export declare const ActionType: { /** * Modify an object's properties */ readonly ModifyProperties: "ModifyProperties"; /** * Run a playbook on an object */ readonly RunPlaybook: "RunPlaybook"; /** * Add a task to an incident object */ readonly AddIncidentTask: "AddIncidentTask"; }; /** * The type of the automation rule action. */ export type ActionType = (typeof ActionType)[keyof typeof ActionType]; export declare const AgentType: { readonly SAP: "SAP"; }; /** * Type of the agent */ export type AgentType = (typeof AgentType)[keyof typeof AgentType]; export declare const AlertDetail: { /** * Alert display name */ readonly DisplayName: "DisplayName"; /** * Alert severity */ readonly Severity: "Severity"; }; /** * Alert detail */ export type AlertDetail = (typeof AlertDetail)[keyof typeof AlertDetail]; export declare const AlertProperty: { /** * Alert's link */ readonly AlertLink: "AlertLink"; /** * Confidence level property */ readonly ConfidenceLevel: "ConfidenceLevel"; /** * Confidence score */ readonly ConfidenceScore: "ConfidenceScore"; /** * Extended links to the alert */ readonly ExtendedLinks: "ExtendedLinks"; /** * Product name alert property */ readonly ProductName: "ProductName"; /** * Provider name alert property */ readonly ProviderName: "ProviderName"; /** * Product component name alert property */ readonly ProductComponentName: "ProductComponentName"; /** * Remediation steps alert property */ readonly RemediationSteps: "RemediationSteps"; /** * Techniques alert property */ readonly Techniques: "Techniques"; }; /** * The V3 alert property */ export type AlertProperty = (typeof AlertProperty)[keyof typeof AlertProperty]; export declare const AlertRuleKind: { readonly Scheduled: "Scheduled"; readonly MicrosoftSecurityIncidentCreation: "MicrosoftSecurityIncidentCreation"; readonly Fusion: "Fusion"; }; /** * The alert rule kind */ export type AlertRuleKind = (typeof AlertRuleKind)[keyof typeof AlertRuleKind]; export declare const AlertSeverity: { /** * High severity */ readonly High: "High"; /** * Medium severity */ readonly Medium: "Medium"; /** * Low severity */ readonly Low: "Low"; /** * Informational severity */ readonly Informational: "Informational"; }; /** * The severity for alerts created by this alert rule. */ export type AlertSeverity = (typeof AlertSeverity)[keyof typeof AlertSeverity]; export declare const AttackTactic: { readonly Reconnaissance: "Reconnaissance"; readonly ResourceDevelopment: "ResourceDevelopment"; readonly InitialAccess: "InitialAccess"; readonly Execution: "Execution"; readonly Persistence: "Persistence"; readonly PrivilegeEscalation: "PrivilegeEscalation"; readonly DefenseEvasion: "DefenseEvasion"; readonly CredentialAccess: "CredentialAccess"; readonly Discovery: "Discovery"; readonly LateralMovement: "LateralMovement"; readonly Collection: "Collection"; readonly Exfiltration: "Exfiltration"; readonly CommandAndControl: "CommandAndControl"; readonly Impact: "Impact"; readonly PreAttack: "PreAttack"; readonly ImpairProcessControl: "ImpairProcessControl"; readonly InhibitResponseFunction: "InhibitResponseFunction"; }; /** * The severity for alerts created by this alert rule. */ export type AttackTactic = (typeof AttackTactic)[keyof typeof AttackTactic]; export declare const AutomationRuleBooleanConditionSupportedOperator: { /** * Evaluates as true if all the item conditions are evaluated as true */ readonly And: "And"; /** * Evaluates as true if at least one of the item conditions are evaluated as true */ readonly Or: "Or"; }; /** * Describes a boolean condition operator. */ export type AutomationRuleBooleanConditionSupportedOperator = (typeof AutomationRuleBooleanConditionSupportedOperator)[keyof typeof AutomationRuleBooleanConditionSupportedOperator]; export declare const AutomationRulePropertyArrayChangedConditionSupportedArrayType: { /** * Evaluate the condition on the alerts */ readonly Alerts: "Alerts"; /** * Evaluate the condition on the labels */ readonly Labels: "Labels"; /** * Evaluate the condition on the tactics */ readonly Tactics: "Tactics"; /** * Evaluate the condition on the comments */ readonly Comments: "Comments"; }; export type AutomationRulePropertyArrayChangedConditionSupportedArrayType = (typeof AutomationRulePropertyArrayChangedConditionSupportedArrayType)[keyof typeof AutomationRulePropertyArrayChangedConditionSupportedArrayType]; export declare const AutomationRulePropertyArrayChangedConditionSupportedChangeType: { /** * Evaluate the condition on items added to the array */ readonly Added: "Added"; }; export type AutomationRulePropertyArrayChangedConditionSupportedChangeType = (typeof AutomationRulePropertyArrayChangedConditionSupportedChangeType)[keyof typeof AutomationRulePropertyArrayChangedConditionSupportedChangeType]; export declare const AutomationRulePropertyArrayConditionSupportedArrayConditionType: { /** * Evaluate the condition as true if any item fulfills it */ readonly AnyItem: "AnyItem"; }; /** * Describes an array condition evaluation type. */ export type AutomationRulePropertyArrayConditionSupportedArrayConditionType = (typeof AutomationRulePropertyArrayConditionSupportedArrayConditionType)[keyof typeof AutomationRulePropertyArrayConditionSupportedArrayConditionType]; export declare const AutomationRulePropertyArrayConditionSupportedArrayType: { /** * Evaluate the condition on the custom detail keys */ readonly CustomDetails: "CustomDetails"; /** * Evaluate the condition on a custom detail's values */ readonly CustomDetailValues: "CustomDetailValues"; }; /** * Describes an array condition evaluated array type. */ export type AutomationRulePropertyArrayConditionSupportedArrayType = (typeof AutomationRulePropertyArrayConditionSupportedArrayType)[keyof typeof AutomationRulePropertyArrayConditionSupportedArrayType]; export declare const AutomationRulePropertyChangedConditionSupportedChangedType: { /** * Evaluate the condition on the previous value of the property */ readonly ChangedFrom: "ChangedFrom"; /** * Evaluate the condition on the updated value of the property */ readonly ChangedTo: "ChangedTo"; }; export type AutomationRulePropertyChangedConditionSupportedChangedType = (typeof AutomationRulePropertyChangedConditionSupportedChangedType)[keyof typeof AutomationRulePropertyChangedConditionSupportedChangedType]; export declare const AutomationRulePropertyChangedConditionSupportedPropertyType: { /** * Evaluate the condition on the incident severity */ readonly IncidentSeverity: "IncidentSeverity"; /** * Evaluate the condition on the incident status */ readonly IncidentStatus: "IncidentStatus"; /** * Evaluate the condition on the incident owner */ readonly IncidentOwner: "IncidentOwner"; }; export type AutomationRulePropertyChangedConditionSupportedPropertyType = (typeof AutomationRulePropertyChangedConditionSupportedPropertyType)[keyof typeof AutomationRulePropertyChangedConditionSupportedPropertyType]; export declare const AutomationRulePropertyConditionSupportedOperator: { /** * Evaluates if the property equals at least one of the condition values */ readonly Equals: "Equals"; /** * Evaluates if the property does not equal any of the condition values */ readonly NotEquals: "NotEquals"; /** * Evaluates if the property contains at least one of the condition values */ readonly Contains: "Contains"; /** * Evaluates if the property does not contain any of the condition values */ readonly NotContains: "NotContains"; /** * Evaluates if the property starts with any of the condition values */ readonly StartsWith: "StartsWith"; /** * Evaluates if the property does not start with any of the condition values */ readonly NotStartsWith: "NotStartsWith"; /** * Evaluates if the property ends with any of the condition values */ readonly EndsWith: "EndsWith"; /** * Evaluates if the property does not end with any of the condition values */ readonly NotEndsWith: "NotEndsWith"; }; export type AutomationRulePropertyConditionSupportedOperator = (typeof AutomationRulePropertyConditionSupportedOperator)[keyof typeof AutomationRulePropertyConditionSupportedOperator]; export declare const AutomationRulePropertyConditionSupportedProperty: { /** * The title of the incident */ readonly IncidentTitle: "IncidentTitle"; /** * The description of the incident */ readonly IncidentDescription: "IncidentDescription"; /** * The severity of the incident */ readonly IncidentSeverity: "IncidentSeverity"; /** * The status of the incident */ readonly IncidentStatus: "IncidentStatus"; /** * The related Analytic rule ids of the incident */ readonly IncidentRelatedAnalyticRuleIds: "IncidentRelatedAnalyticRuleIds"; /** * The tactics of the incident */ readonly IncidentTactics: "IncidentTactics"; /** * The labels of the incident */ readonly IncidentLabel: "IncidentLabel"; /** * The provider name of the incident */ readonly IncidentProviderName: "IncidentProviderName"; /** * The update source of the incident */ readonly IncidentUpdatedBySource: "IncidentUpdatedBySource"; /** * The incident custom detail key */ readonly IncidentCustomDetailsKey: "IncidentCustomDetailsKey"; /** * The incident custom detail value */ readonly IncidentCustomDetailsValue: "IncidentCustomDetailsValue"; /** * The account Azure Active Directory tenant id */ readonly AccountAadTenantId: "AccountAadTenantId"; /** * The account Azure Active Directory user id */ readonly AccountAadUserId: "AccountAadUserId"; /** * The account name */ readonly AccountName: "AccountName"; /** * The account NetBIOS domain name */ readonly AccountNTDomain: "AccountNTDomain"; /** * The account Azure Active Directory Passport User ID */ readonly AccountPUID: "AccountPUID"; /** * The account security identifier */ readonly AccountSid: "AccountSid"; /** * The account unique identifier */ readonly AccountObjectGuid: "AccountObjectGuid"; /** * The account user principal name suffix */ readonly AccountUPNSuffix: "AccountUPNSuffix"; /** * The name of the product of the alert */ readonly AlertProductNames: "AlertProductNames"; /** * The analytic rule ids of the alert */ readonly AlertAnalyticRuleIds: "AlertAnalyticRuleIds"; /** * The Azure resource id */ readonly AzureResourceResourceId: "AzureResourceResourceId"; /** * The Azure resource subscription id */ readonly AzureResourceSubscriptionId: "AzureResourceSubscriptionId"; /** * The cloud application identifier */ readonly CloudApplicationAppId: "CloudApplicationAppId"; /** * The cloud application name */ readonly CloudApplicationAppName: "CloudApplicationAppName"; /** * The dns record domain name */ readonly DNSDomainName: "DNSDomainName"; /** * The file directory full path */ readonly FileDirectory: "FileDirectory"; /** * The file name without path */ readonly FileName: "FileName"; /** * The file hash value */ readonly FileHashValue: "FileHashValue"; /** * The host Azure resource id */ readonly HostAzureID: "HostAzureID"; /** * The host name without domain */ readonly HostName: "HostName"; /** * The host NetBIOS name */ readonly HostNetBiosName: "HostNetBiosName"; /** * The host NT domain */ readonly HostNTDomain: "HostNTDomain"; /** * The host operating system */ readonly HostOSVersion: "HostOSVersion"; /** * "The IoT device id */ readonly IoTDeviceId: "IoTDeviceId"; /** * The IoT device name */ readonly IoTDeviceName: "IoTDeviceName"; /** * The IoT device type */ readonly IoTDeviceType: "IoTDeviceType"; /** * The IoT device vendor */ readonly IoTDeviceVendor: "IoTDeviceVendor"; /** * The IoT device model */ readonly IoTDeviceModel: "IoTDeviceModel"; /** * The IoT device operating system */ readonly IoTDeviceOperatingSystem: "IoTDeviceOperatingSystem"; /** * The IP address */ readonly IPAddress: "IPAddress"; /** * The mailbox display name */ readonly MailboxDisplayName: "MailboxDisplayName"; /** * The mailbox primary address */ readonly MailboxPrimaryAddress: "MailboxPrimaryAddress"; /** * The mailbox user principal name */ readonly MailboxUPN: "MailboxUPN"; /** * The mail message delivery action */ readonly MailMessageDeliveryAction: "MailMessageDeliveryAction"; /** * The mail message delivery location */ readonly MailMessageDeliveryLocation: "MailMessageDeliveryLocation"; /** * The mail message recipient */ readonly MailMessageRecipient: "MailMessageRecipient"; /** * The mail message sender IP address */ readonly MailMessageSenderIP: "MailMessageSenderIP"; /** * The mail message subject */ readonly MailMessageSubject: "MailMessageSubject"; /** * The mail message P1 sender */ readonly MailMessageP1Sender: "MailMessageP1Sender"; /** * The mail message P2 sender */ readonly MailMessageP2Sender: "MailMessageP2Sender"; /** * The malware category */ readonly MalwareCategory: "MalwareCategory"; /** * The malware name */ readonly MalwareName: "MalwareName"; /** * The process execution command line */ readonly ProcessCommandLine: "ProcessCommandLine"; /** * The process id */ readonly ProcessId: "ProcessId"; /** * The registry key path */ readonly RegistryKey: "RegistryKey"; /** * The registry key value in string formatted representation */ readonly RegistryValueData: "RegistryValueData"; /** * The url */ readonly Url: "Url"; }; /** * The property to evaluate in an automation rule property condition. */ export type AutomationRulePropertyConditionSupportedProperty = (typeof AutomationRulePropertyConditionSupportedProperty)[keyof typeof AutomationRulePropertyConditionSupportedProperty]; export declare const CcpAuthType: { readonly Basic: "Basic"; readonly APIKey: "APIKey"; readonly OAuth2: "OAuth2"; readonly AWS: "AWS"; readonly GCP: "GCP"; readonly Session: "Session"; readonly JwtToken: "JwtToken"; readonly GitHub: "GitHub"; readonly ServiceBus: "ServiceBus"; readonly Oracle: "Oracle"; readonly None: "None"; }; /** * The auth type */ export type CcpAuthType = (typeof CcpAuthType)[keyof typeof CcpAuthType]; export declare const ConditionType: { /** * Evaluate an object property value */ readonly Property: "Property"; /** * Evaluate an object array property value */ readonly PropertyArray: "PropertyArray"; /** * Evaluate an object property changed value */ readonly PropertyChanged: "PropertyChanged"; /** * Evaluate an object array property changed value */ readonly PropertyArrayChanged: "PropertyArrayChanged"; /** * Apply a boolean operator (e.g AND, OR) to conditions */ readonly Boolean: "Boolean"; }; export type ConditionType = (typeof ConditionType)[keyof typeof ConditionType]; export declare const ConfigurationType: { readonly SAP: "SAP"; }; /** * Represents the types of configuration for a system. */ export type ConfigurationType = (typeof ConfigurationType)[keyof typeof ConfigurationType]; export declare const ContentType: { readonly AnalyticsRule: "AnalyticsRule"; readonly Workbook: "Workbook"; }; /** * Content type. */ export type ContentType = (typeof ContentType)[keyof typeof ContentType]; export declare const CustomEntityQueryKind: { readonly Activity: "Activity"; }; /** * the entity query kind */ export type CustomEntityQueryKind = (typeof CustomEntityQueryKind)[keyof typeof CustomEntityQueryKind]; export declare const DataConnectorDefinitionKind: { readonly Customizable: "Customizable"; }; /** * The data connector kind */ export type DataConnectorDefinitionKind = (typeof DataConnectorDefinitionKind)[keyof typeof DataConnectorDefinitionKind]; export declare const DataConnectorKind: { readonly AzureActiveDirectory: "AzureActiveDirectory"; readonly AzureSecurityCenter: "AzureSecurityCenter"; readonly MicrosoftCloudAppSecurity: "MicrosoftCloudAppSecurity"; readonly ThreatIntelligence: "ThreatIntelligence"; readonly MicrosoftThreatIntelligence: "MicrosoftThreatIntelligence"; readonly PremiumMicrosoftDefenderForThreatIntelligence: "PremiumMicrosoftDefenderForThreatIntelligence"; readonly Office365: "Office365"; readonly AmazonWebServicesCloudTrail: "AmazonWebServicesCloudTrail"; readonly AzureAdvancedThreatProtection: "AzureAdvancedThreatProtection"; readonly MicrosoftDefenderAdvancedThreatProtection: "MicrosoftDefenderAdvancedThreatProtection"; readonly RestApiPoller: "RestApiPoller"; }; /** * The data connector kind */ export type DataConnectorKind = (typeof DataConnectorKind)[keyof typeof DataConnectorKind]; export declare const DataTypeState: { readonly Enabled: "Enabled"; readonly Disabled: "Disabled"; }; /** * Describe whether this data type connection is enabled or not. */ export type DataTypeState = (typeof DataTypeState)[keyof typeof DataTypeState]; export declare const DeploymentFetchStatus: { readonly Success: "Success"; readonly Unauthorized: "Unauthorized"; readonly NotFound: "NotFound"; }; /** * Status while fetching the last deployment. */ export type DeploymentFetchStatus = (typeof DeploymentFetchStatus)[keyof typeof DeploymentFetchStatus]; export declare const DeploymentResult: { readonly Success: "Success"; readonly Canceled: "Canceled"; readonly Failed: "Failed"; }; /** * The outcome of the deployment. */ export type DeploymentResult = (typeof DeploymentResult)[keyof typeof DeploymentResult]; export declare const DeploymentState: { readonly In_Progress: "In_Progress"; readonly Completed: "Completed"; readonly Queued: "Queued"; readonly Canceling: "Canceling"; }; /** * Current status of the deployment. */ export type DeploymentState = (typeof DeploymentState)[keyof typeof DeploymentState]; export declare const EntityMappingType: { /** * User account entity type */ readonly Account: "Account"; /** * Host entity type */ readonly Host: "Host"; /** * IP address entity type */ readonly IP: "IP"; /** * Malware entity type */ readonly Malware: "Malware"; /** * System file entity type */ readonly File: "File"; /** * Process entity type */ readonly Process: "Process"; /** * Cloud app entity type */ readonly CloudApplication: "CloudApplication"; /** * DNS entity type */ readonly DNS: "DNS"; /** * Azure resource entity type */ readonly AzureResource: "AzureResource"; /** * File-hash entity type */ readonly FileHash: "FileHash"; /** * Registry key entity type */ readonly RegistryKey: "RegistryKey"; /** * Registry value entity type */ readonly RegistryValue: "RegistryValue"; /** * Security group entity type */ readonly SecurityGroup: "SecurityGroup"; /** * URL entity type */ readonly URL: "URL"; /** * Mailbox entity type */ readonly Mailbox: "Mailbox"; /** * Mail cluster entity type */ readonly MailCluster: "MailCluster"; /** * Mail message entity type */ readonly MailMessage: "MailMessage"; /** * Submission mail entity type */ readonly SubmissionMail: "SubmissionMail"; }; /** * The V3 type of the mapped entity */ export type EntityMappingType = (typeof EntityMappingType)[keyof typeof EntityMappingType]; export declare const EntityProviders: { readonly ActiveDirectory: "ActiveDirectory"; readonly AzureActiveDirectory: "AzureActiveDirectory"; }; /** * The entity provider that is synced. */ export type EntityProviders = (typeof EntityProviders)[keyof typeof EntityProviders]; export declare const EntityTimelineKind: { /** * activity */ readonly Activity: "Activity"; /** * bookmarks */ readonly Bookmark: "Bookmark"; /** * security alerts */ readonly SecurityAlert: "SecurityAlert"; /** * anomaly */ readonly Anomaly: "Anomaly"; }; /** * The entity query kind */ export type EntityTimelineKind = (typeof EntityTimelineKind)[keyof typeof EntityTimelineKind]; export declare const EntityType: { /** * Entity represents account in the system. */ readonly Account: "Account"; /** * Entity represents host in the system. */ readonly Host: "Host"; /** * Entity represents file in the system. */ readonly File: "File"; /** * Entity represents azure resource in the system. */ readonly AzureResource: "AzureResource"; /** * Entity represents cloud application in the system. */ readonly CloudApplication: "CloudApplication"; /** * Entity represents dns in the system. */ readonly DNS: "DNS"; /** * Entity represents file hash in the system. */ readonly FileHash: "FileHash"; /** * Entity represents ip in the system. */ readonly IP: "IP"; /** * Entity represents malware in the system. */ readonly Malware: "Malware"; /** * Entity represents process in the system. */ readonly Process: "Process"; /** * Entity represents registry key in the system. */ readonly RegistryKey: "RegistryKey"; /** * Entity represents registry value in the system. */ readonly RegistryValue: "RegistryValue"; /** * Entity represents security group in the system. */ readonly SecurityGroup: "SecurityGroup"; /** * Entity represents url in the system. */ readonly URL: "URL"; /** * Entity represents IoT device in the system. */ readonly IoTDevice: "IoTDevice"; /** * Entity represents security alert in the system. */ readonly SecurityAlert: "SecurityAlert"; /** * Entity represents HuntingBookmark in the system. */ readonly HuntingBookmark: "HuntingBookmark"; /** * Entity represents mail cluster in the system. */ readonly MailCluster: "MailCluster"; /** * Entity represents mail message in the system. */ readonly MailMessage: "MailMessage"; /** * Entity represents mailbox in the system. */ readonly Mailbox: "Mailbox"; /** * Entity represents submission mail in the system. */ readonly SubmissionMail: "SubmissionMail"; /** * Entity represents network interface in the system. */ readonly Nic: "Nic"; }; /** * The type of the query's source entity */ export type EntityType = (typeof EntityType)[keyof typeof EntityType]; export declare const EventGroupingAggregationKind: { readonly SingleAlert: "SingleAlert"; readonly AlertPerResult: "AlertPerResult"; }; /** * The event grouping aggregation kinds */ export type EventGroupingAggregationKind = (typeof EventGroupingAggregationKind)[keyof typeof EventGroupingAggregationKind]; export declare const FileFormat: { /** * A CSV file. */ readonly CSV: "CSV"; /** * A JSON file. */ readonly JSON: "JSON"; /** * A file of other format. */ readonly Unspecified: "Unspecified"; }; /** * The format of the file */ export type FileFormat = (typeof FileFormat)[keyof typeof FileFormat]; export declare const FileImportContentType: { /** * File containing records with the core fields of an indicator, plus the observables to construct the STIX pattern. */ readonly BasicIndicator: "BasicIndicator"; /** * File containing STIX indicators. */ readonly StixIndicator: "StixIndicator"; /** * File containing other records. */ readonly Unspecified: "Unspecified"; }; /** * The content type of this file. */ export type FileImportContentType = (typeof FileImportContentType)[keyof typeof FileImportContentType]; export declare const Flag: { readonly True: "true"; readonly False: "false"; }; /** * Flag indicates if this package is in preview. */ export type Flag = (typeof Flag)[keyof typeof Flag]; export declare const HttpMethodVerb: { readonly GET: "GET"; readonly POST: "POST"; readonly PUT: "PUT"; readonly DELETE: "DELETE"; }; /** * The HTTP method, default value GET. */ export type HttpMethodVerb = (typeof HttpMethodVerb)[keyof typeof HttpMethodVerb]; export declare const HttpsConfigurationType: { readonly HttpOnly: "HttpOnly"; readonly HttpsWithSslVerification: "HttpsWithSslVerification"; readonly HttpsWithoutSslVerification: "HttpsWithoutSslVerification"; }; /** * Represents the types of HTTPS configuration to connect to the SapControl service. */ export type HttpsConfigurationType = (typeof HttpsConfigurationType)[keyof typeof HttpsConfigurationType]; export declare const HypothesisStatus: { readonly Unknown: "Unknown"; readonly Invalidated: "Invalidated"; readonly Validated: "Validated"; }; /** * The hypothesis status of the hunt. */ export type HypothesisStatus = (typeof HypothesisStatus)[keyof typeof HypothesisStatus]; export declare const IncidentClassification: { /** * Incident classification was undetermined */ readonly Undetermined: "Undetermined"; /** * Incident was true positive */ readonly TruePositive: "TruePositive"; /** * Incident was benign positive */ readonly BenignPositive: "BenignPositive"; /** * Incident was false positive */ readonly FalsePositive: "FalsePositive"; }; /** * The reason the incident was closed */ export type IncidentClassification = (typeof IncidentClassification)[keyof typeof IncidentClassification]; export declare const IncidentClassificationReason: { /** * Classification reason was suspicious activity */ readonly SuspiciousActivity: "SuspiciousActivity"; /** * Classification reason was suspicious but expected */ readonly SuspiciousButExpected: "SuspiciousButExpected"; /** * Classification reason was incorrect alert logic */ readonly IncorrectAlertLogic: "IncorrectAlertLogic"; /** * Classification reason was inaccurate data */ readonly InaccurateData: "InaccurateData"; }; /** * The classification reason the incident was closed with */ export type IncidentClassificationReason = (typeof IncidentClassificationReason)[keyof typeof IncidentClassificationReason]; export declare const IncidentSeverity: { /** * High severity */ readonly High: "High"; /** * Medium severity */ readonly Medium: "Medium"; /** * Low severity */ readonly Low: "Low"; /** * Informational severity */ readonly Informational: "Informational"; }; /** * The severity of the incident */ export type IncidentSeverity = (typeof IncidentSeverity)[keyof typeof IncidentSeverity]; export declare const IncidentStatus: { /** * An active incident which isn't being handled currently */ readonly New: "New"; /** * An active incident which is being handled */ readonly Active: "Active"; /** * A non-active incident */ readonly Closed: "Closed"; }; /** * The status of the incident */ export type IncidentStatus = (typeof IncidentStatus)[keyof typeof IncidentStatus]; export declare const IncidentTaskStatus: { /** * A new task */ readonly New: "New"; /** * A completed task */ readonly Completed: "Completed"; }; /** * The status of the task */ export type IncidentTaskStatus = (typeof IncidentTaskStatus)[keyof typeof IncidentTaskStatus]; export declare const IngestionMode: { /** * No records should be ingested when invalid records are detected. */ readonly IngestOnlyIfAllAreValid: "IngestOnlyIfAllAreValid"; /** * Valid records should still be ingested when invalid records are detected. */ readonly IngestAnyValidRecords: "IngestAnyValidRecords"; /** * Unspecified */ readonly Unspecified: "Unspecified"; }; /** * Describes how to ingest the records in the file. */ export type IngestionMode = (typeof IngestionMode)[keyof typeof IngestionMode]; export declare const IngestionType: { readonly Full: "Full"; readonly Incremental: "Incremental"; }; /** * Types of ingestion. */ export type IngestionType = (typeof IngestionType)[keyof typeof IngestionType]; export declare const KeyVaultAuthenticationMode: { readonly ManagedIdentity: "ManagedIdentity"; readonly ServicePrincipal: "ServicePrincipal"; }; /** * The key mode of the agent. * ManagedIdentity|ApplicationIdentity are the options */ export type KeyVaultAuthenticationMode = (typeof KeyVaultAuthenticationMode)[keyof typeof KeyVaultAuthenticationMode]; export declare const Kind: { readonly DataConnector: "DataConnector"; readonly DataType: "DataType"; readonly Workbook: "Workbook"; readonly WorkbookTemplate: "WorkbookTemplate"; readonly Playbook: "Playbook"; readonly PlaybookTemplate: "PlaybookTemplate"; readonly AnalyticsRuleTemplate: "AnalyticsRuleTemplate"; readonly AnalyticsRule: "AnalyticsRule"; readonly HuntingQuery: "HuntingQuery"; readonly InvestigationQuery: "InvestigationQuery"; readonly Parser: "Parser"; readonly Watchlist: "Watchlist"; readonly WatchlistTemplate: "WatchlistTemplate"; readonly Solution: "Solution"; readonly AzureFunction: "AzureFunction"; readonly LogicAppsCustomConnector: "LogicAppsCustomConnector"; readonly AutomationRule: "AutomationRule"; }; /** * Type of the content item we depend on */ export type Kind = (typeof Kind)[keyof typeof Kind]; export declare const LogStatusType: { readonly Enabled: "Enabled"; readonly Disabled: "Disabled"; }; /** * Types of log status. */ export type LogStatusType = (typeof LogStatusType)[keyof typeof LogStatusType]; export declare const LogType: { readonly AbapAuditLog: "AbapAuditLog"; readonly AbapJobLog: "AbapJobLog"; readonly AbapSpoolLog: "AbapSpoolLog"; readonly AbapSpoolOutputLog: "AbapSpoolOutputLog"; readonly AbapChangeDocsLog: "AbapChangeDocsLog"; readonly AbapAppLog: "AbapAppLog"; readonly AbapWorkflowLog: "AbapWorkflowLog"; readonly AbapCrLog: "AbapCrLog"; readonly AbapTableDataLog: "AbapTableDataLog"; readonly AbapFilesLogs: "AbapFilesLogs"; readonly JavaFilesLogs: "JavaFilesLogs"; readonly AGRTCODES: "AGRTCODES"; readonly USR01: "USR01"; readonly USR02: "USR02"; readonly AGR1251: "AGR1251"; readonly AGRUSERS: "AGRUSERS"; readonly AGRPROF: "AGRPROF"; readonly UST04: "UST04"; readonly USR21: "USR21"; readonly ADR6: "ADR6"; readonly ADCP: "ADCP"; readonly USR05: "USR05"; readonly USGRPUSER: "USGRPUSER"; readonly USERADDR: "USERADDR"; readonly DEVACCESS: "DEVACCESS"; readonly AGRDEFINE: "AGRDEFINE"; readonly PAHI: "PAHI"; readonly AGRAGRS: "AGRAGRS"; readonly USRSTAMP: "USRSTAMP"; readonly AGRFLAGS: "AGRFLAGS"; readonly SNCSYSACL: "SNCSYSACL"; readonly USRACL: "USRACL"; }; /** * Types of logs and tables. */ export type LogType = (typeof LogType)[keyof typeof LogType]; export declare const MatchingMethod: { /** * Grouping alerts into a single incident if all the entities match */ readonly AllEntities: "AllEntities"; /** * Grouping any alerts triggered by this rule into a single incident */ readonly AnyAlert: "AnyAlert"; /** * Grouping alerts into a single incident if the selected entities, custom details and alert details match */ readonly Selected: "Selected"; }; /** * Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty. */ export type MatchingMethod = (typeof MatchingMethod)[keyof typeof MatchingMethod]; export declare const MicrosoftSecurityProductName: { readonly Microsoft_Cloud_App_Security: "Microsoft Cloud App Security"; readonly Azure_Security_Center: "Azure Security Center"; readonly Azure_Advanced_Threat_Protection: "Azure Advanced Threat Protection"; readonly Azure_Active_Directory_Identity_Protection: "Azure Active Directory Identity Protection"; readonly Azure_Security_Center_for_IoT: "Azure Security Center for IoT"; }; /** * The alerts' productName on which the cases will be generated */ export type MicrosoftSecurityProductName = (typeof MicrosoftSecurityProductName)[keyof typeof MicrosoftSecurityProductName]; export declare const Mode: { /** * The workspace manager configuration is enabled */ readonly Enabled: "Enabled"; /** * The workspace manager configuration is disabled */ readonly Disabled: "Disabled"; }; /** * The current mode of the workspace manager configuration */ export type Mode = (typeof Mode)[keyof typeof Mode]; export declare const Operator: { readonly AND: "AND"; readonly OR: "OR"; }; /** * Operator used for list of dependencies in criteria array. */ export type Operator = (typeof Operator)[keyof typeof Operator]; export declare const OwnerType: { /** * The incident owner type is unknown */ readonly Unknown: "Unknown"; /** * The incident owner type is an AAD user */ readonly User: "User"; /** * The incident owner type is an AAD group */ readonly Group: "Group"; }; /** * The type of the owner the incident is assigned to. */ export type OwnerType = (typeof OwnerType)[keyof typeof OwnerType]; export declare const PackageKind: { readonly Solution: "Solution"; readonly Standalone: "Standalone"; }; /** * the packageKind of the package contains this template */ export type PackageKind = (typeof PackageKind)[keyof typeof PackageKind]; export declare const ProviderPermissionsScope: { readonly Subscription: "Subscription"; readonly ResourceGroup: "ResourceGroup"; readonly Workspace: "Workspace"; }; /** * The scope on which the user should have permissions, in order to be able to create connections. */ export type ProviderPermissionsScope = (typeof ProviderPermissionsScope)[keyof typeof ProviderPermissionsScope]; export declare const RepoType: { readonly Github: "Github"; readonly DevOps: "DevOps"; }; /** * The repository type of the source control */ export type RepoType = (typeof RepoType)[keyof typeof RepoType]; export declare const RepositoryAccessKind: { readonly OAuth: "OAuth"; readonly PAT: "PAT"; readonly App: "App"; }; /** * The kind of repository access credentials */ export type RepositoryAccessKind = (typeof RepositoryAccessKind)[keyof typeof RepositoryAccessKind]; export declare const RestApiPollerRequestPagingKind: { readonly LinkHeader: "LinkHeader"; readonly NextPageToken: "NextPageToken"; readonly NextPageUrl: "NextPageUrl"; readonly PersistentToken: "PersistentToken"; readonly PersistentLinkHeader: "PersistentLinkHeader"; readonly Offset: "Offset"; readonly CountBasedPaging: "CountBasedPaging"; }; /** * Type of paging */ export type RestApiPollerRequestPagingKind = (typeof RestApiPollerRequestPagingKind)[keyof typeof RestApiPollerRequestPagingKind]; export declare const SapAuthenticationType: { readonly UsernamePassword: "UsernamePassword"; readonly Snc: "Snc"; readonly SncWithUsernamePassword: "SncWithUsernamePassword"; }; /** * The authentication type to SAP. */ export type SapAuthenticationType = (typeof SapAuthenticationType)[keyof typeof SapAuthenticationType]; export declare const SecretSource: { readonly AzureKeyVault: "AzureKeyVault"; }; /** * The secret source of the agent. * AzureKeyVault is the option */ export type SecretSource = (typeof SecretSource)[keyof typeof SecretSource]; export declare const SecurityMLAnalyticsSettingsKind: { readonly Anomaly: "Anomaly"; }; /** * The kind of security ML Analytics Settings */ export type SecurityMLAnalyticsSettingsKind = (typeof SecurityMLAnalyticsSettingsKind)[keyof typeof SecurityMLAnalyticsSettingsKind]; export declare const SettingKind: { readonly Anomalies: "Anomalies"; readonly EyesOn: "EyesOn"; readonly EntityAnalytics: "EntityAnalytics"; readonly Ueba: "Ueba"; }; /** * The kind of the setting */ export type SettingKind = (typeof SettingKind)[keyof typeof SettingKind]; export declare const SettingsStatus: { /** * Anomaly settings status in Production mode */ readonly Production: "Production"; /** * Anomaly settings status in Flighting mode */ readonly Flighting: "Flighting"; }; /** * The anomaly SecurityMLAnalyticsSettings status */ export type SettingsStatus = (typeof SettingsStatus)[keyof typeof SettingsStatus]; export declare const SourceKind: { readonly LocalWorkspace: "LocalWorkspace"; readonly Community: "Community"; readonly Solution: "Solution"; readonly SourceRepository: "SourceRepository"; }; /** * Source type of the content */ export type SourceKind = (typeof SourceKind)[keyof typeof SourceKind]; export declare const SourceType: { /** * The source from local file. */ readonly Local: "Local"; /** * The source from Azure storage. */ readonly AzureStorage: "AzureStorage"; }; /** * The sourceType of the watchlist */ export type SourceType = (typeof SourceType)[keyof typeof SourceType]; export declare const Status: { readonly New: "New"; readonly Active: "Active"; readonly Closed: "Closed"; readonly Backlog: "Backlog"; readonly Approved: "Approved"; }; /** * The status of the hunt. */ export type Status = (typeof Status)[keyof typeof Status]; export declare const SupportTier: { readonly Microsoft: "Microsoft"; readonly Partner: "Partner"; readonly Community: "Community"; }; /** * Type of support for content item */ export type SupportTier = (typeof SupportTier)[keyof typeof SupportTier]; export declare const SystemConfigurationConnectorType: { readonly Rfc: "Rfc"; readonly SapControl: "SapControl"; }; /** * Represents the types of SAP systems. */ export type SystemConfigurationConnectorType = (typeof SystemConfigurationConnectorType)[keyof typeof SystemConfigurationConnectorType]; export declare const SystemStatusType: { readonly Running: "Running"; readonly Stopped: "Stopped"; }; /** * The status of the system. */ export type SystemStatusType = (typeof SystemStatusType)[keyof typeof SystemStatusType]; export declare const ThreatIntelligenceResourceInnerKind: { /** * Entity represents threat intelligence indicator in the system. */ readonly Indicator: "indicator"; }; /** * The kind of the entity. */ export type ThreatIntelligenceResourceInnerKind = (typeof ThreatIntelligenceResourceInnerKind)[keyof typeof ThreatIntelligenceResourceInnerKind]; export declare const TriggerOperator: { readonly GreaterThan: "GreaterThan"; readonly LessThan: "LessThan"; readonly Equal: "Equal"; readonly NotEqual: "NotEqual"; }; /** * The operation against the threshold that triggers alert rule. */ export type TriggerOperator = (typeof TriggerOperator)[keyof typeof TriggerOperator]; export declare const TriggersOn: { /** * Trigger on Incidents */ readonly Incidents: "Incidents"; /** * Trigger on Alerts */ readonly Alerts: "Alerts"; }; export type TriggersOn = (typeof TriggersOn)[keyof typeof TriggersOn]; export declare const TriggersWhen: { /** * Trigger on created objects */ readonly Created: "Created"; /** * Trigger on updated objects */ readonly Updated: "Updated"; }; export type TriggersWhen = (typeof TriggersWhen)[keyof typeof TriggersWhen]; export declare const UebaDataSources: { readonly AuditLogs: "AuditLogs"; readonly AzureActivity: "AzureActivity"; readonly SecurityEvent: "SecurityEvent"; readonly SigninLogs: "SigninLogs"; }; /** * The data source that enriched by ueba. */ export type UebaDataSources = (typeof UebaDataSources)[keyof typeof UebaDataSources]; export declare const Version: { readonly V1: "V1"; readonly V2: "V2"; }; /** * The version number associated with the source control */ export type Version = (typeof Version)[keyof typeof Version];