14247} 14248 14249// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14250func (oacr OfficeATPCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 14251 return nil, false 14252} 14253 14254// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14255func (oacr OfficeATPCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 14256 return nil, false 14257} 14258 14259// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for OfficeATPCheckRequirements. 14260func (oacr OfficeATPCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 14261 return &oacr, true 14262} 14263 14264// UnmarshalJSON is the custom unmarshaler for OfficeATPCheckRequirements struct. 14265func (oacr *OfficeATPCheckRequirements) UnmarshalJSON(body []byte) error { 14266 var m map[string]*json.RawMessage 14267 err := json.Unmarshal(body, &m) 14268 if err != nil { 14269 return err 14270 } 14271 for k, v := range m { 14272 switch k { 14273 case "properties": 14274 if v != nil { 14275 var officeATPCheckRequirementsProperties OfficeATPCheckRequirementsProperties 14276 err = json.Unmarshal(*v, &officeATPCheckRequirementsProperties) 14277 if err != nil { 14278 return err 14279 } 14280 oacr.OfficeATPCheckRequirementsProperties = &officeATPCheckRequirementsProperties 14281 } 14282 case "kind": 14283 if v != nil { 14284 var kind KindBasicDataConnectorsCheckRequirements 14285 err = json.Unmarshal(*v, &kind) 14286 if err != nil { 14287 return err 14288 } 14289 oacr.Kind = kind 14290 } 14291 } 14292 } 14293 14294 return nil 14295} 14296 14297// OfficeATPCheckRequirementsProperties officeATP (Office 365 Advanced Threat Protection) requirements 14298// check properties. 14299type OfficeATPCheckRequirementsProperties struct { 14300 // TenantID - The tenant id to connect to, and get the data from. 14301 TenantID *string `json:"tenantId,omitempty"` 14302} 14303 14304// OfficeATPDataConnector represents OfficeATP (Office 365 Advanced Threat Protection) data connector. 14305type OfficeATPDataConnector struct { 14306 // OfficeATPDataConnectorProperties - OfficeATP (Office 365 Advanced Threat Protection) data connector properties. 14307 *OfficeATPDataConnectorProperties `json:"properties,omitempty"` 14308 // ID - READ-ONLY; Azure resource Id 14309 ID *string `json:"id,omitempty"` 14310 // Name - READ-ONLY; Azure resource name 14311 Name *string `json:"name,omitempty"` 14312 // Type - READ-ONLY; Azure resource type 14313 Type *string `json:"type,omitempty"` 14314 // Etag - Etag of the azure resource 14315 Etag *string `json:"etag,omitempty"` 14316 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 14317 Kind KindBasicDataConnector `json:"kind,omitempty"` 14318} 14319 14320// MarshalJSON is the custom marshaler for OfficeATPDataConnector. 14321func (oadc OfficeATPDataConnector) MarshalJSON() ([]byte, error) { 14322 oadc.Kind = KindBasicDataConnectorKindOfficeATP 14323 objectMap := make(map[string]interface{}) 14324 if oadc.OfficeATPDataConnectorProperties != nil { 14325 objectMap["properties"] = oadc.OfficeATPDataConnectorProperties 14326 } 14327 if oadc.Etag != nil { 14328 objectMap["etag"] = oadc.Etag 14329 } 14330 if oadc.Kind != "" { 14331 objectMap["kind"] = oadc.Kind 14332 } 14333 return json.Marshal(objectMap) 14334} 14335 14336// AsAADDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14337func (oadc OfficeATPDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 14338 return nil, false 14339} 14340 14341// AsAATPDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14342func (oadc OfficeATPDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 14343 return nil, false 14344} 14345 14346// AsMSTIDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14347func (oadc OfficeATPDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 14348 return nil, false 14349} 14350 14351// AsMTPDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14352func (oadc OfficeATPDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 14353 return nil, false 14354} 14355 14356// AsASCDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14357func (oadc OfficeATPDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 14358 return nil, false 14359} 14360 14361// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14362func (oadc OfficeATPDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 14363 return nil, false 14364} 14365 14366// AsDynamics365DataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14367func (oadc OfficeATPDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 14368 return nil, false 14369} 14370 14371// AsMCASDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14372func (oadc OfficeATPDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 14373 return nil, false 14374} 14375 14376// AsMDATPDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14377func (oadc OfficeATPDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 14378 return nil, false 14379} 14380 14381// AsOfficeATPDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14382func (oadc OfficeATPDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 14383 return &oadc, true 14384} 14385 14386// AsOfficeDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14387func (oadc OfficeATPDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 14388 return nil, false 14389} 14390 14391// AsTIDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14392func (oadc OfficeATPDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 14393 return nil, false 14394} 14395 14396// AsTiTaxiiDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14397func (oadc OfficeATPDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 14398 return nil, false 14399} 14400 14401// AsDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14402func (oadc OfficeATPDataConnector) AsDataConnector() (*DataConnector, bool) { 14403 return nil, false 14404} 14405 14406// AsBasicDataConnector is the BasicDataConnector implementation for OfficeATPDataConnector. 14407func (oadc OfficeATPDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 14408 return &oadc, true 14409} 14410 14411// UnmarshalJSON is the custom unmarshaler for OfficeATPDataConnector struct. 14412func (oadc *OfficeATPDataConnector) UnmarshalJSON(body []byte) error { 14413 var m map[string]*json.RawMessage 14414 err := json.Unmarshal(body, &m) 14415 if err != nil { 14416 return err 14417 } 14418 for k, v := range m { 14419 switch k { 14420 case "properties": 14421 if v != nil { 14422 var officeATPDataConnectorProperties OfficeATPDataConnectorProperties 14423 err = json.Unmarshal(*v, &officeATPDataConnectorProperties) 14424 if err != nil { 14425 return err 14426 } 14427 oadc.OfficeATPDataConnectorProperties = &officeATPDataConnectorProperties 14428 } 14429 case "id": 14430 if v != nil { 14431 var ID string 14432 err = json.Unmarshal(*v, &ID) 14433 if err != nil { 14434 return err 14435 } 14436 oadc.ID = &ID 14437 } 14438 case "name": 14439 if v != nil { 14440 var name string 14441 err = json.Unmarshal(*v, &name) 14442 if err != nil { 14443 return err 14444 } 14445 oadc.Name = &name 14446 } 14447 case "type": 14448 if v != nil { 14449 var typeVar string 14450 err = json.Unmarshal(*v, &typeVar) 14451 if err != nil { 14452 return err 14453 } 14454 oadc.Type = &typeVar 14455 } 14456 case "etag": 14457 if v != nil { 14458 var etag string 14459 err = json.Unmarshal(*v, &etag) 14460 if err != nil { 14461 return err 14462 } 14463 oadc.Etag = &etag 14464 } 14465 case "kind": 14466 if v != nil { 14467 var kind KindBasicDataConnector 14468 err = json.Unmarshal(*v, &kind) 14469 if err != nil { 14470 return err 14471 } 14472 oadc.Kind = kind 14473 } 14474 } 14475 } 14476 14477 return nil 14478} 14479 14480// OfficeATPDataConnectorProperties officeATP (Office 365 Advanced Threat Protection) data connector 14481// properties. 14482type OfficeATPDataConnectorProperties struct { 14483 // TenantID - The tenant id to connect to, and get the data from. 14484 TenantID *string `json:"tenantId,omitempty"` 14485 // DataTypes - The available data types for the connector. 14486 DataTypes *AlertsDataTypeOfDataConnector `json:"dataTypes,omitempty"` 14487} 14488 14489// OfficeConsent consent for Office365 tenant that already made. 14490type OfficeConsent struct { 14491 autorest.Response `json:"-"` 14492 // OfficeConsentProperties - Office consent properties 14493 *OfficeConsentProperties `json:"properties,omitempty"` 14494 // ID - READ-ONLY; Azure resource Id 14495 ID *string `json:"id,omitempty"` 14496 // Name - READ-ONLY; Azure resource name 14497 Name *string `json:"name,omitempty"` 14498 // Type - READ-ONLY; Azure resource type 14499 Type *string `json:"type,omitempty"` 14500} 14501 14502// MarshalJSON is the custom marshaler for OfficeConsent. 14503func (oc OfficeConsent) MarshalJSON() ([]byte, error) { 14504 objectMap := make(map[string]interface{}) 14505 if oc.OfficeConsentProperties != nil { 14506 objectMap["properties"] = oc.OfficeConsentProperties 14507 } 14508 return json.Marshal(objectMap) 14509} 14510 14511// UnmarshalJSON is the custom unmarshaler for OfficeConsent struct. 14512func (oc *OfficeConsent) UnmarshalJSON(body []byte) error { 14513 var m map[string]*json.RawMessage 14514 err := json.Unmarshal(body, &m) 14515 if err != nil { 14516 return err 14517 } 14518 for k, v := range m { 14519 switch k { 14520 case "properties": 14521 if v != nil { 14522 var officeConsentProperties OfficeConsentProperties 14523 err = json.Unmarshal(*v, &officeConsentProperties) 14524 if err != nil { 14525 return err 14526 } 14527 oc.OfficeConsentProperties = &officeConsentProperties 14528 } 14529 case "id": 14530 if v != nil { 14531 var ID string 14532 err = json.Unmarshal(*v, &ID) 14533 if err != nil { 14534 return err 14535 } 14536 oc.ID = &ID 14537 } 14538 case "name": 14539 if v != nil { 14540 var name string 14541 err = json.Unmarshal(*v, &name) 14542 if err != nil { 14543 return err 14544 } 14545 oc.Name = &name 14546 } 14547 case "type": 14548 if v != nil { 14549 var typeVar string 14550 err = json.Unmarshal(*v, &typeVar) 14551 if err != nil { 14552 return err 14553 } 14554 oc.Type = &typeVar 14555 } 14556 } 14557 } 14558 14559 return nil 14560} 14561 14562// OfficeConsentList list of all the office365 consents. 14563type OfficeConsentList struct { 14564 autorest.Response `json:"-"` 14565 // NextLink - READ-ONLY; URL to fetch the next set of office consents. 14566 NextLink *string `json:"nextLink,omitempty"` 14567 // Value - Array of the consents. 14568 Value *[]OfficeConsent `json:"value,omitempty"` 14569} 14570 14571// MarshalJSON is the custom marshaler for OfficeConsentList. 14572func (ocl OfficeConsentList) MarshalJSON() ([]byte, error) { 14573 objectMap := make(map[string]interface{}) 14574 if ocl.Value != nil { 14575 objectMap["value"] = ocl.Value 14576 } 14577 return json.Marshal(objectMap) 14578} 14579 14580// OfficeConsentListIterator provides access to a complete listing of OfficeConsent values. 14581type OfficeConsentListIterator struct { 14582 i int 14583 page OfficeConsentListPage 14584} 14585 14586// NextWithContext advances to the next value. If there was an error making 14587// the request the iterator does not advance and the error is returned. 14588func (iter *OfficeConsentListIterator) NextWithContext(ctx context.Context) (err error) { 14589 if tracing.IsEnabled() { 14590 ctx = tracing.StartSpan(ctx, fqdn+"/OfficeConsentListIterator.NextWithContext") 14591 defer func() { 14592 sc := -1 14593 if iter.Response().Response.Response != nil { 14594 sc = iter.Response().Response.Response.StatusCode 14595 } 14596 tracing.EndSpan(ctx, sc, err) 14597 }() 14598 } 14599 iter.i++ 14600 if iter.i < len(iter.page.Values()) { 14601 return nil 14602 } 14603 err = iter.page.NextWithContext(ctx) 14604 if err != nil { 14605 iter.i-- 14606 return err 14607 } 14608 iter.i = 0 14609 return nil 14610} 14611 14612// Next advances to the next value. If there was an error making 14613// the request the iterator does not advance and the error is returned. 14614// Deprecated: Use NextWithContext() instead. 14615func (iter *OfficeConsentListIterator) Next() error { 14616 return iter.NextWithContext(context.Background()) 14617} 14618 14619// NotDone returns true if the enumeration should be started or is not yet complete. 14620func (iter OfficeConsentListIterator) NotDone() bool { 14621 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 14622} 14623 14624// Response returns the raw server response from the last page request. 14625func (iter OfficeConsentListIterator) Response() OfficeConsentList { 14626 return iter.page.Response() 14627} 14628 14629// Value returns the current value or a zero-initialized value if the 14630// iterator has advanced beyond the end of the collection. 14631func (iter OfficeConsentListIterator) Value() OfficeConsent { 14632 if !iter.page.NotDone() { 14633 return OfficeConsent{} 14634 } 14635 return iter.page.Values()[iter.i] 14636} 14637 14638// Creates a new instance of the OfficeConsentListIterator type. 14639func NewOfficeConsentListIterator(page OfficeConsentListPage) OfficeConsentListIterator { 14640 return OfficeConsentListIterator{page: page} 14641} 14642 14643// IsEmpty returns true if the ListResult contains no values. 14644func (ocl OfficeConsentList) IsEmpty() bool { 14645 return ocl.Value == nil || len(*ocl.Value) == 0 14646} 14647 14648// hasNextLink returns true if the NextLink is not empty. 14649func (ocl OfficeConsentList) hasNextLink() bool { 14650 return ocl.NextLink != nil && len(*ocl.NextLink) != 0 14651} 14652 14653// officeConsentListPreparer prepares a request to retrieve the next set of results. 14654// It returns nil if no more results exist. 14655func (ocl OfficeConsentList) officeConsentListPreparer(ctx context.Context) (*http.Request, error) { 14656 if !ocl.hasNextLink() { 14657 return nil, nil 14658 } 14659 return autorest.Prepare((&http.Request{}).WithContext(ctx), 14660 autorest.AsJSON(), 14661 autorest.AsGet(), 14662 autorest.WithBaseURL(to.String(ocl.NextLink))) 14663} 14664 14665// OfficeConsentListPage contains a page of OfficeConsent values. 14666type OfficeConsentListPage struct { 14667 fn func(context.Context, OfficeConsentList) (OfficeConsentList, error) 14668 ocl OfficeConsentList 14669} 14670 14671// NextWithContext advances to the next page of values. If there was an error making 14672// the request the page does not advance and the error is returned. 14673func (page *OfficeConsentListPage) NextWithContext(ctx context.Context) (err error) { 14674 if tracing.IsEnabled() { 14675 ctx = tracing.StartSpan(ctx, fqdn+"/OfficeConsentListPage.NextWithContext") 14676 defer func() { 14677 sc := -1 14678 if page.Response().Response.Response != nil { 14679 sc = page.Response().Response.Response.StatusCode 14680 } 14681 tracing.EndSpan(ctx, sc, err) 14682 }() 14683 } 14684 for { 14685 next, err := page.fn(ctx, page.ocl) 14686 if err != nil { 14687 return err 14688 } 14689 page.ocl = next 14690 if !next.hasNextLink() || !next.IsEmpty() { 14691 break 14692 } 14693 } 14694 return nil 14695} 14696 14697// Next advances to the next page of values. If there was an error making 14698// the request the page does not advance and the error is returned. 14699// Deprecated: Use NextWithContext() instead. 14700func (page *OfficeConsentListPage) Next() error { 14701 return page.NextWithContext(context.Background()) 14702} 14703 14704// NotDone returns true if the page enumeration should be started or is not yet complete. 14705func (page OfficeConsentListPage) NotDone() bool { 14706 return !page.ocl.IsEmpty() 14707} 14708 14709// Response returns the raw server response from the last page request. 14710func (page OfficeConsentListPage) Response() OfficeConsentList { 14711 return page.ocl 14712} 14713 14714// Values returns the slice of values for the current page or nil if there are no values. 14715func (page OfficeConsentListPage) Values() []OfficeConsent { 14716 if page.ocl.IsEmpty() { 14717 return nil 14718 } 14719 return *page.ocl.Value 14720} 14721 14722// Creates a new instance of the OfficeConsentListPage type. 14723func NewOfficeConsentListPage(cur OfficeConsentList, getNextPage func(context.Context, OfficeConsentList) (OfficeConsentList, error)) OfficeConsentListPage { 14724 return OfficeConsentListPage{ 14725 fn: getNextPage, 14726 ocl: cur, 14727 } 14728} 14729 14730// OfficeConsentProperties consent property bag. 14731type OfficeConsentProperties struct { 14732 // TenantID - The tenantId of the Office365 with the consent. 14733 TenantID *string `json:"tenantId,omitempty"` 14734 // ConsentID - Help to easily cascade among the data layers. 14735 ConsentID *string `json:"consentId,omitempty"` 14736} 14737 14738// OfficeDataConnector represents office data connector. 14739type OfficeDataConnector struct { 14740 // OfficeDataConnectorProperties - Office data connector properties. 14741 *OfficeDataConnectorProperties `json:"properties,omitempty"` 14742 // ID - READ-ONLY; Azure resource Id 14743 ID *string `json:"id,omitempty"` 14744 // Name - READ-ONLY; Azure resource name 14745 Name *string `json:"name,omitempty"` 14746 // Type - READ-ONLY; Azure resource type 14747 Type *string `json:"type,omitempty"` 14748 // Etag - Etag of the azure resource 14749 Etag *string `json:"etag,omitempty"` 14750 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 14751 Kind KindBasicDataConnector `json:"kind,omitempty"` 14752} 14753 14754// MarshalJSON is the custom marshaler for OfficeDataConnector. 14755func (odc OfficeDataConnector) MarshalJSON() ([]byte, error) { 14756 odc.Kind = KindBasicDataConnectorKindOffice365 14757 objectMap := make(map[string]interface{}) 14758 if odc.OfficeDataConnectorProperties != nil { 14759 objectMap["properties"] = odc.OfficeDataConnectorProperties 14760 } 14761 if odc.Etag != nil { 14762 objectMap["etag"] = odc.Etag 14763 } 14764 if odc.Kind != "" { 14765 objectMap["kind"] = odc.Kind 14766 } 14767 return json.Marshal(objectMap) 14768} 14769 14770// AsAADDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14771func (odc OfficeDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 14772 return nil, false 14773} 14774 14775// AsAATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14776func (odc OfficeDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 14777 return nil, false 14778} 14779 14780// AsMSTIDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14781func (odc OfficeDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 14782 return nil, false 14783} 14784 14785// AsMTPDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14786func (odc OfficeDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 14787 return nil, false 14788} 14789 14790// AsASCDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14791func (odc OfficeDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 14792 return nil, false 14793} 14794 14795// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14796func (odc OfficeDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 14797 return nil, false 14798} 14799 14800// AsDynamics365DataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14801func (odc OfficeDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 14802 return nil, false 14803} 14804 14805// AsMCASDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14806func (odc OfficeDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 14807 return nil, false 14808} 14809 14810// AsMDATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14811func (odc OfficeDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 14812 return nil, false 14813} 14814 14815// AsOfficeATPDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14816func (odc OfficeDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 14817 return nil, false 14818} 14819 14820// AsOfficeDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14821func (odc OfficeDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 14822 return &odc, true 14823} 14824 14825// AsTIDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14826func (odc OfficeDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 14827 return nil, false 14828} 14829 14830// AsTiTaxiiDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14831func (odc OfficeDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 14832 return nil, false 14833} 14834 14835// AsDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14836func (odc OfficeDataConnector) AsDataConnector() (*DataConnector, bool) { 14837 return nil, false 14838} 14839 14840// AsBasicDataConnector is the BasicDataConnector implementation for OfficeDataConnector. 14841func (odc OfficeDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 14842 return &odc, true 14843} 14844 14845// UnmarshalJSON is the custom unmarshaler for OfficeDataConnector struct. 14846func (odc *OfficeDataConnector) UnmarshalJSON(body []byte) error { 14847 var m map[string]*json.RawMessage 14848 err := json.Unmarshal(body, &m) 14849 if err != nil { 14850 return err 14851 } 14852 for k, v := range m { 14853 switch k { 14854 case "properties": 14855 if v != nil { 14856 var officeDataConnectorProperties OfficeDataConnectorProperties 14857 err = json.Unmarshal(*v, &officeDataConnectorProperties) 14858 if err != nil { 14859 return err 14860 } 14861 odc.OfficeDataConnectorProperties = &officeDataConnectorProperties 14862 } 14863 case "id": 14864 if v != nil { 14865 var ID string 14866 err = json.Unmarshal(*v, &ID) 14867 if err != nil { 14868 return err 14869 } 14870 odc.ID = &ID 14871 } 14872 case "name": 14873 if v != nil { 14874 var name string 14875 err = json.Unmarshal(*v, &name) 14876 if err != nil { 14877 return err 14878 } 14879 odc.Name = &name 14880 } 14881 case "type": 14882 if v != nil { 14883 var typeVar string 14884 err = json.Unmarshal(*v, &typeVar) 14885 if err != nil { 14886 return err 14887 } 14888 odc.Type = &typeVar 14889 } 14890 case "etag": 14891 if v != nil { 14892 var etag string 14893 err = json.Unmarshal(*v, &etag) 14894 if err != nil { 14895 return err 14896 } 14897 odc.Etag = &etag 14898 } 14899 case "kind": 14900 if v != nil { 14901 var kind KindBasicDataConnector 14902 err = json.Unmarshal(*v, &kind) 14903 if err != nil { 14904 return err 14905 } 14906 odc.Kind = kind 14907 } 14908 } 14909 } 14910 14911 return nil 14912} 14913 14914// OfficeDataConnectorDataTypes the available data types for office data connector. 14915type OfficeDataConnectorDataTypes struct { 14916 // Exchange - Exchange data type connection. 14917 Exchange *OfficeDataConnectorDataTypesExchange `json:"exchange,omitempty"` 14918 // SharePoint - SharePoint data type connection. 14919 SharePoint *OfficeDataConnectorDataTypesSharePoint `json:"sharePoint,omitempty"` 14920 // Teams - Teams data type connection. 14921 Teams *OfficeDataConnectorDataTypesTeams `json:"teams,omitempty"` 14922} 14923 14924// OfficeDataConnectorDataTypesExchange exchange data type connection. 14925type OfficeDataConnectorDataTypesExchange struct { 14926 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 14927 State DataTypeState `json:"state,omitempty"` 14928} 14929 14930// OfficeDataConnectorDataTypesSharePoint sharePoint data type connection. 14931type OfficeDataConnectorDataTypesSharePoint struct { 14932 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 14933 State DataTypeState `json:"state,omitempty"` 14934} 14935 14936// OfficeDataConnectorDataTypesTeams teams data type connection. 14937type OfficeDataConnectorDataTypesTeams struct { 14938 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 14939 State DataTypeState `json:"state,omitempty"` 14940} 14941 14942// OfficeDataConnectorProperties office data connector properties. 14943type OfficeDataConnectorProperties struct { 14944 // DataTypes - The available data types for the connector. 14945 DataTypes *OfficeDataConnectorDataTypes `json:"dataTypes,omitempty"` 14946 // TenantID - The tenant id to connect to, and get the data from. 14947 TenantID *string `json:"tenantId,omitempty"` 14948} 14949 14950// Operation operation provided by provider 14951type Operation struct { 14952 // Display - Properties of the operation 14953 Display *OperationDisplay `json:"display,omitempty"` 14954 // Name - Name of the operation 14955 Name *string `json:"name,omitempty"` 14956 // Origin - The origin of the operation 14957 Origin *string `json:"origin,omitempty"` 14958} 14959 14960// OperationDisplay properties of the operation 14961type OperationDisplay struct { 14962 // Description - Description of the operation 14963 Description *string `json:"description,omitempty"` 14964 // Operation - Operation name 14965 Operation *string `json:"operation,omitempty"` 14966 // Provider - Provider name 14967 Provider *string `json:"provider,omitempty"` 14968 // Resource - Resource name 14969 Resource *string `json:"resource,omitempty"` 14970} 14971 14972// OperationsList lists the operations available in the SecurityInsights RP. 14973type OperationsList struct { 14974 autorest.Response `json:"-"` 14975 // NextLink - URL to fetch the next set of operations. 14976 NextLink *string `json:"nextLink,omitempty"` 14977 // Value - Array of operations 14978 Value *[]Operation `json:"value,omitempty"` 14979} 14980 14981// OperationsListIterator provides access to a complete listing of Operation values. 14982type OperationsListIterator struct { 14983 i int 14984 page OperationsListPage 14985} 14986 14987// NextWithContext advances to the next value. If there was an error making 14988// the request the iterator does not advance and the error is returned. 14989func (iter *OperationsListIterator) NextWithContext(ctx context.Context) (err error) { 14990 if tracing.IsEnabled() { 14991 ctx = tracing.StartSpan(ctx, fqdn+"/OperationsListIterator.NextWithContext") 14992 defer func() { 14993 sc := -1 14994 if iter.Response().Response.Response != nil { 14995 sc = iter.Response().Response.Response.StatusCode 14996 } 14997 tracing.EndSpan(ctx, sc, err) 14998 }() 14999 } 15000 iter.i++ 15001 if iter.i < len(iter.page.Values()) { 15002 return nil 15003 } 15004 err = iter.page.NextWithContext(ctx) 15005 if err != nil { 15006 iter.i-- 15007 return err 15008 } 15009 iter.i = 0 15010 return nil 15011} 15012 15013// Next advances to the next value. If there was an error making 15014// the request the iterator does not advance and the error is returned. 15015// Deprecated: Use NextWithContext() instead. 15016func (iter *OperationsListIterator) Next() error { 15017 return iter.NextWithContext(context.Background()) 15018} 15019 15020// NotDone returns true if the enumeration should be started or is not yet complete. 15021func (iter OperationsListIterator) NotDone() bool { 15022 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 15023} 15024 15025// Response returns the raw server response from the last page request. 15026func (iter OperationsListIterator) Response() OperationsList { 15027 return iter.page.Response() 15028} 15029 15030// Value returns the current value or a zero-initialized value if the 15031// iterator has advanced beyond the end of the collection. 15032func (iter OperationsListIterator) Value() Operation { 15033 if !iter.page.NotDone() { 15034 return Operation{} 15035 } 15036 return iter.page.Values()[iter.i] 15037} 15038 15039// Creates a new instance of the OperationsListIterator type. 15040func NewOperationsListIterator(page OperationsListPage) OperationsListIterator { 15041 return OperationsListIterator{page: page} 15042} 15043 15044// IsEmpty returns true if the ListResult contains no values. 15045func (ol OperationsList) IsEmpty() bool { 15046 return ol.Value == nil || len(*ol.Value) == 0 15047} 15048 15049// hasNextLink returns true if the NextLink is not empty. 15050func (ol OperationsList) hasNextLink() bool { 15051 return ol.NextLink != nil && len(*ol.NextLink) != 0 15052} 15053 15054// operationsListPreparer prepares a request to retrieve the next set of results. 15055// It returns nil if no more results exist. 15056func (ol OperationsList) operationsListPreparer(ctx context.Context) (*http.Request, error) { 15057 if !ol.hasNextLink() { 15058 return nil, nil 15059 } 15060 return autorest.Prepare((&http.Request{}).WithContext(ctx), 15061 autorest.AsJSON(), 15062 autorest.AsGet(), 15063 autorest.WithBaseURL(to.String(ol.NextLink))) 15064} 15065 15066// OperationsListPage contains a page of Operation values. 15067type OperationsListPage struct { 15068 fn func(context.Context, OperationsList) (OperationsList, error) 15069 ol OperationsList 15070} 15071 15072// NextWithContext advances to the next page of values. If there was an error making 15073// the request the page does not advance and the error is returned. 15074func (page *OperationsListPage) NextWithContext(ctx context.Context) (err error) { 15075 if tracing.IsEnabled() { 15076 ctx = tracing.StartSpan(ctx, fqdn+"/OperationsListPage.NextWithContext") 15077 defer func() { 15078 sc := -1 15079 if page.Response().Response.Response != nil { 15080 sc = page.Response().Response.Response.StatusCode 15081 } 15082 tracing.EndSpan(ctx, sc, err) 15083 }() 15084 } 15085 for { 15086 next, err := page.fn(ctx, page.ol) 15087 if err != nil { 15088 return err 15089 } 15090 page.ol = next 15091 if !next.hasNextLink() || !next.IsEmpty() { 15092 break 15093 } 15094 } 15095 return nil 15096} 15097 15098// Next advances to the next page of values. If there was an error making 15099// the request the page does not advance and the error is returned. 15100// Deprecated: Use NextWithContext() instead. 15101func (page *OperationsListPage) Next() error { 15102 return page.NextWithContext(context.Background()) 15103} 15104 15105// NotDone returns true if the page enumeration should be started or is not yet complete. 15106func (page OperationsListPage) NotDone() bool { 15107 return !page.ol.IsEmpty() 15108} 15109 15110// Response returns the raw server response from the last page request. 15111func (page OperationsListPage) Response() OperationsList { 15112 return page.ol 15113} 15114 15115// Values returns the slice of values for the current page or nil if there are no values. 15116func (page OperationsListPage) Values() []Operation { 15117 if page.ol.IsEmpty() { 15118 return nil 15119 } 15120 return *page.ol.Value 15121} 15122 15123// Creates a new instance of the OperationsListPage type. 15124func NewOperationsListPage(cur OperationsList, getNextPage func(context.Context, OperationsList) (OperationsList, error)) OperationsListPage { 15125 return OperationsListPage{ 15126 fn: getNextPage, 15127 ol: cur, 15128 } 15129} 15130 15131// ProcessEntity represents a process entity. 15132type ProcessEntity struct { 15133 // ProcessEntityProperties - Process entity properties 15134 *ProcessEntityProperties `json:"properties,omitempty"` 15135 // ID - READ-ONLY; Azure resource Id 15136 ID *string `json:"id,omitempty"` 15137 // Name - READ-ONLY; Azure resource name 15138 Name *string `json:"name,omitempty"` 15139 // Type - READ-ONLY; Azure resource type 15140 Type *string `json:"type,omitempty"` 15141 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 15142 Kind KindBasicEntity `json:"kind,omitempty"` 15143} 15144 15145// MarshalJSON is the custom marshaler for ProcessEntity. 15146func (peVar ProcessEntity) MarshalJSON() ([]byte, error) { 15147 peVar.Kind = KindBasicEntityKindProcess 15148 objectMap := make(map[string]interface{}) 15149 if peVar.ProcessEntityProperties != nil { 15150 objectMap["properties"] = peVar.ProcessEntityProperties 15151 } 15152 if peVar.Kind != "" { 15153 objectMap["kind"] = peVar.Kind 15154 } 15155 return json.Marshal(objectMap) 15156} 15157 15158// AsAccountEntity is the BasicEntity implementation for ProcessEntity. 15159func (peVar ProcessEntity) AsAccountEntity() (*AccountEntity, bool) { 15160 return nil, false 15161} 15162 15163// AsAzureResourceEntity is the BasicEntity implementation for ProcessEntity. 15164func (peVar ProcessEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 15165 return nil, false 15166} 15167 15168// AsCloudApplicationEntity is the BasicEntity implementation for ProcessEntity. 15169func (peVar ProcessEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 15170 return nil, false 15171} 15172 15173// AsDNSEntity is the BasicEntity implementation for ProcessEntity. 15174func (peVar ProcessEntity) AsDNSEntity() (*DNSEntity, bool) { 15175 return nil, false 15176} 15177 15178// AsFileEntity is the BasicEntity implementation for ProcessEntity. 15179func (peVar ProcessEntity) AsFileEntity() (*FileEntity, bool) { 15180 return nil, false 15181} 15182 15183// AsFileHashEntity is the BasicEntity implementation for ProcessEntity. 15184func (peVar ProcessEntity) AsFileHashEntity() (*FileHashEntity, bool) { 15185 return nil, false 15186} 15187 15188// AsHostEntity is the BasicEntity implementation for ProcessEntity. 15189func (peVar ProcessEntity) AsHostEntity() (*HostEntity, bool) { 15190 return nil, false 15191} 15192 15193// AsHuntingBookmark is the BasicEntity implementation for ProcessEntity. 15194func (peVar ProcessEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 15195 return nil, false 15196} 15197 15198// AsSecurityAlert is the BasicEntity implementation for ProcessEntity. 15199func (peVar ProcessEntity) AsSecurityAlert() (*SecurityAlert, bool) { 15200 return nil, false 15201} 15202 15203// AsIPEntity is the BasicEntity implementation for ProcessEntity. 15204func (peVar ProcessEntity) AsIPEntity() (*IPEntity, bool) { 15205 return nil, false 15206} 15207 15208// AsMailboxEntity is the BasicEntity implementation for ProcessEntity. 15209func (peVar ProcessEntity) AsMailboxEntity() (*MailboxEntity, bool) { 15210 return nil, false 15211} 15212 15213// AsMailClusterEntity is the BasicEntity implementation for ProcessEntity. 15214func (peVar ProcessEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 15215 return nil, false 15216} 15217 15218// AsMailMessageEntity is the BasicEntity implementation for ProcessEntity. 15219func (peVar ProcessEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 15220 return nil, false 15221} 15222 15223// AsSubmissionMailEntity is the BasicEntity implementation for ProcessEntity. 15224func (peVar ProcessEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 15225 return nil, false 15226} 15227 15228// AsMalwareEntity is the BasicEntity implementation for ProcessEntity. 15229func (peVar ProcessEntity) AsMalwareEntity() (*MalwareEntity, bool) { 15230 return nil, false 15231} 15232 15233// AsProcessEntity is the BasicEntity implementation for ProcessEntity. 15234func (peVar ProcessEntity) AsProcessEntity() (*ProcessEntity, bool) { 15235 return &peVar, true 15236} 15237 15238// AsRegistryKeyEntity is the BasicEntity implementation for ProcessEntity. 15239func (peVar ProcessEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 15240 return nil, false 15241} 15242 15243// AsRegistryValueEntity is the BasicEntity implementation for ProcessEntity. 15244func (peVar ProcessEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 15245 return nil, false 15246} 15247 15248// AsSecurityGroupEntity is the BasicEntity implementation for ProcessEntity. 15249func (peVar ProcessEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 15250 return nil, false 15251} 15252 15253// AsURLEntity is the BasicEntity implementation for ProcessEntity. 15254func (peVar ProcessEntity) AsURLEntity() (*URLEntity, bool) { 15255 return nil, false 15256} 15257 15258// AsIoTDeviceEntity is the BasicEntity implementation for ProcessEntity. 15259func (peVar ProcessEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 15260 return nil, false 15261} 15262 15263// AsEntity is the BasicEntity implementation for ProcessEntity. 15264func (peVar ProcessEntity) AsEntity() (*Entity, bool) { 15265 return nil, false 15266} 15267 15268// AsBasicEntity is the BasicEntity implementation for ProcessEntity. 15269func (peVar ProcessEntity) AsBasicEntity() (BasicEntity, bool) { 15270 return &peVar, true 15271} 15272 15273// UnmarshalJSON is the custom unmarshaler for ProcessEntity struct. 15274func (peVar *ProcessEntity) UnmarshalJSON(body []byte) error { 15275 var m map[string]*json.RawMessage 15276 err := json.Unmarshal(body, &m) 15277 if err != nil { 15278 return err 15279 } 15280 for k, v := range m { 15281 switch k { 15282 case "properties": 15283 if v != nil { 15284 var processEntityProperties ProcessEntityProperties 15285 err = json.Unmarshal(*v, &processEntityProperties) 15286 if err != nil { 15287 return err 15288 } 15289 peVar.ProcessEntityProperties = &processEntityProperties 15290 } 15291 case "id": 15292 if v != nil { 15293 var ID string 15294 err = json.Unmarshal(*v, &ID) 15295 if err != nil { 15296 return err 15297 } 15298 peVar.ID = &ID 15299 } 15300 case "name": 15301 if v != nil { 15302 var name string 15303 err = json.Unmarshal(*v, &name) 15304 if err != nil { 15305 return err 15306 } 15307 peVar.Name = &name 15308 } 15309 case "type": 15310 if v != nil { 15311 var typeVar string 15312 err = json.Unmarshal(*v, &typeVar) 15313 if err != nil { 15314 return err 15315 } 15316 peVar.Type = &typeVar 15317 } 15318 case "kind": 15319 if v != nil { 15320 var kind KindBasicEntity 15321 err = json.Unmarshal(*v, &kind) 15322 if err != nil { 15323 return err 15324 } 15325 peVar.Kind = kind 15326 } 15327 } 15328 } 15329 15330 return nil 15331} 15332 15333// ProcessEntityProperties process entity property bag. 15334type ProcessEntityProperties struct { 15335 // AccountEntityID - READ-ONLY; The account entity id running the processes. 15336 AccountEntityID *string `json:"accountEntityId,omitempty"` 15337 // CommandLine - READ-ONLY; The command line used to create the process 15338 CommandLine *string `json:"commandLine,omitempty"` 15339 // CreationTimeUtc - READ-ONLY; The time when the process started to run 15340 CreationTimeUtc *date.Time `json:"creationTimeUtc,omitempty"` 15341 // ElevationToken - The elevation token associated with the process. Possible values include: 'ElevationTokenDefault', 'ElevationTokenFull', 'ElevationTokenLimited' 15342 ElevationToken ElevationToken `json:"elevationToken,omitempty"` 15343 // HostEntityID - READ-ONLY; The host entity id on which the process was running 15344 HostEntityID *string `json:"hostEntityId,omitempty"` 15345 // HostLogonSessionEntityID - READ-ONLY; The session entity id in which the process was running 15346 HostLogonSessionEntityID *string `json:"hostLogonSessionEntityId,omitempty"` 15347 // ImageFileEntityID - READ-ONLY; Image file entity id 15348 ImageFileEntityID *string `json:"imageFileEntityId,omitempty"` 15349 // ParentProcessEntityID - READ-ONLY; The parent process entity id. 15350 ParentProcessEntityID *string `json:"parentProcessEntityId,omitempty"` 15351 // ProcessID - READ-ONLY; The process ID 15352 ProcessID *string `json:"processId,omitempty"` 15353 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 15354 AdditionalData map[string]interface{} `json:"additionalData"` 15355 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 15356 FriendlyName *string `json:"friendlyName,omitempty"` 15357} 15358 15359// MarshalJSON is the custom marshaler for ProcessEntityProperties. 15360func (pep ProcessEntityProperties) MarshalJSON() ([]byte, error) { 15361 objectMap := make(map[string]interface{}) 15362 if pep.ElevationToken != "" { 15363 objectMap["elevationToken"] = pep.ElevationToken 15364 } 15365 return json.Marshal(objectMap) 15366} 15367 15368// RegistryKeyEntity represents a registry key entity. 15369type RegistryKeyEntity struct { 15370 // RegistryKeyEntityProperties - RegistryKey entity properties 15371 *RegistryKeyEntityProperties `json:"properties,omitempty"` 15372 // ID - READ-ONLY; Azure resource Id 15373 ID *string `json:"id,omitempty"` 15374 // Name - READ-ONLY; Azure resource name 15375 Name *string `json:"name,omitempty"` 15376 // Type - READ-ONLY; Azure resource type 15377 Type *string `json:"type,omitempty"` 15378 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 15379 Kind KindBasicEntity `json:"kind,omitempty"` 15380} 15381 15382// MarshalJSON is the custom marshaler for RegistryKeyEntity. 15383func (rke RegistryKeyEntity) MarshalJSON() ([]byte, error) { 15384 rke.Kind = KindBasicEntityKindRegistryKey 15385 objectMap := make(map[string]interface{}) 15386 if rke.RegistryKeyEntityProperties != nil { 15387 objectMap["properties"] = rke.RegistryKeyEntityProperties 15388 } 15389 if rke.Kind != "" { 15390 objectMap["kind"] = rke.Kind 15391 } 15392 return json.Marshal(objectMap) 15393} 15394 15395// AsAccountEntity is the BasicEntity implementation for RegistryKeyEntity. 15396func (rke RegistryKeyEntity) AsAccountEntity() (*AccountEntity, bool) { 15397 return nil, false 15398} 15399 15400// AsAzureResourceEntity is the BasicEntity implementation for RegistryKeyEntity. 15401func (rke RegistryKeyEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 15402 return nil, false 15403} 15404 15405// AsCloudApplicationEntity is the BasicEntity implementation for RegistryKeyEntity. 15406func (rke RegistryKeyEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 15407 return nil, false 15408} 15409 15410// AsDNSEntity is the BasicEntity implementation for RegistryKeyEntity. 15411func (rke RegistryKeyEntity) AsDNSEntity() (*DNSEntity, bool) { 15412 return nil, false 15413} 15414 15415// AsFileEntity is the BasicEntity implementation for RegistryKeyEntity. 15416func (rke RegistryKeyEntity) AsFileEntity() (*FileEntity, bool) { 15417 return nil, false 15418} 15419 15420// AsFileHashEntity is the BasicEntity implementation for RegistryKeyEntity. 15421func (rke RegistryKeyEntity) AsFileHashEntity() (*FileHashEntity, bool) { 15422 return nil, false 15423} 15424 15425// AsHostEntity is the BasicEntity implementation for RegistryKeyEntity. 15426func (rke RegistryKeyEntity) AsHostEntity() (*HostEntity, bool) { 15427 return nil, false 15428} 15429 15430// AsHuntingBookmark is the BasicEntity implementation for RegistryKeyEntity. 15431func (rke RegistryKeyEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 15432 return nil, false 15433} 15434 15435// AsSecurityAlert is the BasicEntity implementation for RegistryKeyEntity. 15436func (rke RegistryKeyEntity) AsSecurityAlert() (*SecurityAlert, bool) { 15437 return nil, false 15438} 15439 15440// AsIPEntity is the BasicEntity implementation for RegistryKeyEntity. 15441func (rke RegistryKeyEntity) AsIPEntity() (*IPEntity, bool) { 15442 return nil, false 15443} 15444 15445// AsMailboxEntity is the BasicEntity implementation for RegistryKeyEntity. 15446func (rke RegistryKeyEntity) AsMailboxEntity() (*MailboxEntity, bool) { 15447 return nil, false 15448} 15449 15450// AsMailClusterEntity is the BasicEntity implementation for RegistryKeyEntity. 15451func (rke RegistryKeyEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 15452 return nil, false 15453} 15454 15455// AsMailMessageEntity is the BasicEntity implementation for RegistryKeyEntity. 15456func (rke RegistryKeyEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 15457 return nil, false 15458} 15459 15460// AsSubmissionMailEntity is the BasicEntity implementation for RegistryKeyEntity. 15461func (rke RegistryKeyEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 15462 return nil, false 15463} 15464 15465// AsMalwareEntity is the BasicEntity implementation for RegistryKeyEntity. 15466func (rke RegistryKeyEntity) AsMalwareEntity() (*MalwareEntity, bool) { 15467 return nil, false 15468} 15469 15470// AsProcessEntity is the BasicEntity implementation for RegistryKeyEntity. 15471func (rke RegistryKeyEntity) AsProcessEntity() (*ProcessEntity, bool) { 15472 return nil, false 15473} 15474 15475// AsRegistryKeyEntity is the BasicEntity implementation for RegistryKeyEntity. 15476func (rke RegistryKeyEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 15477 return &rke, true 15478} 15479 15480// AsRegistryValueEntity is the BasicEntity implementation for RegistryKeyEntity. 15481func (rke RegistryKeyEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 15482 return nil, false 15483} 15484 15485// AsSecurityGroupEntity is the BasicEntity implementation for RegistryKeyEntity. 15486func (rke RegistryKeyEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 15487 return nil, false 15488} 15489 15490// AsURLEntity is the BasicEntity implementation for RegistryKeyEntity. 15491func (rke RegistryKeyEntity) AsURLEntity() (*URLEntity, bool) { 15492 return nil, false 15493} 15494 15495// AsIoTDeviceEntity is the BasicEntity implementation for RegistryKeyEntity. 15496func (rke RegistryKeyEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 15497 return nil, false 15498} 15499 15500// AsEntity is the BasicEntity implementation for RegistryKeyEntity. 15501func (rke RegistryKeyEntity) AsEntity() (*Entity, bool) { 15502 return nil, false 15503} 15504 15505// AsBasicEntity is the BasicEntity implementation for RegistryKeyEntity. 15506func (rke RegistryKeyEntity) AsBasicEntity() (BasicEntity, bool) { 15507 return &rke, true 15508} 15509 15510// UnmarshalJSON is the custom unmarshaler for RegistryKeyEntity struct. 15511func (rke *RegistryKeyEntity) UnmarshalJSON(body []byte) error { 15512 var m map[string]*json.RawMessage 15513 err := json.Unmarshal(body, &m) 15514 if err != nil { 15515 return err 15516 } 15517 for k, v := range m { 15518 switch k { 15519 case "properties": 15520 if v != nil { 15521 var registryKeyEntityProperties RegistryKeyEntityProperties 15522 err = json.Unmarshal(*v, ®istryKeyEntityProperties) 15523 if err != nil { 15524 return err 15525 } 15526 rke.RegistryKeyEntityProperties = ®istryKeyEntityProperties 15527 } 15528 case "id": 15529 if v != nil { 15530 var ID string 15531 err = json.Unmarshal(*v, &ID) 15532 if err != nil { 15533 return err 15534 } 15535 rke.ID = &ID 15536 } 15537 case "name": 15538 if v != nil { 15539 var name string 15540 err = json.Unmarshal(*v, &name) 15541 if err != nil { 15542 return err 15543 } 15544 rke.Name = &name 15545 } 15546 case "type": 15547 if v != nil { 15548 var typeVar string 15549 err = json.Unmarshal(*v, &typeVar) 15550 if err != nil { 15551 return err 15552 } 15553 rke.Type = &typeVar 15554 } 15555 case "kind": 15556 if v != nil { 15557 var kind KindBasicEntity 15558 err = json.Unmarshal(*v, &kind) 15559 if err != nil { 15560 return err 15561 } 15562 rke.Kind = kind 15563 } 15564 } 15565 } 15566 15567 return nil 15568} 15569 15570// RegistryKeyEntityProperties registryKey entity property bag. 15571type RegistryKeyEntityProperties struct { 15572 // Hive - READ-ONLY; the hive that holds the registry key. Possible values include: 'RegistryHiveHKEYLOCALMACHINE', 'RegistryHiveHKEYCLASSESROOT', 'RegistryHiveHKEYCURRENTCONFIG', 'RegistryHiveHKEYUSERS', 'RegistryHiveHKEYCURRENTUSERLOCALSETTINGS', 'RegistryHiveHKEYPERFORMANCEDATA', 'RegistryHiveHKEYPERFORMANCENLSTEXT', 'RegistryHiveHKEYPERFORMANCETEXT', 'RegistryHiveHKEYA', 'RegistryHiveHKEYCURRENTUSER' 15573 Hive RegistryHive `json:"hive,omitempty"` 15574 // Key - READ-ONLY; The registry key path. 15575 Key *string `json:"key,omitempty"` 15576 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 15577 AdditionalData map[string]interface{} `json:"additionalData"` 15578 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 15579 FriendlyName *string `json:"friendlyName,omitempty"` 15580} 15581 15582// MarshalJSON is the custom marshaler for RegistryKeyEntityProperties. 15583func (rkep RegistryKeyEntityProperties) MarshalJSON() ([]byte, error) { 15584 objectMap := make(map[string]interface{}) 15585 return json.Marshal(objectMap) 15586} 15587 15588// RegistryValueEntity represents a registry value entity. 15589type RegistryValueEntity struct { 15590 // RegistryValueEntityProperties - RegistryKey entity properties 15591 *RegistryValueEntityProperties `json:"properties,omitempty"` 15592 // ID - READ-ONLY; Azure resource Id 15593 ID *string `json:"id,omitempty"` 15594 // Name - READ-ONLY; Azure resource name 15595 Name *string `json:"name,omitempty"` 15596 // Type - READ-ONLY; Azure resource type 15597 Type *string `json:"type,omitempty"` 15598 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 15599 Kind KindBasicEntity `json:"kind,omitempty"` 15600} 15601 15602// MarshalJSON is the custom marshaler for RegistryValueEntity. 15603func (rve RegistryValueEntity) MarshalJSON() ([]byte, error) { 15604 rve.Kind = KindBasicEntityKindRegistryValue 15605 objectMap := make(map[string]interface{}) 15606 if rve.RegistryValueEntityProperties != nil { 15607 objectMap["properties"] = rve.RegistryValueEntityProperties 15608 } 15609 if rve.Kind != "" { 15610 objectMap["kind"] = rve.Kind 15611 } 15612 return json.Marshal(objectMap) 15613} 15614 15615// AsAccountEntity is the BasicEntity implementation for RegistryValueEntity. 15616func (rve RegistryValueEntity) AsAccountEntity() (*AccountEntity, bool) { 15617 return nil, false 15618} 15619 15620// AsAzureResourceEntity is the BasicEntity implementation for RegistryValueEntity. 15621func (rve RegistryValueEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 15622 return nil, false 15623} 15624 15625// AsCloudApplicationEntity is the BasicEntity implementation for RegistryValueEntity. 15626func (rve RegistryValueEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 15627 return nil, false 15628} 15629 15630// AsDNSEntity is the BasicEntity implementation for RegistryValueEntity. 15631func (rve RegistryValueEntity) AsDNSEntity() (*DNSEntity, bool) { 15632 return nil, false 15633} 15634 15635// AsFileEntity is the BasicEntity implementation for RegistryValueEntity. 15636func (rve RegistryValueEntity) AsFileEntity() (*FileEntity, bool) { 15637 return nil, false 15638} 15639 15640// AsFileHashEntity is the BasicEntity implementation for RegistryValueEntity. 15641func (rve RegistryValueEntity) AsFileHashEntity() (*FileHashEntity, bool) { 15642 return nil, false 15643} 15644 15645// AsHostEntity is the BasicEntity implementation for RegistryValueEntity. 15646func (rve RegistryValueEntity) AsHostEntity() (*HostEntity, bool) { 15647 return nil, false 15648} 15649 15650// AsHuntingBookmark is the BasicEntity implementation for RegistryValueEntity. 15651func (rve RegistryValueEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 15652 return nil, false 15653} 15654 15655// AsSecurityAlert is the BasicEntity implementation for RegistryValueEntity. 15656func (rve RegistryValueEntity) AsSecurityAlert() (*SecurityAlert, bool) { 15657 return nil, false 15658} 15659 15660// AsIPEntity is the BasicEntity implementation for RegistryValueEntity. 15661func (rve RegistryValueEntity) AsIPEntity() (*IPEntity, bool) { 15662 return nil, false 15663} 15664 15665// AsMailboxEntity is the BasicEntity implementation for RegistryValueEntity. 15666func (rve RegistryValueEntity) AsMailboxEntity() (*MailboxEntity, bool) { 15667 return nil, false 15668} 15669 15670// AsMailClusterEntity is the BasicEntity implementation for RegistryValueEntity. 15671func (rve RegistryValueEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 15672 return nil, false 15673} 15674 15675// AsMailMessageEntity is the BasicEntity implementation for RegistryValueEntity. 15676func (rve RegistryValueEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 15677 return nil, false 15678} 15679 15680// AsSubmissionMailEntity is the BasicEntity implementation for RegistryValueEntity. 15681func (rve RegistryValueEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 15682 return nil, false 15683} 15684 15685// AsMalwareEntity is the BasicEntity implementation for RegistryValueEntity. 15686func (rve RegistryValueEntity) AsMalwareEntity() (*MalwareEntity, bool) { 15687 return nil, false 15688} 15689 15690// AsProcessEntity is the BasicEntity implementation for RegistryValueEntity. 15691func (rve RegistryValueEntity) AsProcessEntity() (*ProcessEntity, bool) { 15692 return nil, false 15693} 15694 15695// AsRegistryKeyEntity is the BasicEntity implementation for RegistryValueEntity. 15696func (rve RegistryValueEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 15697 return nil, false 15698} 15699 15700// AsRegistryValueEntity is the BasicEntity implementation for RegistryValueEntity. 15701func (rve RegistryValueEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 15702 return &rve, true 15703} 15704 15705// AsSecurityGroupEntity is the BasicEntity implementation for RegistryValueEntity. 15706func (rve RegistryValueEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 15707 return nil, false 15708} 15709 15710// AsURLEntity is the BasicEntity implementation for RegistryValueEntity. 15711func (rve RegistryValueEntity) AsURLEntity() (*URLEntity, bool) { 15712 return nil, false 15713} 15714 15715// AsIoTDeviceEntity is the BasicEntity implementation for RegistryValueEntity. 15716func (rve RegistryValueEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 15717 return nil, false 15718} 15719 15720// AsEntity is the BasicEntity implementation for RegistryValueEntity. 15721func (rve RegistryValueEntity) AsEntity() (*Entity, bool) { 15722 return nil, false 15723} 15724 15725// AsBasicEntity is the BasicEntity implementation for RegistryValueEntity. 15726func (rve RegistryValueEntity) AsBasicEntity() (BasicEntity, bool) { 15727 return &rve, true 15728} 15729 15730// UnmarshalJSON is the custom unmarshaler for RegistryValueEntity struct. 15731func (rve *RegistryValueEntity) UnmarshalJSON(body []byte) error { 15732 var m map[string]*json.RawMessage 15733 err := json.Unmarshal(body, &m) 15734 if err != nil { 15735 return err 15736 } 15737 for k, v := range m { 15738 switch k { 15739 case "properties": 15740 if v != nil { 15741 var registryValueEntityProperties RegistryValueEntityProperties 15742 err = json.Unmarshal(*v, ®istryValueEntityProperties) 15743 if err != nil { 15744 return err 15745 } 15746 rve.RegistryValueEntityProperties = ®istryValueEntityProperties 15747 } 15748 case "id": 15749 if v != nil { 15750 var ID string 15751 err = json.Unmarshal(*v, &ID) 15752 if err != nil { 15753 return err 15754 } 15755 rve.ID = &ID 15756 } 15757 case "name": 15758 if v != nil { 15759 var name string 15760 err = json.Unmarshal(*v, &name) 15761 if err != nil { 15762 return err 15763 } 15764 rve.Name = &name 15765 } 15766 case "type": 15767 if v != nil { 15768 var typeVar string 15769 err = json.Unmarshal(*v, &typeVar) 15770 if err != nil { 15771 return err 15772 } 15773 rve.Type = &typeVar 15774 } 15775 case "kind": 15776 if v != nil { 15777 var kind KindBasicEntity 15778 err = json.Unmarshal(*v, &kind) 15779 if err != nil { 15780 return err 15781 } 15782 rve.Kind = kind 15783 } 15784 } 15785 } 15786 15787 return nil 15788} 15789 15790// RegistryValueEntityProperties registryValue entity property bag. 15791type RegistryValueEntityProperties struct { 15792 // KeyEntityID - READ-ONLY; The registry key entity id. 15793 KeyEntityID *string `json:"keyEntityId,omitempty"` 15794 // ValueData - READ-ONLY; String formatted representation of the value data. 15795 ValueData *string `json:"valueData,omitempty"` 15796 // ValueName - READ-ONLY; The registry value name. 15797 ValueName *string `json:"valueName,omitempty"` 15798 // ValueType - READ-ONLY; Specifies the data types to use when storing values in the registry, or identifies the data type of a value in the registry. Possible values include: 'RegistryValueKindNone', 'RegistryValueKindUnknown', 'RegistryValueKindString', 'RegistryValueKindExpandString', 'RegistryValueKindBinary', 'RegistryValueKindDWord', 'RegistryValueKindMultiString', 'RegistryValueKindQWord' 15799 ValueType RegistryValueKind `json:"valueType,omitempty"` 15800 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 15801 AdditionalData map[string]interface{} `json:"additionalData"` 15802 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 15803 FriendlyName *string `json:"friendlyName,omitempty"` 15804} 15805 15806// MarshalJSON is the custom marshaler for RegistryValueEntityProperties. 15807func (rvep RegistryValueEntityProperties) MarshalJSON() ([]byte, error) { 15808 objectMap := make(map[string]interface{}) 15809 return json.Marshal(objectMap) 15810} 15811 15812// Relation represents a relation between two resources 15813type Relation struct { 15814 autorest.Response `json:"-"` 15815 // RelationProperties - Relation properties 15816 *RelationProperties `json:"properties,omitempty"` 15817 // ID - READ-ONLY; Azure resource Id 15818 ID *string `json:"id,omitempty"` 15819 // Name - READ-ONLY; Azure resource name 15820 Name *string `json:"name,omitempty"` 15821 // Type - READ-ONLY; Azure resource type 15822 Type *string `json:"type,omitempty"` 15823 // Etag - Etag of the azure resource 15824 Etag *string `json:"etag,omitempty"` 15825} 15826 15827// MarshalJSON is the custom marshaler for Relation. 15828func (r Relation) MarshalJSON() ([]byte, error) { 15829 objectMap := make(map[string]interface{}) 15830 if r.RelationProperties != nil { 15831 objectMap["properties"] = r.RelationProperties 15832 } 15833 if r.Etag != nil { 15834 objectMap["etag"] = r.Etag 15835 } 15836 return json.Marshal(objectMap) 15837} 15838 15839// UnmarshalJSON is the custom unmarshaler for Relation struct. 15840func (r *Relation) UnmarshalJSON(body []byte) error { 15841 var m map[string]*json.RawMessage 15842 err := json.Unmarshal(body, &m) 15843 if err != nil { 15844 return err 15845 } 15846 for k, v := range m { 15847 switch k { 15848 case "properties": 15849 if v != nil { 15850 var relationProperties RelationProperties 15851 err = json.Unmarshal(*v, &relationProperties) 15852 if err != nil { 15853 return err 15854 } 15855 r.RelationProperties = &relationProperties 15856 } 15857 case "id": 15858 if v != nil { 15859 var ID string 15860 err = json.Unmarshal(*v, &ID) 15861 if err != nil { 15862 return err 15863 } 15864 r.ID = &ID 15865 } 15866 case "name": 15867 if v != nil { 15868 var name string 15869 err = json.Unmarshal(*v, &name) 15870 if err != nil { 15871 return err 15872 } 15873 r.Name = &name 15874 } 15875 case "type": 15876 if v != nil { 15877 var typeVar string 15878 err = json.Unmarshal(*v, &typeVar) 15879 if err != nil { 15880 return err 15881 } 15882 r.Type = &typeVar 15883 } 15884 case "etag": 15885 if v != nil { 15886 var etag string 15887 err = json.Unmarshal(*v, &etag) 15888 if err != nil { 15889 return err 15890 } 15891 r.Etag = &etag 15892 } 15893 } 15894 } 15895 15896 return nil 15897} 15898 15899// RelationBase represents a relation 15900type RelationBase struct { 15901 // Kind - READ-ONLY; The type of relation node. Possible values include: 'RelationTypesCasesToBookmarks' 15902 Kind RelationTypes `json:"kind,omitempty"` 15903 // Etag - ETag for relation 15904 Etag *string `json:"etag,omitempty"` 15905 // ID - READ-ONLY; Azure resource Id 15906 ID *string `json:"id,omitempty"` 15907 // Name - READ-ONLY; Azure resource name 15908 Name *string `json:"name,omitempty"` 15909 // Type - READ-ONLY; Azure resource type 15910 Type *string `json:"type,omitempty"` 15911} 15912 15913// MarshalJSON is the custom marshaler for RelationBase. 15914func (rb RelationBase) MarshalJSON() ([]byte, error) { 15915 objectMap := make(map[string]interface{}) 15916 if rb.Etag != nil { 15917 objectMap["etag"] = rb.Etag 15918 } 15919 return json.Marshal(objectMap) 15920} 15921 15922// RelationList list of relations. 15923type RelationList struct { 15924 autorest.Response `json:"-"` 15925 // NextLink - READ-ONLY; URL to fetch the next set of relations. 15926 NextLink *string `json:"nextLink,omitempty"` 15927 // Value - Array of relations. 15928 Value *[]Relation `json:"value,omitempty"` 15929} 15930 15931// MarshalJSON is the custom marshaler for RelationList. 15932func (rl RelationList) MarshalJSON() ([]byte, error) { 15933 objectMap := make(map[string]interface{}) 15934 if rl.Value != nil { 15935 objectMap["value"] = rl.Value 15936 } 15937 return json.Marshal(objectMap) 15938} 15939 15940// RelationListIterator provides access to a complete listing of Relation values. 15941type RelationListIterator struct { 15942 i int 15943 page RelationListPage 15944} 15945 15946// NextWithContext advances to the next value. If there was an error making 15947// the request the iterator does not advance and the error is returned. 15948func (iter *RelationListIterator) NextWithContext(ctx context.Context) (err error) { 15949 if tracing.IsEnabled() { 15950 ctx = tracing.StartSpan(ctx, fqdn+"/RelationListIterator.NextWithContext") 15951 defer func() { 15952 sc := -1 15953 if iter.Response().Response.Response != nil { 15954 sc = iter.Response().Response.Response.StatusCode 15955 } 15956 tracing.EndSpan(ctx, sc, err) 15957 }() 15958 } 15959 iter.i++ 15960 if iter.i < len(iter.page.Values()) { 15961 return nil 15962 } 15963 err = iter.page.NextWithContext(ctx) 15964 if err != nil { 15965 iter.i-- 15966 return err 15967 } 15968 iter.i = 0 15969 return nil 15970} 15971 15972// Next advances to the next value. If there was an error making 15973// the request the iterator does not advance and the error is returned. 15974// Deprecated: Use NextWithContext() instead. 15975func (iter *RelationListIterator) Next() error { 15976 return iter.NextWithContext(context.Background()) 15977} 15978 15979// NotDone returns true if the enumeration should be started or is not yet complete. 15980func (iter RelationListIterator) NotDone() bool { 15981 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 15982} 15983 15984// Response returns the raw server response from the last page request. 15985func (iter RelationListIterator) Response() RelationList { 15986 return iter.page.Response() 15987} 15988 15989// Value returns the current value or a zero-initialized value if the 15990// iterator has advanced beyond the end of the collection. 15991func (iter RelationListIterator) Value() Relation { 15992 if !iter.page.NotDone() { 15993 return Relation{} 15994 } 15995 return iter.page.Values()[iter.i] 15996} 15997 15998// Creates a new instance of the RelationListIterator type. 15999func NewRelationListIterator(page RelationListPage) RelationListIterator { 16000 return RelationListIterator{page: page} 16001} 16002 16003// IsEmpty returns true if the ListResult contains no values. 16004func (rl RelationList) IsEmpty() bool { 16005 return rl.Value == nil || len(*rl.Value) == 0 16006} 16007 16008// hasNextLink returns true if the NextLink is not empty. 16009func (rl RelationList) hasNextLink() bool { 16010 return rl.NextLink != nil && len(*rl.NextLink) != 0 16011} 16012 16013// relationListPreparer prepares a request to retrieve the next set of results. 16014// It returns nil if no more results exist. 16015func (rl RelationList) relationListPreparer(ctx context.Context) (*http.Request, error) { 16016 if !rl.hasNextLink() { 16017 return nil, nil 16018 } 16019 return autorest.Prepare((&http.Request{}).WithContext(ctx), 16020 autorest.AsJSON(), 16021 autorest.AsGet(), 16022 autorest.WithBaseURL(to.String(rl.NextLink))) 16023} 16024 16025// RelationListPage contains a page of Relation values. 16026type RelationListPage struct { 16027 fn func(context.Context, RelationList) (RelationList, error) 16028 rl RelationList 16029} 16030 16031// NextWithContext advances to the next page of values. If there was an error making 16032// the request the page does not advance and the error is returned. 16033func (page *RelationListPage) NextWithContext(ctx context.Context) (err error) { 16034 if tracing.IsEnabled() { 16035 ctx = tracing.StartSpan(ctx, fqdn+"/RelationListPage.NextWithContext") 16036 defer func() { 16037 sc := -1 16038 if page.Response().Response.Response != nil { 16039 sc = page.Response().Response.Response.StatusCode 16040 } 16041 tracing.EndSpan(ctx, sc, err) 16042 }() 16043 } 16044 for { 16045 next, err := page.fn(ctx, page.rl) 16046 if err != nil { 16047 return err 16048 } 16049 page.rl = next 16050 if !next.hasNextLink() || !next.IsEmpty() { 16051 break 16052 } 16053 } 16054 return nil 16055} 16056 16057// Next advances to the next page of values. If there was an error making 16058// the request the page does not advance and the error is returned. 16059// Deprecated: Use NextWithContext() instead. 16060func (page *RelationListPage) Next() error { 16061 return page.NextWithContext(context.Background()) 16062} 16063 16064// NotDone returns true if the page enumeration should be started or is not yet complete. 16065func (page RelationListPage) NotDone() bool { 16066 return !page.rl.IsEmpty() 16067} 16068 16069// Response returns the raw server response from the last page request. 16070func (page RelationListPage) Response() RelationList { 16071 return page.rl 16072} 16073 16074// Values returns the slice of values for the current page or nil if there are no values. 16075func (page RelationListPage) Values() []Relation { 16076 if page.rl.IsEmpty() { 16077 return nil 16078 } 16079 return *page.rl.Value 16080} 16081 16082// Creates a new instance of the RelationListPage type. 16083func NewRelationListPage(cur RelationList, getNextPage func(context.Context, RelationList) (RelationList, error)) RelationListPage { 16084 return RelationListPage{ 16085 fn: getNextPage, 16086 rl: cur, 16087 } 16088} 16089 16090// RelationNode relation node 16091type RelationNode struct { 16092 // RelationNodeID - Relation Node Id 16093 RelationNodeID *string `json:"relationNodeId,omitempty"` 16094 // RelationNodeKind - READ-ONLY; The type of relation node. Possible values include: 'RelationNodeKindCase', 'RelationNodeKindBookmark' 16095 RelationNodeKind RelationNodeKind `json:"relationNodeKind,omitempty"` 16096 // Etag - Etag for relation node 16097 Etag *string `json:"etag,omitempty"` 16098 // RelationAdditionalProperties - Additional set of properties 16099 RelationAdditionalProperties map[string]*string `json:"relationAdditionalProperties"` 16100} 16101 16102// MarshalJSON is the custom marshaler for RelationNode. 16103func (rn RelationNode) MarshalJSON() ([]byte, error) { 16104 objectMap := make(map[string]interface{}) 16105 if rn.RelationNodeID != nil { 16106 objectMap["relationNodeId"] = rn.RelationNodeID 16107 } 16108 if rn.Etag != nil { 16109 objectMap["etag"] = rn.Etag 16110 } 16111 if rn.RelationAdditionalProperties != nil { 16112 objectMap["relationAdditionalProperties"] = rn.RelationAdditionalProperties 16113 } 16114 return json.Marshal(objectMap) 16115} 16116 16117// RelationProperties relation property bag. 16118type RelationProperties struct { 16119 // RelatedResourceID - The resource ID of the related resource 16120 RelatedResourceID *string `json:"relatedResourceId,omitempty"` 16121 // RelatedResourceName - READ-ONLY; The name of the related resource 16122 RelatedResourceName *string `json:"relatedResourceName,omitempty"` 16123 // RelatedResourceType - READ-ONLY; The resource type of the related resource 16124 RelatedResourceType *string `json:"relatedResourceType,omitempty"` 16125 // RelatedResourceKind - READ-ONLY; The resource kind of the related resource 16126 RelatedResourceKind *string `json:"relatedResourceKind,omitempty"` 16127} 16128 16129// MarshalJSON is the custom marshaler for RelationProperties. 16130func (rp RelationProperties) MarshalJSON() ([]byte, error) { 16131 objectMap := make(map[string]interface{}) 16132 if rp.RelatedResourceID != nil { 16133 objectMap["relatedResourceId"] = rp.RelatedResourceID 16134 } 16135 return json.Marshal(objectMap) 16136} 16137 16138// RelationsModelInput relation input model 16139type RelationsModelInput struct { 16140 // RelationsModelInputProperties - Relation input properties 16141 *RelationsModelInputProperties `json:"properties,omitempty"` 16142 // Kind - READ-ONLY; The type of relation node. Possible values include: 'RelationTypesCasesToBookmarks' 16143 Kind RelationTypes `json:"kind,omitempty"` 16144 // Etag - ETag for relation 16145 Etag *string `json:"etag,omitempty"` 16146 // ID - READ-ONLY; Azure resource Id 16147 ID *string `json:"id,omitempty"` 16148 // Name - READ-ONLY; Azure resource name 16149 Name *string `json:"name,omitempty"` 16150 // Type - READ-ONLY; Azure resource type 16151 Type *string `json:"type,omitempty"` 16152} 16153 16154// MarshalJSON is the custom marshaler for RelationsModelInput. 16155func (rmi RelationsModelInput) MarshalJSON() ([]byte, error) { 16156 objectMap := make(map[string]interface{}) 16157 if rmi.RelationsModelInputProperties != nil { 16158 objectMap["properties"] = rmi.RelationsModelInputProperties 16159 } 16160 if rmi.Etag != nil { 16161 objectMap["etag"] = rmi.Etag 16162 } 16163 return json.Marshal(objectMap) 16164} 16165 16166// UnmarshalJSON is the custom unmarshaler for RelationsModelInput struct. 16167func (rmi *RelationsModelInput) UnmarshalJSON(body []byte) error { 16168 var m map[string]*json.RawMessage 16169 err := json.Unmarshal(body, &m) 16170 if err != nil { 16171 return err 16172 } 16173 for k, v := range m { 16174 switch k { 16175 case "properties": 16176 if v != nil { 16177 var relationsModelInputProperties RelationsModelInputProperties 16178 err = json.Unmarshal(*v, &relationsModelInputProperties) 16179 if err != nil { 16180 return err 16181 } 16182 rmi.RelationsModelInputProperties = &relationsModelInputProperties 16183 } 16184 case "kind": 16185 if v != nil { 16186 var kind RelationTypes 16187 err = json.Unmarshal(*v, &kind) 16188 if err != nil { 16189 return err 16190 } 16191 rmi.Kind = kind 16192 } 16193 case "etag": 16194 if v != nil { 16195 var etag string 16196 err = json.Unmarshal(*v, &etag) 16197 if err != nil { 16198 return err 16199 } 16200 rmi.Etag = &etag 16201 } 16202 case "id": 16203 if v != nil { 16204 var ID string 16205 err = json.Unmarshal(*v, &ID) 16206 if err != nil { 16207 return err 16208 } 16209 rmi.ID = &ID 16210 } 16211 case "name": 16212 if v != nil { 16213 var name string 16214 err = json.Unmarshal(*v, &name) 16215 if err != nil { 16216 return err 16217 } 16218 rmi.Name = &name 16219 } 16220 case "type": 16221 if v != nil { 16222 var typeVar string 16223 err = json.Unmarshal(*v, &typeVar) 16224 if err != nil { 16225 return err 16226 } 16227 rmi.Type = &typeVar 16228 } 16229 } 16230 } 16231 16232 return nil 16233} 16234 16235// RelationsModelInputProperties relation input properties 16236type RelationsModelInputProperties struct { 16237 // RelationName - Name of relation 16238 RelationName *string `json:"relationName,omitempty"` 16239 // SourceRelationNode - Relation source node 16240 SourceRelationNode *RelationNode `json:"sourceRelationNode,omitempty"` 16241 // TargetRelationNode - Relation target node 16242 TargetRelationNode *RelationNode `json:"targetRelationNode,omitempty"` 16243} 16244 16245// Resource an azure resource object 16246type Resource struct { 16247 // ID - READ-ONLY; Azure resource Id 16248 ID *string `json:"id,omitempty"` 16249 // Name - READ-ONLY; Azure resource name 16250 Name *string `json:"name,omitempty"` 16251 // Type - READ-ONLY; Azure resource type 16252 Type *string `json:"type,omitempty"` 16253} 16254 16255// MarshalJSON is the custom marshaler for Resource. 16256func (r Resource) MarshalJSON() ([]byte, error) { 16257 objectMap := make(map[string]interface{}) 16258 return json.Marshal(objectMap) 16259} 16260 16261// ResourceWithEtag an azure resource object with an Etag property 16262type ResourceWithEtag struct { 16263 // ID - READ-ONLY; Azure resource Id 16264 ID *string `json:"id,omitempty"` 16265 // Name - READ-ONLY; Azure resource name 16266 Name *string `json:"name,omitempty"` 16267 // Type - READ-ONLY; Azure resource type 16268 Type *string `json:"type,omitempty"` 16269 // Etag - Etag of the azure resource 16270 Etag *string `json:"etag,omitempty"` 16271} 16272 16273// MarshalJSON is the custom marshaler for ResourceWithEtag. 16274func (rwe ResourceWithEtag) MarshalJSON() ([]byte, error) { 16275 objectMap := make(map[string]interface{}) 16276 if rwe.Etag != nil { 16277 objectMap["etag"] = rwe.Etag 16278 } 16279 return json.Marshal(objectMap) 16280} 16281 16282// ScheduledAlertRule represents scheduled alert rule. 16283type ScheduledAlertRule struct { 16284 // ScheduledAlertRuleProperties - Scheduled alert rule properties 16285 *ScheduledAlertRuleProperties `json:"properties,omitempty"` 16286 // ID - READ-ONLY; Azure resource Id 16287 ID *string `json:"id,omitempty"` 16288 // Name - READ-ONLY; Azure resource name 16289 Name *string `json:"name,omitempty"` 16290 // Type - READ-ONLY; Azure resource type 16291 Type *string `json:"type,omitempty"` 16292 // Etag - Etag of the azure resource 16293 Etag *string `json:"etag,omitempty"` 16294 // Kind - Possible values include: 'KindBasicAlertRuleKindAlertRule', 'KindBasicAlertRuleKindMLBehaviorAnalytics', 'KindBasicAlertRuleKindFusion', 'KindBasicAlertRuleKindThreatIntelligence', 'KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleKindScheduled' 16295 Kind KindBasicAlertRule `json:"kind,omitempty"` 16296} 16297 16298// MarshalJSON is the custom marshaler for ScheduledAlertRule. 16299func (sar ScheduledAlertRule) MarshalJSON() ([]byte, error) { 16300 sar.Kind = KindBasicAlertRuleKindScheduled 16301 objectMap := make(map[string]interface{}) 16302 if sar.ScheduledAlertRuleProperties != nil { 16303 objectMap["properties"] = sar.ScheduledAlertRuleProperties 16304 } 16305 if sar.Etag != nil { 16306 objectMap["etag"] = sar.Etag 16307 } 16308 if sar.Kind != "" { 16309 objectMap["kind"] = sar.Kind 16310 } 16311 return json.Marshal(objectMap) 16312} 16313 16314// AsMLBehaviorAnalyticsAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16315func (sar ScheduledAlertRule) AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) { 16316 return nil, false 16317} 16318 16319// AsFusionAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16320func (sar ScheduledAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 16321 return nil, false 16322} 16323 16324// AsThreatIntelligenceAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16325func (sar ScheduledAlertRule) AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) { 16326 return nil, false 16327} 16328 16329// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16330func (sar ScheduledAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 16331 return nil, false 16332} 16333 16334// AsScheduledAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16335func (sar ScheduledAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 16336 return &sar, true 16337} 16338 16339// AsAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16340func (sar ScheduledAlertRule) AsAlertRule() (*AlertRule, bool) { 16341 return nil, false 16342} 16343 16344// AsBasicAlertRule is the BasicAlertRule implementation for ScheduledAlertRule. 16345func (sar ScheduledAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 16346 return &sar, true 16347} 16348 16349// UnmarshalJSON is the custom unmarshaler for ScheduledAlertRule struct. 16350func (sar *ScheduledAlertRule) UnmarshalJSON(body []byte) error { 16351 var m map[string]*json.RawMessage 16352 err := json.Unmarshal(body, &m) 16353 if err != nil { 16354 return err 16355 } 16356 for k, v := range m { 16357 switch k { 16358 case "properties": 16359 if v != nil { 16360 var scheduledAlertRuleProperties ScheduledAlertRuleProperties 16361 err = json.Unmarshal(*v, &scheduledAlertRuleProperties) 16362 if err != nil { 16363 return err 16364 } 16365 sar.ScheduledAlertRuleProperties = &scheduledAlertRuleProperties 16366 } 16367 case "id": 16368 if v != nil { 16369 var ID string 16370 err = json.Unmarshal(*v, &ID) 16371 if err != nil { 16372 return err 16373 } 16374 sar.ID = &ID 16375 } 16376 case "name": 16377 if v != nil { 16378 var name string 16379 err = json.Unmarshal(*v, &name) 16380 if err != nil { 16381 return err 16382 } 16383 sar.Name = &name 16384 } 16385 case "type": 16386 if v != nil { 16387 var typeVar string 16388 err = json.Unmarshal(*v, &typeVar) 16389 if err != nil { 16390 return err 16391 } 16392 sar.Type = &typeVar 16393 } 16394 case "etag": 16395 if v != nil { 16396 var etag string 16397 err = json.Unmarshal(*v, &etag) 16398 if err != nil { 16399 return err 16400 } 16401 sar.Etag = &etag 16402 } 16403 case "kind": 16404 if v != nil { 16405 var kind KindBasicAlertRule 16406 err = json.Unmarshal(*v, &kind) 16407 if err != nil { 16408 return err 16409 } 16410 sar.Kind = kind 16411 } 16412 } 16413 } 16414 16415 return nil 16416} 16417 16418// ScheduledAlertRuleCommonProperties scheduled alert rule template property bag. 16419type ScheduledAlertRuleCommonProperties struct { 16420 // Query - The query that creates alerts for this rule. 16421 Query *string `json:"query,omitempty"` 16422 // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run. 16423 QueryFrequency *string `json:"queryFrequency,omitempty"` 16424 // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at. 16425 QueryPeriod *string `json:"queryPeriod,omitempty"` 16426 // Severity - The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 16427 Severity AlertSeverity `json:"severity,omitempty"` 16428 // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'TriggerOperatorGreaterThan', 'TriggerOperatorLessThan', 'TriggerOperatorEqual', 'TriggerOperatorNotEqual' 16429 TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"` 16430 // TriggerThreshold - The threshold triggers this alert rule. 16431 TriggerThreshold *int32 `json:"triggerThreshold,omitempty"` 16432 // EventGroupingSettings - The event grouping settings. 16433 EventGroupingSettings *EventGroupingSettings `json:"eventGroupingSettings,omitempty"` 16434} 16435 16436// ScheduledAlertRuleProperties scheduled alert rule base property bag. 16437type ScheduledAlertRuleProperties struct { 16438 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 16439 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 16440 // Description - The description of the alert rule. 16441 Description *string `json:"description,omitempty"` 16442 // DisplayName - The display name for alerts created by this alert rule. 16443 DisplayName *string `json:"displayName,omitempty"` 16444 // Enabled - Determines whether this alert rule is enabled or disabled. 16445 Enabled *bool `json:"enabled,omitempty"` 16446 // LastModifiedUtc - READ-ONLY; The last time that this alert rule has been modified. 16447 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 16448 // SuppressionDuration - The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. 16449 SuppressionDuration *string `json:"suppressionDuration,omitempty"` 16450 // SuppressionEnabled - Determines whether the suppression for this alert rule is enabled or disabled. 16451 SuppressionEnabled *bool `json:"suppressionEnabled,omitempty"` 16452 // Tactics - The tactics of the alert rule 16453 Tactics *[]AttackTactic `json:"tactics,omitempty"` 16454 // IncidentConfiguration - The settings of the incidents that created from alerts triggered by this analytics rule 16455 IncidentConfiguration *IncidentConfiguration `json:"incidentConfiguration,omitempty"` 16456 // Query - The query that creates alerts for this rule. 16457 Query *string `json:"query,omitempty"` 16458 // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run. 16459 QueryFrequency *string `json:"queryFrequency,omitempty"` 16460 // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at. 16461 QueryPeriod *string `json:"queryPeriod,omitempty"` 16462 // Severity - The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 16463 Severity AlertSeverity `json:"severity,omitempty"` 16464 // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'TriggerOperatorGreaterThan', 'TriggerOperatorLessThan', 'TriggerOperatorEqual', 'TriggerOperatorNotEqual' 16465 TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"` 16466 // TriggerThreshold - The threshold triggers this alert rule. 16467 TriggerThreshold *int32 `json:"triggerThreshold,omitempty"` 16468 // EventGroupingSettings - The event grouping settings. 16469 EventGroupingSettings *EventGroupingSettings `json:"eventGroupingSettings,omitempty"` 16470} 16471 16472// MarshalJSON is the custom marshaler for ScheduledAlertRuleProperties. 16473func (sarp ScheduledAlertRuleProperties) MarshalJSON() ([]byte, error) { 16474 objectMap := make(map[string]interface{}) 16475 if sarp.AlertRuleTemplateName != nil { 16476 objectMap["alertRuleTemplateName"] = sarp.AlertRuleTemplateName 16477 } 16478 if sarp.Description != nil { 16479 objectMap["description"] = sarp.Description 16480 } 16481 if sarp.DisplayName != nil { 16482 objectMap["displayName"] = sarp.DisplayName 16483 } 16484 if sarp.Enabled != nil { 16485 objectMap["enabled"] = sarp.Enabled 16486 } 16487 if sarp.SuppressionDuration != nil { 16488 objectMap["suppressionDuration"] = sarp.SuppressionDuration 16489 } 16490 if sarp.SuppressionEnabled != nil { 16491 objectMap["suppressionEnabled"] = sarp.SuppressionEnabled 16492 } 16493 if sarp.Tactics != nil { 16494 objectMap["tactics"] = sarp.Tactics 16495 } 16496 if sarp.IncidentConfiguration != nil { 16497 objectMap["incidentConfiguration"] = sarp.IncidentConfiguration 16498 } 16499 if sarp.Query != nil { 16500 objectMap["query"] = sarp.Query 16501 } 16502 if sarp.QueryFrequency != nil { 16503 objectMap["queryFrequency"] = sarp.QueryFrequency 16504 } 16505 if sarp.QueryPeriod != nil { 16506 objectMap["queryPeriod"] = sarp.QueryPeriod 16507 } 16508 if sarp.Severity != "" { 16509 objectMap["severity"] = sarp.Severity 16510 } 16511 if sarp.TriggerOperator != "" { 16512 objectMap["triggerOperator"] = sarp.TriggerOperator 16513 } 16514 if sarp.TriggerThreshold != nil { 16515 objectMap["triggerThreshold"] = sarp.TriggerThreshold 16516 } 16517 if sarp.EventGroupingSettings != nil { 16518 objectMap["eventGroupingSettings"] = sarp.EventGroupingSettings 16519 } 16520 return json.Marshal(objectMap) 16521} 16522 16523// ScheduledAlertRuleTemplate represents scheduled alert rule template. 16524type ScheduledAlertRuleTemplate struct { 16525 // ScheduledAlertRuleTemplateProperties - Scheduled alert rule template properties 16526 *ScheduledAlertRuleTemplateProperties `json:"properties,omitempty"` 16527 // ID - READ-ONLY; Azure resource Id 16528 ID *string `json:"id,omitempty"` 16529 // Name - READ-ONLY; Azure resource name 16530 Name *string `json:"name,omitempty"` 16531 // Type - READ-ONLY; Azure resource type 16532 Type *string `json:"type,omitempty"` 16533 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindMLBehaviorAnalytics', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindThreatIntelligence', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 16534 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 16535} 16536 16537// MarshalJSON is the custom marshaler for ScheduledAlertRuleTemplate. 16538func (sart ScheduledAlertRuleTemplate) MarshalJSON() ([]byte, error) { 16539 sart.Kind = KindBasicAlertRuleTemplateKindScheduled 16540 objectMap := make(map[string]interface{}) 16541 if sart.ScheduledAlertRuleTemplateProperties != nil { 16542 objectMap["properties"] = sart.ScheduledAlertRuleTemplateProperties 16543 } 16544 if sart.Kind != "" { 16545 objectMap["kind"] = sart.Kind 16546 } 16547 return json.Marshal(objectMap) 16548} 16549 16550// AsMLBehaviorAnalyticsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16551func (sart ScheduledAlertRuleTemplate) AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) { 16552 return nil, false 16553} 16554 16555// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16556func (sart ScheduledAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 16557 return nil, false 16558} 16559 16560// AsThreatIntelligenceAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16561func (sart ScheduledAlertRuleTemplate) AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) { 16562 return nil, false 16563} 16564 16565// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16566func (sart ScheduledAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 16567 return nil, false 16568} 16569 16570// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16571func (sart ScheduledAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 16572 return &sart, true 16573} 16574 16575// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16576func (sart ScheduledAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 16577 return nil, false 16578} 16579 16580// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ScheduledAlertRuleTemplate. 16581func (sart ScheduledAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 16582 return &sart, true 16583} 16584 16585// UnmarshalJSON is the custom unmarshaler for ScheduledAlertRuleTemplate struct. 16586func (sart *ScheduledAlertRuleTemplate) UnmarshalJSON(body []byte) error { 16587 var m map[string]*json.RawMessage 16588 err := json.Unmarshal(body, &m) 16589 if err != nil { 16590 return err 16591 } 16592 for k, v := range m { 16593 switch k { 16594 case "properties": 16595 if v != nil { 16596 var scheduledAlertRuleTemplateProperties ScheduledAlertRuleTemplateProperties 16597 err = json.Unmarshal(*v, &scheduledAlertRuleTemplateProperties) 16598 if err != nil { 16599 return err 16600 } 16601 sart.ScheduledAlertRuleTemplateProperties = &scheduledAlertRuleTemplateProperties 16602 } 16603 case "id": 16604 if v != nil { 16605 var ID string 16606 err = json.Unmarshal(*v, &ID) 16607 if err != nil { 16608 return err 16609 } 16610 sart.ID = &ID 16611 } 16612 case "name": 16613 if v != nil { 16614 var name string 16615 err = json.Unmarshal(*v, &name) 16616 if err != nil { 16617 return err 16618 } 16619 sart.Name = &name 16620 } 16621 case "type": 16622 if v != nil { 16623 var typeVar string 16624 err = json.Unmarshal(*v, &typeVar) 16625 if err != nil { 16626 return err 16627 } 16628 sart.Type = &typeVar 16629 } 16630 case "kind": 16631 if v != nil { 16632 var kind KindBasicAlertRuleTemplate 16633 err = json.Unmarshal(*v, &kind) 16634 if err != nil { 16635 return err 16636 } 16637 sart.Kind = kind 16638 } 16639 } 16640 } 16641 16642 return nil 16643} 16644 16645// ScheduledAlertRuleTemplateProperties scheduled alert rule template properties 16646type ScheduledAlertRuleTemplateProperties struct { 16647 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 16648 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 16649 // LastUpdatedDateUTC - READ-ONLY; The last time that this alert rule template has been updated. 16650 LastUpdatedDateUTC *date.Time `json:"lastUpdatedDateUTC,omitempty"` 16651 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 16652 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 16653 // Description - The description of the alert rule template. 16654 Description *string `json:"description,omitempty"` 16655 // DisplayName - The display name for alert rule template. 16656 DisplayName *string `json:"displayName,omitempty"` 16657 // RequiredDataConnectors - The required data sources for this template 16658 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 16659 // Status - The alert rule template status. Possible values include: 'TemplateStatusInstalled', 'TemplateStatusAvailable', 'TemplateStatusNotAvailable' 16660 Status TemplateStatus `json:"status,omitempty"` 16661 // Query - The query that creates alerts for this rule. 16662 Query *string `json:"query,omitempty"` 16663 // QueryFrequency - The frequency (in ISO 8601 duration format) for this alert rule to run. 16664 QueryFrequency *string `json:"queryFrequency,omitempty"` 16665 // QueryPeriod - The period (in ISO 8601 duration format) that this alert rule looks at. 16666 QueryPeriod *string `json:"queryPeriod,omitempty"` 16667 // Severity - The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 16668 Severity AlertSeverity `json:"severity,omitempty"` 16669 // TriggerOperator - The operation against the threshold that triggers alert rule. Possible values include: 'TriggerOperatorGreaterThan', 'TriggerOperatorLessThan', 'TriggerOperatorEqual', 'TriggerOperatorNotEqual' 16670 TriggerOperator TriggerOperator `json:"triggerOperator,omitempty"` 16671 // TriggerThreshold - The threshold triggers this alert rule. 16672 TriggerThreshold *int32 `json:"triggerThreshold,omitempty"` 16673 // EventGroupingSettings - The event grouping settings. 16674 EventGroupingSettings *EventGroupingSettings `json:"eventGroupingSettings,omitempty"` 16675 // Tactics - The tactics of the alert rule template 16676 Tactics *[]AttackTactic `json:"tactics,omitempty"` 16677} 16678 16679// MarshalJSON is the custom marshaler for ScheduledAlertRuleTemplateProperties. 16680func (sart ScheduledAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 16681 objectMap := make(map[string]interface{}) 16682 if sart.AlertRulesCreatedByTemplateCount != nil { 16683 objectMap["alertRulesCreatedByTemplateCount"] = sart.AlertRulesCreatedByTemplateCount 16684 } 16685 if sart.Description != nil { 16686 objectMap["description"] = sart.Description 16687 } 16688 if sart.DisplayName != nil { 16689 objectMap["displayName"] = sart.DisplayName 16690 } 16691 if sart.RequiredDataConnectors != nil { 16692 objectMap["requiredDataConnectors"] = sart.RequiredDataConnectors 16693 } 16694 if sart.Status != "" { 16695 objectMap["status"] = sart.Status 16696 } 16697 if sart.Query != nil { 16698 objectMap["query"] = sart.Query 16699 } 16700 if sart.QueryFrequency != nil { 16701 objectMap["queryFrequency"] = sart.QueryFrequency 16702 } 16703 if sart.QueryPeriod != nil { 16704 objectMap["queryPeriod"] = sart.QueryPeriod 16705 } 16706 if sart.Severity != "" { 16707 objectMap["severity"] = sart.Severity 16708 } 16709 if sart.TriggerOperator != "" { 16710 objectMap["triggerOperator"] = sart.TriggerOperator 16711 } 16712 if sart.TriggerThreshold != nil { 16713 objectMap["triggerThreshold"] = sart.TriggerThreshold 16714 } 16715 if sart.EventGroupingSettings != nil { 16716 objectMap["eventGroupingSettings"] = sart.EventGroupingSettings 16717 } 16718 if sart.Tactics != nil { 16719 objectMap["tactics"] = sart.Tactics 16720 } 16721 return json.Marshal(objectMap) 16722} 16723 16724// SecurityAlert represents a security alert entity. 16725type SecurityAlert struct { 16726 // SecurityAlertProperties - SecurityAlert entity properties 16727 *SecurityAlertProperties `json:"properties,omitempty"` 16728 // ID - READ-ONLY; Azure resource Id 16729 ID *string `json:"id,omitempty"` 16730 // Name - READ-ONLY; Azure resource name 16731 Name *string `json:"name,omitempty"` 16732 // Type - READ-ONLY; Azure resource type 16733 Type *string `json:"type,omitempty"` 16734 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 16735 Kind KindBasicEntity `json:"kind,omitempty"` 16736} 16737 16738// MarshalJSON is the custom marshaler for SecurityAlert. 16739func (sa SecurityAlert) MarshalJSON() ([]byte, error) { 16740 sa.Kind = KindBasicEntityKindSecurityAlert 16741 objectMap := make(map[string]interface{}) 16742 if sa.SecurityAlertProperties != nil { 16743 objectMap["properties"] = sa.SecurityAlertProperties 16744 } 16745 if sa.Kind != "" { 16746 objectMap["kind"] = sa.Kind 16747 } 16748 return json.Marshal(objectMap) 16749} 16750 16751// AsAccountEntity is the BasicEntity implementation for SecurityAlert. 16752func (sa SecurityAlert) AsAccountEntity() (*AccountEntity, bool) { 16753 return nil, false 16754} 16755 16756// AsAzureResourceEntity is the BasicEntity implementation for SecurityAlert. 16757func (sa SecurityAlert) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 16758 return nil, false 16759} 16760 16761// AsCloudApplicationEntity is the BasicEntity implementation for SecurityAlert. 16762func (sa SecurityAlert) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 16763 return nil, false 16764} 16765 16766// AsDNSEntity is the BasicEntity implementation for SecurityAlert. 16767func (sa SecurityAlert) AsDNSEntity() (*DNSEntity, bool) { 16768 return nil, false 16769} 16770 16771// AsFileEntity is the BasicEntity implementation for SecurityAlert. 16772func (sa SecurityAlert) AsFileEntity() (*FileEntity, bool) { 16773 return nil, false 16774} 16775 16776// AsFileHashEntity is the BasicEntity implementation for SecurityAlert. 16777func (sa SecurityAlert) AsFileHashEntity() (*FileHashEntity, bool) { 16778 return nil, false 16779} 16780 16781// AsHostEntity is the BasicEntity implementation for SecurityAlert. 16782func (sa SecurityAlert) AsHostEntity() (*HostEntity, bool) { 16783 return nil, false 16784} 16785 16786// AsHuntingBookmark is the BasicEntity implementation for SecurityAlert. 16787func (sa SecurityAlert) AsHuntingBookmark() (*HuntingBookmark, bool) { 16788 return nil, false 16789} 16790 16791// AsSecurityAlert is the BasicEntity implementation for SecurityAlert. 16792func (sa SecurityAlert) AsSecurityAlert() (*SecurityAlert, bool) { 16793 return &sa, true 16794} 16795 16796// AsIPEntity is the BasicEntity implementation for SecurityAlert. 16797func (sa SecurityAlert) AsIPEntity() (*IPEntity, bool) { 16798 return nil, false 16799} 16800 16801// AsMailboxEntity is the BasicEntity implementation for SecurityAlert. 16802func (sa SecurityAlert) AsMailboxEntity() (*MailboxEntity, bool) { 16803 return nil, false 16804} 16805 16806// AsMailClusterEntity is the BasicEntity implementation for SecurityAlert. 16807func (sa SecurityAlert) AsMailClusterEntity() (*MailClusterEntity, bool) { 16808 return nil, false 16809} 16810 16811// AsMailMessageEntity is the BasicEntity implementation for SecurityAlert. 16812func (sa SecurityAlert) AsMailMessageEntity() (*MailMessageEntity, bool) { 16813 return nil, false 16814} 16815 16816// AsSubmissionMailEntity is the BasicEntity implementation for SecurityAlert. 16817func (sa SecurityAlert) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 16818 return nil, false 16819} 16820 16821// AsMalwareEntity is the BasicEntity implementation for SecurityAlert. 16822func (sa SecurityAlert) AsMalwareEntity() (*MalwareEntity, bool) { 16823 return nil, false 16824} 16825 16826// AsProcessEntity is the BasicEntity implementation for SecurityAlert. 16827func (sa SecurityAlert) AsProcessEntity() (*ProcessEntity, bool) { 16828 return nil, false 16829} 16830 16831// AsRegistryKeyEntity is the BasicEntity implementation for SecurityAlert. 16832func (sa SecurityAlert) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 16833 return nil, false 16834} 16835 16836// AsRegistryValueEntity is the BasicEntity implementation for SecurityAlert. 16837func (sa SecurityAlert) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 16838 return nil, false 16839} 16840 16841// AsSecurityGroupEntity is the BasicEntity implementation for SecurityAlert. 16842func (sa SecurityAlert) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 16843 return nil, false 16844} 16845 16846// AsURLEntity is the BasicEntity implementation for SecurityAlert. 16847func (sa SecurityAlert) AsURLEntity() (*URLEntity, bool) { 16848 return nil, false 16849} 16850 16851// AsIoTDeviceEntity is the BasicEntity implementation for SecurityAlert. 16852func (sa SecurityAlert) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 16853 return nil, false 16854} 16855 16856// AsEntity is the BasicEntity implementation for SecurityAlert. 16857func (sa SecurityAlert) AsEntity() (*Entity, bool) { 16858 return nil, false 16859} 16860 16861// AsBasicEntity is the BasicEntity implementation for SecurityAlert. 16862func (sa SecurityAlert) AsBasicEntity() (BasicEntity, bool) { 16863 return &sa, true 16864} 16865 16866// UnmarshalJSON is the custom unmarshaler for SecurityAlert struct. 16867func (sa *SecurityAlert) UnmarshalJSON(body []byte) error { 16868 var m map[string]*json.RawMessage 16869 err := json.Unmarshal(body, &m) 16870 if err != nil { 16871 return err 16872 } 16873 for k, v := range m { 16874 switch k { 16875 case "properties": 16876 if v != nil { 16877 var securityAlertProperties SecurityAlertProperties 16878 err = json.Unmarshal(*v, &securityAlertProperties) 16879 if err != nil { 16880 return err 16881 } 16882 sa.SecurityAlertProperties = &securityAlertProperties 16883 } 16884 case "id": 16885 if v != nil { 16886 var ID string 16887 err = json.Unmarshal(*v, &ID) 16888 if err != nil { 16889 return err 16890 } 16891 sa.ID = &ID 16892 } 16893 case "name": 16894 if v != nil { 16895 var name string 16896 err = json.Unmarshal(*v, &name) 16897 if err != nil { 16898 return err 16899 } 16900 sa.Name = &name 16901 } 16902 case "type": 16903 if v != nil { 16904 var typeVar string 16905 err = json.Unmarshal(*v, &typeVar) 16906 if err != nil { 16907 return err 16908 } 16909 sa.Type = &typeVar 16910 } 16911 case "kind": 16912 if v != nil { 16913 var kind KindBasicEntity 16914 err = json.Unmarshal(*v, &kind) 16915 if err != nil { 16916 return err 16917 } 16918 sa.Kind = kind 16919 } 16920 } 16921 } 16922 16923 return nil 16924} 16925 16926// SecurityAlertProperties securityAlert entity property bag. 16927type SecurityAlertProperties struct { 16928 // AlertDisplayName - READ-ONLY; The display name of the alert. 16929 AlertDisplayName *string `json:"alertDisplayName,omitempty"` 16930 // AlertType - READ-ONLY; The type name of the alert. 16931 AlertType *string `json:"alertType,omitempty"` 16932 // CompromisedEntity - READ-ONLY; Display name of the main entity being reported on. 16933 CompromisedEntity *string `json:"compromisedEntity,omitempty"` 16934 // ConfidenceLevel - READ-ONLY; The confidence level of this alert. Possible values include: 'ConfidenceLevelUnknown', 'ConfidenceLevelLow', 'ConfidenceLevelHigh' 16935 ConfidenceLevel ConfidenceLevel `json:"confidenceLevel,omitempty"` 16936 // ConfidenceReasons - READ-ONLY; The confidence reasons 16937 ConfidenceReasons *[]SecurityAlertPropertiesConfidenceReasonsItem `json:"confidenceReasons,omitempty"` 16938 // ConfidenceScore - READ-ONLY; The confidence score of the alert. 16939 ConfidenceScore *float64 `json:"confidenceScore,omitempty"` 16940 // ConfidenceScoreStatus - READ-ONLY; The confidence score calculation status, i.e. indicating if score calculation is pending for this alert, not applicable or final. Possible values include: 'ConfidenceScoreStatusNotApplicable', 'ConfidenceScoreStatusInProcess', 'ConfidenceScoreStatusNotFinal', 'ConfidenceScoreStatusFinal' 16941 ConfidenceScoreStatus ConfidenceScoreStatus `json:"confidenceScoreStatus,omitempty"` 16942 // Description - READ-ONLY; Alert description. 16943 Description *string `json:"description,omitempty"` 16944 // EndTimeUtc - READ-ONLY; The impact end time of the alert (the time of the last event contributing to the alert). 16945 EndTimeUtc *date.Time `json:"endTimeUtc,omitempty"` 16946 // Intent - READ-ONLY; Holds the alert intent stage(s) mapping for this alert. Possible values include: 'KillChainIntentUnknown', 'KillChainIntentProbing', 'KillChainIntentExploitation', 'KillChainIntentPersistence', 'KillChainIntentPrivilegeEscalation', 'KillChainIntentDefenseEvasion', 'KillChainIntentCredentialAccess', 'KillChainIntentDiscovery', 'KillChainIntentLateralMovement', 'KillChainIntentExecution', 'KillChainIntentCollection', 'KillChainIntentExfiltration', 'KillChainIntentCommandAndControl', 'KillChainIntentImpact' 16947 Intent KillChainIntent `json:"intent,omitempty"` 16948 // ProviderAlertID - READ-ONLY; The identifier of the alert inside the product which generated the alert. 16949 ProviderAlertID *string `json:"providerAlertId,omitempty"` 16950 // ProcessingEndTime - READ-ONLY; The time the alert was made available for consumption. 16951 ProcessingEndTime *date.Time `json:"processingEndTime,omitempty"` 16952 // ProductComponentName - READ-ONLY; The name of a component inside the product which generated the alert. 16953 ProductComponentName *string `json:"productComponentName,omitempty"` 16954 // ProductName - READ-ONLY; The name of the product which published this alert. 16955 ProductName *string `json:"productName,omitempty"` 16956 // ProductVersion - READ-ONLY; The version of the product generating the alert. 16957 ProductVersion *string `json:"productVersion,omitempty"` 16958 // RemediationSteps - READ-ONLY; Manual action items to take to remediate the alert. 16959 RemediationSteps *[]string `json:"remediationSteps,omitempty"` 16960 // Severity - The severity of the alert. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 16961 Severity AlertSeverity `json:"severity,omitempty"` 16962 // StartTimeUtc - READ-ONLY; The impact start time of the alert (the time of the first event contributing to the alert). 16963 StartTimeUtc *date.Time `json:"startTimeUtc,omitempty"` 16964 // Status - READ-ONLY; The lifecycle status of the alert. Possible values include: 'AlertStatusUnknown', 'AlertStatusNew', 'AlertStatusResolved', 'AlertStatusDismissed', 'AlertStatusInProgress' 16965 Status AlertStatus `json:"status,omitempty"` 16966 // SystemAlertID - READ-ONLY; Holds the product identifier of the alert for the product. 16967 SystemAlertID *string `json:"systemAlertId,omitempty"` 16968 // Tactics - READ-ONLY; The tactics of the alert 16969 Tactics *[]AttackTactic `json:"tactics,omitempty"` 16970 // TimeGenerated - READ-ONLY; The time the alert was generated. 16971 TimeGenerated *date.Time `json:"timeGenerated,omitempty"` 16972 // VendorName - READ-ONLY; The name of the vendor that raise the alert. 16973 VendorName *string `json:"vendorName,omitempty"` 16974 // AlertLink - READ-ONLY; The uri link of the alert. 16975 AlertLink *string `json:"alertLink,omitempty"` 16976 // ResourceIdentifiers - READ-ONLY; The list of resource identifiers of the alert. 16977 ResourceIdentifiers *[]interface{} `json:"resourceIdentifiers,omitempty"` 16978 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 16979 AdditionalData map[string]interface{} `json:"additionalData"` 16980 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 16981 FriendlyName *string `json:"friendlyName,omitempty"` 16982} 16983 16984// MarshalJSON is the custom marshaler for SecurityAlertProperties. 16985func (sap SecurityAlertProperties) MarshalJSON() ([]byte, error) { 16986 objectMap := make(map[string]interface{}) 16987 if sap.Severity != "" { 16988 objectMap["severity"] = sap.Severity 16989 } 16990 return json.Marshal(objectMap) 16991} 16992 16993// SecurityAlertPropertiesConfidenceReasonsItem confidence reason item 16994type SecurityAlertPropertiesConfidenceReasonsItem struct { 16995 // Reason - READ-ONLY; The reason's description 16996 Reason *string `json:"reason,omitempty"` 16997 // ReasonType - READ-ONLY; The type (category) of the reason 16998 ReasonType *string `json:"reasonType,omitempty"` 16999} 17000 17001// MarshalJSON is the custom marshaler for SecurityAlertPropertiesConfidenceReasonsItem. 17002func (sapRi SecurityAlertPropertiesConfidenceReasonsItem) MarshalJSON() ([]byte, error) { 17003 objectMap := make(map[string]interface{}) 17004 return json.Marshal(objectMap) 17005} 17006 17007// SecurityAlertTimelineItem represents security alert timeline item. 17008type SecurityAlertTimelineItem struct { 17009 // AzureResourceID - The alert azure resource id. 17010 AzureResourceID *string `json:"azureResourceId,omitempty"` 17011 // ProductName - The alert product name. 17012 ProductName *string `json:"productName,omitempty"` 17013 // Description - The alert description. 17014 Description *string `json:"description,omitempty"` 17015 // DisplayName - The alert name. 17016 DisplayName *string `json:"displayName,omitempty"` 17017 // Severity - The alert severity. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 17018 Severity AlertSeverity `json:"severity,omitempty"` 17019 // EndTimeUtc - The alert end time. 17020 EndTimeUtc *date.Time `json:"endTimeUtc,omitempty"` 17021 // StartTimeUtc - The alert start time. 17022 StartTimeUtc *date.Time `json:"startTimeUtc,omitempty"` 17023 // TimeGenerated - The alert generated time. 17024 TimeGenerated *date.Time `json:"timeGenerated,omitempty"` 17025 // AlertType - The name of the alert type. 17026 AlertType *string `json:"alertType,omitempty"` 17027 // Kind - Possible values include: 'KindBasicEntityTimelineItemKindEntityTimelineItem', 'KindBasicEntityTimelineItemKindActivity', 'KindBasicEntityTimelineItemKindSecurityAlert', 'KindBasicEntityTimelineItemKindBookmark' 17028 Kind KindBasicEntityTimelineItem `json:"kind,omitempty"` 17029} 17030 17031// MarshalJSON is the custom marshaler for SecurityAlertTimelineItem. 17032func (sati SecurityAlertTimelineItem) MarshalJSON() ([]byte, error) { 17033 sati.Kind = KindBasicEntityTimelineItemKindSecurityAlert 17034 objectMap := make(map[string]interface{}) 17035 if sati.AzureResourceID != nil { 17036 objectMap["azureResourceId"] = sati.AzureResourceID 17037 } 17038 if sati.ProductName != nil { 17039 objectMap["productName"] = sati.ProductName 17040 } 17041 if sati.Description != nil { 17042 objectMap["description"] = sati.Description 17043 } 17044 if sati.DisplayName != nil { 17045 objectMap["displayName"] = sati.DisplayName 17046 } 17047 if sati.Severity != "" { 17048 objectMap["severity"] = sati.Severity 17049 } 17050 if sati.EndTimeUtc != nil { 17051 objectMap["endTimeUtc"] = sati.EndTimeUtc 17052 } 17053 if sati.StartTimeUtc != nil { 17054 objectMap["startTimeUtc"] = sati.StartTimeUtc 17055 } 17056 if sati.TimeGenerated != nil { 17057 objectMap["timeGenerated"] = sati.TimeGenerated 17058 } 17059 if sati.AlertType != nil { 17060 objectMap["alertType"] = sati.AlertType 17061 } 17062 if sati.Kind != "" { 17063 objectMap["kind"] = sati.Kind 17064 } 17065 return json.Marshal(objectMap) 17066} 17067 17068// AsActivityTimelineItem is the BasicEntityTimelineItem implementation for SecurityAlertTimelineItem. 17069func (sati SecurityAlertTimelineItem) AsActivityTimelineItem() (*ActivityTimelineItem, bool) { 17070 return nil, false 17071} 17072 17073// AsSecurityAlertTimelineItem is the BasicEntityTimelineItem implementation for SecurityAlertTimelineItem. 17074func (sati SecurityAlertTimelineItem) AsSecurityAlertTimelineItem() (*SecurityAlertTimelineItem, bool) { 17075 return &sati, true 17076} 17077 17078// AsBookmarkTimelineItem is the BasicEntityTimelineItem implementation for SecurityAlertTimelineItem. 17079func (sati SecurityAlertTimelineItem) AsBookmarkTimelineItem() (*BookmarkTimelineItem, bool) { 17080 return nil, false 17081} 17082 17083// AsEntityTimelineItem is the BasicEntityTimelineItem implementation for SecurityAlertTimelineItem. 17084func (sati SecurityAlertTimelineItem) AsEntityTimelineItem() (*EntityTimelineItem, bool) { 17085 return nil, false 17086} 17087 17088// AsBasicEntityTimelineItem is the BasicEntityTimelineItem implementation for SecurityAlertTimelineItem. 17089func (sati SecurityAlertTimelineItem) AsBasicEntityTimelineItem() (BasicEntityTimelineItem, bool) { 17090 return &sati, true 17091} 17092 17093// SecurityGroupEntity represents a security group entity. 17094type SecurityGroupEntity struct { 17095 // SecurityGroupEntityProperties - SecurityGroup entity properties 17096 *SecurityGroupEntityProperties `json:"properties,omitempty"` 17097 // ID - READ-ONLY; Azure resource Id 17098 ID *string `json:"id,omitempty"` 17099 // Name - READ-ONLY; Azure resource name 17100 Name *string `json:"name,omitempty"` 17101 // Type - READ-ONLY; Azure resource type 17102 Type *string `json:"type,omitempty"` 17103 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 17104 Kind KindBasicEntity `json:"kind,omitempty"` 17105} 17106 17107// MarshalJSON is the custom marshaler for SecurityGroupEntity. 17108func (sge SecurityGroupEntity) MarshalJSON() ([]byte, error) { 17109 sge.Kind = KindBasicEntityKindSecurityGroup 17110 objectMap := make(map[string]interface{}) 17111 if sge.SecurityGroupEntityProperties != nil { 17112 objectMap["properties"] = sge.SecurityGroupEntityProperties 17113 } 17114 if sge.Kind != "" { 17115 objectMap["kind"] = sge.Kind 17116 } 17117 return json.Marshal(objectMap) 17118} 17119 17120// AsAccountEntity is the BasicEntity implementation for SecurityGroupEntity. 17121func (sge SecurityGroupEntity) AsAccountEntity() (*AccountEntity, bool) { 17122 return nil, false 17123} 17124 17125// AsAzureResourceEntity is the BasicEntity implementation for SecurityGroupEntity. 17126func (sge SecurityGroupEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 17127 return nil, false 17128} 17129 17130// AsCloudApplicationEntity is the BasicEntity implementation for SecurityGroupEntity. 17131func (sge SecurityGroupEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 17132 return nil, false 17133} 17134 17135// AsDNSEntity is the BasicEntity implementation for SecurityGroupEntity. 17136func (sge SecurityGroupEntity) AsDNSEntity() (*DNSEntity, bool) { 17137 return nil, false 17138} 17139 17140// AsFileEntity is the BasicEntity implementation for SecurityGroupEntity. 17141func (sge SecurityGroupEntity) AsFileEntity() (*FileEntity, bool) { 17142 return nil, false 17143} 17144 17145// AsFileHashEntity is the BasicEntity implementation for SecurityGroupEntity. 17146func (sge SecurityGroupEntity) AsFileHashEntity() (*FileHashEntity, bool) { 17147 return nil, false 17148} 17149 17150// AsHostEntity is the BasicEntity implementation for SecurityGroupEntity. 17151func (sge SecurityGroupEntity) AsHostEntity() (*HostEntity, bool) { 17152 return nil, false 17153} 17154 17155// AsHuntingBookmark is the BasicEntity implementation for SecurityGroupEntity. 17156func (sge SecurityGroupEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 17157 return nil, false 17158} 17159 17160// AsSecurityAlert is the BasicEntity implementation for SecurityGroupEntity. 17161func (sge SecurityGroupEntity) AsSecurityAlert() (*SecurityAlert, bool) { 17162 return nil, false 17163} 17164 17165// AsIPEntity is the BasicEntity implementation for SecurityGroupEntity. 17166func (sge SecurityGroupEntity) AsIPEntity() (*IPEntity, bool) { 17167 return nil, false 17168} 17169 17170// AsMailboxEntity is the BasicEntity implementation for SecurityGroupEntity. 17171func (sge SecurityGroupEntity) AsMailboxEntity() (*MailboxEntity, bool) { 17172 return nil, false 17173} 17174 17175// AsMailClusterEntity is the BasicEntity implementation for SecurityGroupEntity. 17176func (sge SecurityGroupEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 17177 return nil, false 17178} 17179 17180// AsMailMessageEntity is the BasicEntity implementation for SecurityGroupEntity. 17181func (sge SecurityGroupEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 17182 return nil, false 17183} 17184 17185// AsSubmissionMailEntity is the BasicEntity implementation for SecurityGroupEntity. 17186func (sge SecurityGroupEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 17187 return nil, false 17188} 17189 17190// AsMalwareEntity is the BasicEntity implementation for SecurityGroupEntity. 17191func (sge SecurityGroupEntity) AsMalwareEntity() (*MalwareEntity, bool) { 17192 return nil, false 17193} 17194 17195// AsProcessEntity is the BasicEntity implementation for SecurityGroupEntity. 17196func (sge SecurityGroupEntity) AsProcessEntity() (*ProcessEntity, bool) { 17197 return nil, false 17198} 17199 17200// AsRegistryKeyEntity is the BasicEntity implementation for SecurityGroupEntity. 17201func (sge SecurityGroupEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 17202 return nil, false 17203} 17204 17205// AsRegistryValueEntity is the BasicEntity implementation for SecurityGroupEntity. 17206func (sge SecurityGroupEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 17207 return nil, false 17208} 17209 17210// AsSecurityGroupEntity is the BasicEntity implementation for SecurityGroupEntity. 17211func (sge SecurityGroupEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 17212 return &sge, true 17213} 17214 17215// AsURLEntity is the BasicEntity implementation for SecurityGroupEntity. 17216func (sge SecurityGroupEntity) AsURLEntity() (*URLEntity, bool) { 17217 return nil, false 17218} 17219 17220// AsIoTDeviceEntity is the BasicEntity implementation for SecurityGroupEntity. 17221func (sge SecurityGroupEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 17222 return nil, false 17223} 17224 17225// AsEntity is the BasicEntity implementation for SecurityGroupEntity. 17226func (sge SecurityGroupEntity) AsEntity() (*Entity, bool) { 17227 return nil, false 17228} 17229 17230// AsBasicEntity is the BasicEntity implementation for SecurityGroupEntity. 17231func (sge SecurityGroupEntity) AsBasicEntity() (BasicEntity, bool) { 17232 return &sge, true 17233} 17234 17235// UnmarshalJSON is the custom unmarshaler for SecurityGroupEntity struct. 17236func (sge *SecurityGroupEntity) UnmarshalJSON(body []byte) error { 17237 var m map[string]*json.RawMessage 17238 err := json.Unmarshal(body, &m) 17239 if err != nil { 17240 return err 17241 } 17242 for k, v := range m { 17243 switch k { 17244 case "properties": 17245 if v != nil { 17246 var securityGroupEntityProperties SecurityGroupEntityProperties 17247 err = json.Unmarshal(*v, &securityGroupEntityProperties) 17248 if err != nil { 17249 return err 17250 } 17251 sge.SecurityGroupEntityProperties = &securityGroupEntityProperties 17252 } 17253 case "id": 17254 if v != nil { 17255 var ID string 17256 err = json.Unmarshal(*v, &ID) 17257 if err != nil { 17258 return err 17259 } 17260 sge.ID = &ID 17261 } 17262 case "name": 17263 if v != nil { 17264 var name string 17265 err = json.Unmarshal(*v, &name) 17266 if err != nil { 17267 return err 17268 } 17269 sge.Name = &name 17270 } 17271 case "type": 17272 if v != nil { 17273 var typeVar string 17274 err = json.Unmarshal(*v, &typeVar) 17275 if err != nil { 17276 return err 17277 } 17278 sge.Type = &typeVar 17279 } 17280 case "kind": 17281 if v != nil { 17282 var kind KindBasicEntity 17283 err = json.Unmarshal(*v, &kind) 17284 if err != nil { 17285 return err 17286 } 17287 sge.Kind = kind 17288 } 17289 } 17290 } 17291 17292 return nil 17293} 17294 17295// SecurityGroupEntityProperties securityGroup entity property bag. 17296type SecurityGroupEntityProperties struct { 17297 // DistinguishedName - READ-ONLY; The group distinguished name 17298 DistinguishedName *string `json:"distinguishedName,omitempty"` 17299 // ObjectGUID - READ-ONLY; A single-value attribute that is the unique identifier for the object, assigned by active directory. 17300 ObjectGUID *uuid.UUID `json:"objectGuid,omitempty"` 17301 // Sid - READ-ONLY; The SID attribute is a single-value attribute that specifies the security identifier (SID) of the group 17302 Sid *string `json:"sid,omitempty"` 17303 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 17304 AdditionalData map[string]interface{} `json:"additionalData"` 17305 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 17306 FriendlyName *string `json:"friendlyName,omitempty"` 17307} 17308 17309// MarshalJSON is the custom marshaler for SecurityGroupEntityProperties. 17310func (sgep SecurityGroupEntityProperties) MarshalJSON() ([]byte, error) { 17311 objectMap := make(map[string]interface{}) 17312 return json.Marshal(objectMap) 17313} 17314 17315// SettingList list of all the settings. 17316type SettingList struct { 17317 autorest.Response `json:"-"` 17318 // Value - Array of settings. 17319 Value *[]BasicSettings `json:"value,omitempty"` 17320} 17321 17322// UnmarshalJSON is the custom unmarshaler for SettingList struct. 17323func (sl *SettingList) UnmarshalJSON(body []byte) error { 17324 var m map[string]*json.RawMessage 17325 err := json.Unmarshal(body, &m) 17326 if err != nil { 17327 return err 17328 } 17329 for k, v := range m { 17330 switch k { 17331 case "value": 17332 if v != nil { 17333 value, err := unmarshalBasicSettingsArray(*v) 17334 if err != nil { 17335 return err 17336 } 17337 sl.Value = &value 17338 } 17339 } 17340 } 17341 17342 return nil 17343} 17344 17345// BasicSettings the Setting. 17346type BasicSettings interface { 17347 AsIPSyncer() (*IPSyncer, bool) 17348 AsEyesOn() (*EyesOn, bool) 17349 AsEntityAnalytics() (*EntityAnalytics, bool) 17350 AsUeba() (*Ueba, bool) 17351 AsSettings() (*Settings, bool) 17352} 17353 17354// Settings the Setting. 17355type Settings struct { 17356 autorest.Response `json:"-"` 17357 // ID - READ-ONLY; Azure resource Id 17358 ID *string `json:"id,omitempty"` 17359 // Name - READ-ONLY; Azure resource name 17360 Name *string `json:"name,omitempty"` 17361 // Type - READ-ONLY; Azure resource type 17362 Type *string `json:"type,omitempty"` 17363 // Etag - Etag of the azure resource 17364 Etag *string `json:"etag,omitempty"` 17365 // Kind - Possible values include: 'KindBasicSettingsKindSettings', 'KindBasicSettingsKindIPSyncer', 'KindBasicSettingsKindEyesOn', 'KindBasicSettingsKindEntityAnalytics', 'KindBasicSettingsKindUeba' 17366 Kind KindBasicSettings `json:"kind,omitempty"` 17367} 17368 17369func unmarshalBasicSettings(body []byte) (BasicSettings, error) { 17370 var m map[string]interface{} 17371 err := json.Unmarshal(body, &m) 17372 if err != nil { 17373 return nil, err 17374 } 17375 17376 switch m["kind"] { 17377 case string(KindBasicSettingsKindIPSyncer): 17378 var is IPSyncer 17379 err := json.Unmarshal(body, &is) 17380 return is, err 17381 case string(KindBasicSettingsKindEyesOn): 17382 var eo EyesOn 17383 err := json.Unmarshal(body, &eo) 17384 return eo, err 17385 case string(KindBasicSettingsKindEntityAnalytics): 17386 var ea EntityAnalytics 17387 err := json.Unmarshal(body, &ea) 17388 return ea, err 17389 case string(KindBasicSettingsKindUeba): 17390 var u Ueba 17391 err := json.Unmarshal(body, &u) 17392 return u, err 17393 default: 17394 var s Settings 17395 err := json.Unmarshal(body, &s) 17396 return s, err 17397 } 17398} 17399func unmarshalBasicSettingsArray(body []byte) ([]BasicSettings, error) { 17400 var rawMessages []*json.RawMessage 17401 err := json.Unmarshal(body, &rawMessages) 17402 if err != nil { 17403 return nil, err 17404 } 17405 17406 sArray := make([]BasicSettings, len(rawMessages)) 17407 17408 for index, rawMessage := range rawMessages { 17409 s, err := unmarshalBasicSettings(*rawMessage) 17410 if err != nil { 17411 return nil, err 17412 } 17413 sArray[index] = s 17414 } 17415 return sArray, nil 17416} 17417 17418// MarshalJSON is the custom marshaler for Settings. 17419func (s Settings) MarshalJSON() ([]byte, error) { 17420 s.Kind = KindBasicSettingsKindSettings 17421 objectMap := make(map[string]interface{}) 17422 if s.Etag != nil { 17423 objectMap["etag"] = s.Etag 17424 } 17425 if s.Kind != "" { 17426 objectMap["kind"] = s.Kind 17427 } 17428 return json.Marshal(objectMap) 17429} 17430 17431// AsIPSyncer is the BasicSettings implementation for Settings. 17432func (s Settings) AsIPSyncer() (*IPSyncer, bool) { 17433 return nil, false 17434} 17435 17436// AsEyesOn is the BasicSettings implementation for Settings. 17437func (s Settings) AsEyesOn() (*EyesOn, bool) { 17438 return nil, false 17439} 17440 17441// AsEntityAnalytics is the BasicSettings implementation for Settings. 17442func (s Settings) AsEntityAnalytics() (*EntityAnalytics, bool) { 17443 return nil, false 17444} 17445 17446// AsUeba is the BasicSettings implementation for Settings. 17447func (s Settings) AsUeba() (*Ueba, bool) { 17448 return nil, false 17449} 17450 17451// AsSettings is the BasicSettings implementation for Settings. 17452func (s Settings) AsSettings() (*Settings, bool) { 17453 return &s, true 17454} 17455 17456// AsBasicSettings is the BasicSettings implementation for Settings. 17457func (s Settings) AsBasicSettings() (BasicSettings, bool) { 17458 return &s, true 17459} 17460 17461// SettingsKind describes an Azure resource with kind. 17462type SettingsKind struct { 17463 // Kind - The kind of the setting. Possible values include: 'SettingKindEyesOn', 'SettingKindEntityAnalytics', 'SettingKindUeba' 17464 Kind SettingKind `json:"kind,omitempty"` 17465} 17466 17467// SettingsModel ... 17468type SettingsModel struct { 17469 autorest.Response `json:"-"` 17470 Value BasicSettings `json:"value,omitempty"` 17471} 17472 17473// UnmarshalJSON is the custom unmarshaler for SettingsModel struct. 17474func (sm *SettingsModel) UnmarshalJSON(body []byte) error { 17475 s, err := unmarshalBasicSettings(body) 17476 if err != nil { 17477 return err 17478 } 17479 sm.Value = s 17480 17481 return nil 17482} 17483 17484// SubmissionMailEntity represents a submission mail entity. 17485type SubmissionMailEntity struct { 17486 // SubmissionMailEntityProperties - Submission mail entity properties 17487 *SubmissionMailEntityProperties `json:"properties,omitempty"` 17488 // ID - READ-ONLY; Azure resource Id 17489 ID *string `json:"id,omitempty"` 17490 // Name - READ-ONLY; Azure resource name 17491 Name *string `json:"name,omitempty"` 17492 // Type - READ-ONLY; Azure resource type 17493 Type *string `json:"type,omitempty"` 17494 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 17495 Kind KindBasicEntity `json:"kind,omitempty"` 17496} 17497 17498// MarshalJSON is the custom marshaler for SubmissionMailEntity. 17499func (sme SubmissionMailEntity) MarshalJSON() ([]byte, error) { 17500 sme.Kind = KindBasicEntityKindSubmissionMail 17501 objectMap := make(map[string]interface{}) 17502 if sme.SubmissionMailEntityProperties != nil { 17503 objectMap["properties"] = sme.SubmissionMailEntityProperties 17504 } 17505 if sme.Kind != "" { 17506 objectMap["kind"] = sme.Kind 17507 } 17508 return json.Marshal(objectMap) 17509} 17510 17511// AsAccountEntity is the BasicEntity implementation for SubmissionMailEntity. 17512func (sme SubmissionMailEntity) AsAccountEntity() (*AccountEntity, bool) { 17513 return nil, false 17514} 17515 17516// AsAzureResourceEntity is the BasicEntity implementation for SubmissionMailEntity. 17517func (sme SubmissionMailEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 17518 return nil, false 17519} 17520 17521// AsCloudApplicationEntity is the BasicEntity implementation for SubmissionMailEntity. 17522func (sme SubmissionMailEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 17523 return nil, false 17524} 17525 17526// AsDNSEntity is the BasicEntity implementation for SubmissionMailEntity. 17527func (sme SubmissionMailEntity) AsDNSEntity() (*DNSEntity, bool) { 17528 return nil, false 17529} 17530 17531// AsFileEntity is the BasicEntity implementation for SubmissionMailEntity. 17532func (sme SubmissionMailEntity) AsFileEntity() (*FileEntity, bool) { 17533 return nil, false 17534} 17535 17536// AsFileHashEntity is the BasicEntity implementation for SubmissionMailEntity. 17537func (sme SubmissionMailEntity) AsFileHashEntity() (*FileHashEntity, bool) { 17538 return nil, false 17539} 17540 17541// AsHostEntity is the BasicEntity implementation for SubmissionMailEntity. 17542func (sme SubmissionMailEntity) AsHostEntity() (*HostEntity, bool) { 17543 return nil, false 17544} 17545 17546// AsHuntingBookmark is the BasicEntity implementation for SubmissionMailEntity. 17547func (sme SubmissionMailEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 17548 return nil, false 17549} 17550 17551// AsSecurityAlert is the BasicEntity implementation for SubmissionMailEntity. 17552func (sme SubmissionMailEntity) AsSecurityAlert() (*SecurityAlert, bool) { 17553 return nil, false 17554} 17555 17556// AsIPEntity is the BasicEntity implementation for SubmissionMailEntity. 17557func (sme SubmissionMailEntity) AsIPEntity() (*IPEntity, bool) { 17558 return nil, false 17559} 17560 17561// AsMailboxEntity is the BasicEntity implementation for SubmissionMailEntity. 17562func (sme SubmissionMailEntity) AsMailboxEntity() (*MailboxEntity, bool) { 17563 return nil, false 17564} 17565 17566// AsMailClusterEntity is the BasicEntity implementation for SubmissionMailEntity. 17567func (sme SubmissionMailEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 17568 return nil, false 17569} 17570 17571// AsMailMessageEntity is the BasicEntity implementation for SubmissionMailEntity. 17572func (sme SubmissionMailEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 17573 return nil, false 17574} 17575 17576// AsSubmissionMailEntity is the BasicEntity implementation for SubmissionMailEntity. 17577func (sme SubmissionMailEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 17578 return &sme, true 17579} 17580 17581// AsMalwareEntity is the BasicEntity implementation for SubmissionMailEntity. 17582func (sme SubmissionMailEntity) AsMalwareEntity() (*MalwareEntity, bool) { 17583 return nil, false 17584} 17585 17586// AsProcessEntity is the BasicEntity implementation for SubmissionMailEntity. 17587func (sme SubmissionMailEntity) AsProcessEntity() (*ProcessEntity, bool) { 17588 return nil, false 17589} 17590 17591// AsRegistryKeyEntity is the BasicEntity implementation for SubmissionMailEntity. 17592func (sme SubmissionMailEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 17593 return nil, false 17594} 17595 17596// AsRegistryValueEntity is the BasicEntity implementation for SubmissionMailEntity. 17597func (sme SubmissionMailEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 17598 return nil, false 17599} 17600 17601// AsSecurityGroupEntity is the BasicEntity implementation for SubmissionMailEntity. 17602func (sme SubmissionMailEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 17603 return nil, false 17604} 17605 17606// AsURLEntity is the BasicEntity implementation for SubmissionMailEntity. 17607func (sme SubmissionMailEntity) AsURLEntity() (*URLEntity, bool) { 17608 return nil, false 17609} 17610 17611// AsIoTDeviceEntity is the BasicEntity implementation for SubmissionMailEntity. 17612func (sme SubmissionMailEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 17613 return nil, false 17614} 17615 17616// AsEntity is the BasicEntity implementation for SubmissionMailEntity. 17617func (sme SubmissionMailEntity) AsEntity() (*Entity, bool) { 17618 return nil, false 17619} 17620 17621// AsBasicEntity is the BasicEntity implementation for SubmissionMailEntity. 17622func (sme SubmissionMailEntity) AsBasicEntity() (BasicEntity, bool) { 17623 return &sme, true 17624} 17625 17626// UnmarshalJSON is the custom unmarshaler for SubmissionMailEntity struct. 17627func (sme *SubmissionMailEntity) UnmarshalJSON(body []byte) error { 17628 var m map[string]*json.RawMessage 17629 err := json.Unmarshal(body, &m) 17630 if err != nil { 17631 return err 17632 } 17633 for k, v := range m { 17634 switch k { 17635 case "properties": 17636 if v != nil { 17637 var submissionMailEntityProperties SubmissionMailEntityProperties 17638 err = json.Unmarshal(*v, &submissionMailEntityProperties) 17639 if err != nil { 17640 return err 17641 } 17642 sme.SubmissionMailEntityProperties = &submissionMailEntityProperties 17643 } 17644 case "id": 17645 if v != nil { 17646 var ID string 17647 err = json.Unmarshal(*v, &ID) 17648 if err != nil { 17649 return err 17650 } 17651 sme.ID = &ID 17652 } 17653 case "name": 17654 if v != nil { 17655 var name string 17656 err = json.Unmarshal(*v, &name) 17657 if err != nil { 17658 return err 17659 } 17660 sme.Name = &name 17661 } 17662 case "type": 17663 if v != nil { 17664 var typeVar string 17665 err = json.Unmarshal(*v, &typeVar) 17666 if err != nil { 17667 return err 17668 } 17669 sme.Type = &typeVar 17670 } 17671 case "kind": 17672 if v != nil { 17673 var kind KindBasicEntity 17674 err = json.Unmarshal(*v, &kind) 17675 if err != nil { 17676 return err 17677 } 17678 sme.Kind = kind 17679 } 17680 } 17681 } 17682 17683 return nil 17684} 17685 17686// SubmissionMailEntityProperties submission mail entity property bag. 17687type SubmissionMailEntityProperties struct { 17688 // NetworkMessageID - READ-ONLY; The network message id of email to which submission belongs 17689 NetworkMessageID *uuid.UUID `json:"networkMessageId,omitempty"` 17690 // SubmissionID - READ-ONLY; The submission id 17691 SubmissionID *uuid.UUID `json:"submissionId,omitempty"` 17692 // Submitter - READ-ONLY; The submitter 17693 Submitter *string `json:"submitter,omitempty"` 17694 // SubmissionDate - READ-ONLY; The submission date 17695 SubmissionDate *date.Time `json:"submissionDate,omitempty"` 17696 // Timestamp - READ-ONLY; The Time stamp when the message is received (Mail) 17697 Timestamp *date.Time `json:"timestamp,omitempty"` 17698 // Recipient - READ-ONLY; The recipient of the mail 17699 Recipient *string `json:"recipient,omitempty"` 17700 // Sender - READ-ONLY; The sender of the mail 17701 Sender *string `json:"sender,omitempty"` 17702 // SenderIP - READ-ONLY; The sender's IP 17703 SenderIP *string `json:"senderIp,omitempty"` 17704 // Subject - READ-ONLY; The subject of submission mail 17705 Subject *string `json:"subject,omitempty"` 17706 // ReportType - READ-ONLY; The submission type for the given instance. This maps to Junk, Phish, Malware or NotJunk. 17707 ReportType *string `json:"reportType,omitempty"` 17708 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 17709 AdditionalData map[string]interface{} `json:"additionalData"` 17710 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 17711 FriendlyName *string `json:"friendlyName,omitempty"` 17712} 17713 17714// MarshalJSON is the custom marshaler for SubmissionMailEntityProperties. 17715func (smep SubmissionMailEntityProperties) MarshalJSON() ([]byte, error) { 17716 objectMap := make(map[string]interface{}) 17717 return json.Marshal(objectMap) 17718} 17719 17720// ThreatIntelligence threatIntelligence property bag. 17721type ThreatIntelligence struct { 17722 // Confidence - READ-ONLY; Confidence (must be between 0 and 1) 17723 Confidence *float64 `json:"confidence,omitempty"` 17724 // ProviderName - READ-ONLY; Name of the provider from whom this Threat Intelligence information was received 17725 ProviderName *string `json:"providerName,omitempty"` 17726 // ReportLink - READ-ONLY; Report link 17727 ReportLink *string `json:"reportLink,omitempty"` 17728 // ThreatDescription - READ-ONLY; Threat description (free text) 17729 ThreatDescription *string `json:"threatDescription,omitempty"` 17730 // ThreatName - READ-ONLY; Threat name (e.g. "Jedobot malware") 17731 ThreatName *string `json:"threatName,omitempty"` 17732 // ThreatType - READ-ONLY; Threat type (e.g. "Botnet") 17733 ThreatType *string `json:"threatType,omitempty"` 17734} 17735 17736// MarshalJSON is the custom marshaler for ThreatIntelligence. 17737func (ti ThreatIntelligence) MarshalJSON() ([]byte, error) { 17738 objectMap := make(map[string]interface{}) 17739 return json.Marshal(objectMap) 17740} 17741 17742// ThreatIntelligenceAlertRule represents Threat Intelligence alert rule. 17743type ThreatIntelligenceAlertRule struct { 17744 // ThreatIntelligenceAlertRuleProperties - Threat Intelligence alert rule properties 17745 *ThreatIntelligenceAlertRuleProperties `json:"properties,omitempty"` 17746 // ID - READ-ONLY; Azure resource Id 17747 ID *string `json:"id,omitempty"` 17748 // Name - READ-ONLY; Azure resource name 17749 Name *string `json:"name,omitempty"` 17750 // Type - READ-ONLY; Azure resource type 17751 Type *string `json:"type,omitempty"` 17752 // Etag - Etag of the azure resource 17753 Etag *string `json:"etag,omitempty"` 17754 // Kind - Possible values include: 'KindBasicAlertRuleKindAlertRule', 'KindBasicAlertRuleKindMLBehaviorAnalytics', 'KindBasicAlertRuleKindFusion', 'KindBasicAlertRuleKindThreatIntelligence', 'KindBasicAlertRuleKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleKindScheduled' 17755 Kind KindBasicAlertRule `json:"kind,omitempty"` 17756} 17757 17758// MarshalJSON is the custom marshaler for ThreatIntelligenceAlertRule. 17759func (tiar ThreatIntelligenceAlertRule) MarshalJSON() ([]byte, error) { 17760 tiar.Kind = KindBasicAlertRuleKindThreatIntelligence 17761 objectMap := make(map[string]interface{}) 17762 if tiar.ThreatIntelligenceAlertRuleProperties != nil { 17763 objectMap["properties"] = tiar.ThreatIntelligenceAlertRuleProperties 17764 } 17765 if tiar.Etag != nil { 17766 objectMap["etag"] = tiar.Etag 17767 } 17768 if tiar.Kind != "" { 17769 objectMap["kind"] = tiar.Kind 17770 } 17771 return json.Marshal(objectMap) 17772} 17773 17774// AsMLBehaviorAnalyticsAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17775func (tiar ThreatIntelligenceAlertRule) AsMLBehaviorAnalyticsAlertRule() (*MLBehaviorAnalyticsAlertRule, bool) { 17776 return nil, false 17777} 17778 17779// AsFusionAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17780func (tiar ThreatIntelligenceAlertRule) AsFusionAlertRule() (*FusionAlertRule, bool) { 17781 return nil, false 17782} 17783 17784// AsThreatIntelligenceAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17785func (tiar ThreatIntelligenceAlertRule) AsThreatIntelligenceAlertRule() (*ThreatIntelligenceAlertRule, bool) { 17786 return &tiar, true 17787} 17788 17789// AsMicrosoftSecurityIncidentCreationAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17790func (tiar ThreatIntelligenceAlertRule) AsMicrosoftSecurityIncidentCreationAlertRule() (*MicrosoftSecurityIncidentCreationAlertRule, bool) { 17791 return nil, false 17792} 17793 17794// AsScheduledAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17795func (tiar ThreatIntelligenceAlertRule) AsScheduledAlertRule() (*ScheduledAlertRule, bool) { 17796 return nil, false 17797} 17798 17799// AsAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17800func (tiar ThreatIntelligenceAlertRule) AsAlertRule() (*AlertRule, bool) { 17801 return nil, false 17802} 17803 17804// AsBasicAlertRule is the BasicAlertRule implementation for ThreatIntelligenceAlertRule. 17805func (tiar ThreatIntelligenceAlertRule) AsBasicAlertRule() (BasicAlertRule, bool) { 17806 return &tiar, true 17807} 17808 17809// UnmarshalJSON is the custom unmarshaler for ThreatIntelligenceAlertRule struct. 17810func (tiar *ThreatIntelligenceAlertRule) UnmarshalJSON(body []byte) error { 17811 var m map[string]*json.RawMessage 17812 err := json.Unmarshal(body, &m) 17813 if err != nil { 17814 return err 17815 } 17816 for k, v := range m { 17817 switch k { 17818 case "properties": 17819 if v != nil { 17820 var threatIntelligenceAlertRuleProperties ThreatIntelligenceAlertRuleProperties 17821 err = json.Unmarshal(*v, &threatIntelligenceAlertRuleProperties) 17822 if err != nil { 17823 return err 17824 } 17825 tiar.ThreatIntelligenceAlertRuleProperties = &threatIntelligenceAlertRuleProperties 17826 } 17827 case "id": 17828 if v != nil { 17829 var ID string 17830 err = json.Unmarshal(*v, &ID) 17831 if err != nil { 17832 return err 17833 } 17834 tiar.ID = &ID 17835 } 17836 case "name": 17837 if v != nil { 17838 var name string 17839 err = json.Unmarshal(*v, &name) 17840 if err != nil { 17841 return err 17842 } 17843 tiar.Name = &name 17844 } 17845 case "type": 17846 if v != nil { 17847 var typeVar string 17848 err = json.Unmarshal(*v, &typeVar) 17849 if err != nil { 17850 return err 17851 } 17852 tiar.Type = &typeVar 17853 } 17854 case "etag": 17855 if v != nil { 17856 var etag string 17857 err = json.Unmarshal(*v, &etag) 17858 if err != nil { 17859 return err 17860 } 17861 tiar.Etag = &etag 17862 } 17863 case "kind": 17864 if v != nil { 17865 var kind KindBasicAlertRule 17866 err = json.Unmarshal(*v, &kind) 17867 if err != nil { 17868 return err 17869 } 17870 tiar.Kind = kind 17871 } 17872 } 17873 } 17874 17875 return nil 17876} 17877 17878// ThreatIntelligenceAlertRuleProperties threat Intelligence alert rule base property bag. 17879type ThreatIntelligenceAlertRuleProperties struct { 17880 // AlertRuleTemplateName - The Name of the alert rule template used to create this rule. 17881 AlertRuleTemplateName *string `json:"alertRuleTemplateName,omitempty"` 17882 // Description - READ-ONLY; The description of the alert rule. 17883 Description *string `json:"description,omitempty"` 17884 // DisplayName - READ-ONLY; The display name for alerts created by this alert rule. 17885 DisplayName *string `json:"displayName,omitempty"` 17886 // Enabled - Determines whether this alert rule is enabled or disabled. 17887 Enabled *bool `json:"enabled,omitempty"` 17888 // LastModifiedUtc - READ-ONLY; The last time that this alert has been modified. 17889 LastModifiedUtc *date.Time `json:"lastModifiedUtc,omitempty"` 17890 // Severity - READ-ONLY; The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 17891 Severity AlertSeverity `json:"severity,omitempty"` 17892 // Tactics - READ-ONLY; The tactics of the alert rule 17893 Tactics *[]AttackTactic `json:"tactics,omitempty"` 17894} 17895 17896// MarshalJSON is the custom marshaler for ThreatIntelligenceAlertRuleProperties. 17897func (tiarp ThreatIntelligenceAlertRuleProperties) MarshalJSON() ([]byte, error) { 17898 objectMap := make(map[string]interface{}) 17899 if tiarp.AlertRuleTemplateName != nil { 17900 objectMap["alertRuleTemplateName"] = tiarp.AlertRuleTemplateName 17901 } 17902 if tiarp.Enabled != nil { 17903 objectMap["enabled"] = tiarp.Enabled 17904 } 17905 return json.Marshal(objectMap) 17906} 17907 17908// ThreatIntelligenceAlertRuleTemplate represents Threat Intelligence alert rule template. 17909type ThreatIntelligenceAlertRuleTemplate struct { 17910 // ThreatIntelligenceAlertRuleTemplateProperties - Threat Intelligence alert rule template properties 17911 *ThreatIntelligenceAlertRuleTemplateProperties `json:"properties,omitempty"` 17912 // ID - READ-ONLY; Azure resource Id 17913 ID *string `json:"id,omitempty"` 17914 // Name - READ-ONLY; Azure resource name 17915 Name *string `json:"name,omitempty"` 17916 // Type - READ-ONLY; Azure resource type 17917 Type *string `json:"type,omitempty"` 17918 // Kind - Possible values include: 'KindBasicAlertRuleTemplateKindAlertRuleTemplate', 'KindBasicAlertRuleTemplateKindMLBehaviorAnalytics', 'KindBasicAlertRuleTemplateKindFusion', 'KindBasicAlertRuleTemplateKindThreatIntelligence', 'KindBasicAlertRuleTemplateKindMicrosoftSecurityIncidentCreation', 'KindBasicAlertRuleTemplateKindScheduled' 17919 Kind KindBasicAlertRuleTemplate `json:"kind,omitempty"` 17920} 17921 17922// MarshalJSON is the custom marshaler for ThreatIntelligenceAlertRuleTemplate. 17923func (tiart ThreatIntelligenceAlertRuleTemplate) MarshalJSON() ([]byte, error) { 17924 tiart.Kind = KindBasicAlertRuleTemplateKindThreatIntelligence 17925 objectMap := make(map[string]interface{}) 17926 if tiart.ThreatIntelligenceAlertRuleTemplateProperties != nil { 17927 objectMap["properties"] = tiart.ThreatIntelligenceAlertRuleTemplateProperties 17928 } 17929 if tiart.Kind != "" { 17930 objectMap["kind"] = tiart.Kind 17931 } 17932 return json.Marshal(objectMap) 17933} 17934 17935// AsMLBehaviorAnalyticsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17936func (tiart ThreatIntelligenceAlertRuleTemplate) AsMLBehaviorAnalyticsAlertRuleTemplate() (*MLBehaviorAnalyticsAlertRuleTemplate, bool) { 17937 return nil, false 17938} 17939 17940// AsFusionAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17941func (tiart ThreatIntelligenceAlertRuleTemplate) AsFusionAlertRuleTemplate() (*FusionAlertRuleTemplate, bool) { 17942 return nil, false 17943} 17944 17945// AsThreatIntelligenceAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17946func (tiart ThreatIntelligenceAlertRuleTemplate) AsThreatIntelligenceAlertRuleTemplate() (*ThreatIntelligenceAlertRuleTemplate, bool) { 17947 return &tiart, true 17948} 17949 17950// AsMicrosoftSecurityIncidentCreationAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17951func (tiart ThreatIntelligenceAlertRuleTemplate) AsMicrosoftSecurityIncidentCreationAlertRuleTemplate() (*MicrosoftSecurityIncidentCreationAlertRuleTemplate, bool) { 17952 return nil, false 17953} 17954 17955// AsScheduledAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17956func (tiart ThreatIntelligenceAlertRuleTemplate) AsScheduledAlertRuleTemplate() (*ScheduledAlertRuleTemplate, bool) { 17957 return nil, false 17958} 17959 17960// AsAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17961func (tiart ThreatIntelligenceAlertRuleTemplate) AsAlertRuleTemplate() (*AlertRuleTemplate, bool) { 17962 return nil, false 17963} 17964 17965// AsBasicAlertRuleTemplate is the BasicAlertRuleTemplate implementation for ThreatIntelligenceAlertRuleTemplate. 17966func (tiart ThreatIntelligenceAlertRuleTemplate) AsBasicAlertRuleTemplate() (BasicAlertRuleTemplate, bool) { 17967 return &tiart, true 17968} 17969 17970// UnmarshalJSON is the custom unmarshaler for ThreatIntelligenceAlertRuleTemplate struct. 17971func (tiart *ThreatIntelligenceAlertRuleTemplate) UnmarshalJSON(body []byte) error { 17972 var m map[string]*json.RawMessage 17973 err := json.Unmarshal(body, &m) 17974 if err != nil { 17975 return err 17976 } 17977 for k, v := range m { 17978 switch k { 17979 case "properties": 17980 if v != nil { 17981 var threatIntelligenceAlertRuleTemplateProperties ThreatIntelligenceAlertRuleTemplateProperties 17982 err = json.Unmarshal(*v, &threatIntelligenceAlertRuleTemplateProperties) 17983 if err != nil { 17984 return err 17985 } 17986 tiart.ThreatIntelligenceAlertRuleTemplateProperties = &threatIntelligenceAlertRuleTemplateProperties 17987 } 17988 case "id": 17989 if v != nil { 17990 var ID string 17991 err = json.Unmarshal(*v, &ID) 17992 if err != nil { 17993 return err 17994 } 17995 tiart.ID = &ID 17996 } 17997 case "name": 17998 if v != nil { 17999 var name string 18000 err = json.Unmarshal(*v, &name) 18001 if err != nil { 18002 return err 18003 } 18004 tiart.Name = &name 18005 } 18006 case "type": 18007 if v != nil { 18008 var typeVar string 18009 err = json.Unmarshal(*v, &typeVar) 18010 if err != nil { 18011 return err 18012 } 18013 tiart.Type = &typeVar 18014 } 18015 case "kind": 18016 if v != nil { 18017 var kind KindBasicAlertRuleTemplate 18018 err = json.Unmarshal(*v, &kind) 18019 if err != nil { 18020 return err 18021 } 18022 tiart.Kind = kind 18023 } 18024 } 18025 } 18026 18027 return nil 18028} 18029 18030// ThreatIntelligenceAlertRuleTemplateProperties threat Intelligence alert rule template properties 18031type ThreatIntelligenceAlertRuleTemplateProperties struct { 18032 // Severity - The severity for alerts created by this alert rule. Possible values include: 'AlertSeverityHigh', 'AlertSeverityMedium', 'AlertSeverityLow', 'AlertSeverityInformational' 18033 Severity AlertSeverity `json:"severity,omitempty"` 18034 // Tactics - The tactics of the alert rule template 18035 Tactics *[]AttackTactic `json:"tactics,omitempty"` 18036 // AlertRulesCreatedByTemplateCount - the number of alert rules that were created by this template 18037 AlertRulesCreatedByTemplateCount *int32 `json:"alertRulesCreatedByTemplateCount,omitempty"` 18038 // LastUpdatedDateUTC - READ-ONLY; The last time that this alert rule template has been updated. 18039 LastUpdatedDateUTC *date.Time `json:"lastUpdatedDateUTC,omitempty"` 18040 // CreatedDateUTC - READ-ONLY; The time that this alert rule template has been added. 18041 CreatedDateUTC *date.Time `json:"createdDateUTC,omitempty"` 18042 // Description - The description of the alert rule template. 18043 Description *string `json:"description,omitempty"` 18044 // DisplayName - The display name for alert rule template. 18045 DisplayName *string `json:"displayName,omitempty"` 18046 // RequiredDataConnectors - The required data sources for this template 18047 RequiredDataConnectors *[]AlertRuleTemplateDataSource `json:"requiredDataConnectors,omitempty"` 18048 // Status - The alert rule template status. Possible values include: 'TemplateStatusInstalled', 'TemplateStatusAvailable', 'TemplateStatusNotAvailable' 18049 Status TemplateStatus `json:"status,omitempty"` 18050} 18051 18052// MarshalJSON is the custom marshaler for ThreatIntelligenceAlertRuleTemplateProperties. 18053func (tiart ThreatIntelligenceAlertRuleTemplateProperties) MarshalJSON() ([]byte, error) { 18054 objectMap := make(map[string]interface{}) 18055 if tiart.Severity != "" { 18056 objectMap["severity"] = tiart.Severity 18057 } 18058 if tiart.Tactics != nil { 18059 objectMap["tactics"] = tiart.Tactics 18060 } 18061 if tiart.AlertRulesCreatedByTemplateCount != nil { 18062 objectMap["alertRulesCreatedByTemplateCount"] = tiart.AlertRulesCreatedByTemplateCount 18063 } 18064 if tiart.Description != nil { 18065 objectMap["description"] = tiart.Description 18066 } 18067 if tiart.DisplayName != nil { 18068 objectMap["displayName"] = tiart.DisplayName 18069 } 18070 if tiart.RequiredDataConnectors != nil { 18071 objectMap["requiredDataConnectors"] = tiart.RequiredDataConnectors 18072 } 18073 if tiart.Status != "" { 18074 objectMap["status"] = tiart.Status 18075 } 18076 return json.Marshal(objectMap) 18077} 18078 18079// ThreatIntelligenceAppendTags array of tags to be appended to the threat intelligence indicator. 18080type ThreatIntelligenceAppendTags struct { 18081 // ThreatIntelligenceTags - List of tags to be appended. 18082 ThreatIntelligenceTags *[]string `json:"threatIntelligenceTags,omitempty"` 18083} 18084 18085// ThreatIntelligenceExternalReference describes external reference 18086type ThreatIntelligenceExternalReference struct { 18087 // Description - External reference description 18088 Description *string `json:"description,omitempty"` 18089 // ExternalID - External reference ID 18090 ExternalID *string `json:"externalId,omitempty"` 18091 // SourceName - External reference source name 18092 SourceName *string `json:"sourceName,omitempty"` 18093 // URL - External reference URL 18094 URL *string `json:"url,omitempty"` 18095 // Hashes - External reference hashes 18096 Hashes map[string]*string `json:"hashes"` 18097} 18098 18099// MarshalJSON is the custom marshaler for ThreatIntelligenceExternalReference. 18100func (tier ThreatIntelligenceExternalReference) MarshalJSON() ([]byte, error) { 18101 objectMap := make(map[string]interface{}) 18102 if tier.Description != nil { 18103 objectMap["description"] = tier.Description 18104 } 18105 if tier.ExternalID != nil { 18106 objectMap["externalId"] = tier.ExternalID 18107 } 18108 if tier.SourceName != nil { 18109 objectMap["sourceName"] = tier.SourceName 18110 } 18111 if tier.URL != nil { 18112 objectMap["url"] = tier.URL 18113 } 18114 if tier.Hashes != nil { 18115 objectMap["hashes"] = tier.Hashes 18116 } 18117 return json.Marshal(objectMap) 18118} 18119 18120// ThreatIntelligenceFilteringCriteria filtering criteria for querying threat intelligence indicators. 18121type ThreatIntelligenceFilteringCriteria struct { 18122 // PageSize - Page size 18123 PageSize *int32 `json:"pageSize,omitempty"` 18124 // MinConfidence - Minimum confidence. 18125 MinConfidence *int32 `json:"minConfidence,omitempty"` 18126 // MaxConfidence - Maximum confidence. 18127 MaxConfidence *int32 `json:"maxConfidence,omitempty"` 18128 // MinValidUntil - Start time for ValidUntil filter. 18129 MinValidUntil *string `json:"minValidUntil,omitempty"` 18130 // MaxValidUntil - End time for ValidUntil filter. 18131 MaxValidUntil *string `json:"maxValidUntil,omitempty"` 18132 // IncludeDisabled - Parameter to include/exclude disabled indicators. 18133 IncludeDisabled *bool `json:"includeDisabled,omitempty"` 18134 // SortBy - Columns to sort by and sorting order 18135 SortBy *[]ThreatIntelligenceSortingCriteria1 `json:"sortBy,omitempty"` 18136 // Sources - Sources of threat intelligence indicators 18137 Sources *[]string `json:"sources,omitempty"` 18138 // PatternTypes - Pattern types 18139 PatternTypes *[]string `json:"patternTypes,omitempty"` 18140 // ThreatTypes - Threat types of threat intelligence indicators 18141 ThreatTypes *[]string `json:"threatTypes,omitempty"` 18142 // Ids - Ids of threat intelligence indicators 18143 Ids *[]string `json:"ids,omitempty"` 18144 // Keywords - Keywords for searching threat intelligence indicators 18145 Keywords *[]string `json:"keywords,omitempty"` 18146 // SkipToken - Skip token. 18147 SkipToken *string `json:"skipToken,omitempty"` 18148} 18149 18150// ThreatIntelligenceGranularMarkingModel describes threat granular marking model entity 18151type ThreatIntelligenceGranularMarkingModel struct { 18152 // Language - Language granular marking model 18153 Language *string `json:"language,omitempty"` 18154 // MarkingRef - marking reference granular marking model 18155 MarkingRef *int32 `json:"markingRef,omitempty"` 18156 // Selectors - granular marking model selectors 18157 Selectors *[]string `json:"selectors,omitempty"` 18158} 18159 18160// ThreatIntelligenceIndicatorModel threat intelligence indicator entity. 18161type ThreatIntelligenceIndicatorModel struct { 18162 // ThreatIntelligenceIndicatorProperties - Threat Intelligence Entity properties 18163 *ThreatIntelligenceIndicatorProperties `json:"properties,omitempty"` 18164 // ID - READ-ONLY; Azure resource Id 18165 ID *string `json:"id,omitempty"` 18166 // Name - READ-ONLY; Azure resource name 18167 Name *string `json:"name,omitempty"` 18168 // Type - READ-ONLY; Azure resource type 18169 Type *string `json:"type,omitempty"` 18170 // Etag - Etag of the azure resource 18171 Etag *string `json:"etag,omitempty"` 18172 // Kind - Possible values include: 'KindBasicThreatIntelligenceInformationKindThreatIntelligenceInformation', 'KindBasicThreatIntelligenceInformationKindIndicator' 18173 Kind KindBasicThreatIntelligenceInformation `json:"kind,omitempty"` 18174} 18175 18176// MarshalJSON is the custom marshaler for ThreatIntelligenceIndicatorModel. 18177func (tiim ThreatIntelligenceIndicatorModel) MarshalJSON() ([]byte, error) { 18178 tiim.Kind = KindBasicThreatIntelligenceInformationKindIndicator 18179 objectMap := make(map[string]interface{}) 18180 if tiim.ThreatIntelligenceIndicatorProperties != nil { 18181 objectMap["properties"] = tiim.ThreatIntelligenceIndicatorProperties 18182 } 18183 if tiim.Etag != nil { 18184 objectMap["etag"] = tiim.Etag 18185 } 18186 if tiim.Kind != "" { 18187 objectMap["kind"] = tiim.Kind 18188 } 18189 return json.Marshal(objectMap) 18190} 18191 18192// AsThreatIntelligenceIndicatorModel is the BasicThreatIntelligenceInformation implementation for ThreatIntelligenceIndicatorModel. 18193func (tiim ThreatIntelligenceIndicatorModel) AsThreatIntelligenceIndicatorModel() (*ThreatIntelligenceIndicatorModel, bool) { 18194 return &tiim, true 18195} 18196 18197// AsThreatIntelligenceInformation is the BasicThreatIntelligenceInformation implementation for ThreatIntelligenceIndicatorModel. 18198func (tiim ThreatIntelligenceIndicatorModel) AsThreatIntelligenceInformation() (*ThreatIntelligenceInformation, bool) { 18199 return nil, false 18200} 18201 18202// AsBasicThreatIntelligenceInformation is the BasicThreatIntelligenceInformation implementation for ThreatIntelligenceIndicatorModel. 18203func (tiim ThreatIntelligenceIndicatorModel) AsBasicThreatIntelligenceInformation() (BasicThreatIntelligenceInformation, bool) { 18204 return &tiim, true 18205} 18206 18207// UnmarshalJSON is the custom unmarshaler for ThreatIntelligenceIndicatorModel struct. 18208func (tiim *ThreatIntelligenceIndicatorModel) UnmarshalJSON(body []byte) error { 18209 var m map[string]*json.RawMessage 18210 err := json.Unmarshal(body, &m) 18211 if err != nil { 18212 return err 18213 } 18214 for k, v := range m { 18215 switch k { 18216 case "properties": 18217 if v != nil { 18218 var threatIntelligenceIndicatorProperties ThreatIntelligenceIndicatorProperties 18219 err = json.Unmarshal(*v, &threatIntelligenceIndicatorProperties) 18220 if err != nil { 18221 return err 18222 } 18223 tiim.ThreatIntelligenceIndicatorProperties = &threatIntelligenceIndicatorProperties 18224 } 18225 case "id": 18226 if v != nil { 18227 var ID string 18228 err = json.Unmarshal(*v, &ID) 18229 if err != nil { 18230 return err 18231 } 18232 tiim.ID = &ID 18233 } 18234 case "name": 18235 if v != nil { 18236 var name string 18237 err = json.Unmarshal(*v, &name) 18238 if err != nil { 18239 return err 18240 } 18241 tiim.Name = &name 18242 } 18243 case "type": 18244 if v != nil { 18245 var typeVar string 18246 err = json.Unmarshal(*v, &typeVar) 18247 if err != nil { 18248 return err 18249 } 18250 tiim.Type = &typeVar 18251 } 18252 case "etag": 18253 if v != nil { 18254 var etag string 18255 err = json.Unmarshal(*v, &etag) 18256 if err != nil { 18257 return err 18258 } 18259 tiim.Etag = &etag 18260 } 18261 case "kind": 18262 if v != nil { 18263 var kind KindBasicThreatIntelligenceInformation 18264 err = json.Unmarshal(*v, &kind) 18265 if err != nil { 18266 return err 18267 } 18268 tiim.Kind = kind 18269 } 18270 } 18271 } 18272 18273 return nil 18274} 18275 18276// ThreatIntelligenceIndicatorModelForRequestBody threat intelligence indicator entity used in request 18277// body. 18278type ThreatIntelligenceIndicatorModelForRequestBody struct { 18279 // Etag - Etag of the azure resource 18280 Etag *string `json:"etag,omitempty"` 18281 // ThreatIntelligenceIndicatorProperties - Threat Intelligence Entity properties 18282 *ThreatIntelligenceIndicatorProperties `json:"properties,omitempty"` 18283 // Kind - The kind of the entity. 18284 Kind *string `json:"kind,omitempty"` 18285} 18286 18287// MarshalJSON is the custom marshaler for ThreatIntelligenceIndicatorModelForRequestBody. 18288func (tiimfrb ThreatIntelligenceIndicatorModelForRequestBody) MarshalJSON() ([]byte, error) { 18289 objectMap := make(map[string]interface{}) 18290 if tiimfrb.Etag != nil { 18291 objectMap["etag"] = tiimfrb.Etag 18292 } 18293 if tiimfrb.ThreatIntelligenceIndicatorProperties != nil { 18294 objectMap["properties"] = tiimfrb.ThreatIntelligenceIndicatorProperties 18295 } 18296 if tiimfrb.Kind != nil { 18297 objectMap["kind"] = tiimfrb.Kind 18298 } 18299 return json.Marshal(objectMap) 18300} 18301 18302// UnmarshalJSON is the custom unmarshaler for ThreatIntelligenceIndicatorModelForRequestBody struct. 18303func (tiimfrb *ThreatIntelligenceIndicatorModelForRequestBody) UnmarshalJSON(body []byte) error { 18304 var m map[string]*json.RawMessage 18305 err := json.Unmarshal(body, &m) 18306 if err != nil { 18307 return err 18308 } 18309 for k, v := range m { 18310 switch k { 18311 case "etag": 18312 if v != nil { 18313 var etag string 18314 err = json.Unmarshal(*v, &etag) 18315 if err != nil { 18316 return err 18317 } 18318 tiimfrb.Etag = &etag 18319 } 18320 case "properties": 18321 if v != nil { 18322 var threatIntelligenceIndicatorProperties ThreatIntelligenceIndicatorProperties 18323 err = json.Unmarshal(*v, &threatIntelligenceIndicatorProperties) 18324 if err != nil { 18325 return err 18326 } 18327 tiimfrb.ThreatIntelligenceIndicatorProperties = &threatIntelligenceIndicatorProperties 18328 } 18329 case "kind": 18330 if v != nil { 18331 var kind string 18332 err = json.Unmarshal(*v, &kind) 18333 if err != nil { 18334 return err 18335 } 18336 tiimfrb.Kind = &kind 18337 } 18338 } 18339 } 18340 18341 return nil 18342} 18343 18344// ThreatIntelligenceIndicatorProperties describes threat intelligence entity properties 18345type ThreatIntelligenceIndicatorProperties struct { 18346 // ThreatIntelligenceTags - List of tags 18347 ThreatIntelligenceTags *[]string `json:"threatIntelligenceTags,omitempty"` 18348 // LastUpdatedTimeUtc - Last updated time in UTC 18349 LastUpdatedTimeUtc *string `json:"lastUpdatedTimeUtc,omitempty"` 18350 // Source - Source of a threat intelligence entity 18351 Source *string `json:"source,omitempty"` 18352 // DisplayName - Display name of a threat intelligence entity 18353 DisplayName *string `json:"displayName,omitempty"` 18354 // Description - Description of a threat intelligence entity 18355 Description *string `json:"description,omitempty"` 18356 // IndicatorTypes - Indicator types of threat intelligence entities 18357 IndicatorTypes *[]string `json:"indicatorTypes,omitempty"` 18358 // Pattern - Pattern of a threat intelligence entity 18359 Pattern *string `json:"pattern,omitempty"` 18360 // PatternType - Pattern type of a threat intelligence entity 18361 PatternType *string `json:"patternType,omitempty"` 18362 // PatternVersion - Pattern version of a threat intelligence entity 18363 PatternVersion *string `json:"patternVersion,omitempty"` 18364 // KillChainPhases - Kill chain phases 18365 KillChainPhases *[]ThreatIntelligenceKillChainPhase `json:"killChainPhases,omitempty"` 18366 // ParsedPattern - Parsed patterns 18367 ParsedPattern *[]ThreatIntelligenceParsedPattern `json:"parsedPattern,omitempty"` 18368 // ExternalID - External ID of threat intelligence entity 18369 ExternalID *string `json:"externalId,omitempty"` 18370 // CreatedByRef - Created by reference of threat intelligence entity 18371 CreatedByRef *string `json:"createdByRef,omitempty"` 18372 // Defanged - Is threat intelligence entity defanged 18373 Defanged *bool `json:"defanged,omitempty"` 18374 // ExternalLastUpdatedTimeUtc - External last updated time in UTC 18375 ExternalLastUpdatedTimeUtc *string `json:"externalLastUpdatedTimeUtc,omitempty"` 18376 // ExternalReferences - External References 18377 ExternalReferences *[]ThreatIntelligenceExternalReference `json:"externalReferences,omitempty"` 18378 // GranularMarkings - Granular Markings 18379 GranularMarkings *[]ThreatIntelligenceGranularMarkingModel `json:"granularMarkings,omitempty"` 18380 // Labels - Labels of threat intelligence entity 18381 Labels *[]string `json:"labels,omitempty"` 18382 // Revoked - Is threat intelligence entity revoked 18383 Revoked *bool `json:"revoked,omitempty"` 18384 // Confidence - Confidence of threat intelligence entity 18385 Confidence *int32 `json:"confidence,omitempty"` 18386 // ObjectMarkingRefs - Threat intelligence entity object marking references 18387 ObjectMarkingRefs *[]string `json:"objectMarkingRefs,omitempty"` 18388 // Language - Language of threat intelligence entity 18389 Language *string `json:"language,omitempty"` 18390 // ThreatTypes - Threat types 18391 ThreatTypes *[]string `json:"threatTypes,omitempty"` 18392 // ValidFrom - Valid from 18393 ValidFrom *string `json:"validFrom,omitempty"` 18394 // ValidUntil - Valid until 18395 ValidUntil *string `json:"validUntil,omitempty"` 18396 // Created - Created by 18397 Created *string `json:"created,omitempty"` 18398 // Modified - Modified by 18399 Modified *string `json:"modified,omitempty"` 18400 // Extensions - Extensions map 18401 Extensions map[string]interface{} `json:"extensions"` 18402 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 18403 AdditionalData map[string]interface{} `json:"additionalData"` 18404 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 18405 FriendlyName *string `json:"friendlyName,omitempty"` 18406} 18407 18408// MarshalJSON is the custom marshaler for ThreatIntelligenceIndicatorProperties. 18409func (tiip ThreatIntelligenceIndicatorProperties) MarshalJSON() ([]byte, error) { 18410 objectMap := make(map[string]interface{}) 18411 if tiip.ThreatIntelligenceTags != nil { 18412 objectMap["threatIntelligenceTags"] = tiip.ThreatIntelligenceTags 18413 } 18414 if tiip.LastUpdatedTimeUtc != nil { 18415 objectMap["lastUpdatedTimeUtc"] = tiip.LastUpdatedTimeUtc 18416 } 18417 if tiip.Source != nil { 18418 objectMap["source"] = tiip.Source 18419 } 18420 if tiip.DisplayName != nil { 18421 objectMap["displayName"] = tiip.DisplayName 18422 } 18423 if tiip.Description != nil { 18424 objectMap["description"] = tiip.Description 18425 } 18426 if tiip.IndicatorTypes != nil { 18427 objectMap["indicatorTypes"] = tiip.IndicatorTypes 18428 } 18429 if tiip.Pattern != nil { 18430 objectMap["pattern"] = tiip.Pattern 18431 } 18432 if tiip.PatternType != nil { 18433 objectMap["patternType"] = tiip.PatternType 18434 } 18435 if tiip.PatternVersion != nil { 18436 objectMap["patternVersion"] = tiip.PatternVersion 18437 } 18438 if tiip.KillChainPhases != nil { 18439 objectMap["killChainPhases"] = tiip.KillChainPhases 18440 } 18441 if tiip.ParsedPattern != nil { 18442 objectMap["parsedPattern"] = tiip.ParsedPattern 18443 } 18444 if tiip.ExternalID != nil { 18445 objectMap["externalId"] = tiip.ExternalID 18446 } 18447 if tiip.CreatedByRef != nil { 18448 objectMap["createdByRef"] = tiip.CreatedByRef 18449 } 18450 if tiip.Defanged != nil { 18451 objectMap["defanged"] = tiip.Defanged 18452 } 18453 if tiip.ExternalLastUpdatedTimeUtc != nil { 18454 objectMap["externalLastUpdatedTimeUtc"] = tiip.ExternalLastUpdatedTimeUtc 18455 } 18456 if tiip.ExternalReferences != nil { 18457 objectMap["externalReferences"] = tiip.ExternalReferences 18458 } 18459 if tiip.GranularMarkings != nil { 18460 objectMap["granularMarkings"] = tiip.GranularMarkings 18461 } 18462 if tiip.Labels != nil { 18463 objectMap["labels"] = tiip.Labels 18464 } 18465 if tiip.Revoked != nil { 18466 objectMap["revoked"] = tiip.Revoked 18467 } 18468 if tiip.Confidence != nil { 18469 objectMap["confidence"] = tiip.Confidence 18470 } 18471 if tiip.ObjectMarkingRefs != nil { 18472 objectMap["objectMarkingRefs"] = tiip.ObjectMarkingRefs 18473 } 18474 if tiip.Language != nil { 18475 objectMap["language"] = tiip.Language 18476 } 18477 if tiip.ThreatTypes != nil { 18478 objectMap["threatTypes"] = tiip.ThreatTypes 18479 } 18480 if tiip.ValidFrom != nil { 18481 objectMap["validFrom"] = tiip.ValidFrom 18482 } 18483 if tiip.ValidUntil != nil { 18484 objectMap["validUntil"] = tiip.ValidUntil 18485 } 18486 if tiip.Created != nil { 18487 objectMap["created"] = tiip.Created 18488 } 18489 if tiip.Modified != nil { 18490 objectMap["modified"] = tiip.Modified 18491 } 18492 if tiip.Extensions != nil { 18493 objectMap["extensions"] = tiip.Extensions 18494 } 18495 return json.Marshal(objectMap) 18496} 18497 18498// BasicThreatIntelligenceInformation threat intelligence information object. 18499type BasicThreatIntelligenceInformation interface { 18500 AsThreatIntelligenceIndicatorModel() (*ThreatIntelligenceIndicatorModel, bool) 18501 AsThreatIntelligenceInformation() (*ThreatIntelligenceInformation, bool) 18502} 18503 18504// ThreatIntelligenceInformation threat intelligence information object. 18505type ThreatIntelligenceInformation struct { 18506 autorest.Response `json:"-"` 18507 // ID - READ-ONLY; Azure resource Id 18508 ID *string `json:"id,omitempty"` 18509 // Name - READ-ONLY; Azure resource name 18510 Name *string `json:"name,omitempty"` 18511 // Type - READ-ONLY; Azure resource type 18512 Type *string `json:"type,omitempty"` 18513 // Etag - Etag of the azure resource 18514 Etag *string `json:"etag,omitempty"` 18515 // Kind - Possible values include: 'KindBasicThreatIntelligenceInformationKindThreatIntelligenceInformation', 'KindBasicThreatIntelligenceInformationKindIndicator' 18516 Kind KindBasicThreatIntelligenceInformation `json:"kind,omitempty"` 18517} 18518 18519func unmarshalBasicThreatIntelligenceInformation(body []byte) (BasicThreatIntelligenceInformation, error) { 18520 var m map[string]interface{} 18521 err := json.Unmarshal(body, &m) 18522 if err != nil { 18523 return nil, err 18524 } 18525 18526 switch m["kind"] { 18527 case string(KindBasicThreatIntelligenceInformationKindIndicator): 18528 var tiim ThreatIntelligenceIndicatorModel 18529 err := json.Unmarshal(body, &tiim) 18530 return tiim, err 18531 default: 18532 var tii ThreatIntelligenceInformation 18533 err := json.Unmarshal(body, &tii) 18534 return tii, err 18535 } 18536} 18537func unmarshalBasicThreatIntelligenceInformationArray(body []byte) ([]BasicThreatIntelligenceInformation, error) { 18538 var rawMessages []*json.RawMessage 18539 err := json.Unmarshal(body, &rawMessages) 18540 if err != nil { 18541 return nil, err 18542 } 18543 18544 tiiArray := make([]BasicThreatIntelligenceInformation, len(rawMessages)) 18545 18546 for index, rawMessage := range rawMessages { 18547 tii, err := unmarshalBasicThreatIntelligenceInformation(*rawMessage) 18548 if err != nil { 18549 return nil, err 18550 } 18551 tiiArray[index] = tii 18552 } 18553 return tiiArray, nil 18554} 18555 18556// MarshalJSON is the custom marshaler for ThreatIntelligenceInformation. 18557func (tii ThreatIntelligenceInformation) MarshalJSON() ([]byte, error) { 18558 tii.Kind = KindBasicThreatIntelligenceInformationKindThreatIntelligenceInformation 18559 objectMap := make(map[string]interface{}) 18560 if tii.Etag != nil { 18561 objectMap["etag"] = tii.Etag 18562 } 18563 if tii.Kind != "" { 18564 objectMap["kind"] = tii.Kind 18565 } 18566 return json.Marshal(objectMap) 18567} 18568 18569// AsThreatIntelligenceIndicatorModel is the BasicThreatIntelligenceInformation implementation for ThreatIntelligenceInformation. 18570func (tii ThreatIntelligenceInformation) AsThreatIntelligenceIndicatorModel() (*ThreatIntelligenceIndicatorModel, bool) { 18571 return nil, false 18572} 18573 18574// AsThreatIntelligenceInformation is the BasicThreatIntelligenceInformation implementation for ThreatIntelligenceInformation. 18575func (tii ThreatIntelligenceInformation) AsThreatIntelligenceInformation() (*ThreatIntelligenceInformation, bool) { 18576 return &tii, true 18577} 18578 18579// AsBasicThreatIntelligenceInformation is the BasicThreatIntelligenceInformation implementation for ThreatIntelligenceInformation. 18580func (tii ThreatIntelligenceInformation) AsBasicThreatIntelligenceInformation() (BasicThreatIntelligenceInformation, bool) { 18581 return &tii, true 18582} 18583 18584// ThreatIntelligenceInformationList list of all the threat intelligence information objects. 18585type ThreatIntelligenceInformationList struct { 18586 autorest.Response `json:"-"` 18587 // NextLink - READ-ONLY; URL to fetch the next set of information objects. 18588 NextLink *string `json:"nextLink,omitempty"` 18589 // Value - Array of threat intelligence information objects. 18590 Value *[]BasicThreatIntelligenceInformation `json:"value,omitempty"` 18591} 18592 18593// MarshalJSON is the custom marshaler for ThreatIntelligenceInformationList. 18594func (tiil ThreatIntelligenceInformationList) MarshalJSON() ([]byte, error) { 18595 objectMap := make(map[string]interface{}) 18596 if tiil.Value != nil { 18597 objectMap["value"] = tiil.Value 18598 } 18599 return json.Marshal(objectMap) 18600} 18601 18602// UnmarshalJSON is the custom unmarshaler for ThreatIntelligenceInformationList struct. 18603func (tiil *ThreatIntelligenceInformationList) UnmarshalJSON(body []byte) error { 18604 var m map[string]*json.RawMessage 18605 err := json.Unmarshal(body, &m) 18606 if err != nil { 18607 return err 18608 } 18609 for k, v := range m { 18610 switch k { 18611 case "nextLink": 18612 if v != nil { 18613 var nextLink string 18614 err = json.Unmarshal(*v, &nextLink) 18615 if err != nil { 18616 return err 18617 } 18618 tiil.NextLink = &nextLink 18619 } 18620 case "value": 18621 if v != nil { 18622 value, err := unmarshalBasicThreatIntelligenceInformationArray(*v) 18623 if err != nil { 18624 return err 18625 } 18626 tiil.Value = &value 18627 } 18628 } 18629 } 18630 18631 return nil 18632} 18633 18634// ThreatIntelligenceInformationListIterator provides access to a complete listing of 18635// ThreatIntelligenceInformation values. 18636type ThreatIntelligenceInformationListIterator struct { 18637 i int 18638 page ThreatIntelligenceInformationListPage 18639} 18640 18641// NextWithContext advances to the next value. If there was an error making 18642// the request the iterator does not advance and the error is returned. 18643func (iter *ThreatIntelligenceInformationListIterator) NextWithContext(ctx context.Context) (err error) { 18644 if tracing.IsEnabled() { 18645 ctx = tracing.StartSpan(ctx, fqdn+"/ThreatIntelligenceInformationListIterator.NextWithContext") 18646 defer func() { 18647 sc := -1 18648 if iter.Response().Response.Response != nil { 18649 sc = iter.Response().Response.Response.StatusCode 18650 } 18651 tracing.EndSpan(ctx, sc, err) 18652 }() 18653 } 18654 iter.i++ 18655 if iter.i < len(iter.page.Values()) { 18656 return nil 18657 } 18658 err = iter.page.NextWithContext(ctx) 18659 if err != nil { 18660 iter.i-- 18661 return err 18662 } 18663 iter.i = 0 18664 return nil 18665} 18666 18667// Next advances to the next value. If there was an error making 18668// the request the iterator does not advance and the error is returned. 18669// Deprecated: Use NextWithContext() instead. 18670func (iter *ThreatIntelligenceInformationListIterator) Next() error { 18671 return iter.NextWithContext(context.Background()) 18672} 18673 18674// NotDone returns true if the enumeration should be started or is not yet complete. 18675func (iter ThreatIntelligenceInformationListIterator) NotDone() bool { 18676 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 18677} 18678 18679// Response returns the raw server response from the last page request. 18680func (iter ThreatIntelligenceInformationListIterator) Response() ThreatIntelligenceInformationList { 18681 return iter.page.Response() 18682} 18683 18684// Value returns the current value or a zero-initialized value if the 18685// iterator has advanced beyond the end of the collection. 18686func (iter ThreatIntelligenceInformationListIterator) Value() BasicThreatIntelligenceInformation { 18687 if !iter.page.NotDone() { 18688 return ThreatIntelligenceInformation{} 18689 } 18690 return iter.page.Values()[iter.i] 18691} 18692 18693// Creates a new instance of the ThreatIntelligenceInformationListIterator type. 18694func NewThreatIntelligenceInformationListIterator(page ThreatIntelligenceInformationListPage) ThreatIntelligenceInformationListIterator { 18695 return ThreatIntelligenceInformationListIterator{page: page} 18696} 18697 18698// IsEmpty returns true if the ListResult contains no values. 18699func (tiil ThreatIntelligenceInformationList) IsEmpty() bool { 18700 return tiil.Value == nil || len(*tiil.Value) == 0 18701} 18702 18703// hasNextLink returns true if the NextLink is not empty. 18704func (tiil ThreatIntelligenceInformationList) hasNextLink() bool { 18705 return tiil.NextLink != nil && len(*tiil.NextLink) != 0 18706} 18707 18708// threatIntelligenceInformationListPreparer prepares a request to retrieve the next set of results. 18709// It returns nil if no more results exist. 18710func (tiil ThreatIntelligenceInformationList) threatIntelligenceInformationListPreparer(ctx context.Context) (*http.Request, error) { 18711 if !tiil.hasNextLink() { 18712 return nil, nil 18713 } 18714 return autorest.Prepare((&http.Request{}).WithContext(ctx), 18715 autorest.AsJSON(), 18716 autorest.AsGet(), 18717 autorest.WithBaseURL(to.String(tiil.NextLink))) 18718} 18719 18720// ThreatIntelligenceInformationListPage contains a page of BasicThreatIntelligenceInformation values. 18721type ThreatIntelligenceInformationListPage struct { 18722 fn func(context.Context, ThreatIntelligenceInformationList) (ThreatIntelligenceInformationList, error) 18723 tiil ThreatIntelligenceInformationList 18724} 18725 18726// NextWithContext advances to the next page of values. If there was an error making 18727// the request the page does not advance and the error is returned. 18728func (page *ThreatIntelligenceInformationListPage) NextWithContext(ctx context.Context) (err error) { 18729 if tracing.IsEnabled() { 18730 ctx = tracing.StartSpan(ctx, fqdn+"/ThreatIntelligenceInformationListPage.NextWithContext") 18731 defer func() { 18732 sc := -1 18733 if page.Response().Response.Response != nil { 18734 sc = page.Response().Response.Response.StatusCode 18735 } 18736 tracing.EndSpan(ctx, sc, err) 18737 }() 18738 } 18739 for { 18740 next, err := page.fn(ctx, page.tiil) 18741 if err != nil { 18742 return err 18743 } 18744 page.tiil = next 18745 if !next.hasNextLink() || !next.IsEmpty() { 18746 break 18747 } 18748 } 18749 return nil 18750} 18751 18752// Next advances to the next page of values. If there was an error making 18753// the request the page does not advance and the error is returned. 18754// Deprecated: Use NextWithContext() instead. 18755func (page *ThreatIntelligenceInformationListPage) Next() error { 18756 return page.NextWithContext(context.Background()) 18757} 18758 18759// NotDone returns true if the page enumeration should be started or is not yet complete. 18760func (page ThreatIntelligenceInformationListPage) NotDone() bool { 18761 return !page.tiil.IsEmpty() 18762} 18763 18764// Response returns the raw server response from the last page request. 18765func (page ThreatIntelligenceInformationListPage) Response() ThreatIntelligenceInformationList { 18766 return page.tiil 18767} 18768 18769// Values returns the slice of values for the current page or nil if there are no values. 18770func (page ThreatIntelligenceInformationListPage) Values() []BasicThreatIntelligenceInformation { 18771 if page.tiil.IsEmpty() { 18772 return nil 18773 } 18774 return *page.tiil.Value 18775} 18776 18777// Creates a new instance of the ThreatIntelligenceInformationListPage type. 18778func NewThreatIntelligenceInformationListPage(cur ThreatIntelligenceInformationList, getNextPage func(context.Context, ThreatIntelligenceInformationList) (ThreatIntelligenceInformationList, error)) ThreatIntelligenceInformationListPage { 18779 return ThreatIntelligenceInformationListPage{ 18780 fn: getNextPage, 18781 tiil: cur, 18782 } 18783} 18784 18785// ThreatIntelligenceInformationModel ... 18786type ThreatIntelligenceInformationModel struct { 18787 autorest.Response `json:"-"` 18788 Value BasicThreatIntelligenceInformation `json:"value,omitempty"` 18789} 18790 18791// UnmarshalJSON is the custom unmarshaler for ThreatIntelligenceInformationModel struct. 18792func (tiim *ThreatIntelligenceInformationModel) UnmarshalJSON(body []byte) error { 18793 tii, err := unmarshalBasicThreatIntelligenceInformation(body) 18794 if err != nil { 18795 return err 18796 } 18797 tiim.Value = tii 18798 18799 return nil 18800} 18801 18802// ThreatIntelligenceKillChainPhase describes threat kill chain phase entity 18803type ThreatIntelligenceKillChainPhase struct { 18804 // KillChainName - Kill chainName name 18805 KillChainName *string `json:"killChainName,omitempty"` 18806 // PhaseName - Phase name 18807 PhaseName *string `json:"phaseName,omitempty"` 18808} 18809 18810// ThreatIntelligenceMetric describes threat intelligence metric 18811type ThreatIntelligenceMetric struct { 18812 // LastUpdatedTimeUtc - Last updated indicator metric 18813 LastUpdatedTimeUtc *string `json:"lastUpdatedTimeUtc,omitempty"` 18814 // ThreatTypeMetrics - Threat type metrics 18815 ThreatTypeMetrics *[]ThreatIntelligenceMetricEntity `json:"threatTypeMetrics,omitempty"` 18816 // PatternTypeMetrics - Pattern type metrics 18817 PatternTypeMetrics *[]ThreatIntelligenceMetricEntity `json:"patternTypeMetrics,omitempty"` 18818 // SourceMetrics - Source metrics 18819 SourceMetrics *[]ThreatIntelligenceMetricEntity `json:"sourceMetrics,omitempty"` 18820} 18821 18822// ThreatIntelligenceMetricEntity describes threat intelligence metric entity 18823type ThreatIntelligenceMetricEntity struct { 18824 // MetricName - Metric name 18825 MetricName *string `json:"metricName,omitempty"` 18826 // MetricValue - Metric value 18827 MetricValue *int32 `json:"metricValue,omitempty"` 18828} 18829 18830// ThreatIntelligenceMetrics threat intelligence metrics. 18831type ThreatIntelligenceMetrics struct { 18832 // Properties - Threat intelligence metrics. 18833 Properties *ThreatIntelligenceMetric `json:"properties,omitempty"` 18834} 18835 18836// ThreatIntelligenceMetricsList list of all the threat intelligence metric fields (type/threat 18837// type/source). 18838type ThreatIntelligenceMetricsList struct { 18839 autorest.Response `json:"-"` 18840 // Value - Array of threat intelligence metric fields (type/threat type/source). 18841 Value *[]ThreatIntelligenceMetrics `json:"value,omitempty"` 18842} 18843 18844// ThreatIntelligenceParsedPattern describes parsed pattern entity 18845type ThreatIntelligenceParsedPattern struct { 18846 // PatternTypeKey - Pattern type key 18847 PatternTypeKey *string `json:"patternTypeKey,omitempty"` 18848 // PatternTypeValues - Pattern type keys 18849 PatternTypeValues *[]ThreatIntelligenceParsedPatternTypeValue `json:"patternTypeValues,omitempty"` 18850} 18851 18852// ThreatIntelligenceParsedPatternTypeValue describes threat kill chain phase entity 18853type ThreatIntelligenceParsedPatternTypeValue struct { 18854 // ValueType - Type of the value 18855 ValueType *string `json:"valueType,omitempty"` 18856 // Value - Value of parsed pattern 18857 Value *string `json:"value,omitempty"` 18858} 18859 18860// ThreatIntelligenceResourceKind1 describes an entity with kind. 18861type ThreatIntelligenceResourceKind1 struct { 18862 // Kind - The kind of the entity. 18863 Kind *string `json:"kind,omitempty"` 18864} 18865 18866// ThreatIntelligenceSortingCriteria1 list of available columns for sorting 18867type ThreatIntelligenceSortingCriteria1 struct { 18868 // ItemKey - Column name 18869 ItemKey *string `json:"itemKey,omitempty"` 18870 // SortOrder - Sorting order (ascending/descending/unsorted). Possible values include: 'ThreatIntelligenceSortingCriteriaUnsorted', 'ThreatIntelligenceSortingCriteriaAscending', 'ThreatIntelligenceSortingCriteriaDescending' 18871 SortOrder ThreatIntelligenceSortingCriteria `json:"sortOrder,omitempty"` 18872} 18873 18874// TICheckRequirements threat Intelligence Platforms data connector check requirements 18875type TICheckRequirements struct { 18876 // TICheckRequirementsProperties - Threat Intelligence Platforms data connector check required properties 18877 *TICheckRequirementsProperties `json:"properties,omitempty"` 18878 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 18879 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 18880} 18881 18882// MarshalJSON is the custom marshaler for TICheckRequirements. 18883func (tcr TICheckRequirements) MarshalJSON() ([]byte, error) { 18884 tcr.Kind = KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence 18885 objectMap := make(map[string]interface{}) 18886 if tcr.TICheckRequirementsProperties != nil { 18887 objectMap["properties"] = tcr.TICheckRequirementsProperties 18888 } 18889 if tcr.Kind != "" { 18890 objectMap["kind"] = tcr.Kind 18891 } 18892 return json.Marshal(objectMap) 18893} 18894 18895// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18896func (tcr TICheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 18897 return nil, false 18898} 18899 18900// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18901func (tcr TICheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 18902 return nil, false 18903} 18904 18905// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18906func (tcr TICheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 18907 return nil, false 18908} 18909 18910// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18911func (tcr TICheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 18912 return nil, false 18913} 18914 18915// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18916func (tcr TICheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 18917 return nil, false 18918} 18919 18920// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18921func (tcr TICheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 18922 return nil, false 18923} 18924 18925// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18926func (tcr TICheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 18927 return nil, false 18928} 18929 18930// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18931func (tcr TICheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 18932 return nil, false 18933} 18934 18935// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18936func (tcr TICheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 18937 return nil, false 18938} 18939 18940// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18941func (tcr TICheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 18942 return nil, false 18943} 18944 18945// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18946func (tcr TICheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 18947 return &tcr, true 18948} 18949 18950// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18951func (tcr TICheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 18952 return nil, false 18953} 18954 18955// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18956func (tcr TICheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 18957 return nil, false 18958} 18959 18960// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TICheckRequirements. 18961func (tcr TICheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 18962 return &tcr, true 18963} 18964 18965// UnmarshalJSON is the custom unmarshaler for TICheckRequirements struct. 18966func (tcr *TICheckRequirements) UnmarshalJSON(body []byte) error { 18967 var m map[string]*json.RawMessage 18968 err := json.Unmarshal(body, &m) 18969 if err != nil { 18970 return err 18971 } 18972 for k, v := range m { 18973 switch k { 18974 case "properties": 18975 if v != nil { 18976 var tICheckRequirementsProperties TICheckRequirementsProperties 18977 err = json.Unmarshal(*v, &tICheckRequirementsProperties) 18978 if err != nil { 18979 return err 18980 } 18981 tcr.TICheckRequirementsProperties = &tICheckRequirementsProperties 18982 } 18983 case "kind": 18984 if v != nil { 18985 var kind KindBasicDataConnectorsCheckRequirements 18986 err = json.Unmarshal(*v, &kind) 18987 if err != nil { 18988 return err 18989 } 18990 tcr.Kind = kind 18991 } 18992 } 18993 } 18994 18995 return nil 18996} 18997 18998// TICheckRequirementsProperties threat Intelligence Platforms data connector required properties. 18999type TICheckRequirementsProperties struct { 19000 // TenantID - The tenant id to connect to, and get the data from. 19001 TenantID *string `json:"tenantId,omitempty"` 19002} 19003 19004// TIDataConnector data connector to pull threat intelligence data from TIP products. 19005type TIDataConnector struct { 19006 // TIDataConnectorProperties - Threat Intelligence Platforms data connector properties. 19007 *TIDataConnectorProperties `json:"properties,omitempty"` 19008 // ID - READ-ONLY; Azure resource Id 19009 ID *string `json:"id,omitempty"` 19010 // Name - READ-ONLY; Azure resource name 19011 Name *string `json:"name,omitempty"` 19012 // Type - READ-ONLY; Azure resource type 19013 Type *string `json:"type,omitempty"` 19014 // Etag - Etag of the azure resource 19015 Etag *string `json:"etag,omitempty"` 19016 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 19017 Kind KindBasicDataConnector `json:"kind,omitempty"` 19018} 19019 19020// MarshalJSON is the custom marshaler for TIDataConnector. 19021func (tdc TIDataConnector) MarshalJSON() ([]byte, error) { 19022 tdc.Kind = KindBasicDataConnectorKindThreatIntelligence 19023 objectMap := make(map[string]interface{}) 19024 if tdc.TIDataConnectorProperties != nil { 19025 objectMap["properties"] = tdc.TIDataConnectorProperties 19026 } 19027 if tdc.Etag != nil { 19028 objectMap["etag"] = tdc.Etag 19029 } 19030 if tdc.Kind != "" { 19031 objectMap["kind"] = tdc.Kind 19032 } 19033 return json.Marshal(objectMap) 19034} 19035 19036// AsAADDataConnector is the BasicDataConnector implementation for TIDataConnector. 19037func (tdc TIDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 19038 return nil, false 19039} 19040 19041// AsAATPDataConnector is the BasicDataConnector implementation for TIDataConnector. 19042func (tdc TIDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 19043 return nil, false 19044} 19045 19046// AsMSTIDataConnector is the BasicDataConnector implementation for TIDataConnector. 19047func (tdc TIDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 19048 return nil, false 19049} 19050 19051// AsMTPDataConnector is the BasicDataConnector implementation for TIDataConnector. 19052func (tdc TIDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 19053 return nil, false 19054} 19055 19056// AsASCDataConnector is the BasicDataConnector implementation for TIDataConnector. 19057func (tdc TIDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 19058 return nil, false 19059} 19060 19061// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for TIDataConnector. 19062func (tdc TIDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 19063 return nil, false 19064} 19065 19066// AsDynamics365DataConnector is the BasicDataConnector implementation for TIDataConnector. 19067func (tdc TIDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 19068 return nil, false 19069} 19070 19071// AsMCASDataConnector is the BasicDataConnector implementation for TIDataConnector. 19072func (tdc TIDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 19073 return nil, false 19074} 19075 19076// AsMDATPDataConnector is the BasicDataConnector implementation for TIDataConnector. 19077func (tdc TIDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 19078 return nil, false 19079} 19080 19081// AsOfficeATPDataConnector is the BasicDataConnector implementation for TIDataConnector. 19082func (tdc TIDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 19083 return nil, false 19084} 19085 19086// AsOfficeDataConnector is the BasicDataConnector implementation for TIDataConnector. 19087func (tdc TIDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 19088 return nil, false 19089} 19090 19091// AsTIDataConnector is the BasicDataConnector implementation for TIDataConnector. 19092func (tdc TIDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 19093 return &tdc, true 19094} 19095 19096// AsTiTaxiiDataConnector is the BasicDataConnector implementation for TIDataConnector. 19097func (tdc TIDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 19098 return nil, false 19099} 19100 19101// AsDataConnector is the BasicDataConnector implementation for TIDataConnector. 19102func (tdc TIDataConnector) AsDataConnector() (*DataConnector, bool) { 19103 return nil, false 19104} 19105 19106// AsBasicDataConnector is the BasicDataConnector implementation for TIDataConnector. 19107func (tdc TIDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 19108 return &tdc, true 19109} 19110 19111// UnmarshalJSON is the custom unmarshaler for TIDataConnector struct. 19112func (tdc *TIDataConnector) UnmarshalJSON(body []byte) error { 19113 var m map[string]*json.RawMessage 19114 err := json.Unmarshal(body, &m) 19115 if err != nil { 19116 return err 19117 } 19118 for k, v := range m { 19119 switch k { 19120 case "properties": 19121 if v != nil { 19122 var tIDataConnectorProperties TIDataConnectorProperties 19123 err = json.Unmarshal(*v, &tIDataConnectorProperties) 19124 if err != nil { 19125 return err 19126 } 19127 tdc.TIDataConnectorProperties = &tIDataConnectorProperties 19128 } 19129 case "id": 19130 if v != nil { 19131 var ID string 19132 err = json.Unmarshal(*v, &ID) 19133 if err != nil { 19134 return err 19135 } 19136 tdc.ID = &ID 19137 } 19138 case "name": 19139 if v != nil { 19140 var name string 19141 err = json.Unmarshal(*v, &name) 19142 if err != nil { 19143 return err 19144 } 19145 tdc.Name = &name 19146 } 19147 case "type": 19148 if v != nil { 19149 var typeVar string 19150 err = json.Unmarshal(*v, &typeVar) 19151 if err != nil { 19152 return err 19153 } 19154 tdc.Type = &typeVar 19155 } 19156 case "etag": 19157 if v != nil { 19158 var etag string 19159 err = json.Unmarshal(*v, &etag) 19160 if err != nil { 19161 return err 19162 } 19163 tdc.Etag = &etag 19164 } 19165 case "kind": 19166 if v != nil { 19167 var kind KindBasicDataConnector 19168 err = json.Unmarshal(*v, &kind) 19169 if err != nil { 19170 return err 19171 } 19172 tdc.Kind = kind 19173 } 19174 } 19175 } 19176 19177 return nil 19178} 19179 19180// TIDataConnectorDataTypes the available data types for Threat Intelligence Platforms data connector. 19181type TIDataConnectorDataTypes struct { 19182 // Indicators - Data type for Threat Intelligence Platforms data connector. 19183 Indicators *TIDataConnectorDataTypesIndicators `json:"indicators,omitempty"` 19184} 19185 19186// TIDataConnectorDataTypesIndicators data type for Threat Intelligence Platforms data connector. 19187type TIDataConnectorDataTypesIndicators struct { 19188 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 19189 State DataTypeState `json:"state,omitempty"` 19190} 19191 19192// TIDataConnectorProperties TI (Threat Intelligence) data connector properties. 19193type TIDataConnectorProperties struct { 19194 // TenantID - The tenant id to connect to, and get the data from. 19195 TenantID *string `json:"tenantId,omitempty"` 19196 // TipLookbackPeriod - The lookback period for the feed to be imported. 19197 TipLookbackPeriod *date.Time `json:"tipLookbackPeriod,omitempty"` 19198 // DataTypes - The available data types for the connector. 19199 DataTypes *TIDataConnectorDataTypes `json:"dataTypes,omitempty"` 19200} 19201 19202// TimelineAggregation timeline aggregation information per kind 19203type TimelineAggregation struct { 19204 // Count - the total items found for a kind 19205 Count *int32 `json:"count,omitempty"` 19206 // Kind - the query kind. Possible values include: 'EntityTimelineKindActivity', 'EntityTimelineKindBookmark', 'EntityTimelineKindSecurityAlert' 19207 Kind EntityTimelineKind `json:"kind,omitempty"` 19208} 19209 19210// TimelineError timeline Query Errors. 19211type TimelineError struct { 19212 // Kind - the query kind. Possible values include: 'EntityTimelineKindActivity', 'EntityTimelineKindBookmark', 'EntityTimelineKindSecurityAlert' 19213 Kind EntityTimelineKind `json:"kind,omitempty"` 19214 // QueryID - the query id 19215 QueryID *string `json:"queryId,omitempty"` 19216 // ErrorMessage - the error message 19217 ErrorMessage *string `json:"errorMessage,omitempty"` 19218} 19219 19220// TimelineResultsMetadata expansion result metadata. 19221type TimelineResultsMetadata struct { 19222 // TotalCount - the total items found for the timeline request 19223 TotalCount *int32 `json:"totalCount,omitempty"` 19224 // Aggregations - timeline aggregation per kind 19225 Aggregations *[]TimelineAggregation `json:"aggregations,omitempty"` 19226 // Errors - information about the failure queries 19227 Errors *[]TimelineError `json:"errors,omitempty"` 19228} 19229 19230// TiTaxiiCheckRequirements threat Intelligence TAXII data connector check requirements 19231type TiTaxiiCheckRequirements struct { 19232 // TiTaxiiCheckRequirementsProperties - Threat Intelligence TAXII check required properties. 19233 *TiTaxiiCheckRequirementsProperties `json:"properties,omitempty"` 19234 // Kind - Possible values include: 'KindBasicDataConnectorsCheckRequirementsKindDataConnectorsCheckRequirements', 'KindBasicDataConnectorsCheckRequirementsKindAzureActiveDirectory', 'KindBasicDataConnectorsCheckRequirementsKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindAzureSecurityCenter', 'KindBasicDataConnectorsCheckRequirementsKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorsCheckRequirementsKindDynamics365', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorsCheckRequirementsKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorsCheckRequirementsKindOfficeATP', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligence', 'KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii' 19235 Kind KindBasicDataConnectorsCheckRequirements `json:"kind,omitempty"` 19236} 19237 19238// MarshalJSON is the custom marshaler for TiTaxiiCheckRequirements. 19239func (ttcr TiTaxiiCheckRequirements) MarshalJSON() ([]byte, error) { 19240 ttcr.Kind = KindBasicDataConnectorsCheckRequirementsKindThreatIntelligenceTaxii 19241 objectMap := make(map[string]interface{}) 19242 if ttcr.TiTaxiiCheckRequirementsProperties != nil { 19243 objectMap["properties"] = ttcr.TiTaxiiCheckRequirementsProperties 19244 } 19245 if ttcr.Kind != "" { 19246 objectMap["kind"] = ttcr.Kind 19247 } 19248 return json.Marshal(objectMap) 19249} 19250 19251// AsAADCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19252func (ttcr TiTaxiiCheckRequirements) AsAADCheckRequirements() (*AADCheckRequirements, bool) { 19253 return nil, false 19254} 19255 19256// AsAATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19257func (ttcr TiTaxiiCheckRequirements) AsAATPCheckRequirements() (*AATPCheckRequirements, bool) { 19258 return nil, false 19259} 19260 19261// AsMSTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19262func (ttcr TiTaxiiCheckRequirements) AsMSTICheckRequirements() (*MSTICheckRequirements, bool) { 19263 return nil, false 19264} 19265 19266// AsMtpCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19267func (ttcr TiTaxiiCheckRequirements) AsMtpCheckRequirements() (*MtpCheckRequirements, bool) { 19268 return nil, false 19269} 19270 19271// AsASCCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19272func (ttcr TiTaxiiCheckRequirements) AsASCCheckRequirements() (*ASCCheckRequirements, bool) { 19273 return nil, false 19274} 19275 19276// AsAwsCloudTrailCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19277func (ttcr TiTaxiiCheckRequirements) AsAwsCloudTrailCheckRequirements() (*AwsCloudTrailCheckRequirements, bool) { 19278 return nil, false 19279} 19280 19281// AsDynamics365CheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19282func (ttcr TiTaxiiCheckRequirements) AsDynamics365CheckRequirements() (*Dynamics365CheckRequirements, bool) { 19283 return nil, false 19284} 19285 19286// AsMCASCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19287func (ttcr TiTaxiiCheckRequirements) AsMCASCheckRequirements() (*MCASCheckRequirements, bool) { 19288 return nil, false 19289} 19290 19291// AsMDATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19292func (ttcr TiTaxiiCheckRequirements) AsMDATPCheckRequirements() (*MDATPCheckRequirements, bool) { 19293 return nil, false 19294} 19295 19296// AsOfficeATPCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19297func (ttcr TiTaxiiCheckRequirements) AsOfficeATPCheckRequirements() (*OfficeATPCheckRequirements, bool) { 19298 return nil, false 19299} 19300 19301// AsTICheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19302func (ttcr TiTaxiiCheckRequirements) AsTICheckRequirements() (*TICheckRequirements, bool) { 19303 return nil, false 19304} 19305 19306// AsTiTaxiiCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19307func (ttcr TiTaxiiCheckRequirements) AsTiTaxiiCheckRequirements() (*TiTaxiiCheckRequirements, bool) { 19308 return &ttcr, true 19309} 19310 19311// AsDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19312func (ttcr TiTaxiiCheckRequirements) AsDataConnectorsCheckRequirements() (*DataConnectorsCheckRequirements, bool) { 19313 return nil, false 19314} 19315 19316// AsBasicDataConnectorsCheckRequirements is the BasicDataConnectorsCheckRequirements implementation for TiTaxiiCheckRequirements. 19317func (ttcr TiTaxiiCheckRequirements) AsBasicDataConnectorsCheckRequirements() (BasicDataConnectorsCheckRequirements, bool) { 19318 return &ttcr, true 19319} 19320 19321// UnmarshalJSON is the custom unmarshaler for TiTaxiiCheckRequirements struct. 19322func (ttcr *TiTaxiiCheckRequirements) UnmarshalJSON(body []byte) error { 19323 var m map[string]*json.RawMessage 19324 err := json.Unmarshal(body, &m) 19325 if err != nil { 19326 return err 19327 } 19328 for k, v := range m { 19329 switch k { 19330 case "properties": 19331 if v != nil { 19332 var tiTaxiiCheckRequirementsProperties TiTaxiiCheckRequirementsProperties 19333 err = json.Unmarshal(*v, &tiTaxiiCheckRequirementsProperties) 19334 if err != nil { 19335 return err 19336 } 19337 ttcr.TiTaxiiCheckRequirementsProperties = &tiTaxiiCheckRequirementsProperties 19338 } 19339 case "kind": 19340 if v != nil { 19341 var kind KindBasicDataConnectorsCheckRequirements 19342 err = json.Unmarshal(*v, &kind) 19343 if err != nil { 19344 return err 19345 } 19346 ttcr.Kind = kind 19347 } 19348 } 19349 } 19350 19351 return nil 19352} 19353 19354// TiTaxiiCheckRequirementsProperties threat Intelligence TAXII data connector required properties. 19355type TiTaxiiCheckRequirementsProperties struct { 19356 // TenantID - The tenant id to connect to, and get the data from. 19357 TenantID *string `json:"tenantId,omitempty"` 19358} 19359 19360// TiTaxiiDataConnector data connector to pull Threat intelligence data from TAXII 2.0/2.1 server 19361type TiTaxiiDataConnector struct { 19362 // TiTaxiiDataConnectorProperties - Threat intelligence TAXII data connector properties. 19363 *TiTaxiiDataConnectorProperties `json:"properties,omitempty"` 19364 // ID - READ-ONLY; Azure resource Id 19365 ID *string `json:"id,omitempty"` 19366 // Name - READ-ONLY; Azure resource name 19367 Name *string `json:"name,omitempty"` 19368 // Type - READ-ONLY; Azure resource type 19369 Type *string `json:"type,omitempty"` 19370 // Etag - Etag of the azure resource 19371 Etag *string `json:"etag,omitempty"` 19372 // Kind - Possible values include: 'KindBasicDataConnectorKindDataConnector', 'KindBasicDataConnectorKindAzureActiveDirectory', 'KindBasicDataConnectorKindAzureAdvancedThreatProtection', 'KindBasicDataConnectorKindMicrosoftThreatIntelligence', 'KindBasicDataConnectorKindMicrosoftThreatProtection', 'KindBasicDataConnectorKindAzureSecurityCenter', 'KindBasicDataConnectorKindAmazonWebServicesCloudTrail', 'KindBasicDataConnectorKindDynamics365', 'KindBasicDataConnectorKindMicrosoftCloudAppSecurity', 'KindBasicDataConnectorKindMicrosoftDefenderAdvancedThreatProtection', 'KindBasicDataConnectorKindOfficeATP', 'KindBasicDataConnectorKindOffice365', 'KindBasicDataConnectorKindThreatIntelligence', 'KindBasicDataConnectorKindThreatIntelligenceTaxii' 19373 Kind KindBasicDataConnector `json:"kind,omitempty"` 19374} 19375 19376// MarshalJSON is the custom marshaler for TiTaxiiDataConnector. 19377func (ttdc TiTaxiiDataConnector) MarshalJSON() ([]byte, error) { 19378 ttdc.Kind = KindBasicDataConnectorKindThreatIntelligenceTaxii 19379 objectMap := make(map[string]interface{}) 19380 if ttdc.TiTaxiiDataConnectorProperties != nil { 19381 objectMap["properties"] = ttdc.TiTaxiiDataConnectorProperties 19382 } 19383 if ttdc.Etag != nil { 19384 objectMap["etag"] = ttdc.Etag 19385 } 19386 if ttdc.Kind != "" { 19387 objectMap["kind"] = ttdc.Kind 19388 } 19389 return json.Marshal(objectMap) 19390} 19391 19392// AsAADDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19393func (ttdc TiTaxiiDataConnector) AsAADDataConnector() (*AADDataConnector, bool) { 19394 return nil, false 19395} 19396 19397// AsAATPDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19398func (ttdc TiTaxiiDataConnector) AsAATPDataConnector() (*AATPDataConnector, bool) { 19399 return nil, false 19400} 19401 19402// AsMSTIDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19403func (ttdc TiTaxiiDataConnector) AsMSTIDataConnector() (*MSTIDataConnector, bool) { 19404 return nil, false 19405} 19406 19407// AsMTPDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19408func (ttdc TiTaxiiDataConnector) AsMTPDataConnector() (*MTPDataConnector, bool) { 19409 return nil, false 19410} 19411 19412// AsASCDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19413func (ttdc TiTaxiiDataConnector) AsASCDataConnector() (*ASCDataConnector, bool) { 19414 return nil, false 19415} 19416 19417// AsAwsCloudTrailDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19418func (ttdc TiTaxiiDataConnector) AsAwsCloudTrailDataConnector() (*AwsCloudTrailDataConnector, bool) { 19419 return nil, false 19420} 19421 19422// AsDynamics365DataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19423func (ttdc TiTaxiiDataConnector) AsDynamics365DataConnector() (*Dynamics365DataConnector, bool) { 19424 return nil, false 19425} 19426 19427// AsMCASDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19428func (ttdc TiTaxiiDataConnector) AsMCASDataConnector() (*MCASDataConnector, bool) { 19429 return nil, false 19430} 19431 19432// AsMDATPDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19433func (ttdc TiTaxiiDataConnector) AsMDATPDataConnector() (*MDATPDataConnector, bool) { 19434 return nil, false 19435} 19436 19437// AsOfficeATPDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19438func (ttdc TiTaxiiDataConnector) AsOfficeATPDataConnector() (*OfficeATPDataConnector, bool) { 19439 return nil, false 19440} 19441 19442// AsOfficeDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19443func (ttdc TiTaxiiDataConnector) AsOfficeDataConnector() (*OfficeDataConnector, bool) { 19444 return nil, false 19445} 19446 19447// AsTIDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19448func (ttdc TiTaxiiDataConnector) AsTIDataConnector() (*TIDataConnector, bool) { 19449 return nil, false 19450} 19451 19452// AsTiTaxiiDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19453func (ttdc TiTaxiiDataConnector) AsTiTaxiiDataConnector() (*TiTaxiiDataConnector, bool) { 19454 return &ttdc, true 19455} 19456 19457// AsDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19458func (ttdc TiTaxiiDataConnector) AsDataConnector() (*DataConnector, bool) { 19459 return nil, false 19460} 19461 19462// AsBasicDataConnector is the BasicDataConnector implementation for TiTaxiiDataConnector. 19463func (ttdc TiTaxiiDataConnector) AsBasicDataConnector() (BasicDataConnector, bool) { 19464 return &ttdc, true 19465} 19466 19467// UnmarshalJSON is the custom unmarshaler for TiTaxiiDataConnector struct. 19468func (ttdc *TiTaxiiDataConnector) UnmarshalJSON(body []byte) error { 19469 var m map[string]*json.RawMessage 19470 err := json.Unmarshal(body, &m) 19471 if err != nil { 19472 return err 19473 } 19474 for k, v := range m { 19475 switch k { 19476 case "properties": 19477 if v != nil { 19478 var tiTaxiiDataConnectorProperties TiTaxiiDataConnectorProperties 19479 err = json.Unmarshal(*v, &tiTaxiiDataConnectorProperties) 19480 if err != nil { 19481 return err 19482 } 19483 ttdc.TiTaxiiDataConnectorProperties = &tiTaxiiDataConnectorProperties 19484 } 19485 case "id": 19486 if v != nil { 19487 var ID string 19488 err = json.Unmarshal(*v, &ID) 19489 if err != nil { 19490 return err 19491 } 19492 ttdc.ID = &ID 19493 } 19494 case "name": 19495 if v != nil { 19496 var name string 19497 err = json.Unmarshal(*v, &name) 19498 if err != nil { 19499 return err 19500 } 19501 ttdc.Name = &name 19502 } 19503 case "type": 19504 if v != nil { 19505 var typeVar string 19506 err = json.Unmarshal(*v, &typeVar) 19507 if err != nil { 19508 return err 19509 } 19510 ttdc.Type = &typeVar 19511 } 19512 case "etag": 19513 if v != nil { 19514 var etag string 19515 err = json.Unmarshal(*v, &etag) 19516 if err != nil { 19517 return err 19518 } 19519 ttdc.Etag = &etag 19520 } 19521 case "kind": 19522 if v != nil { 19523 var kind KindBasicDataConnector 19524 err = json.Unmarshal(*v, &kind) 19525 if err != nil { 19526 return err 19527 } 19528 ttdc.Kind = kind 19529 } 19530 } 19531 } 19532 19533 return nil 19534} 19535 19536// TiTaxiiDataConnectorDataTypes the available data types for Threat Intelligence TAXII data connector. 19537type TiTaxiiDataConnectorDataTypes struct { 19538 // TaxiiClient - Data type for TAXII connector. 19539 TaxiiClient *TiTaxiiDataConnectorDataTypesTaxiiClient `json:"taxiiClient,omitempty"` 19540} 19541 19542// TiTaxiiDataConnectorDataTypesTaxiiClient data type for TAXII connector. 19543type TiTaxiiDataConnectorDataTypesTaxiiClient struct { 19544 // State - Describe whether this data type connection is enabled or not. Possible values include: 'DataTypeStateEnabled', 'DataTypeStateDisabled' 19545 State DataTypeState `json:"state,omitempty"` 19546} 19547 19548// TiTaxiiDataConnectorProperties threat Intelligence TAXII data connector properties. 19549type TiTaxiiDataConnectorProperties struct { 19550 // WorkspaceID - The workspace id. 19551 WorkspaceID *string `json:"workspaceId,omitempty"` 19552 // FriendlyName - The friendly name for the TAXII server. 19553 FriendlyName *string `json:"friendlyName,omitempty"` 19554 // TaxiiServer - The API root for the TAXII server. 19555 TaxiiServer *string `json:"taxiiServer,omitempty"` 19556 // CollectionID - The collection id of the TAXII server. 19557 CollectionID *string `json:"collectionId,omitempty"` 19558 // UserName - The userName for the TAXII server. 19559 UserName *string `json:"userName,omitempty"` 19560 // Password - The password for the TAXII server. 19561 Password *string `json:"password,omitempty"` 19562 // TaxiiLookbackPeriod - The lookback period for the TAXII server. 19563 TaxiiLookbackPeriod *date.Time `json:"taxiiLookbackPeriod,omitempty"` 19564 // PollingFrequency - The polling frequency for the TAXII server. Possible values include: 'PollingFrequencyOnceAMinute', 'PollingFrequencyOnceAnHour', 'PollingFrequencyOnceADay' 19565 PollingFrequency PollingFrequency `json:"pollingFrequency,omitempty"` 19566 // DataTypes - The available data types for Threat Intelligence TAXII data connector. 19567 DataTypes *TiTaxiiDataConnectorDataTypes `json:"dataTypes,omitempty"` 19568 // TenantID - The tenant id to connect to, and get the data from. 19569 TenantID *string `json:"tenantId,omitempty"` 19570} 19571 19572// Ueba settings with single toggle. 19573type Ueba struct { 19574 // UebaProperties - Ueba properties 19575 *UebaProperties `json:"properties,omitempty"` 19576 // ID - READ-ONLY; Azure resource Id 19577 ID *string `json:"id,omitempty"` 19578 // Name - READ-ONLY; Azure resource name 19579 Name *string `json:"name,omitempty"` 19580 // Type - READ-ONLY; Azure resource type 19581 Type *string `json:"type,omitempty"` 19582 // Etag - Etag of the azure resource 19583 Etag *string `json:"etag,omitempty"` 19584 // Kind - Possible values include: 'KindBasicSettingsKindSettings', 'KindBasicSettingsKindIPSyncer', 'KindBasicSettingsKindEyesOn', 'KindBasicSettingsKindEntityAnalytics', 'KindBasicSettingsKindUeba' 19585 Kind KindBasicSettings `json:"kind,omitempty"` 19586} 19587 19588// MarshalJSON is the custom marshaler for Ueba. 19589func (u Ueba) MarshalJSON() ([]byte, error) { 19590 u.Kind = KindBasicSettingsKindUeba 19591 objectMap := make(map[string]interface{}) 19592 if u.UebaProperties != nil { 19593 objectMap["properties"] = u.UebaProperties 19594 } 19595 if u.Etag != nil { 19596 objectMap["etag"] = u.Etag 19597 } 19598 if u.Kind != "" { 19599 objectMap["kind"] = u.Kind 19600 } 19601 return json.Marshal(objectMap) 19602} 19603 19604// AsIPSyncer is the BasicSettings implementation for Ueba. 19605func (u Ueba) AsIPSyncer() (*IPSyncer, bool) { 19606 return nil, false 19607} 19608 19609// AsEyesOn is the BasicSettings implementation for Ueba. 19610func (u Ueba) AsEyesOn() (*EyesOn, bool) { 19611 return nil, false 19612} 19613 19614// AsEntityAnalytics is the BasicSettings implementation for Ueba. 19615func (u Ueba) AsEntityAnalytics() (*EntityAnalytics, bool) { 19616 return nil, false 19617} 19618 19619// AsUeba is the BasicSettings implementation for Ueba. 19620func (u Ueba) AsUeba() (*Ueba, bool) { 19621 return &u, true 19622} 19623 19624// AsSettings is the BasicSettings implementation for Ueba. 19625func (u Ueba) AsSettings() (*Settings, bool) { 19626 return nil, false 19627} 19628 19629// AsBasicSettings is the BasicSettings implementation for Ueba. 19630func (u Ueba) AsBasicSettings() (BasicSettings, bool) { 19631 return &u, true 19632} 19633 19634// UnmarshalJSON is the custom unmarshaler for Ueba struct. 19635func (u *Ueba) UnmarshalJSON(body []byte) error { 19636 var m map[string]*json.RawMessage 19637 err := json.Unmarshal(body, &m) 19638 if err != nil { 19639 return err 19640 } 19641 for k, v := range m { 19642 switch k { 19643 case "properties": 19644 if v != nil { 19645 var uebaProperties UebaProperties 19646 err = json.Unmarshal(*v, &uebaProperties) 19647 if err != nil { 19648 return err 19649 } 19650 u.UebaProperties = &uebaProperties 19651 } 19652 case "id": 19653 if v != nil { 19654 var ID string 19655 err = json.Unmarshal(*v, &ID) 19656 if err != nil { 19657 return err 19658 } 19659 u.ID = &ID 19660 } 19661 case "name": 19662 if v != nil { 19663 var name string 19664 err = json.Unmarshal(*v, &name) 19665 if err != nil { 19666 return err 19667 } 19668 u.Name = &name 19669 } 19670 case "type": 19671 if v != nil { 19672 var typeVar string 19673 err = json.Unmarshal(*v, &typeVar) 19674 if err != nil { 19675 return err 19676 } 19677 u.Type = &typeVar 19678 } 19679 case "etag": 19680 if v != nil { 19681 var etag string 19682 err = json.Unmarshal(*v, &etag) 19683 if err != nil { 19684 return err 19685 } 19686 u.Etag = &etag 19687 } 19688 case "kind": 19689 if v != nil { 19690 var kind KindBasicSettings 19691 err = json.Unmarshal(*v, &kind) 19692 if err != nil { 19693 return err 19694 } 19695 u.Kind = kind 19696 } 19697 } 19698 } 19699 19700 return nil 19701} 19702 19703// UebaProperties ueba property bag. 19704type UebaProperties struct { 19705 // DataSources - The relevant data sources that enriched by ueba 19706 DataSources *[]UebaDataSources `json:"dataSources,omitempty"` 19707} 19708 19709// URLEntity represents a url entity. 19710type URLEntity struct { 19711 // URLEntityProperties - Url entity properties 19712 *URLEntityProperties `json:"properties,omitempty"` 19713 // ID - READ-ONLY; Azure resource Id 19714 ID *string `json:"id,omitempty"` 19715 // Name - READ-ONLY; Azure resource name 19716 Name *string `json:"name,omitempty"` 19717 // Type - READ-ONLY; Azure resource type 19718 Type *string `json:"type,omitempty"` 19719 // Kind - Possible values include: 'KindBasicEntityKindEntity', 'KindBasicEntityKindAccount', 'KindBasicEntityKindAzureResource', 'KindBasicEntityKindCloudApplication', 'KindBasicEntityKindDNSResolution', 'KindBasicEntityKindFile', 'KindBasicEntityKindFileHash', 'KindBasicEntityKindHost', 'KindBasicEntityKindBookmark', 'KindBasicEntityKindSecurityAlert', 'KindBasicEntityKindIP', 'KindBasicEntityKindMailbox', 'KindBasicEntityKindMailCluster', 'KindBasicEntityKindMailMessage', 'KindBasicEntityKindSubmissionMail', 'KindBasicEntityKindMalware', 'KindBasicEntityKindProcess', 'KindBasicEntityKindRegistryKey', 'KindBasicEntityKindRegistryValue', 'KindBasicEntityKindSecurityGroup', 'KindBasicEntityKindURL', 'KindBasicEntityKindIoTDevice' 19720 Kind KindBasicEntity `json:"kind,omitempty"` 19721} 19722 19723// MarshalJSON is the custom marshaler for URLEntity. 19724func (ue URLEntity) MarshalJSON() ([]byte, error) { 19725 ue.Kind = KindBasicEntityKindURL 19726 objectMap := make(map[string]interface{}) 19727 if ue.URLEntityProperties != nil { 19728 objectMap["properties"] = ue.URLEntityProperties 19729 } 19730 if ue.Kind != "" { 19731 objectMap["kind"] = ue.Kind 19732 } 19733 return json.Marshal(objectMap) 19734} 19735 19736// AsAccountEntity is the BasicEntity implementation for URLEntity. 19737func (ue URLEntity) AsAccountEntity() (*AccountEntity, bool) { 19738 return nil, false 19739} 19740 19741// AsAzureResourceEntity is the BasicEntity implementation for URLEntity. 19742func (ue URLEntity) AsAzureResourceEntity() (*AzureResourceEntity, bool) { 19743 return nil, false 19744} 19745 19746// AsCloudApplicationEntity is the BasicEntity implementation for URLEntity. 19747func (ue URLEntity) AsCloudApplicationEntity() (*CloudApplicationEntity, bool) { 19748 return nil, false 19749} 19750 19751// AsDNSEntity is the BasicEntity implementation for URLEntity. 19752func (ue URLEntity) AsDNSEntity() (*DNSEntity, bool) { 19753 return nil, false 19754} 19755 19756// AsFileEntity is the BasicEntity implementation for URLEntity. 19757func (ue URLEntity) AsFileEntity() (*FileEntity, bool) { 19758 return nil, false 19759} 19760 19761// AsFileHashEntity is the BasicEntity implementation for URLEntity. 19762func (ue URLEntity) AsFileHashEntity() (*FileHashEntity, bool) { 19763 return nil, false 19764} 19765 19766// AsHostEntity is the BasicEntity implementation for URLEntity. 19767func (ue URLEntity) AsHostEntity() (*HostEntity, bool) { 19768 return nil, false 19769} 19770 19771// AsHuntingBookmark is the BasicEntity implementation for URLEntity. 19772func (ue URLEntity) AsHuntingBookmark() (*HuntingBookmark, bool) { 19773 return nil, false 19774} 19775 19776// AsSecurityAlert is the BasicEntity implementation for URLEntity. 19777func (ue URLEntity) AsSecurityAlert() (*SecurityAlert, bool) { 19778 return nil, false 19779} 19780 19781// AsIPEntity is the BasicEntity implementation for URLEntity. 19782func (ue URLEntity) AsIPEntity() (*IPEntity, bool) { 19783 return nil, false 19784} 19785 19786// AsMailboxEntity is the BasicEntity implementation for URLEntity. 19787func (ue URLEntity) AsMailboxEntity() (*MailboxEntity, bool) { 19788 return nil, false 19789} 19790 19791// AsMailClusterEntity is the BasicEntity implementation for URLEntity. 19792func (ue URLEntity) AsMailClusterEntity() (*MailClusterEntity, bool) { 19793 return nil, false 19794} 19795 19796// AsMailMessageEntity is the BasicEntity implementation for URLEntity. 19797func (ue URLEntity) AsMailMessageEntity() (*MailMessageEntity, bool) { 19798 return nil, false 19799} 19800 19801// AsSubmissionMailEntity is the BasicEntity implementation for URLEntity. 19802func (ue URLEntity) AsSubmissionMailEntity() (*SubmissionMailEntity, bool) { 19803 return nil, false 19804} 19805 19806// AsMalwareEntity is the BasicEntity implementation for URLEntity. 19807func (ue URLEntity) AsMalwareEntity() (*MalwareEntity, bool) { 19808 return nil, false 19809} 19810 19811// AsProcessEntity is the BasicEntity implementation for URLEntity. 19812func (ue URLEntity) AsProcessEntity() (*ProcessEntity, bool) { 19813 return nil, false 19814} 19815 19816// AsRegistryKeyEntity is the BasicEntity implementation for URLEntity. 19817func (ue URLEntity) AsRegistryKeyEntity() (*RegistryKeyEntity, bool) { 19818 return nil, false 19819} 19820 19821// AsRegistryValueEntity is the BasicEntity implementation for URLEntity. 19822func (ue URLEntity) AsRegistryValueEntity() (*RegistryValueEntity, bool) { 19823 return nil, false 19824} 19825 19826// AsSecurityGroupEntity is the BasicEntity implementation for URLEntity. 19827func (ue URLEntity) AsSecurityGroupEntity() (*SecurityGroupEntity, bool) { 19828 return nil, false 19829} 19830 19831// AsURLEntity is the BasicEntity implementation for URLEntity. 19832func (ue URLEntity) AsURLEntity() (*URLEntity, bool) { 19833 return &ue, true 19834} 19835 19836// AsIoTDeviceEntity is the BasicEntity implementation for URLEntity. 19837func (ue URLEntity) AsIoTDeviceEntity() (*IoTDeviceEntity, bool) { 19838 return nil, false 19839} 19840 19841// AsEntity is the BasicEntity implementation for URLEntity. 19842func (ue URLEntity) AsEntity() (*Entity, bool) { 19843 return nil, false 19844} 19845 19846// AsBasicEntity is the BasicEntity implementation for URLEntity. 19847func (ue URLEntity) AsBasicEntity() (BasicEntity, bool) { 19848 return &ue, true 19849} 19850 19851// UnmarshalJSON is the custom unmarshaler for URLEntity struct. 19852func (ue *URLEntity) UnmarshalJSON(body []byte) error { 19853 var m map[string]*json.RawMessage 19854 err := json.Unmarshal(body, &m) 19855 if err != nil { 19856 return err 19857 } 19858 for k, v := range m { 19859 switch k { 19860 case "properties": 19861 if v != nil { 19862 var URLEntityProperties URLEntityProperties 19863 err = json.Unmarshal(*v, &URLEntityProperties) 19864 if err != nil { 19865 return err 19866 } 19867 ue.URLEntityProperties = &URLEntityProperties 19868 } 19869 case "id": 19870 if v != nil { 19871 var ID string 19872 err = json.Unmarshal(*v, &ID) 19873 if err != nil { 19874 return err 19875 } 19876 ue.ID = &ID 19877 } 19878 case "name": 19879 if v != nil { 19880 var name string 19881 err = json.Unmarshal(*v, &name) 19882 if err != nil { 19883 return err 19884 } 19885 ue.Name = &name 19886 } 19887 case "type": 19888 if v != nil { 19889 var typeVar string 19890 err = json.Unmarshal(*v, &typeVar) 19891 if err != nil { 19892 return err 19893 } 19894 ue.Type = &typeVar 19895 } 19896 case "kind": 19897 if v != nil { 19898 var kind KindBasicEntity 19899 err = json.Unmarshal(*v, &kind) 19900 if err != nil { 19901 return err 19902 } 19903 ue.Kind = kind 19904 } 19905 } 19906 } 19907 19908 return nil 19909} 19910 19911// URLEntityProperties url entity property bag. 19912type URLEntityProperties struct { 19913 // URL - READ-ONLY; A full URL the entity points to 19914 URL *string `json:"url,omitempty"` 19915 // AdditionalData - READ-ONLY; A bag of custom fields that should be part of the entity and will be presented to the user. 19916 AdditionalData map[string]interface{} `json:"additionalData"` 19917 // FriendlyName - READ-ONLY; The graph item display name which is a short humanly readable description of the graph item instance. This property is optional and might be system generated. 19918 FriendlyName *string `json:"friendlyName,omitempty"` 19919} 19920 19921// MarshalJSON is the custom marshaler for URLEntityProperties. 19922func (uep URLEntityProperties) MarshalJSON() ([]byte, error) { 19923 objectMap := make(map[string]interface{}) 19924 return json.Marshal(objectMap) 19925} 19926 19927// UserInfo user information that made some action 19928type UserInfo struct { 19929 // Email - READ-ONLY; The email of the user. 19930 Email *string `json:"email,omitempty"` 19931 // Name - READ-ONLY; The name of the user. 19932 Name *string `json:"name,omitempty"` 19933 // ObjectID - The object id of the user. 19934 ObjectID *uuid.UUID `json:"objectId,omitempty"` 19935} 19936 19937// MarshalJSON is the custom marshaler for UserInfo. 19938func (UI UserInfo) MarshalJSON() ([]byte, error) { 19939 objectMap := make(map[string]interface{}) 19940 if UI.ObjectID != nil { 19941 objectMap["objectId"] = UI.ObjectID 19942 } 19943 return json.Marshal(objectMap) 19944} 19945 19946// Watchlist represents a Watchlist in Azure Security Insights. 19947type Watchlist struct { 19948 autorest.Response `json:"-"` 19949 // WatchlistProperties - Watchlist properties 19950 *WatchlistProperties `json:"properties,omitempty"` 19951 // ID - READ-ONLY; Azure resource Id 19952 ID *string `json:"id,omitempty"` 19953 // Name - READ-ONLY; Azure resource name 19954 Name *string `json:"name,omitempty"` 19955 // Type - READ-ONLY; Azure resource type 19956 Type *string `json:"type,omitempty"` 19957 // Etag - Etag of the azure resource 19958 Etag *string `json:"etag,omitempty"` 19959} 19960 19961// MarshalJSON is the custom marshaler for Watchlist. 19962func (w Watchlist) MarshalJSON() ([]byte, error) { 19963 objectMap := make(map[string]interface{}) 19964 if w.WatchlistProperties != nil { 19965 objectMap["properties"] = w.WatchlistProperties 19966 } 19967 if w.Etag != nil { 19968 objectMap["etag"] = w.Etag 19969 } 19970 return json.Marshal(objectMap) 19971} 19972 19973// UnmarshalJSON is the custom unmarshaler for Watchlist struct. 19974func (w *Watchlist) UnmarshalJSON(body []byte) error { 19975 var m map[string]*json.RawMessage 19976 err := json.Unmarshal(body, &m) 19977 if err != nil { 19978 return err 19979 } 19980 for k, v := range m { 19981 switch k { 19982 case "properties": 19983 if v != nil { 19984 var watchlistProperties WatchlistProperties 19985 err = json.Unmarshal(*v, &watchlistProperties) 19986 if err != nil { 19987 return err 19988 } 19989 w.WatchlistProperties = &watchlistProperties 19990 } 19991 case "id": 19992 if v != nil { 19993 var ID string 19994 err = json.Unmarshal(*v, &ID) 19995 if err != nil { 19996 return err 19997 } 19998 w.ID = &ID 19999 } 20000 case "name": 20001 if v != nil { 20002 var name string 20003 err = json.Unmarshal(*v, &name) 20004 if err != nil { 20005 return err 20006 } 20007 w.Name = &name 20008 } 20009 case "type": 20010 if v != nil { 20011 var typeVar string 20012 err = json.Unmarshal(*v, &typeVar) 20013 if err != nil { 20014 return err 20015 } 20016 w.Type = &typeVar 20017 } 20018 case "etag": 20019 if v != nil { 20020 var etag string 20021 err = json.Unmarshal(*v, &etag) 20022 if err != nil { 20023 return err 20024 } 20025 w.Etag = &etag 20026 } 20027 } 20028 } 20029 20030 return nil 20031} 20032 20033// WatchlistItem represents a Watchlist item in Azure Security Insights. 20034type WatchlistItem struct { 20035 autorest.Response `json:"-"` 20036 // WatchlistItemProperties - Watchlist Item properties 20037 *WatchlistItemProperties `json:"properties,omitempty"` 20038 // ID - READ-ONLY; Azure resource Id 20039 ID *string `json:"id,omitempty"` 20040 // Name - READ-ONLY; Azure resource name 20041 Name *string `json:"name,omitempty"` 20042 // Type - READ-ONLY; Azure resource type 20043 Type *string `json:"type,omitempty"` 20044 // Etag - Etag of the azure resource 20045 Etag *string `json:"etag,omitempty"` 20046} 20047 20048// MarshalJSON is the custom marshaler for WatchlistItem. 20049func (wi WatchlistItem) MarshalJSON() ([]byte, error) { 20050 objectMap := make(map[string]interface{}) 20051 if wi.WatchlistItemProperties != nil { 20052 objectMap["properties"] = wi.WatchlistItemProperties 20053 } 20054 if wi.Etag != nil { 20055 objectMap["etag"] = wi.Etag 20056 } 20057 return json.Marshal(objectMap) 20058} 20059 20060// UnmarshalJSON is the custom unmarshaler for WatchlistItem struct. 20061func (wi *WatchlistItem) UnmarshalJSON(body []byte) error { 20062 var m map[string]*json.RawMessage 20063 err := json.Unmarshal(body, &m) 20064 if err != nil { 20065 return err 20066 } 20067 for k, v := range m { 20068 switch k { 20069 case "properties": 20070 if v != nil { 20071 var watchlistItemProperties WatchlistItemProperties 20072 err = json.Unmarshal(*v, &watchlistItemProperties) 20073 if err != nil { 20074 return err 20075 } 20076 wi.WatchlistItemProperties = &watchlistItemProperties 20077 } 20078 case "id": 20079 if v != nil { 20080 var ID string 20081 err = json.Unmarshal(*v, &ID) 20082 if err != nil { 20083 return err 20084 } 20085 wi.ID = &ID 20086 } 20087 case "name": 20088 if v != nil { 20089 var name string 20090 err = json.Unmarshal(*v, &name) 20091 if err != nil { 20092 return err 20093 } 20094 wi.Name = &name 20095 } 20096 case "type": 20097 if v != nil { 20098 var typeVar string 20099 err = json.Unmarshal(*v, &typeVar) 20100 if err != nil { 20101 return err 20102 } 20103 wi.Type = &typeVar 20104 } 20105 case "etag": 20106 if v != nil { 20107 var etag string 20108 err = json.Unmarshal(*v, &etag) 20109 if err != nil { 20110 return err 20111 } 20112 wi.Etag = &etag 20113 } 20114 } 20115 } 20116 20117 return nil 20118} 20119 20120// WatchlistItemList list all the watchlist items. 20121type WatchlistItemList struct { 20122 autorest.Response `json:"-"` 20123 // NextLink - READ-ONLY; URL to fetch the next set of watchlist item. 20124 NextLink *string `json:"nextLink,omitempty"` 20125 // Value - Array of watchlist items. 20126 Value *[]WatchlistItem `json:"value,omitempty"` 20127} 20128 20129// MarshalJSON is the custom marshaler for WatchlistItemList. 20130func (wil WatchlistItemList) MarshalJSON() ([]byte, error) { 20131 objectMap := make(map[string]interface{}) 20132 if wil.Value != nil { 20133 objectMap["value"] = wil.Value 20134 } 20135 return json.Marshal(objectMap) 20136} 20137 20138// WatchlistItemListIterator provides access to a complete listing of WatchlistItem values. 20139type WatchlistItemListIterator struct { 20140 i int 20141 page WatchlistItemListPage 20142} 20143 20144// NextWithContext advances to the next value. If there was an error making 20145// the request the iterator does not advance and the error is returned. 20146func (iter *WatchlistItemListIterator) NextWithContext(ctx context.Context) (err error) { 20147 if tracing.IsEnabled() { 20148 ctx = tracing.StartSpan(ctx, fqdn+"/WatchlistItemListIterator.NextWithContext") 20149 defer func() { 20150 sc := -1 20151 if iter.Response().Response.Response != nil { 20152 sc = iter.Response().Response.Response.StatusCode 20153 } 20154 tracing.EndSpan(ctx, sc, err) 20155 }() 20156 } 20157 iter.i++ 20158 if iter.i < len(iter.page.Values()) { 20159 return nil 20160 } 20161 err = iter.page.NextWithContext(ctx) 20162 if err != nil { 20163 iter.i-- 20164 return err 20165 } 20166 iter.i = 0 20167 return nil 20168} 20169 20170// Next advances to the next value. If there was an error making 20171// the request the iterator does not advance and the error is returned. 20172// Deprecated: Use NextWithContext() instead. 20173func (iter *WatchlistItemListIterator) Next() error { 20174 return iter.NextWithContext(context.Background()) 20175} 20176 20177// NotDone returns true if the enumeration should be started or is not yet complete. 20178func (iter WatchlistItemListIterator) NotDone() bool { 20179 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 20180} 20181 20182// Response returns the raw server response from the last page request. 20183func (iter WatchlistItemListIterator) Response() WatchlistItemList { 20184 return iter.page.Response() 20185} 20186 20187// Value returns the current value or a zero-initialized value if the 20188// iterator has advanced beyond the end of the collection. 20189func (iter WatchlistItemListIterator) Value() WatchlistItem { 20190 if !iter.page.NotDone() { 20191 return WatchlistItem{} 20192 } 20193 return iter.page.Values()[iter.i] 20194} 20195 20196// Creates a new instance of the WatchlistItemListIterator type. 20197func NewWatchlistItemListIterator(page WatchlistItemListPage) WatchlistItemListIterator { 20198 return WatchlistItemListIterator{page: page} 20199} 20200 20201// IsEmpty returns true if the ListResult contains no values. 20202func (wil WatchlistItemList) IsEmpty() bool { 20203 return wil.Value == nil || len(*wil.Value) == 0 20204} 20205 20206// hasNextLink returns true if the NextLink is not empty. 20207func (wil WatchlistItemList) hasNextLink() bool { 20208 return wil.NextLink != nil && len(*wil.NextLink) != 0 20209} 20210 20211// watchlistItemListPreparer prepares a request to retrieve the next set of results. 20212// It returns nil if no more results exist. 20213func (wil WatchlistItemList) watchlistItemListPreparer(ctx context.Context) (*http.Request, error) { 20214 if !wil.hasNextLink() { 20215 return nil, nil 20216 } 20217 return autorest.Prepare((&http.Request{}).WithContext(ctx), 20218 autorest.AsJSON(), 20219 autorest.AsGet(), 20220 autorest.WithBaseURL(to.String(wil.NextLink))) 20221} 20222 20223// WatchlistItemListPage contains a page of WatchlistItem values. 20224type WatchlistItemListPage struct { 20225 fn func(context.Context, WatchlistItemList) (WatchlistItemList, error) 20226 wil WatchlistItemList 20227} 20228 20229// NextWithContext advances to the next page of values. If there was an error making 20230// the request the page does not advance and the error is returned. 20231func (page *WatchlistItemListPage) NextWithContext(ctx context.Context) (err error) { 20232 if tracing.IsEnabled() { 20233 ctx = tracing.StartSpan(ctx, fqdn+"/WatchlistItemListPage.NextWithContext") 20234 defer func() { 20235 sc := -1 20236 if page.Response().Response.Response != nil { 20237 sc = page.Response().Response.Response.StatusCode 20238 } 20239 tracing.EndSpan(ctx, sc, err) 20240 }() 20241 } 20242 for { 20243 next, err := page.fn(ctx, page.wil) 20244 if err != nil { 20245 return err 20246 } 20247 page.wil = next 20248 if !next.hasNextLink() || !next.IsEmpty() { 20249 break 20250 } 20251 } 20252 return nil 20253} 20254 20255// Next advances to the next page of values. If there was an error making 20256// the request the page does not advance and the error is returned. 20257// Deprecated: Use NextWithContext() instead. 20258func (page *WatchlistItemListPage) Next() error { 20259 return page.NextWithContext(context.Background()) 20260} 20261 20262// NotDone returns true if the page enumeration should be started or is not yet complete. 20263func (page WatchlistItemListPage) NotDone() bool { 20264 return !page.wil.IsEmpty() 20265} 20266 20267// Response returns the raw server response from the last page request. 20268func (page WatchlistItemListPage) Response() WatchlistItemList { 20269 return page.wil 20270} 20271 20272// Values returns the slice of values for the current page or nil if there are no values. 20273func (page WatchlistItemListPage) Values() []WatchlistItem { 20274 if page.wil.IsEmpty() { 20275 return nil 20276 } 20277 return *page.wil.Value 20278} 20279 20280// Creates a new instance of the WatchlistItemListPage type. 20281func NewWatchlistItemListPage(cur WatchlistItemList, getNextPage func(context.Context, WatchlistItemList) (WatchlistItemList, error)) WatchlistItemListPage { 20282 return WatchlistItemListPage{ 20283 fn: getNextPage, 20284 wil: cur, 20285 } 20286} 20287 20288// WatchlistItemProperties describes watchlist item properties 20289type WatchlistItemProperties struct { 20290 // WatchlistItemType - The type of the watchlist item 20291 WatchlistItemType *string `json:"watchlistItemType,omitempty"` 20292 // WatchlistItemID - The id (a Guid) of the watchlist item 20293 WatchlistItemID *string `json:"watchlistItemId,omitempty"` 20294 // TenantID - The tenantId to which the watchlist item belongs to 20295 TenantID *string `json:"tenantId,omitempty"` 20296 // IsDeleted - A flag that indicates if the watchlist item is deleted or not 20297 IsDeleted *bool `json:"isDeleted,omitempty"` 20298 // Created - The time the watchlist item was created 20299 Created *date.Time `json:"created,omitempty"` 20300 // Updated - The last time the watchlist item was updated 20301 Updated *date.Time `json:"updated,omitempty"` 20302 // CreatedBy - Describes a user that created the watchlist item 20303 CreatedBy *UserInfo `json:"createdBy,omitempty"` 20304 // UpdatedBy - Describes a user that updated the watchlist item 20305 UpdatedBy *UserInfo `json:"updatedBy,omitempty"` 20306 // ItemsKeyValue - key-value pairs for a watchlist item 20307 ItemsKeyValue interface{} `json:"itemsKeyValue,omitempty"` 20308 // EntityMapping - key-value pairs for a watchlist item entity mapping 20309 EntityMapping interface{} `json:"entityMapping,omitempty"` 20310} 20311 20312// WatchlistList list all the watchlists. 20313type WatchlistList struct { 20314 autorest.Response `json:"-"` 20315 // NextLink - READ-ONLY; URL to fetch the next set of watchlists. 20316 NextLink *string `json:"nextLink,omitempty"` 20317 // Value - Array of watchlist. 20318 Value *[]Watchlist `json:"value,omitempty"` 20319} 20320 20321// MarshalJSON is the custom marshaler for WatchlistList. 20322func (wl WatchlistList) MarshalJSON() ([]byte, error) { 20323 objectMap := make(map[string]interface{}) 20324 if wl.Value != nil { 20325 objectMap["value"] = wl.Value 20326 } 20327 return json.Marshal(objectMap) 20328} 20329 20330// WatchlistListIterator provides access to a complete listing of Watchlist values. 20331type WatchlistListIterator struct { 20332 i int 20333 page WatchlistListPage 20334} 20335 20336// NextWithContext advances to the next value. If there was an error making 20337// the request the iterator does not advance and the error is returned. 20338func (iter *WatchlistListIterator) NextWithContext(ctx context.Context) (err error) { 20339 if tracing.IsEnabled() { 20340 ctx = tracing.StartSpan(ctx, fqdn+"/WatchlistListIterator.NextWithContext") 20341 defer func() { 20342 sc := -1 20343 if iter.Response().Response.Response != nil { 20344 sc = iter.Response().Response.Response.StatusCode 20345 } 20346 tracing.EndSpan(ctx, sc, err) 20347 }() 20348 } 20349 iter.i++ 20350 if iter.i < len(iter.page.Values()) { 20351 return nil 20352 } 20353 err = iter.page.NextWithContext(ctx) 20354 if err != nil { 20355 iter.i-- 20356 return err 20357 } 20358 iter.i = 0 20359 return nil 20360} 20361 20362// Next advances to the next value. If there was an error making 20363// the request the iterator does not advance and the error is returned. 20364// Deprecated: Use NextWithContext() instead. 20365func (iter *WatchlistListIterator) Next() error { 20366 return iter.NextWithContext(context.Background()) 20367} 20368 20369// NotDone returns true if the enumeration should be started or is not yet complete. 20370func (iter WatchlistListIterator) NotDone() bool { 20371 return iter.page.NotDone() && iter.i < len(iter.page.Values()) 20372} 20373 20374// Response returns the raw server response from the last page request. 20375func (iter WatchlistListIterator) Response() WatchlistList { 20376 return iter.page.Response() 20377} 20378 20379// Value returns the current value or a zero-initialized value if the 20380// iterator has advanced beyond the end of the collection. 20381func (iter WatchlistListIterator) Value() Watchlist { 20382 if !iter.page.NotDone() { 20383 return Watchlist{} 20384 } 20385 return iter.page.Values()[iter.i] 20386} 20387 20388// Creates a new instance of the WatchlistListIterator type. 20389func NewWatchlistListIterator(page WatchlistListPage) WatchlistListIterator { 20390 return WatchlistListIterator{page: page} 20391} 20392 20393// IsEmpty returns true if the ListResult contains no values. 20394func (wl WatchlistList) IsEmpty() bool { 20395 return wl.Value == nil || len(*wl.Value) == 0 20396} 20397 20398// hasNextLink returns true if the NextLink is not empty. 20399func (wl WatchlistList) hasNextLink() bool { 20400 return wl.NextLink != nil && len(*wl.NextLink) != 0 20401} 20402 20403// watchlistListPreparer prepares a request to retrieve the next set of results. 20404// It returns nil if no more results exist. 20405func (wl WatchlistList) watchlistListPreparer(ctx context.Context) (*http.Request, error) { 20406 if !wl.hasNextLink() { 20407 return nil, nil 20408 } 20409 return autorest.Prepare((&http.Request{}).WithContext(ctx), 20410 autorest.AsJSON(), 20411 autorest.AsGet(), 20412 autorest.WithBaseURL(to.String(wl.NextLink))) 20413} 20414 20415// WatchlistListPage contains a page of Watchlist values. 20416type WatchlistListPage struct { 20417 fn func(context.Context, WatchlistList) (WatchlistList, error) 20418 wl WatchlistList 20419} 20420 20421// NextWithContext advances to the next page of values. If there was an error making 20422// the request the page does not advance and the error is returned. 20423func (page *WatchlistListPage) NextWithContext(ctx context.Context) (err error) { 20424 if tracing.IsEnabled() { 20425 ctx = tracing.StartSpan(ctx, fqdn+"/WatchlistListPage.NextWithContext") 20426 defer func() { 20427 sc := -1 20428 if page.Response().Response.Response != nil { 20429 sc = page.Response().Response.Response.StatusCode 20430 } 20431 tracing.EndSpan(ctx, sc, err) 20432 }() 20433 } 20434 for { 20435 next, err := page.fn(ctx, page.wl) 20436 if err != nil { 20437 return err 20438 } 20439 page.wl = next 20440 if !next.hasNextLink() || !next.IsEmpty() { 20441 break 20442 } 20443 } 20444 return nil 20445} 20446 20447// Next advances to the next page of values. If there was an error making 20448// the request the page does not advance and the error is returned. 20449// Deprecated: Use NextWithContext() instead. 20450func (page *WatchlistListPage) Next() error { 20451 return page.NextWithContext(context.Background()) 20452} 20453 20454// NotDone returns true if the page enumeration should be started or is not yet complete. 20455func (page WatchlistListPage) NotDone() bool { 20456 return !page.wl.IsEmpty() 20457} 20458 20459// Response returns the raw server response from the last page request. 20460func (page WatchlistListPage) Response() WatchlistList { 20461 return page.wl 20462} 20463 20464// Values returns the slice of values for the current page or nil if there are no values. 20465func (page WatchlistListPage) Values() []Watchlist { 20466 if page.wl.IsEmpty() { 20467 return nil 20468 } 20469 return *page.wl.Value 20470} 20471 20472// Creates a new instance of the WatchlistListPage type. 20473func NewWatchlistListPage(cur WatchlistList, getNextPage func(context.Context, WatchlistList) (WatchlistList, error)) WatchlistListPage { 20474 return WatchlistListPage{ 20475 fn: getNextPage, 20476 wl: cur, 20477 } 20478} 20479 20480// WatchlistProperties describes watchlist properties 20481type WatchlistProperties struct { 20482 // WatchlistID - The id (a Guid) of the watchlist 20483 WatchlistID *string `json:"watchlistId,omitempty"` 20484 // DisplayName - The display name of the watchlist 20485 DisplayName *string `json:"displayName,omitempty"` 20486 // Provider - The provider of the watchlist 20487 Provider *string `json:"provider,omitempty"` 20488 // Source - The source of the watchlist. Possible values include: 'SourceLocalfile', 'SourceRemotestorage' 20489 Source Source `json:"source,omitempty"` 20490 // Created - The time the watchlist was created 20491 Created *date.Time `json:"created,omitempty"` 20492 // Updated - The last time the watchlist was updated 20493 Updated *date.Time `json:"updated,omitempty"` 20494 // CreatedBy - Describes a user that created the watchlist 20495 CreatedBy *UserInfo `json:"createdBy,omitempty"` 20496 // UpdatedBy - Describes a user that updated the watchlist 20497 UpdatedBy *UserInfo `json:"updatedBy,omitempty"` 20498 // Description - A description of the watchlist 20499 Description *string `json:"description,omitempty"` 20500 // WatchlistType - The type of the watchlist 20501 WatchlistType *string `json:"watchlistType,omitempty"` 20502 // WatchlistAlias - The alias of the watchlist 20503 WatchlistAlias *string `json:"watchlistAlias,omitempty"` 20504 // IsDeleted - A flag that indicates if the watchlist is deleted or not 20505 IsDeleted *bool `json:"isDeleted,omitempty"` 20506 // Labels - List of labels relevant to this watchlist 20507 Labels *[]string `json:"labels,omitempty"` 20508 // DefaultDuration - The default duration of a watchlist (in ISO 8601 duration format) 20509 DefaultDuration *string `json:"defaultDuration,omitempty"` 20510 // TenantID - The tenantId where the watchlist belongs to 20511 TenantID *string `json:"tenantId,omitempty"` 20512 // NumberOfLinesToSkip - The number of lines in a csv/tsv content to skip before the header 20513 NumberOfLinesToSkip *int32 `json:"numberOfLinesToSkip,omitempty"` 20514 // RawContent - The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint 20515 RawContent *string `json:"rawContent,omitempty"` 20516 // ContentType - The content type of the raw content. Example : text/csv or text/tsv 20517 ContentType *string `json:"contentType,omitempty"` 20518 // UploadStatus - The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted 20519 UploadStatus *string `json:"uploadStatus,omitempty"` 20520 // WatchlistItemsCount - The number of Watchlist Items in the Watchlist 20521 WatchlistItemsCount *int32 `json:"watchlistItemsCount,omitempty"` 20522} 20523