// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.chronicle.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/httpbody.proto";
import "google/api/resource.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.Chronicle.V1";
option go_package = "cloud.google.com/go/chronicle/apiv1/chroniclepb;chroniclepb";
option java_multiple_files = true;
option java_outer_classname = "FeedProto";
option java_package = "com.google.cloud.chronicle.v1";
option php_namespace = "Google\\Cloud\\Chronicle\\V1";
option ruby_package = "Google::Cloud::Chronicle::V1";
option (google.api.resource_definition) = {
  type: "chronicle.googleapis.com/LogType"
  pattern: "projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}"
};

// FeedsService contains procedures for managing Chronicle third-party feeds.
service FeedsService {
  option (google.api.default_host) = "chronicle.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/chronicle,"
      "https://www.googleapis.com/auth/chronicle.readonly,"
      "https://www.googleapis.com/auth/cloud-platform";

  // Fetch Chronicle's service account used for ingesting data from Cloud
  // Storage buckets.
  rpc FetchServiceAccountForCustomer(FetchServiceAccountForCustomerRequest)
      returns (FeedServiceAccount) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/instances/*}/feedServiceAccounts:fetchServiceAccountForCustomer"
    };
    option (google.api.method_signature) = "parent";
  }

  // Creates a feed.
  rpc CreateFeed(CreateFeedRequest) returns (Feed) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/instances/*}/feeds"
      body: "feed"
    };
    option (google.api.method_signature) = "parent,feed";
  }

  // Gets a feed.
  rpc GetFeed(GetFeedRequest) returns (Feed) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/instances/*/feeds/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Deletes a feed.
  rpc DeleteFeed(DeleteFeedRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/instances/*/feeds/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Enable feed for ingestion.
  rpc EnableFeed(EnableFeedRequest) returns (Feed) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/instances/*/feeds/*}:enable"
      body: "*"
    };
    option (google.api.method_signature) = "name";
  }

  // Disable feed for ingestion. Make FeedState ARCHIVED.
  rpc DisableFeed(DisableFeedRequest) returns (Feed) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/instances/*/feeds/*}:disable"
      body: "*"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists all feeds for the customer.
  rpc ListFeeds(ListFeedsRequest) returns (ListFeedsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/instances/*}/feeds"
    };
    option (google.api.method_signature) = "parent";
  }

  // Lists Packs for which feeds can be configured.
  rpc ListFeedPacks(ListFeedPacksRequest) returns (ListFeedPacksResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/instances/*}/feedPacks"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets a feed pack.
  rpc GetFeedPack(GetFeedPackRequest) returns (FeedPack) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/instances/*/feedPacks/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Updates the full feed.
  rpc UpdateFeed(UpdateFeedRequest) returns (Feed) {
    option (google.api.http) = {
      patch: "/v1/{feed.name=projects/*/locations/*/instances/*/feeds/*}"
      body: "feed"
    };
    option (google.api.method_signature) = "feed,update_mask";
  }

  // List all FeedSourceTypeSchemas.
  rpc ListFeedSourceTypeSchemas(ListFeedSourceTypeSchemasRequest)
      returns (ListFeedSourceTypeSchemasResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/instances/*}/feedSourceTypeSchemas"
    };
    option (google.api.method_signature) = "parent";
  }

  // List all LogTypeSchemas compatible with a given
  // FeedSourceType.
  rpc ListLogTypeSchemas(ListLogTypeSchemasRequest)
      returns (ListLogTypeSchemasResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/instances/*/feedSourceTypeSchemas/*}/logTypeSchemas"
    };
    option (google.api.method_signature) = "parent";
  }

  // Import logs coming from https push feeds.
  // All log entries must be valid UTF-8. A single invalid event will cause the
  // entire request to be rejected.
  rpc ImportPushLogs(ImportPushLogsRequest) returns (google.api.HttpBody) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/instances/*/feeds/*}:importPushLogs"
      body: "*"
    };
    option (google.api.method_signature) = "parent";
  }

  // Generates a new secret for https push feeds which do not support jwt
  // tokens. Secrets once generated should be copied and stored in safe place
  // to be used while configuring https push feeds.Please note that you can
  // always generate a new secret again for a feed using this API but it will
  // invalidate the previously generated secret for the feed.
  rpc GenerateSecret(GenerateSecretRequest) returns (GenerateSecretResponse) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/instances/*/feeds/*}:generateSecret"
      body: "*"
    };
    option (google.api.method_signature) = "name";
  }
}

// The type of URIs specified in the source URIs.
enum URISourceType {
  // If encountered, will throw an `INVALID_ARGUMENT` error.
  URI_SOURCE_TYPE_UNSPECIFIED = 0;

  // The type of files pointed to by `source_uris` are files.
  FILES = 1;

  // The type of files pointed to by `source_uris` are folders and Xenon
  // should not descend into subfolders of those folders.
  FOLDERS = 2;

  // The type of files pointed to by `source_uris` are folders and Xenon
  // should descend into subfolders of those folders.
  FOLDERS_RECURSIVE = 3;
}

// Source deletion option controls whether source files should be deleted after
// transferring.
enum SourceDeletionOption {
  // If encountered, will be treated as `SOURCE_DELETION_NEVER`.
  SOURCE_DELETION_OPTION_UNSPECIFIED = 0;

  // Never delete files from the source.
  SOURCE_DELETION_NEVER = 1;

  // After the fetch completes, if there are no errors, delete files and any
  // directories made empty by the file deletion from the source.
  SOURCE_DELETION_ON_SUCCESS = 2;

  // After the fetch completes, if there are no errors, delete files (leaving
  // any directories) from the source.
  SOURCE_DELETION_ON_SUCCESS_FILES_ONLY = 3;
}

// Source deletion option determines whether source files should be deleted
// after transferring.
enum SourceDeletionOptionV2 {
  // If encountered, will be treated as `SOURCE_DELETION_NEVER`.
  SOURCE_DELETION_OPTION_V2_UNSPECIFIED = 0;

  // Never delete files from the source.
  NEVER = 1;

  // After the fetch completes, if there are no errors, delete files and any
  // directories made empty by the file deletion from the source.
  ON_SUCCESS = 2;
}

// AWS S3 regions:
// https://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region.
enum S3Region {
  // Unspecified region means Auto detect.
  // Auto detect does not successfully detect GOV Cloud.
  S3_REGION_UNSPECIFIED = 0;

  // US.
  // N. Virginia (previously known as US_STANDARD).
  US_EAST_1 = 1;

  // Ohio.
  US_EAST_2 = 2;

  // N. California.
  US_WEST_1 = 3;

  // Oregon.
  US_WEST_2 = 4;

  // Not accessible unless AWS US Govt. account.
  US_GOV_CLOUD = 5;

  // Not accessible unless AWS US Govt. account.
  US_GOV_EAST_1 = 6;

  // Europe.
  // Ireland.
  EU_WEST_1 = 7;

  // London.
  EU_WEST_2 = 8;

  // Paris.
  EU_WEST_3 = 9;

  // Frankfurt.
  EU_CENTRAL_1 = 10;

  // Stockholm.
  EU_NORTH_1 = 11;

  // Milan.
  EU_SOUTH_1 = 21;

  // Asia Pacific
  // Mumbai.
  AP_SOUTH_1 = 12;

  // Singapore.
  AP_SOUTHEAST_1 = 13;

  // Sydney.
  AP_SOUTHEAST_2 = 14;

  // Jakarta.
  AP_SOUTHEAST_3 = 22;

  // Tokyo.
  AP_NORTHEAST_1 = 15;

  // Seoul.
  AP_NORTHEAST_2 = 16;

  // Osaka.
  AP_NORTHEAST_3 = 23;

  // Hong Kong.
  AP_EAST_1 = 24;

  // South America.
  // Sao Paulo.
  SA_EAST_1 = 17;

  // China - Not accessible unless AWS China account.
  // China - Beijing.
  CN_NORTH_1 = 18;

  // China - Ningxia.
  CN_NORTHWEST_1 = 19;

  // Canada.
  // Canada Central.
  CA_CENTRAL_1 = 20;

  // Africa.
  // Capetown.
  AF_SOUTH_1 = 25;

  // Middle East.
  // Bahrain.
  ME_SOUTH_1 = 26;

  // Asia Pacific (Hyderabad).
  AP_SOUTH_2 = 27;

  // Asia Pacific (Melbourne).
  AP_SOUTHEAST_4 = 28;

  // Canada West (Calgary).
  CA_WEST_1 = 29;

  // Europe (Spain).
  EU_SOUTH_2 = 30;

  // Europe (Zurich).
  EU_CENTRAL_2 = 31;

  // Israel (Tel Aviv).
  IL_CENTRAL_1 = 32;

  // Middle East (UAE).
  ME_CENTRAL_1 = 33;
}

// An enumeration of the possible types of a `Feed.details` field, where type
// implies both encoding and semantics. This is used in constructing a schema in
// order to construct a UI for creating well formed feeds.
enum SemanticType {
  // No semantic type. All fields must specify a semantic type.
  SEMANTIC_TYPE_UNSPECIFIED = 0;

  // A boolean (with no special semantics).
  BOOL = 1;

  // An enum (with no special semantics).
  ENUM = 2;

  // A repeated field with a Message type where the Message contains two
  // fields: `key` and `value`.
  KEY_VALUE_LIST = 3;

  // A `map<string, string>` (with no special semantics).
  MAP_STRING_STRING = 4;

  // A string (with no special semantics).
  STRING = 5;

  // A repeated string (with no special semantics).
  STRING_LIST = 6;

  // A string that may contain any whitespace characters (with no special
  // semantics).
  STRING_MULTILINE = 7;

  // A string that may contain any whitespace characters and that encodes a
  // secret.
  STRING_MULTILINE_SECRET = 8;

  // A string which encodes a secret.
  STRING_SECRET = 9;

  // A string which encodes a URI.
  STRING_URI = 10;

  // A repeated string which encodes URIs.
  STRING_URI_LIST = 11;
}

// FeedPack is a logical container for related LogTypes for which feeds can be
// configured.
message FeedPack {
  option (google.api.resource) = {
    type: "chronicle.googleapis.com/FeedPack"
    pattern: "projects/{project}/locations/{location}/instances/{instance}/feedPacks/{feed_pack}"
    plural: "feedPacks"
    singular: "feedPack"
  };

  // Type of feed pack. Feeds Page currently only lists PRODUCT_BASED packs.
  enum PackType {
    // Unspecified feed pack type.
    PACK_TYPE_UNSPECIFIED = 0;

    // Product based feed pack type.
    PRODUCT_BASED = 1;

    // Use case based feed pack type.
    USECASE_BASED = 2;

    // Onboarding feed pack type.
    ONBOARDING = 3;
  }

  // Identifier. The resource name of the feed pack.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feedPacks/{feed_pack}
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. The display name of the feed pack.
  string display_name = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The description of the feed pack.
  string description = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The icon image of the content pack in base64 in png format.
  bytes icon = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Categories the featured content is associated with. In case of
  // product feed packs, there will be only one category.
  repeated string categories = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Type of pack.
  PackType pack_type = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Log types featured in the pack.
  repeated PackLogType pack_log_types = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Whether the feed pack should be displayed in the Feeds Page.
  bool hidden = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Pack specific documentation in markdown format.
  string pack_documentation = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// PackLogtype is a log type featured in the feed pack.
message PackLogType {
  // Log Type featured in the feed pack.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}
  string log_type = 1;

  // Whether the logtype is required to deploy a feed pack.
  bool required = 2;

  // Whether a default(prebuilt) parser is available for the given log type.
  bool has_default_parser = 3;

  // The recommended source type for the log type.
  FeedDetails.FeedSourceType recommended_source_type = 4;

  // The display name of the log type.
  string display_name = 5;

  // Documentation to define steps on how to configure a log type.
  string configuration_documentation = 6;

  // Documentation to share any CTAs for more reference.
  string additional_documentation = 7;
}

// Feed is a resource that contains feed information needed to create a feed.
message Feed {
  option (google.api.resource) = {
    type: "chronicle.googleapis.com/Feed"
    pattern: "projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}"
  };

  // List of states a feed can have.
  enum State {
    // Unspecified feed state.
    STATE_UNSPECIFIED = 0;

    // Feed is configured and ready to ingest data. Newly created feeds have
    // this state. Once ingestion begins the feed will transition out of this
    // state and will not transition back.
    ACTIVE = 1;

    // Feed is Disabled. When a user disables a feed it will transition to this
    // state regardless of its current state. Once enabled a feed will
    // transition to its previous state.
    INACTIVE = 2;

    // Feed is enabled and currently ingesting data. A feed will transition to
    // this state from an ACTIVE or COMPLETED state when Chronicle has begun
    // fetching data for this feed.
    RUNNING = 3;

    // Feed is enabled and has recently successfully ingested data. A feed will
    // transition to this state from RUNNING or FAILED once a fetch has
    // completed successfully.
    SUCCEEDED = 4;

    // Feed is enabled, but has recently failed to ingest data. A feed will
    // transition to this state only from RUNNING once a fetch has failed. It
    // will remain in this state until a subsequent fetch has succeeded.
    FAILED = 5;
  }

  // The resource name of the feed.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string name = 1;

  // Output only. Unique identifier for the feed.
  string uid = 9 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Customer-provided feed name.
  string display_name = 2;

  // Additional details of the feed, these details are dynamic and will be
  // different for each of the feeds.
  FeedDetails details = 3;

  // Output only. State of the feed.
  State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Details about the most recent failure when feed state is
  // FAILED.
  string failure_msg = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Whether this feed can be updated or deleted.
  bool read_only = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Latest timestamp when the transfer was successful for the
  // feed.
  google.protobuf.Timestamp last_feed_initiation_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Failure details for the feed. If the feed is in the failure
  // state, this field will contain the details of the error cause and actions.
  FeedFailureDetails failure_details = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Reference ID, this field will contain the legacy id of the
  // feed.
  string reference_id = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// FeedFailureDetails contains details about the errors thrown by chronicle for
// the feeds. These are user visible details. These details help user identify
// the root cause and take appropriate action for the feed errors.
message FeedFailureDetails {
  // Output only. error_code contains the error code for the feed. The field is
  // populated for the feeds with failed status.
  string error_code = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. http_error_code contains the HTTP error code for the feed
  // failure. feed transfer failure may or may not result in http error code.
  int32 http_error_code = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. error_cause contains the information regarding the failure
  // cause.
  string error_cause = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. error_action contains the user action prescribed for
  // remediation of feed error.
  string error_action = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// FeedServiceAccount is a resource that wraps the feed service account's name.
message FeedServiceAccount {
  option (google.api.resource) = {
    type: "chronicle.googleapis.com/FeedServiceAccount"
    pattern: "projects/{project}/locations/{location}/instances/{instance}/feedServiceAccounts/{feed_service_account}"
  };

  // The resource name of the feedServiceAccount.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feedServiceAccounts/{feedserviceaccount}
  string name = 1;

  // Unique identifier for the service account.
  string subject_id = 2;
}

// Additional details of the feed, these details are dynamic and will be
// different for each of the feeds.
message FeedDetails {
  // Different types of feed sources.
  enum FeedSourceType {
    // Unspecified feed source type.
    FEED_SOURCE_TYPE_UNSPECIFIED = 0;

    // Cloud Storage.
    GOOGLE_CLOUD_STORAGE = 1;

    // HTTP.
    HTTP = 2;

    // SFTP.
    SFTP = 3;

    // S3.
    AMAZON_S3 = 4;

    // Azure Blobstore.
    AZURE_BLOBSTORE = 5;

    // API.
    API = 6;

    // SQS.
    AMAZON_SQS = 7;

    // Pub/Sub.
    PUBSUB = 8;

    // AMAZON_KINESIS_FIREHOSE.
    AMAZON_KINESIS_FIREHOSE = 9;

    // WEBHOOK.
    WEBHOOK = 10;

    // HTTPS GCloud Pub/Sub.
    HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB = 11;

    // HTTPS Amazon Kinesis Firehose.
    HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE = 12;

    // HTTPS Webhook.
    HTTPS_PUSH_WEBHOOK = 13;

    // Microsoft Azure native ingestion for event hub.
    AZURE_EVENT_HUB = 17;

    // Google Cloud Storage Feed backed by Omniflow STS
    GOOGLE_CLOUD_STORAGE_V2 = 18;

    // Amazon S3 Feed backed by Omniflow STS.
    AMAZON_S3_V2 = 19;

    // Amazon SQS Feed backed by Omniflow STS.
    AMAZON_SQS_V2 = 20;

    // Azure Blobstore Feed backed by Omniflow STS.
    AZURE_BLOBSTORE_V2 = 21;

    // Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
    GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN = 22;

    // A customized, declarative, configuration-driven connector for
    // ingesting JSON data from third-party REST APIs.
    CUSTOM_API = 23;
  }

  // Whether the feed is ready for STS migration.
  enum STSMigrationReadiness {
    // Default value. This value is unused.
    STS_MIGRATION_READINESS_UNSPECIFIED = 0;

    // The feed needs some work for STS migration.
    NOT_READY = 1;

    // The feed is ready for STS migration.
    READY = 2;

    // Need to recreate feed with updated auth.
    AUTH_RECONFIG_REQUIRED = 3;
  }

  // Additional details of the feed. Depends on the feed type.
  oneof details {
    // Anomali IOC settings.
    AnomaliIocSettings anomali_settings = 3;

    // Azure AD Context settings.
    AzureADContextSettings azure_ad_context_settings = 4;

    // Cloud Passage settings.
    CloudPassageSettings cloud_passage_settings = 5;

    // Cortex XDR settings.
    CortexXDRSettings cortex_xdr_settings = 6;

    // Duo Auth settings.
    DuoAuthSettings duo_auth_settings = 7;

    // Duo User Context settings.
    DuoUserContextSettings duo_user_context_settings = 8;

    // Microsoft Graph Alert settings.
    MicrosoftGraphAlertSettings microsoft_graph_alert_settings = 9;

    // Microsoft Security center alert settings.
    MicrosoftSecurityCenterAlertSettings
        microsoft_security_center_alert_settings = 10;

    // Mimecast mail settings.
    MimecastMailSettings mimecast_mail_settings = 11;

    // Office 365 settings.
    Office365Settings office365_settings = 12;

    // Proofpoint mail settings.
    ProofpointMailSettings proofpoint_mail_settings = 13;

    // Recorded Future IOC settings.
    RecordedFutureIocSettings recorded_future_ioc_settings = 14;

    // Workday settings.
    WorkdaySettings workday_settings = 15;

    // PAN IOC settings.
    PanIocSettings pan_ioc_settings = 16;

    // Okta settings.
    OktaSettings okta_settings = 17;

    // Okta user context settings.
    OktaUserContextSettings okta_user_context_settings = 18;

    // Fox-IT STIX settings.
    FoxITStixSettings fox_it_stix_settings = 19;

    // ThreatConnect IOC settings.
    ThreatConnectIoCSettings threat_connect_ioc_settings = 20;

    // ServiceNow CMDB settings.
    ServiceNowCMDBSettings service_now_cmdb_settings = 21;

    // Imperva WAF settings.
    ImpervaWAFSettings imperva_waf_settings = 22;

    // Thinkst Canary settings.
    ThinkstCanarySettings thinkst_canary_settings = 23;

    // RH-ISAC IOC settings.
    RHIsacIocSettings rh_isac_ioc_settings = 24;

    // Rapid7 Insight settings.
    Rapid7InsightSettings rapid7_insight_settings = 25;

    // Salesforce settings.
    SalesforceSettings salesforce_settings = 26;

    // Netskope alert settings.
    NetskopeAlertSettings netskope_alert_settings = 27;

    // Azure MDM Intune settings.
    AzureMDMIntuneSettings azure_mdm_intune_settings = 28;

    // Azure AD settings.
    AzureADSettings azure_ad_settings = 29;

    // Proofpoint On-Demand settings.
    ProofpointOnDemandSettings proofpoint_on_demand_settings = 30;

    // Workspace users settings.
    WorkspaceUsersSettings workspace_users_settings = 31;

    // Workspace activity settings.
    WorkspaceActivitySettings workspace_activity_settings = 32;

    // Workspace alerts settings.
    WorkspaceAlertsSettings workspace_alerts_settings = 33;

    // Workspace privileges settings.
    WorkspacePrivilegesSettings workspace_privileges_settings = 34;

    // Workspace mobile settings.
    WorkspaceMobileSettings workspace_mobile_settings = 35;

    // Workspace ChromeOS settings.
    WorkspaceChromeOSSettings workspace_chrome_os_settings = 36;

    // Workspace Groups settings.
    WorkspaceGroupsSettings workspace_groups_settings = 37;

    // Azure AD Audit settings.
    AzureADAuditSettings azure_ad_audit_settings = 38;

    // Symantec Event Export settings.
    SymantecEventExportSettings symantec_event_export_settings = 39;

    // Qualys VM settings
    QualysVMSettings qualys_vm_settings = 40;

    // PAN Prisma Cloud settings.
    PanPrismaCloudSettings pan_prisma_cloud_settings = 41;

    // Google Cloud Storage settings.
    GoogleCloudStorageSettings gcs_settings = 42;

    // HTTP settings.
    HttpSettings http_settings = 43;

    // SFTP settings.
    SftpSettings sftp_settings = 44;

    // Amazon S3 settings.
    AmazonS3Settings amazon_s3_settings = 45;

    // Azure Blob Storage settings.
    AzureBlobStoreSettings azure_blob_store_settings = 46;

    // Amazon SQS settings.
    AmazonSQSSettings amazon_sqs_settings = 47;

    // Google Cloud Identity Devices settings.
    GoogleCloudIdentityDevicesSettings google_cloud_identity_devices_settings =
        48;

    // Google Cloud Identity Device Users settings.
    GoogleCloudIdentityDeviceUsersSettings
        google_cloud_identity_device_users_settings = 49;

    // CrowdStrike Detects API settings.
    CrowdStrikeDetectsSettings crowdstrike_detects_settings = 50;

    // Mandiant IOC settings.
    MandiantIoCSettings mandiant_ioc_settings = 53;

    // SentinelOne Alert settings.
    SentineloneAlertSettings sentinelone_alert_settings = 54;

    // Qualys Scan Settings
    QualysScanSettings qualys_scan_settings = 55;

    // Pub/Sub settings.
    PubsubSettings pubsub_settings = 56;

    // Amazon Kinesis Firehose settings.
    AmazonKinesisFirehoseSettings amazon_kinesis_firehose_settings = 57;

    // Webhook settings.
    WebhookSettings webhook_settings = 58;

    // DummyLogType Settings.
    DummyLogTypeSettings dummy_log_type_settings = 59;

    // Https push Google Pub/Sub settings.
    HttpsPushGoogleCloudPubSubSettings https_push_google_cloud_pubsub_settings =
        60;

    // Https push Amazon Kinesis Firehose settings.
    HttpsPushAmazonKinesisFirehoseSettings
        https_push_amazon_kinesis_firehose_settings = 61;

    // Https push Webhook settings.
    HttpsPushWebhookSettings https_push_webhook_settings = 62;

    // AWS EC2 Hosts settings.
    AWSEC2HostsSettings aws_ec2_hosts_settings = 63;

    // AWS EC2 Instances settings.
    AWSEC2InstancesSettings aws_ec2_instances_settings = 64;

    // AWS EC2 Vpcs settings.
    AWSEC2VpcsSettings aws_ec2_vpcs_settings = 65;

    // AWS IAM settings.
    AWSIAMSettings aws_iam_settings = 66;

    // Netskope alert V2 settings.
    NetskopeAlertV2Settings netskope_alert_v2_settings = 70;

    // Settings for Google Cloud Storage Omniflow feeds.
    GoogleCloudStorageV2Settings gcs_v2_settings = 71;

    // Settings for S3 Omniflow feeds.
    AmazonS3V2Settings amazon_s3_v2_settings = 72;

    // Settings for SQS Omniflow feeds.
    AmazonSQSV2Settings amazon_sqs_v2_settings = 73;

    // Settings for Omniflow based native ingestion from azure event hub.
    AzureEventHubSettings azure_event_hub_settings = 74;

    // Settings for Trellix HX Host Metadata.
    TrellixHxHostsSettings trellix_hx_hosts_settings = 75;

    // Settings for Azure Blobstore Omniflow feeds.
    AzureBlobStoreV2Settings azure_blob_store_v2_settings = 76;

    // Settings for Trellix HX Alerts Metadata.
    TrellixHxAlertsSettings trellix_hx_alerts_settings = 77;

    // Settings for Omniflow based Google Cloud Storage event driven feeds.
    GoogleCloudStorageEventDrivenSettings
        google_cloud_storage_event_driven_settings = 78;

    // CrowdStrike Alerts API settings.
    CrowdStrikeAlertsSettings crowdstrike_alerts_settings = 79;

    // Settings for Trellix HX Bulk Acquisitions Metadata.
    TrellixHxBulkAcqsSettings trellix_hx_bulk_acqs_settings = 80;

    // Required. Mimecast mail v2 settings.
    MimecastMailV2Settings mimecast_mail_v2_settings = 82
        [(google.api.field_behavior) = REQUIRED];

    // Threat Connect IOC V3 settings.
    ThreatConnectIoCV3Settings threat_connect_ioc_v3_settings = 83;

    // Settings for Custom API (Codeless) Feeds.
    CustomAPISettings custom_api_settings = 85;
  }

  // Source Type of the feed.
  FeedSourceType feed_source_type = 1;

  // LogType.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}
  string log_type = 2 [(google.api.resource_reference) = {
    type: "chronicle.googleapis.com/LogType"
  }];

  // The asset namespace to apply to all logs ingested through this feed.
  string asset_namespace = 51;

  // The ingestion metadata labels to apply to all logs ingested through this
  // feed, and the resulting normalized data.
  map<string, string> labels = 52;

  // Optional. The status of the feed's migration to STS.
  STSMigrationReadiness sts_migration_readiness = 81
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. The time of the last attempt to migrate the feed to STS V2.
  google.protobuf.Timestamp last_v2_migration_attempt_time = 84
      [(google.api.field_behavior) = OPTIONAL];
}

// Settings required by Feeds of DummyLogType(used for testing purposes).
message DummyLogTypeSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // Full API Endpoint.
  string api_endpoint = 2;
}

// Settings required by Google Cloud Platform Pub/Sub Feeds(HTTPS-Push V2).
message HttpsPushGoogleCloudPubSubSettings {
  // Optional. Delimiter to split on for the feed.
  string split_delimiter = 1 [(google.api.field_behavior) = OPTIONAL];
}

// Settings required by Amazon Kinesis Firehose Feeds(HTTPS-Push V2).
message HttpsPushAmazonKinesisFirehoseSettings {
  // Optional. Delimiter to split on for the feed.
  string split_delimiter = 1 [(google.api.field_behavior) = OPTIONAL];
}

// Settings required by Webhook Feeds(HTTPS-Push V2).
message HttpsPushWebhookSettings {
  // Optional. Delimiter to split on for the feed.
  string split_delimiter = 1 [(google.api.field_behavior) = OPTIONAL];
}

// SentinelOne Alert settings.
message SentineloneAlertSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // Hostname of SentinelOne alert settings.
  string hostname = 2;

  // initialStartTime from when to fetch the alerts
  string initial_start_time = 3;

  // Is the customer subscribed to Alerts Api
  bool is_alert_api_subscribed = 4;
}

// Qualys Scan settings.
message QualysScanSettings {
  // API Type
  enum ApiType {
    // Unspecified API Type
    API_TYPE_UNSPECIFIED = 0;

    // Scan Summaries
    SCAN_SUMMARY_OUTPUT = 1;

    // Scan Compliance
    SCAN_COMPLIANCE_OUTPUT = 2;

    // Scan Compliance Control
    SCAN_COMPLIANCE_CONTROL_OUTPUT = 3;
  }

  // Input only. Authentication
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Hostname.
  string hostname = 2;

  // Supported Qualys Scan api type.
  ApiType api_type = 3;
}

// Settings required by Google Cloud Pub/Sub Feeds(HTTP-Push).
message PubsubSettings {
  // Google Service Account Email.
  string google_service_account_email = 1;
}

// Settings required by Amazon Kinesis Firehose Feeds(HTTP-Push).
message AmazonKinesisFirehoseSettings {}

// Settings required by Webhook Feeds(HTTP-Push).
message WebhookSettings {}

// Amazon SQS settings.
message AmazonSQSSettings {
  // S3 Region.
  S3Region region = 1;

  // Name of the queue.
  string queue = 2;

  // Account number of the owner of the queue.
  string account_number = 3;

  // Input only. Authentication.
  SQSAuth authentication = 4 [(google.api.field_behavior) = INPUT_ONLY];

  // Source deletion option.
  SourceDeletionOption source_deletion_option = 5;
}

// Anomali IOC settings.
message AnomaliIocSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Optional. The hostname of the Anomali ThreatStream instance.
  string hostname = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Azure AD settings.
message AzureADSettings {
  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Tenant ID.
  string tenant_id = 2;

  // API Hostname.
  string hostname = 3;

  // API Auth Endpoint.
  string auth_endpoint = 4;
}

// Azure AD Audit settings.
message AzureADAuditSettings {
  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Tenant ID.
  string tenant_id = 2;

  // API Hostname.
  string hostname = 3;

  // API Auth Endpoint.
  string auth_endpoint = 4;
}

// Azure AD Context settings.
message AzureADContextSettings {
  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Whether to retrieve device information in user context.
  bool retrieve_devices = 2;

  // Whether to retrieve group information in user context.
  bool retrieve_groups = 3;

  // Tenant ID.
  string tenant_id = 4;

  // API Hostname.
  string hostname = 5;

  // API Auth Endpoint.
  string auth_endpoint = 6;
}

// CloudPassage settings.
message CloudPassageSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Event types filter for the events API.
  repeated string event_types = 2;
}

// PAN Cortex XDR settings.
message CortexXDRSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // API Endpoint.
  string endpoint = 3;
}

// CrowdStrike Detects settings.
message CrowdStrikeDetectsSettings {
  // Ingestion Type.
  enum IngestionType {
    // For the feeds in which this field is not set
    INGESTION_TYPE_UNSPECIFIED = 0;

    // Ingests only new detections to be ingested.
    BRING_ONLY_NEW_DETECTIONS = 1;

    // Ingests both new as well as old detections which are updated
    BRING_ALL_DETECTIONS = 2;
  }

  // Input only. OAuthClientCredentials.
  OAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Optional. Ingestion Type.
  IngestionType ingestion_type = 3 [(google.api.field_behavior) = OPTIONAL];
}

// CrowdStrike Alerts settings.
message CrowdStrikeAlertsSettings {
  // Ingestion Type.
  enum IngestionType {
    // For the feeds in which this field is not set
    INGESTION_TYPE_UNSPECIFIED = 0;

    // Ingests both new as well as old alerts which are updated
    BRING_ALL_ALERTS = 1;

    // Ingests only new alerts to be ingested.
    BRING_ONLY_NEW_ALERTS = 2;
  }

  // Required. OAuthClientCredentials.
  OAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. API Hostname.
  string hostname = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. Ingestion Type.
  IngestionType ingestion_type = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Duo Authentication settings.
message DuoAuthSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;
}

// Duo User Context settings.
message DuoUserContextSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API hostname.
  string hostname = 2;
}

// Microsoft Graph Alert settings.
message MicrosoftGraphAlertSettings {
  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Tenant ID.
  string tenant_id = 2;

  // API Hostname.
  string hostname = 3;

  // API Auth Endpoint.
  string auth_endpoint = 4;
}

// Microsoft Security Center alert settings.
message MicrosoftSecurityCenterAlertSettings {
  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Subscription ID of the Microsoft security center alert settings alert.
  string subscription_id = 2;

  // Tenant ID.
  string tenant_id = 3;

  // API Hostname.
  string hostname = 4;

  // API Auth Endpoint.
  string auth_endpoint = 5;
}

// Mimecast Mail settings.
message MimecastMailSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;
}

// Mimecast Mail V2 Settings.
message MimecastMailV2Settings {
  // Required. Mimecast OAuthClientCredentials.
  MimecastV2OAuthClientCredentials auth_credentials = 1
      [(google.api.field_behavior) = REQUIRED];
}

// Office 365 settings.
message Office365Settings {
  // Office 365 supported content types:
  // https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#working-with-the-office-365-management-activity-api
  enum ContentType {
    // Unspecified content type.
    CONTENT_TYPE_UNSPECIFIED = 0;

    // Audit.AzureActiveDirectory.
    AUDIT_AZURE_ACTIVE_DIRECTORY = 1;

    // Audit.Exchange.
    AUDIT_EXCHANGE = 2;

    // Audit.SharePoint.
    AUDIT_SHARE_POINT = 3;

    // Audit.General.
    AUDIT_GENERAL = 4;

    // DLP.All.
    DLP_ALL = 5;
  }

  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Tenant ID.
  string tenant_id = 2;

  // Supported office 365 content type.
  ContentType content_type = 3;

  // API Hostname.
  string hostname = 4;

  // API Auth Endpoint.
  string auth_endpoint = 5;
}

// Proofpoint Mail settings.
message ProofpointMailSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// Proofpoint On-demand settings.
message ProofpointOnDemandSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // Cluster ID.
  string cluster_id = 2;
}

// Recorded Future IOC settings.
message RecordedFutureIocSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];
}

// Workday settings.
message WorkdaySettings {
  // Input only. Authentication.
  WorkdayAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Tenant ID.
  string tenant_id = 3;
}

// PAN IOC settings.
message PanIocSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // PAN IOC feed ID.
  string feed_id = 2;

  // PAN IOC feed name.
  string feed = 3;
}

// Okta settings.
message OktaSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;
}

// Okta user context settings.
message OktaUserContextSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Manager id reference field.
  string manager_id_reference_field = 3;
}

// Fox-IT STIX settings.
message FoxITStixSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // SSL client key pair.
  SSLClientKeypair ssl = 2;

  // TAXII poll service URI.
  string poll_service_uri = 3;

  // Collection available at the poll service.
  string collection = 4;
}

// ThreatConnect IOC Settings.
message ThreatConnectIoCSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Owners.
  repeated string owners = 3;
}

// ThreatConnectIoCV3Settings
message ThreatConnectIoCV3Settings {
  // Required. Input only. UsernameSecretAuth.
  UsernameSecretAuth authentication = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = INPUT_ONLY
  ];

  // Required. hostname.
  string hostname = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Owners.
  repeated string owners = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. ThreatConnect Query Language filter.
  string tql_query = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Fields
  repeated string fields = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Schedule
  int32 schedule = 6 [(google.api.field_behavior) = OPTIONAL];
}

// ServiceNow CMDB settings.
message ServiceNowCMDBSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Feedname.
  string feedname = 3;
}

// Imperva WAF settings.
message ImpervaWAFSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];
}

// Thinkst Canary settings.
message ThinkstCanarySettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;
}

// RH-ISAC settings.
message RHIsacIocSettings {
  // Input only. Authentication.
  OAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// Rapid7 Insight settings.
message Rapid7InsightSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // Rapid7 API endpoint. Should be "vulnerabilities" or "assets".
  string endpoint = 2;

  // API Hostname.
  string hostname = 3;
}

// Salesforce settings.
message SalesforceSettings {
  // Possible types of authentication.
  oneof authentication {
    // Input only. OAuthPasswordGrantCredentials auth.
    OAuthPasswordGrantCredentials oauth_password_grant_auth = 1
        [(google.api.field_behavior) = INPUT_ONLY];

    // Input only. OAuthJWTCredentials auth.
    OAuthJWTCredentials oauth_jwt_credentials = 2
        [(google.api.field_behavior) = INPUT_ONLY];
  }

  // API hostname.
  string hostname = 3;
}

// Mandiant IOC settings.
message MandiantIoCSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // time since when to start fetching the IOCs
  google.protobuf.Timestamp start_time = 2;
}

// Netskope Alert settings.
message NetskopeAlertSettings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Feedname.
  string feedname = 3;

  // Content type.
  string content_type = 4;
}

// Netskope Alert V2 settings.
message NetskopeAlertV2Settings {
  // Input only. Authentication.
  HttpHeaderAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;

  // Content Category.
  string content_category = 3;

  // Content type.
  repeated string content_types = 4;
}

// Azure MDM Intune settings.
message AzureMDMIntuneSettings {
  // Input only. Authentication.
  MicrosoftOAuthClientCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Tenant ID.
  string tenant_id = 2;

  // API Hostname.
  string hostname = 3;

  // API Auth Endpoint.
  string auth_endpoint = 4;
}

// Workspace Users settings.
message WorkspaceUsersSettings {
  // Projection Type.
  enum ProjectionType {
    // For the feeds in which this field is not set.
    PROJECTION_TYPE_UNSPECIFIED = 0;

    // Do not include any custom fields for the user.
    BASIC_PROJECTION = 1;

    // Include both basic and custom fields associated with this user.
    FULL_PROJECTION = 2;
  }

  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;

  // Optional. Projection Type.
  ProjectionType projection_type = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Workspace Activity settings.
message WorkspaceActivitySettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;

  // Applications.
  repeated string applications = 3;
}

// Workspace Alert settings.
message WorkspaceAlertsSettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;
}

// Workspace Privileges settings.
message WorkspacePrivilegesSettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;
}

// Workspace Mobile settings.
message WorkspaceMobileSettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;
}

// Workspace Chrome OS settings.
message WorkspaceChromeOSSettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;
}

// Workspace Groups settings.
message WorkspaceGroupsSettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // Customer ID.
  string workspace_customer_id = 2;
}

// Google Cloud Identity Devices settings.
message GoogleCloudIdentityDevicesSettings {
  // Input only. Authentication
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API Version
  string api_version = 2;
}

// Google Cloud Identity Device Users settings.
message GoogleCloudIdentityDeviceUsersSettings {
  // Input only. Authentication.
  OAuthJWTCredentials authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// Symantec Event Export settings.
message SymantecEventExportSettings {
  // Input only. Authentication.
  OAuthRefreshToken authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// Qualys VM settings.
message QualysVMSettings {
  // Input only. Authentication.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;
}

// PAN Prisma Cloud settings.
message PanPrismaCloudSettings {
  // Input only. Authentication.
  PanPrismaAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // API Hostname.
  string hostname = 2;
}

// SFTP settings.
message SftpSettings {
  // Input only. Authentication.
  SftpAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // SFTP URI.
  string uri = 2;

  // The URI source type.
  URISourceType source_type = 3;

  // Source deletion option.
  SourceDeletionOption source_deletion_option = 4;
}

// Google Cloud Storage settings.
message GoogleCloudStorageSettings {
  // Bucket URI.
  string bucket_uri = 1;

  // The URI source type.
  URISourceType source_type = 2;

  // Source deletion option.
  SourceDeletionOption source_deletion_option = 3;

  // Output only. Service Account Chronicle will be using to pull data.
  string chronicle_service_account = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// HTTP settings.
message HttpSettings {
  // HTTP URI.
  string uri = 1;

  // The URI source type.
  URISourceType source_type = 2;

  // Source deletion option.
  SourceDeletionOption source_deletion_option = 3;
}

// Amazon S3 settings.
message AmazonS3Settings {
  // Input only. Authentication.
  S3Auth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // S3 URI.
  string s3_uri = 2;

  // The URI source type.
  URISourceType source_type = 3;

  // Source deletion option.
  SourceDeletionOption source_deletion_option = 4;
}

// Azure Blob Storage settings.
message AzureBlobStoreSettings {
  // Input only. Authentication.
  AzureAuth authentication = 1 [(google.api.field_behavior) = INPUT_ONLY];

  // Azure URI.
  string azure_uri = 2;

  // The URI source type.
  URISourceType source_type = 3;

  // Source deletion option.
  SourceDeletionOption source_deletion_option = 4;
}

// AWS EC2 Hosts Settings.
message AWSEC2HostsSettings {
  // Input only. UsernameSecretAuth.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// AWS EC2 Instances Settings.
message AWSEC2InstancesSettings {
  // Input only. UsernameSecretAuth.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// AWS EC2 Vpcs Settings.
message AWSEC2VpcsSettings {
  // Input only. UsernameSecretAuth.
  UsernameSecretAuth authentication = 1
      [(google.api.field_behavior) = INPUT_ONLY];
}

// AWSIAMSettings contains details needed for creating an AWS IAM feed.
message AWSIAMSettings {
  // API Type
  enum ApiType {
    // API Type Unspecified
    API_TYPE_UNSPECIFIED = 0;

    // Users.
    USERS = 1;

    // Roles.
    ROLES = 2;

    // Groups.
    GROUPS = 3;
  }

  // Input only. Authentication
  UsernameSecretAuth authentication = 2
      [(google.api.field_behavior) = INPUT_ONLY];

  // Supported AWS IAM api type.
  ApiType api_type = 3;
}

// Azure auth.
message AzureAuth {
  // Type of auth used with Azure.
  oneof auth_type {
    // Shared Key.
    string shared_key = 1;

    // SAS Token.
    string sas_token = 2;
  }
}

// Amazon SQS auth.
message SQSAuth {
  // SQS access key secret auth.
  SQSAccessKeySecretAuth sqs_access_key_secret_auth = 1;

  // Authentication for the S3 bucket referred to by the items in the SQS queue.
  // This is only required if it is different from the authentication for the
  // queue.
  AdditionalS3AccessKeySecretAuth additional_s3_access_key_secret_auth = 2;
}

// A message containing fields used to authenticate with Amazon SQS.
message SQSAuthV2 {
  // auth tyoe for the SQS queue.
  oneof auth_type {
    // Required. Auth key and secret for the SQS queue.
    SQSV2AccessKeySecretAuth sqs_v2_access_key_secret_auth = 3
        [(google.api.field_behavior) = REQUIRED];

    // Required. AWS IAM Role for Identity Federation.
    SQSV2AwsIamRoleAuth aws_iam_role_auth = 5
        [(google.api.field_behavior) = REQUIRED];
  }
}

// AWS IAM Role Auth for SQS V2.
message SQSV2AwsIamRoleAuth {
  // AWS IAM Role for Identity Federation.
  string aws_iam_role_arn = 1;

  // Subject ID to use for SQS.
  string subject_id = 2;
}

// SQS V2 access key and secret auth.
message SQSV2AccessKeySecretAuth {
  // Access key ID of the S3 bucket.  Ex: AKIABCDEFGHIJKL.
  string access_key_id = 1;

  // Secret access key to access the S3 bucket.
  string secret_access_key = 2;
}

// Amazon SQS access key and secret auth.
message SQSAccessKeySecretAuth {
  // Access key ID.
  string access_key_id = 1;

  // Secret access key.
  string secret_access_key = 2;
}

// Additional S3 access key secret auth.
message AdditionalS3AccessKeySecretAuth {
  // Access key ID.
  string access_key_id = 1;

  // Secret access key.
  string secret_access_key = 2;
}

// Amazon S3 auth.
message S3Auth {
  // Access key ID. Used when using access key auth.
  string access_key_id = 1;

  // Secret access key. Used when using access key auth.
  string secret_access_key = 2;

  // Client ID. Used when using OAuth auth.
  string client_id = 3;

  // Client secret. Used when using OAuth auth.
  string client_secret = 4;

  // Refresh URI. Used when using OAuth auth.
  string refresh_uri = 5;

  // S3 Region.
  S3Region region = 6;
}

// OAuth 2.0 refresh token grant. See https://tools.ietf.org/html/rfc6749.
message OAuthRefreshToken {
  // Token endpoint to get the OAuth token from.
  string token_endpoint = 1;

  // Client ID.
  string client_id = 2;

  // Client secret.
  string client_secret = 3;

  // Refresh token.
  string refresh_token = 4;
}

// SFTP Auth.
message SftpAuth {
  // Username. Used for username and password authentication.
  string username = 1;

  // Password. Used for username and password authentication.
  string password = 2;

  // Private key. Used for private key authentication.
  string private_key = 3;

  // Private key passphrase. Used for private key authentication.
  string private_key_passphrase = 4;
}

// HTTP header based authentication.
message HttpHeaderAuth {
  // Header key-value pairs.
  repeated HeaderKeyValue header_key_values = 1;
}

// Header key-value pairs.
message HeaderKeyValue {
  // Key.
  string key = 1;

  // Value.
  string value = 2;
}

// Info for username and secret based authentication.
message UsernameSecretAuth {
  // Username of an identity used for authentication.
  string user = 1;

  // Secret of the account identified by user_name.
  string secret = 2;
}

// Microsoft OAuth 2.0 client credentials grant.
message MicrosoftOAuthClientCredentials {
  // Client ID.
  string client_id = 1;

  // Client secret.
  string client_secret = 2;
}

// OAuth 2.0 client credentials grant. See https://tools.ietf.org/html/rfc6749.
message OAuthClientCredentials {
  // Token endpoint.
  string token_endpoint = 1;

  // Client ID.
  string client_id = 2;

  // Client secret.
  string client_secret = 3;
}

// OAuth 2.0 password grant. See https://tools.ietf.org/html/rfc6749.
message OAuthPasswordGrantCredentials {
  // Token endpoint to get the OAuth token from.
  string token_endpoint = 1;

  // Client ID.
  string client_id = 2;

  // Client secret.
  string client_secret = 3;

  // Username.
  string user = 4;

  // Password.
  string password = 5;
}

// PAN Prisma Cloud auth.
message PanPrismaAuth {
  // Username.
  string user = 1;

  // Password.
  string password = 2;
}

// OAuth 2.0 JWT grant. See, https://tools.ietf.org/html/rfc7519
message OAuthJWTCredentials {
  // Credentials.
  oneof credentials {
    // RS credentials.
    RSCredentials rs_credentials = 3;
  }

  // Token endpoint to get the OAuth token from.
  string token_endpoint = 1;

  // Claims.
  Claims claims = 2;
}

// RS credentials.
message RSCredentials {
  // Private key in PEM format.
  string private_key = 1;
}

// Claims identifying a specific customer.
message Claims {
  // Issuer. Usually the client_id.
  string issuer = 1;

  // Subject. Usually the email.
  string subject = 2;

  // Audience.
  string audience = 3;
}

// An SSL client certificate keypair.
message SSLClientKeypair {
  // The encoded private key. The string should be a private key in PEM format,
  // and should include the begin header and end footer lines. It may also
  // include newlines.
  //
  // Example:
  // -----BEGIN RSA PRIVATE KEY-----
  // Proc-Type: 4,ENCRYPTED
  // DEK-Info: DES-EDE3-CBC,F23074E02CF47304
  //
  // <REDACTED>
  // -----END RSA PRIVATE KEY-----
  string encoded_private_key = 1;

  // The encoded SSL certificate. The string should be an SSL certificate in
  // PEM format, and should include the begin header and end footer lines. It
  // may also include newlines.
  //
  // Example:
  // -----BEGIN CERTIFICATE-----
  // <REDACTED>
  // -----END CERTIFICATE-----
  string ssl_certificate = 2;
}

// Authentication for Workday.
message WorkdayAuth {
  // Username. This is unused: Workday feeds were originally configured using a
  // username and secret authentication method, but only the secret field was
  // used, and it was used to supply the OAuth access token.
  string user = 1;

  // The access token used to authenticate against Workday. This field is called
  // "secret" to maintain backwards compatibility. Workday was (only) configured
  // using username (which was unused) and secret (which is used as the access
  // token). Either this field or all of the other OAuth fields below must be
  // specified.
  string secret = 2;

  // Token endpoint to get the OAuth token from.
  string token_endpoint = 3;

  // Client ID.
  string client_id = 4;

  // Client Secret.
  string client_secret = 5;

  // Refresh Token.
  string refresh_token = 6;
}

// GoogleCloudStorageV2Settings is the settings proto for Omniflow Google Cloud
// Storage feeds.
message GoogleCloudStorageV2Settings {
  // Required. Google Cloud Storage Bucket URI for the feed.
  string bucket_uri = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Source deletion option determines if the data from the source is
  // to be deleted after ingestion.
  SourceDeletionOptionV2 source_deletion_option = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. SA that will read data, this is Storage Transfer Service SA of
  // Customer's Tenancy Project.
  string chronicle_service_account = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Maximum File Age to ingest in days.
  int32 max_lookback_days = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Optional list of object prefixes to include.
  repeated string include_prefixes = 5 [(google.api.field_behavior) = OPTIONAL];
}

// GoogleCloudStorageEventDrivenSettings is the settings proto for Omniflow
// Google Cloud Storage feeds driven by pubsub events.
message GoogleCloudStorageEventDrivenSettings {
  // Required. Google Cloud Storage Bucket URI for the feed.
  string bucket_uri = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Subscription name for pubsub topic.
  string pubsub_subscription = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. Source deletion option determines if the data from the source is
  // to be deleted after ingestion.
  SourceDeletionOptionV2 source_deletion_option = 3
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. SA that will read data, this is Storage Transfer Service SA of
  // Customer's Tenancy Project.
  string chronicle_service_account = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Maximum File Age to ingest in days.
  int32 max_lookback_days = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Optional list of object prefixes to include.
  repeated string include_prefixes = 6 [(google.api.field_behavior) = OPTIONAL];
}

// A message containing fields used to authenticate with Amazon S3.
message S3AuthV2 {
  // auth type for S3.
  oneof auth_type {
    // Access Key ID and Secret Access Key for an AWS account.
    S3V2AccessKeySecretAuth access_key_secret_auth = 3;

    // AWS IAM Role Auth for Identity Federation.
    S3V2AwsIamRoleAuth aws_iam_role_auth = 5;
  }
}

// AWS IAM Role Auth for S3 V2.
message S3V2AwsIamRoleAuth {
  // AWS IAM Role for Identity Federation.
  string aws_iam_role_arn = 1;

  // Subject ID to use for S3.
  string subject_id = 2;
}

// S3 V2 access key and secret auth.
message S3V2AccessKeySecretAuth {
  // Required. Access Key ID for an AWS account (a 20-character, alphanumeric
  // string).
  string access_key_id = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Secret Access Key for an AWS account (a 40-character string).
  string secret_access_key = 2 [(google.api.field_behavior) = REQUIRED];
}

// AmazonS3V2Settings is the settings proto for Omniflow S3 feeds.
message AmazonS3V2Settings {
  // Required. Authentication.
  S3AuthV2 authentication = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. S3 URI.
  string s3_uri = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. Source deletion option.
  SourceDeletionOptionV2 source_deletion_option = 3
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Maximum File Age to ingest in days.
  int32 max_lookback_days = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. SA that will read data, this is Storage Transfer Service SA of
  // Customer's Tenancy Project.
  string chronicle_service_account = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of object prefixes to include.
  repeated string include_prefixes = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Info for MssoAuthentication using a username, password, and login api
// endpoint.
message MssoAuthentication {
  // Required. Username for MSSO authentication.
  // There are no restrictions on the format of the username. It has no default,
  // specifically enforced min / max length or character set. The username
  // will have been provided by an MSSO administrator and it is assumed that
  // they have provided a username that is internally consistent with MSSO
  // authentication requirements / validation.
  string username = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Password of the account identified by username.
  // There are no restrictions on the format of the password. It has no default,
  // specifically enforced min / max length or character set. The password
  // will have been provided by an MSSO administrator and it is assumed that
  // they have provided a password that is internally consistent with MSSO
  // authentication requirements / validation.
  string password = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The login api endpoint url.
  // This must be a valid URL with an http or https scheme. It has no default.
  string api_endpoint = 3 [(google.api.field_behavior) = REQUIRED];
}

// OAuth 2.0 client credentials grant. See https://tools.ietf.org/html/rfc6749.
message MimecastV2OAuthClientCredentials {
  // Required. Client ID.
  string client_id = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Client Secret.
  string client_secret = 2 [(google.api.field_behavior) = REQUIRED];
}

// Settings for TrellixIAMAuthentication.
message TrellixIAMAuthentication {
  // Required. Client ID generated in Trellix IAM.
  // This is a unique identifier for the user that is generated in Trellix IAM.
  // It has no default, specifically enforced min / max length or character set.
  // It is assumed that the Client ID generated in Trellix IAM is internally
  // consistent with Trellix IAM authentication requirements / validation.
  string client_id = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Secret associated with the Client ID.
  // This is the secret generated in Trellix IAM for the Client ID. It has no
  // default, specifically enforced min / max length or character set. It is
  // assumed that the secret generated in Trellix IAM is internally
  // consistent with Trellix IAM authentication requirements / validation.
  string client_secret = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. OAUTH 2 scope to request for the authentication token.
  // This is the OAUTH 2 scope to request for the authentication token. It has
  // no default, specifically enforced min / max length or character set. It is
  // assumed that the scope provided is internally consistent with Trellix IAM
  // authentication requirements / validation.
  string scope = 3 [(google.api.field_behavior) = REQUIRED];
}

// Info for TrellixLocalAuthentication using a username, password, endpoint,
// and header name.
message TrellixLocalAuthentication {
  // Required. Username for Trellix Local authentication.
  // This is a unique username for the user that is generated on a Trellix
  // device. It has no default, specifically enforced min / max length,
  // or character set.
  string username = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Password of the account identified by username.
  // There are no restrictions on the format of the password. It has no default,
  // specifically enforced min / max length or character set. The password
  // will have been provided by the Trellix administrator.
  string password = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The endpoint to fetch the token from.
  // This must be a valid URL with an http or https scheme. It has no default.
  string token_endpoint = 3 [(google.api.field_behavior) = REQUIRED];

  // Required. The HTTP header name to use for the token for authentcated
  // requests. It varies per Trellix product. Refer to the Trellix API
  // documentation for the correct value. It has no default.
  string token_header = 4 [(google.api.field_behavior) = REQUIRED];
}

// TrellixStarXAuthentication contains a oneof with all of the authentication
// types supported by Trellix *X devices.
message TrellixStarXAuthentication {
  // One of multiple potential auth types.
  oneof auth_type {
    // Input only. MssoAuthentication auth type.
    MssoAuthentication msso = 1 [(google.api.field_behavior) = INPUT_ONLY];

    // Input only. TrellixIAMAuthentication auth type.
    TrellixIAMAuthentication trellix_iam = 2
        [(google.api.field_behavior) = INPUT_ONLY];

    // Input only. TrellixLocalAuthentication auth type.
    TrellixLocalAuthentication trellix_local = 3
        [(google.api.field_behavior) = INPUT_ONLY];
  }
}

// Settings required by Feeds of TrellixHxHosts.
message TrellixHxHostsSettings {
  // Required. Authentication.
  TrellixStarXAuthentication authentication = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Trellix HX Device URL.
  // This must be a valid URL with an http or https scheme. It has no default.
  // Usually a device URL is in the form of either:
  // https://xxx.trellix.com/hx/id/<hx id>/
  //  - or -
  // https://htapdeviceproxy.md.mandiant.net/dphb/hx/<device uuid>/
  string endpoint = 2 [(google.api.field_behavior) = REQUIRED];
}

// Settings required by Feeds of TrellixHxAlerts.
message TrellixHxAlertsSettings {
  // Required. Authentication.
  TrellixStarXAuthentication authentication = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Trellix HX Device URL.
  // This must be a valid URL with an http or https scheme. It has no default.
  // Usually a device URL is in the form of either:
  // https://xxx.trellix.com/hx/id/<hx id>/
  //  - or -
  // https://htapdeviceproxy.md.mandiant.net/dphb/hx/<device uuid>/
  string endpoint = 2 [(google.api.field_behavior) = REQUIRED];
}

// Settings required by Feeds of TrellixHxBulkAcqs.
message TrellixHxBulkAcqsSettings {
  // Required. Authentication.
  TrellixStarXAuthentication authentication = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Trellix HX Device URL.
  // This must be a valid URL with an http or https scheme. It has no default.
  // Usually a device URL is in the form of either:
  // https://xxx.trellix.com/hx/id/<hx id>/
  //  - or -
  // https://htapdeviceproxy.md.mandiant.net/dphb/hx/<device uuid>/
  string endpoint = 2 [(google.api.field_behavior) = REQUIRED];
}

// Settings required by Azure Event Hub Feeds.
message AzureEventHubSettings {
  // Required. Event hub to read from.
  string name = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Event hub consumer group to read from.
  string consumer_group = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Event hub connection string for authentication.
  string event_hub_connection_string = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. Blob store connection string for authentication.
  string azure_storage_connection_string = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Blob storage container name.
  string azure_storage_container = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. SAS token
  string azure_sas_token = 6 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Event hub namespace
  string event_hub_namespace = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// AmazonSQSV2Settings is the settings proto for Omniflow SQS feeds.
message AmazonSQSV2Settings {
  // Required. Amazon Resource Name(ARN) of the queue.
  string queue = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. S3 URI.
  string s3_uri = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Authentication.
  SQSAuthV2 authentication = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. Source deletion option.
  SourceDeletionOptionV2 source_deletion_option = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Maximum File Age to ingest in days.
  int32 max_lookback_days = 5 [(google.api.field_behavior) = OPTIONAL];

  // Output only. SA that will read data, this is Storage Transfer Service SA of
  // Customer's Tenancy Project.
  string chronicle_service_account = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of object prefixes to include.
  repeated string include_prefixes = 7 [(google.api.field_behavior) = OPTIONAL];
}

// AzureBlobStoreV2Settings is the settings proto for Azure Blob Storage feeds.
message AzureBlobStoreV2Settings {
  // Required. Azure URI.
  string azure_uri = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Authentication.
  AzureAuthV2 authentication = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. Source deletion option.
  SourceDeletionOptionV2 source_deletion_option = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Maximum File Age to ingest in days.
  int32 max_lookback_days = 5 [(google.api.field_behavior) = OPTIONAL];

  // Output only. SA that will read data, this is Storage Transfer Service SA of
  // Customer's Tenancy Project.
  string chronicle_service_account = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of object prefixes to include.
  repeated string include_prefixes = 7 [(google.api.field_behavior) = OPTIONAL];
}

// Azure V2 Workload Identity Federation.
message AzureV2WorkloadIdentityFederation {
  // Required. OAuth client ID.
  string client_id = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Tenant ID.
  string tenant_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Subject ID of the Azure subscription.
  string subject_id = 3 [(google.api.field_behavior) = REQUIRED];
}

// A message containing fields used to authenticate with Azure Blob Storage.
message AzureAuthV2 {
  // Possible types of authentication.
  oneof auth_type {
    // Required. Access Key also known as shared key.
    string access_key = 1 [(google.api.field_behavior) = REQUIRED];

    // Required. SAS Token.
    string sas_token = 2 [(google.api.field_behavior) = REQUIRED];

    // Required. Azure V2 Workload Identity Federation.
    AzureV2WorkloadIdentityFederation azure_v2_workload_identity_federation = 3
        [(google.api.field_behavior) = REQUIRED];
  }
}

// Metadata that pertains to feed source types (see
// Feed.FeedDetails.FeedSourceType) that is useful for building interfaces to
// construct valid Feed messages.
message FeedSourceTypeSchema {
  option (google.api.resource) = {
    type: "chronicle.googleapis.com/FeedSourceTypeSchema"
    pattern: "projects/{project}/locations/{location}/instances/{instance}/feedSourceTypeSchemas/{feed_source_type}"
  };

  // The resource name for this FeedSourceTypeSchema.
  // Format:
  // "projects/{project}/locations/{location}/instances/{instance}/feedSourceTypeSchemas/{feed_source_type}".
  string name = 1;

  // A human-readable name for this feed source type.
  string display_name = 2;

  // A human-readable description for this feed source type.
  string description = 3;

  // Whether feeds having this source type, while they are expected to exist,
  // should not be modified (created, edited, or deleted).
  bool read_only = 4;

  // The value to be used in the `details.feed_source_type` field in the Feed
  // message.
  FeedDetails.FeedSourceType feed_source_type = 5;
}

// Metadata that pertains to a log type in the context of Feeds, and is useful
// for building interfaces to construct valid Feed messages.
message LogTypeSchema {
  option (google.api.resource) = {
    type: "chronicle.googleapis.com/LogTypeSchema"
    pattern: "projects/{project}/locations/{location}/instances/{instance}/feedSourceTypeSchemas/{feed_source_type}/logTypeSchemas/{log_type}"
  };

  // A collection of `details` field schema sets. The user must provide values
  // for only one set of fields within an alternative.
  message DetailsFieldSchemaAlternative {
    // The schemas for each alternative set of fields.
    repeated DetailsFieldSchemaSet details_field_schema_sets = 1;
  }

  // A collection of schemas for related fields within `details`.
  message DetailsFieldSchemaSet {
    // A human-readable name for this collection of `details` fields.
    string display_name = 1;

    // A human-readable description for this collection of `details` fields.
    string description = 2;

    // Schemas for the fields in this set.
    repeated DetailsFieldSchema details_field_schemas = 3;
  }

  // A schema for a particular `details` field on the Feed proto message.
  message DetailsFieldSchema {
    // The protocol buffer field path. For example,
    // "details.azure_ad_context_settings.authentication.token_endpoint".
    string field_path = 1;

    // A human-readable name for this field.
    string display_name = 2;

    // A human-readable description for this field.
    string description = 3;

    // A type that represents both the encoding and the semantics of this field.
    SemanticType type = 4;

    // If a field has an enum type, this is the schema describing the possible
    // values.
    repeated EnumFieldSchema enum_field_schemas = 5;

    // Whether this field must be specified to have a valid feed configuration.
    bool required = 6;

    // For those fields with input requirements that aren't adequately expressed
    // by the SemanticType it is often useful to supply an example input.
    string example_input = 7;

    // For those fields which are read only.
    bool read_only = 8;
  }

  // A schema for a particular value, for a particular enum `details` field on
  // the Feed proto message.
  message EnumFieldSchema {
    // The value to assign to the field.
    string value = 1;

    // A human-readable name for this value.
    string display_name = 2;

    // A human-readable description for this value.
    string description = 3;
  }

  // The resource name.
  // Format:
  // "projects/{project}/locations/{location}/instances/{instance}/feedSourceTypeSchemas/{feed_source_type}/logTypeSchemas/{log_type}"
  string name = 1;

  // A human-readable name for this log type.
  string display_name = 2;

  // The log type to be used in the `details.log_type` field.
  string log_type = 3;

  // Whether this log type schema represents a feed configuration that may
  // exist, but should not be modified (created, edited, or deleted).
  bool read_only = 4;

  // A description that is displayed when users create or edit feeds.
  string supporting_documentation = 5;

  // The schemas for `detail` fields that are compatible with this log
  // type and feed source type. All fields for this log type and feed source
  // type are either contained here or within
  // details_field_schema_alternatives.
  repeated DetailsFieldSchema details_field_schemas = 6;

  // There are sets of fields which represent alternatives to one another. A
  // user would only fill in one set of fields for any one alternative.
  repeated DetailsFieldSchemaAlternative details_field_schema_alternatives = 7;
}

// Request message for FetchServiceAccountForCustomer.
message FetchServiceAccountForCustomerRequest {
  // Required. The parent resource where this FeedServiceAccount will be
  // created. Format:
  // projects/{project}/locations/{location}/instances/{instance}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "chronicle.googleapis.com/FeedServiceAccount"
    }
  ];
}

// ListFeedSourceTypeSchemas request message. Note that Feed schemas do not
// contain customer data, so are not scoped to a particular customer.
message ListFeedSourceTypeSchemasRequest {
  // Required. The parent, which owns this collection of FeedSourceTypeSchemas.
  // Format: projects/{project}/locations/{location}/instances/{instance}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "chronicle.googleapis.com/FeedSourceTypeSchema"
    }
  ];

  // The maximum number of FeedSourceTypeSchemas to return. The service may
  // return fewer than this value. If unspecified all FeedSourceTypeSchemas will
  // be returned, meaning one FeedSourceTypeSchema for each
  // FeedDetails.FeedSourceType.
  // The maximum value is 100; values above 100 will be coerced to 100.
  int32 page_size = 2;

  // A page token, received from a previous `ListFeedSourceTypeSchemas` call.
  // Provide this to retrieve the subsequent page.
  string page_token = 3;
}

// ListFeedSourceTypeSchemas response message.
message ListFeedSourceTypeSchemasResponse {
  // Schemas describing each FeedSourceType.
  repeated FeedSourceTypeSchema feed_source_type_schemas = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// ListLogTypeSchemas request message. Note that feed schemas do not contain
// customer data, so are not scoped to a particular customer.
message ListLogTypeSchemasRequest {
  // Required. The parent, which owns this collection of LogTypeSchemas.
  // Format: Format:
  // projects/{project}/locations/{location}/instances/{instance}/feedSourceTypeSchemas/{feed_source_type}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "chronicle.googleapis.com/LogTypeSchema"
    }
  ];

  // The maximum number of LogTypeSchemas to return. The service may return
  // fewer than this value.
  // If unspecified, at most 5000 LogTypeSchemas will be returned.
  // The maximum value is 10000; values above 10000 will be coerced to 10000.
  int32 page_size = 2;

  // A page token, received from a previous `ListLogTypeSchemas` call. Provide
  // this to retrieve the subsequent page.
  string page_token = 3;
}

// ListLogTypeSchemas response message.
message ListLogTypeSchemasResponse {
  // LogTypeSchemas.
  repeated LogTypeSchema log_type_schemas = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// ImportPushLogsRequest request message.
message ImportPushLogsRequest {
  // Required. The parent, which owns this collection of logs.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "chronicle.googleapis.com/Feed" }
  ];

  // Required. The raw HTTP body is bound to this field.
  // All log entries must be valid UTF-8. A single invalid event will cause the
  // entire request to be rejected.
  google.api.HttpBody http_body = 2 [(google.api.field_behavior) = REQUIRED];

  // Immutable. The secret for the feed.
  string secret = 3 [(google.api.field_behavior) = IMMUTABLE];
}

// Request message for UpdateFeed.
message UpdateFeedRequest {
  // Required. Feed to update. Updates full feed object.
  Feed feed = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Specifies which fields to update. If empty, update the full feed.
  // To update the display name, pass only `displayName` and no other
  // fields. To update other fields, pass a comma-separated list of fields to
  // update and omit `displayName`. The update fails if an existing
  // `displayName` is sent in the update request.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = OPTIONAL];
}

// Request message for ListFeed.
message ListFeedsRequest {
  // Required. The parent resource where this Feed will be created.
  // Format: projects/{project}/locations/{location}/instances/{instance}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "chronicle.googleapis.com/Feed"
    }
  ];

  // The maximum number of feeds to return. The service may return fewer than
  // this value.
  // If unspecified, at most 100 feeds will be returned.
  // The maximum value is 1000; values above 1000 will be coerced to 1000.
  int32 page_size = 2;

  // A page token, received from a previous `ListFeeds` call. Provide this to
  // retrieve the subsequent page.
  string page_token = 3;
}

// Response message for ListFeed.
message ListFeedsResponse {
  // List of feeds.
  repeated Feed feeds = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// Request message for ListFeedPacks.
message ListFeedPacksRequest {
  // Required. The parent resource where this content pack will be created.
  // Format: projects/{project}/locations/{location}/instances/{instance}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "chronicle.googleapis.com/FeedPack"
    }
  ];

  // Optional. The maximum number of feed content packs to return. The service
  // may return fewer than this value. If unspecified, at most 50 feed content
  // packs will be returned. The maximum value is 1000; values above 1000 will
  // be coerced to 1000.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous `ListFeedPacks` call.
  // Provide this to retrieve the subsequent page. When paginating, all other
  // parameters provided to `ListFeedPacks` must match the call that provided
  // the page token.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for ListFeedPacks.
message ListFeedPacksResponse {
  // List of feeds packs.
  repeated FeedPack feed_packs = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// Request message for GetFeedPack.
message GetFeedPackRequest {
  // Required. The ID of the feed pack to retrieve.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feedPacks/{feedPack}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "chronicle.googleapis.com/FeedPack"
    }
  ];
}

// Request message for CreateFeed.
message CreateFeedRequest {
  // Required. The parent resource where this Feed will be created.
  // Format: projects/{project}/locations/{location}/instances/{instance}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "chronicle.googleapis.com/Feed"
    }
  ];

  // Required. Feed to create.
  Feed feed = 2 [(google.api.field_behavior) = REQUIRED];
}

// Request message to retrieve a feed.
message GetFeedRequest {
  // Required. The ID of the feed to retrieve.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "chronicle.googleapis.com/Feed" }
  ];
}

// Request message to delete a feed.
message DeleteFeedRequest {
  // Required. The ID of the feed to retrieve.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "chronicle.googleapis.com/Feed" }
  ];

  // Optional. If true, delete the uningested backlog in OOB retry queue for the
  // feed.
  bool delete_backlog = 2 [(google.api.field_behavior) = OPTIONAL];
}

// EnableFeed request message.
message EnableFeedRequest {
  // Required. The name of the feed to enable.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "chronicle.googleapis.com/Feed" }
  ];
}

// GenerateSecret request message.
message GenerateSecretRequest {
  // Required. The name of the feed to for which to generate secret.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "chronicle.googleapis.com/Feed" }
  ];
}

// GenerateSecret response message.
message GenerateSecretResponse {
  // The generated secret. Store the secret value at a safe place and use it
  // while configuring your https push feed.
  string secret = 1;
}

// DisableFeed request message.
message DisableFeedRequest {
  // Required. The name of the feed to disable.
  // Format:
  // projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "chronicle.googleapis.com/Feed" }
  ];
}

// CustomAPIHeaderKeyValue defines dynamic headers key-values for Custom API.
message CustomAPIHeaderKeyValue {
  // Required. Enter the name of the HTTP Request header (e.g., Authorization or
  // X-API-Key).
  string key = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Enter the API Key, Bearer Token, or credential value associated
  // with the header.
  string value = 2 [(google.api.field_behavior) = REQUIRED];
}

// CustomAPIHeaderAuth lists HTTP headers for custom API auth.
message CustomAPIHeaderAuth {
  // Optional. Add HTTP request header key-value pairs.
  repeated CustomAPIHeaderKeyValue header_key_values = 1
      [(google.api.field_behavior) = OPTIONAL];
}

// CustomAPIQueryKeyValue defines dynamic query parameters key-values for Custom
// API Auth.
message CustomAPIQueryKeyValue {
  // Required. Enter the name of the URL Query Parameter (e.g., api_key or
  // token).
  string key = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Enter the API Key or credential value associated with the query
  // parameter.
  string value = 2 [(google.api.field_behavior) = REQUIRED];
}

// CustomAPIQueryAuth lists URL Query parameters for custom API auth.
message CustomAPIQueryAuth {
  // Optional. Add URL Query parameter key-value pairs.
  repeated CustomAPIQueryKeyValue query_key_values = 1
      [(google.api.field_behavior) = OPTIONAL];
}

// Info for No-Authentication custom API feeds.
message CustomAPINoAuth {}

// Settings required by Feeds of Custom API (Codeless).
// Supports fetching data from third-party APIs with configurable pagination,
// authentication, and response parsing.
message CustomAPISettings {
  // Choose the method and credentials used to securely authorize access to the
  // API.
  oneof authentication {
    // Authenticate without credentials or secrets.
    CustomAPINoAuth no_auth = 8;

    // Authenticate using Username/Password credentials.
    UsernameSecretAuth basic_auth = 3;

    // Authenticate using OAuth 2.0 Client Credentials Grant flow.
    OAuthClientCredentials oauth_client_credentials = 4;

    // Authenticate using custom API Keys injected into request headers.
    CustomAPIHeaderAuth header_auth = 5;

    // Authenticate using custom API Keys injected into URL query parameters.
    CustomAPIQueryAuth query_auth = 9;
  }

  // Required. Enter the primary web address of the third-party API (e.g.,
  // https://api.vendor.com).
  string base_url = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Specify how often the platform checks the API for new data in
  // minutes (default is 15 minutes).
  int32 polling_frequency = 2 [(google.api.field_behavior) = OPTIONAL];

  // Required. Configure the initial API call used to fetch the main list of
  // logs or events.
  CustomAPITransferNode primary_request = 6
      [(google.api.field_behavior) = REQUIRED];
}

// Container for a specific API interaction.
message CustomAPITransferNode {
  // Required. Define the technical parameters for the outgoing API call,
  // including paths, headers, and payloads.
  CustomAPIRequestConfig request_settings = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Provide rules that tell the platform how to locate and extract
  // the relevant security data from the API's reply.
  CustomAPIResponseConfig response_mapping = 2
      [(google.api.field_behavior) = REQUIRED];

  // Required. Select how the connector should request subsequent pages when the
  // data is too large for a single response.
  CustomAPIPagination pagination_strategy = 3
      [(google.api.field_behavior) = REQUIRED];

  // Required. Configure settings that allow the connector to remember where it
  // left off in the previous poll (e.g., tracking the last fetched timestamp).
  CustomAPICheckpointConfig checkpointing = 4
      [(google.api.field_behavior) = REQUIRED];

  // Optional. Configuration for dependent requests (child chaining).
  CustomAPIDependentRequestsConfig dependent_requests_config = 8
      [(google.api.field_behavior) = OPTIONAL];
}

// Configuration for dependent requests (child chaining).
message CustomAPIDependentRequestsConfig {
  // Required. Enter the specific field in the response that uniquely identifies
  // an individual record or alert.
  string item_id_json_path = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Specify a custom variable name to hold the extracted ID, which
  // can be linked as a placeholder in dependent requests.
  string item_id_variable = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Add follow-up API calls triggered for each item found in the
  // primary request (e.g., fetching full event details for a list of basic
  // alert IDs). Note: In MVP, the child depth fan-out limit is capped at 1.
  repeated CustomAPITransferNode dependent_requests = 3
      [(google.api.field_behavior) = OPTIONAL];
}

// Configuration for the outgoing API request.
message CustomAPIRequestConfig {
  // HTTPS methods supported.
  enum HttpMethod {
    // Unspecified method.
    HTTP_METHOD_UNSPECIFIED = 0;

    // HTTP GET method.
    GET = 1;

    // HTTP POST method.
    POST = 2;
  }

  // Required. Enter the specific API route appended to the Base URL to fetch
  // the data (e.g., /v1/alerts).
  string endpoint_path = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Select the type of action to perform on the API endpoint (usually
  // GET to retrieve data or POST to submit a query).
  HttpMethod http_method = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. Provide the data payload sent to the API to specify what
  // information you want, typically formatted in JSON.
  string request_body = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Add extra filters or settings appended to the end of the URL
  // (e.g., ?status=critical).
  repeated HeaderKeyValue query_parameters = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Define specialized key-value pairs sent with the request, often
  // used for custom API versioning or specific vendor requirements.
  repeated HeaderKeyValue custom_headers = 5
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Set a safety limit to ensure the connector does not exceed the
  // third-party vendor's API rate limits.
  int32 max_requests_per_minute = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Configuration for handling the API response.
message CustomAPIResponseConfig {
  // Required. Enter the exact path in the API's response payload where the list
  // of target log entries is located.
  repeated string target_data_path = 1 [(google.api.field_behavior) = REQUIRED];
}

// Checkpoint configuration to enable sequential (cursor-based) polling.
message CustomAPICheckpointConfig {
  // Fetch all available data in one go without tracking progress.
  message NoneStrategy {}

  // Track the timestamp of the newest record to fetch newer ones next.
  message LatestTimestampStrategy {
    // Required. Enter the exact location within a log record where the
    // checkpoint value (like a timestamp or ID) is found.
    string checkpoint_value_path = 1 [(google.api.field_behavior) = REQUIRED];

    // Required. Specify a custom name you assign to store and reference the
    // checkpoint value between polling cycles.
    string checkpoint_variable = 2 [(google.api.field_behavior) = REQUIRED];
  }

  // Track the highest record ID to fetch only new records next.
  message LatestRecordStrategy {
    // Required. Enter the exact location within a log record where the
    // checkpoint value (like a timestamp or ID) is found.
    string checkpoint_value_path = 1 [(google.api.field_behavior) = REQUIRED];

    // Required. Specify a custom name you assign to store and reference the
    // checkpoint value between polling cycles.
    string checkpoint_variable = 2 [(google.api.field_behavior) = REQUIRED];
  }

  // Use progress tokens provided by the API.
  message IteratorStrategy {
    // Required. Enter the exact location within a log record where the
    // checkpoint value (like a timestamp or ID) is found.
    string checkpoint_value_path = 1 [(google.api.field_behavior) = REQUIRED];

    // Required. Specify a custom name you assign to store and reference the
    // checkpoint value between polling cycles.
    string checkpoint_variable = 2 [(google.api.field_behavior) = REQUIRED];
  }

  // Select the specific checkpointing mechanism the third-party API requires.
  oneof strategy {
    // Fetch all available data in one go without tracking progress.
    NoneStrategy none_strategy = 1;

    // Track the timestamp of the newest record to fetch newer ones next.
    LatestTimestampStrategy latest_timestamp_strategy = 2;

    // Track the highest record ID to fetch only new records next.
    LatestRecordStrategy latest_record_strategy = 3;

    // Use progress tokens provided by the API.
    IteratorStrategy iterator_strategy = 4;
  }
}

// Pagination strategy for the request.
message CustomAPIPagination {
  // Fetch data in a single request without paging.
  message NonePagination {}

  // Use tokens (custom keys) to get the next page of data.
  message TokenPagination {
    // Required. Enter the field in the API response that contains the URL or
    // token needed to fetch the next page of data.
    string next_page_token_json_path = 1
        [(google.api.field_behavior) = REQUIRED];

    // Required. Specify the name of the query parameter for next page token in
    // request.
    string query_param = 2 [(google.api.field_behavior) = REQUIRED];
  }

  // Follow links provided in the response to get more data.
  message LinkPagination {
    // Required. Enter the field in the API response that contains the URL or
    // token needed to fetch the next page of data.
    string next_page_link_json_path = 1
        [(google.api.field_behavior) = REQUIRED];
  }

  // Skip a set number of records to get the next set.
  message OffsetPagination {
    // Required. Specify the name of the query parameter for offset in request.
    string offset_query_param = 1 [(google.api.field_behavior) = REQUIRED];
  }

  // Go to the next page number (e.g., page 2).
  message PageNumberPagination {
    // Required. Specify the name of the query parameter for page number in
    // request.
    string page_number_query_param = 1 [(google.api.field_behavior) = REQUIRED];
  }

  // Select the specific paging mechanism the third-party API requires.
  oneof pagination_strategy {
    // Fetch data in a single request without paging.
    NonePagination none = 4;

    // Use tokens (custom keys) to get the next page of data.
    TokenPagination token = 5;

    // Follow links provided in the response to get more data.
    LinkPagination link = 6;

    // Skip a set number of records to get the next set.
    OffsetPagination offset = 7;

    // Go to the next page number (e.g., page 2).
    PageNumberPagination page_number = 8;
  }
}