mgmt

package
v0.10.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: Apache-2.0 Imports: 13 Imported by: 0

Documentation

Overview

Package mgmt is a Go client for the SentinelOne REST Management API v2.1.

The client is pure — HTTP calls and typed structs, no disk I/O. All on-disk layout lives in internal/.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type ADAckExposuresFilter added in v0.10.0 

type ADAckExposuresFilter struct {
	DetectionName []string `json:"detectionName"`
	DomainName    []string `json:"domainName"`
	Acknowledged  bool     `json:"acknowledged"`
}

ADAckExposuresFilter is the filter for setting acknowledged status on exposures.

type ADAckExposuresParams added in v0.10.0 

type ADAckExposuresParams struct {
	SiteIDs    string
	AccountIDs string
	Filter     ADAckExposuresFilter
}

ADAckExposuresParams are parameters for setting acknowledged status.

type ADAffectedObject added in v0.4.0 

type ADAffectedObject struct {
	ID             int     `json:"id"`
	RunID          int     `json:"runId"`
	DN             *string `json:"dn"`
	DisplayName    *string `json:"displayName"`
	SAMAccountName *string `json:"samAccountName"`
	UPN            *string `json:"upn"`
	CommonName     *string `json:"commonName"`
	ObjectType     *string `json:"objectType"`
	ObjectGUID     *string `json:"objectGUID"`
	DNSHostName    *string `json:"dNSHostName"`
	OS             *string `json:"os"`
	AccountStatus  *string `json:"accountStatus"`
	Description    *string `json:"description"`
	LastLogon      *int    `json:"lastLogonTimestamp"`
	WhenCreated    *int    `json:"whenCreated"`
	WhenChanged    *int    `json:"whenChanged"`
	PwdLastSet     *int    `json:"pwdLastSet"`

	Raw json.RawMessage `json:"-"`
}

ADAffectedObject is an object affected by a Ranger AD exposure.

func (*ADAffectedObject) UnmarshalJSON added in v0.4.0 

func (o *ADAffectedObject) UnmarshalJSON(b []byte) error

type ADAffectedObjectFilter added in v0.4.0 

type ADAffectedObjectFilter struct {
	DetectionName []string `json:"detectionName"`
	DomainName    []string `json:"domainName"`
	ForestName    []string `json:"forestName,omitempty"`
	ObjectType    []string `json:"objectType,omitempty"`
}

ADAffectedObjectFilter is the filter body for listing affected objects.

type ADAffectedObjectListParams added in v0.4.0 

type ADAffectedObjectListParams struct {
	Limit      int
	Skip       int
	SiteIDs    string
	AccountIDs string
	Filter     ADAffectedObjectFilter
}

ADAffectedObjectListParams are parameters for listing affected objects.

type ADAssessmentStatus added in v0.4.0 

type ADAssessmentStatus struct {
	Status  AssessmentStatus `json:"status"`
	Domains []DomainStatus   `json:"domainWiseCurrentStatusList"`
	Tenants []TenantStatus   `json:"tenantWiseCurrentStatusList"`

	Raw json.RawMessage `json:"-"`
}

ADAssessmentStatus is the response from the Ranger AD assessment status endpoint.

func (*ADAssessmentStatus) UnmarshalJSON added in v0.4.0 

func (s *ADAssessmentStatus) UnmarshalJSON(b []byte) error

type ADAssessmentStatusParams added in v0.4.0 

type ADAssessmentStatusParams struct {
	SiteIDs    string
	AccountIDs string
}

ADAssessmentStatusParams are query parameters for the assessment status endpoint.

type ADConfigAssessmentStatus added in v0.10.0 

type ADConfigAssessmentStatus string

ADConfigAssessmentStatus is the assessment status of an AD configuration. 

const (
	ADConfigAssessmentPending    ADConfigAssessmentStatus = "PENDING"
	ADConfigAssessmentInProgress ADConfigAssessmentStatus = "IN_PROGRESS"
	ADConfigAssessmentCompleted  ADConfigAssessmentStatus = "COMPLETED"
	ADConfigAssessmentFailed     ADConfigAssessmentStatus = "FAILED"
	ADConfigAssessmentCancelled  ADConfigAssessmentStatus = "CANCELLED"
	ADConfigAssessmentNA         ADConfigAssessmentStatus = "NA"
)

type ADConfigScope added in v0.10.0 

type ADConfigScope struct {
	ID   string `json:"id"`
	Type string `json:"type"`
}

ADConfigScope identifies an allowed scope for an AD configuration.

type ADConfiguration added in v0.10.0 

type ADConfiguration struct {
	ID                           int64                    `json:"id"`
	TenantID                     string                   `json:"tenantId"`
	CloudlinkID                  int                      `json:"cloudlinkId"`
	DomainName                   string                   `json:"domainName"`
	DomainControllerFqdn         string                   `json:"domainControllerFqdn"`
	TrustingDomainControllerFqdn string                   `json:"trustingDomainControllerFqdn"`
	TrustingDomainName           string                   `json:"trustingDomainName"`
	PortNumber                   int                      `json:"portNumber"`
	Enabled                      bool                     `json:"enabled"`
	AssessmentStatus             ADConfigAssessmentStatus `json:"assessmentStatus"`
	SyncStatus                   bool                     `json:"syncStatus"`
	EncryptionMethod             EncryptionMethod         `json:"encryptionMethod"`
	CreatedAt                    *ScopeInfo               `json:"createdAt"`
	ScopeBundle                  []ScopeInfo              `json:"scopeBundle"`
	Username                     string                   `json:"username"`
	LDAPReferral                 bool                     `json:"ldapReferral"`
	IsConnected                  bool                     `json:"isConnected"`
	AssessOtherDomains           bool                     `json:"assessOtherDomains"`
	FeaturesOpted                []string                 `json:"featuresOpted"`
	IsPolicyActive               bool                     `json:"isPolicyActive"`
	FeatureStatusInfo            []FeatureStatusInfo      `json:"featureStatusInfo"`
	UseWinRmOverSSL              bool                     `json:"useWinRmOverSsl"`
	ADSync                       bool                     `json:"adSync"`
	PolicyUsage                  []PolicyUsage            `json:"policyUsage"`

	Raw json.RawMessage `json:"-"`
}

ADConfiguration is an AD configuration entry returned by the API.

func (*ADConfiguration) UnmarshalJSON added in v0.10.0 

func (a *ADConfiguration) UnmarshalJSON(b []byte) error

type ADConfigurationInput added in v0.10.0 

type ADConfigurationInput struct {
	CloudlinkID                *int64               `json:"cloudlinkId,omitempty"`
	FeaturesOpted              []string             `json:"featuresOpted,omitempty"`
	AllowedScopes              []ADConfigScope      `json:"allowedScopes,omitempty"`
	IsAllScopesAllowed         *bool                `json:"isAllScopesAllowed,omitempty"`
	DomainName                 string               `json:"domainName"`
	AssessOtherDomainsInForest *bool                `json:"assessOtherDomainsInForest,omitempty"`
	DomainControllerFqdn       string               `json:"domainControllerFqdn"`
	UserName                   string               `json:"userName"`
	Password                   string               `json:"password"`
	EncryptionMethod           EncryptionMethod     `json:"encryptionMethod"`
	AccessOverTrustInfo        *AccessOverTrustInfo `json:"accessOverTrustInfo,omitempty"`
	EnableThreatDetection      *bool                `json:"enableThreatDetection,omitempty"`
	LDAPReferral               *bool                `json:"ldapReferral,omitempty"`
	UseWinRmOverSSL            *bool                `json:"useWinRmOverSsl,omitempty"`
	ADSync                     *bool                `json:"adSync,omitempty"`
}

ADConfigurationInput is the request body for creating an AD configuration. Password is a secret field — never log or echo it.

type ADConnectorConfigStatus added in v0.10.0 

type ADConnectorConfigStatus string

ADConnectorConfigStatus is the onboarding state of the AD connector. 

const (
	ADConnectorConfigured    ADConnectorConfigStatus = "CONFIGURED"
	ADConnectorConfigPending ADConnectorConfigStatus = "CONFIG_PENDING"
)

type ADExposure added in v0.4.0 

type ADExposure struct {
	ID                  string                  `json:"id"`
	DetectionID         int                     `json:"detectionId"`
	DetectionName       string                  `json:"detectionName"`
	DetectionStatus     ExposureDetectionStatus `json:"detectionStatus"`
	Severity            ExposureSeverity        `json:"severity"`
	Source              ExposureSource          `json:"source"`
	DomainName          string                  `json:"domainName"`
	ForestName          string                  `json:"forestName"`
	VulnerableCount     int                     `json:"vulnerableCount"`
	PrevVulnerableCount *int                    `json:"prevVulnerableCount"`
	Acknowledged        bool                    `json:"acknowledged"`
	Remediable          bool                    `json:"remediable"`
	RunTimestamp        int                     `json:"runTimestamp"`
	SpecialRun          *bool                   `json:"specialRun"`
	SpecialRunTimestamp *int                    `json:"specialRunTimestamp"`
	SkipReason          *string                 `json:"skipReason"`
	SkipCode            *string                 `json:"skipCode"`
	HasExcludableObjs   *bool                   `json:"hasExcludableObjects"`

	Raw json.RawMessage `json:"-"`
}

ADExposure is a Ranger AD exposure finding.

func (*ADExposure) UnmarshalJSON added in v0.4.0 

func (e *ADExposure) UnmarshalJSON(b []byte) error

type ADExposureFilter added in v0.4.0 

type ADExposureFilter struct {
	DetectionStatus []string `json:"detectionStatus,omitempty"`
	DetectionName   []string `json:"detectionName,omitempty"`
	DomainName      []string `json:"domainName,omitempty"`
	ForestName      []string `json:"forestName,omitempty"`
	Severity        []string `json:"severity,omitempty"`
	Source          []string `json:"source,omitempty"`
}

ADExposureFilter is the filter body for listing AD exposures.

type ADExposureListParams added in v0.4.0 

type ADExposureListParams struct {
	Limit      int
	Skip       int
	SiteIDs    string
	AccountIDs string
	Filter     ADExposureFilter
}

ADExposureListParams are parameters for listing AD exposures.

type ADFeature added in v0.10.0 

type ADFeature struct {
	FeatureName ADFeatureName `json:"featureName"`
	Available   bool          `json:"available"`

	Raw json.RawMessage `json:"-"`
}

ADFeature is an available feature returned by the available-features endpoint.

func (*ADFeature) UnmarshalJSON added in v0.10.0 

func (f *ADFeature) UnmarshalJSON(b []byte) error

type ADFeatureName added in v0.10.0 

type ADFeatureName string

ADFeatureName is a named feature available for AD configuration. 

const (
	ADFeatureRangerAD        ADFeatureName = "RANGER_AD"
	ADFeatureSingularityID   ADFeatureName = "SINGULARITY_IDENTITY"
	ADFeatureRangerADProtect ADFeatureName = "RANGER_AD_PROTECT"
)

type ADFeatureStatus added in v0.10.0 

type ADFeatureStatus string

ADFeatureStatus is the status of a feature in the feature status info. 

const (
	ADFeatureStatusNotEnabled            ADFeatureStatus = "NOT_ENABLED"
	ADFeatureStatusCompleted             ADFeatureStatus = "COMPLETED"
	ADFeatureStatusFailed                ADFeatureStatus = "FAILED"
	ADFeatureStatusInProgress            ADFeatureStatus = "IN_PROGRESS"
	ADFeatureStatusSuccess               ADFeatureStatus = "SUCCESS"
	ADFeatureStatusPendingAndInProgress  ADFeatureStatus = "PENDING_AND_IN_PROGRESS"
	ADFeatureStatusMisconfigurationError ADFeatureStatus = "MISCONFIGURATION_ERROR"
)

type ADFeatureType added in v0.10.0 

type ADFeatureType string

ADFeatureType is the type of a feature in the feature status info. 

const (
	ADFeatureTypeADSecure        ADFeatureType = "AD_SECURE"
	ADFeatureTypeADAssessment    ADFeatureType = "AD_ASSESSMENT"
	ADFeatureTypeRangerADProtect ADFeatureType = "RANGER_AD_PROTECT"
)

type ADOnboardingStatus added in v0.10.0 

type ADOnboardingStatus struct {
	Status          OnboardingStatus        `json:"status"`
	FeatureSelected []string                `json:"featureSelected"`
	ADConnector     ADConnectorConfigStatus `json:"adConnector"`
	DomainName      string                  `json:"domainName"`

	Raw json.RawMessage `json:"-"`
}

ADOnboardingStatus is the onboarding status response.

func (*ADOnboardingStatus) UnmarshalJSON added in v0.10.0 

func (o *ADOnboardingStatus) UnmarshalJSON(b []byte) error

type ADScopeMapping added in v0.7.0 

type ADScopeMapping struct {
	Admin  []string `json:"admin"`
	Viewer []string `json:"viewer"`

	Raw json.RawMessage `json:"-"`
}

ADScopeMapping maps Active Directory groups to admin and viewer scopes.

func (*ADScopeMapping) UnmarshalJSON added in v0.7.0 

func (m *ADScopeMapping) UnmarshalJSON(b []byte) error

type ADSettings added in v0.7.0 

type ADSettings struct {
	Enabled  bool   `json:"enabled"`
	Host     string `json:"host"`
	Port     int    `json:"port"`
	Username string `json:"username"`
	RootDN   string `json:"rootDn"`
	SSL      bool   `json:"ssl"`
	Password string `json:"password"`

	Raw json.RawMessage `json:"-"`
}

ADSettings is the Active Directory integration configuration. Password is a secret (the bind account credential); the GET endpoint does not echo it, but it is accepted on update. Never print Password to --json or the audit log.

func (*ADSettings) UnmarshalJSON added in v0.7.0 

func (a *ADSettings) UnmarshalJSON(b []byte) error

type ADSkipExposuresFilter added in v0.10.0 

type ADSkipExposuresFilter struct {
	DetectionName []string `json:"detectionName"`
	DomainName    []string `json:"domainName"`
	Skip          bool     `json:"skip"`
	SkipReason    string   `json:"skipReason,omitempty"`
}

ADSkipExposuresFilter is the filter for setting skipped exposures.

type ADSkipExposuresParams added in v0.10.0 

type ADSkipExposuresParams struct {
	SiteIDs    string
	AccountIDs string
	Filter     ADSkipExposuresFilter
}

ADSkipExposuresParams are parameters for setting skipped exposures.

type ADTriggerAssessmentFilter added in v0.4.0 

type ADTriggerAssessmentFilter struct {
	IsFullScan   bool                        `json:"isFullScan"`
	DomainName   []string                    `json:"domainName,omitempty"`
	ScanSource   *string                     `json:"scanSource,omitempty"`
	ExposureList []ADTriggerExposureListItem `json:"exposureList,omitempty"`
}

ADTriggerAssessmentFilter is the filter for triggering an AD assessment.

type ADTriggerAssessmentParams added in v0.4.0 

type ADTriggerAssessmentParams struct {
	SiteIDs    string
	AccountIDs string
	Filter     ADTriggerAssessmentFilter
}

ADTriggerAssessmentParams are parameters for triggering an AD assessment.

type ADTriggerExposureListItem added in v0.4.0 

type ADTriggerExposureListItem struct {
	DomainName    string `json:"domainName"`
	DetectionName string `json:"detectionName"`
}

ADTriggerExposureListItem identifies a specific exposure to reassess.

type APIError 

type APIError struct {
	Status  int    `json:"-"`
	Title   string `json:"title"`
	Detail  string `json:"detail"`
	RawBody []byte `json:"-"`
}

APIError is a non-2xx response from the SentinelOne API.

func (*APIError) Error 

func (e *APIError) Error() string

type AccessOverTrustInfo added in v0.10.0 

type AccessOverTrustInfo struct {
	AccessOverTrustEnabled       bool   `json:"accessOverTrustEnabled"`
	TrustingDomainName           string `json:"trustingDomainName,omitempty"`
	TrustingDomainControllerFqdn string `json:"trustingDomainControllerFqdn,omitempty"`
}

AccessOverTrustInfo holds trust-domain settings for AD configuration.

type Account 

type Account struct {
	ID             string `json:"id"`
	Name           string `json:"name"`
	State          string `json:"state"`
	AccountType    string `json:"accountType"`
	TotalLicenses  int    `json:"totalLicenses"`
	ActiveLicenses int    `json:"activeLicenses"`
	ActiveAgents   int    `json:"activeAgents"`
	NumberOfSites  int    `json:"numberOfSites"`
	Expiration     string `json:"expiration"`
	CreatedAt      string `json:"createdAt"`
	UpdatedAt      string `json:"updatedAt"`
	UsageType      string `json:"usageType"`
	BillingMode    string `json:"billingMode"`

	Raw json.RawMessage `json:"-"`
}

Account is a SentinelOne account.

func (*Account) UnmarshalJSON 

func (a *Account) UnmarshalJSON(b []byte) error

type AccountListParams 

type AccountListParams struct {
	States    []string
	IDs       []string
	Query     string
	Limit     int
	Cursor    string
	SortBy    string
	SortOrder string
	CountOnly bool
}

AccountListParams are query parameters for listing accounts.

type ActionFilter 

type ActionFilter struct {
	IDs      []string `json:"ids,omitempty"`
	SiteIDs  []string `json:"siteIds,omitempty"`
	GroupIDs []string `json:"groupIds,omitempty"`
	Query    string   `json:"query,omitempty"`
}

ActionFilter identifies which resources to act on.

type Activity 

type Activity struct {
	ID            string          `json:"id"`
	ActivityType  int             `json:"activityType"`
	PrimaryDesc   string          `json:"primaryDescription"`
	SecondaryDesc string          `json:"secondaryDescription"`
	AccountID     string          `json:"accountId"`
	AccountName   string          `json:"accountName"`
	SiteID        string          `json:"siteId"`
	SiteName      string          `json:"siteName"`
	GroupID       string          `json:"groupId"`
	GroupName     string          `json:"groupName"`
	AgentID       string          `json:"agentId"`
	ThreatID      string          `json:"threatId"`
	UserID        string          `json:"userId"`
	CreatedAt     string          `json:"createdAt"`
	UpdatedAt     string          `json:"updatedAt"`
	Data          json.RawMessage `json:"data"`

	Raw json.RawMessage `json:"-"`
}

Activity is a SentinelOne activity log entry.

func (*Activity) UnmarshalJSON 

func (a *Activity) UnmarshalJSON(b []byte) error

type ActivityExportParams added in v0.4.0 

type ActivityExportParams struct {
	SiteIDs       []string
	AccountIDs    []string
	GroupIDs      []string
	ActivityTypes []int
	CreatedAtGt   string
	CreatedAtLt   string
	CreatedAtGte  string
	CreatedAtLte  string
}

ActivityExportParams are query parameters for exporting activities as CSV.

type ActivityListParams 

type ActivityListParams struct {
	SiteIDs       []string
	AccountIDs    []string
	GroupIDs      []string
	AgentIDs      []string
	ThreatIDs     []string
	ActivityTypes []int
	UserIDs       []string
	CreatedAtGt   string
	CreatedAtLt   string
	Limit         int
	Cursor        string
	SortBy        string
	SortOrder     string
	CountOnly     bool
}

ActivityListParams are query parameters for listing activities.

type ActivityType added in v0.4.0 

type ActivityType struct {
	ID          int    `json:"id"`
	Description string `json:"action"`

	Raw json.RawMessage `json:"-"`
}

ActivityType describes a SentinelOne activity type code.

func (*ActivityType) UnmarshalJSON added in v0.4.0 

func (t *ActivityType) UnmarshalJSON(b []byte) error

type Agent 

type Agent struct {
	ID                      string `json:"id"`
	ComputerName            string `json:"computerName"`
	Domain                  string `json:"domain"`
	OSType                  string `json:"osType"`
	OSName                  string `json:"osName"`
	OSArch                  string `json:"osArch"`
	AgentVersion            string `json:"agentVersion"`
	IsActive                bool   `json:"isActive"`
	Infected                bool   `json:"infected"`
	ActiveThreats           int    `json:"activeThreats"`
	NetworkStatus           string `json:"networkStatus"`
	MachineType             string `json:"machineType"`
	AccountID               string `json:"accountId"`
	AccountName             string `json:"accountName"`
	SiteID                  string `json:"siteId"`
	SiteName                string `json:"siteName"`
	GroupID                 string `json:"groupId"`
	GroupName               string `json:"groupName"`
	ExternalIP              string `json:"externalIp"`
	LastActiveDate          string `json:"lastActiveDate"`
	RegisteredAt            string `json:"registeredAt"`
	CreatedAt               string `json:"createdAt"`
	UpdatedAt               string `json:"updatedAt"`
	LastLoggedInUserName    string `json:"lastLoggedInUserName"`
	IsDecommissioned        bool   `json:"isDecommissioned"`
	IsUninstalled           bool   `json:"isUninstalled"`
	IsUpToDate              bool   `json:"isUpToDate"`
	ScanStatus              string `json:"scanStatus"`
	MitigationMode          string `json:"mitigationMode"`
	FirewallEnabled         bool   `json:"firewallEnabled"`
	TotalMemory             int    `json:"totalMemory"`
	CPUCount                int    `json:"cpuCount"`
	CoreCount               int    `json:"coreCount"`
	UUID                    string `json:"uuid"`
	SerialNumber            string `json:"serialNumber"`
	ModelName               string `json:"modelName"`
	AppsVulnerabilityStatus string `json:"appsVulnerabilityStatus"`
	OperationalState        string `json:"operationalState"`

	Raw json.RawMessage `json:"-"`
}

Agent is a SentinelOne endpoint agent.

func (*Agent) UnmarshalJSON 

func (a *Agent) UnmarshalJSON(b []byte) error

type AgentListParams 

type AgentListParams struct {
	SiteIDs          []string
	GroupIDs         []string
	AccountIDs       []string
	OSTypes          []string
	IsActive         *bool
	Infected         *bool
	IsDecommissioned *bool
	IsUninstalled    *bool
	IsUpToDate       *bool
	NetworkStatuses  []string
	MachineTypes     []string
	Query            string
	Limit            int
	Cursor           string
	SortBy           string
	SortOrder        string
	CountOnly        bool
}

AgentListParams are query parameters for listing agents.

type AgentLocalUpgradeAuth added in v0.7.0 

type AgentLocalUpgradeAuth struct {
	AgentAuthorization string `json:"agentAuthorization"`
	SiteAuthorization  string `json:"siteAuthorization"`

	Raw json.RawMessage `json:"-"`
}

AgentLocalUpgradeAuth is a single agent's local upgrade/downgrade authorization state.

func (*AgentLocalUpgradeAuth) UnmarshalJSON added in v0.7.0 

func (a *AgentLocalUpgradeAuth) UnmarshalJSON(b []byte) error

type AgentPassphrase added in v0.7.0 

type AgentPassphrase struct {
	ID                   string `json:"id"`
	UUID                 string `json:"uuid"`
	ComputerName         string `json:"computerName"`
	Domain               string `json:"domain"`
	LastLoggedInUserName string `json:"lastLoggedInUserName"`
	Passphrase           string `json:"passphrase"`
	CreatedAt            string `json:"createdAt"`
	AcknowledgedAt       string `json:"acknowledgedAt"`
	CreatedByUser        string `json:"createdByUser"`

	Raw json.RawMessage `json:"-"`
}

AgentPassphrase is an agent's maintenance passphrase record. The Passphrase field is SECRET material.

func (*AgentPassphrase) UnmarshalJSON added in v0.7.0 

func (a *AgentPassphrase) UnmarshalJSON(b []byte) error

type AgentPassphraseParams added in v0.7.0 

type AgentPassphraseParams struct {
	SiteIDs    []string
	GroupIDs   []string
	AccountIDs []string
	IDs        []string
	Query      string
	Limit      int
	Cursor     string
	CountOnly  bool
}

AgentPassphraseParams are query parameters for listing agent passphrases.

type AppControlBehavior added in v0.10.0 

type AppControlBehavior string

AppControlBehavior is the enforcement behavior of an application control rule. 

const (
	AppControlBehaviorAllow   AppControlBehavior = "ALLOW"
	AppControlBehaviorMonitor AppControlBehavior = "MONITOR"
	AppControlBehaviorBlock   AppControlBehavior = "BLOCK"
)

type AppControlCommonResponse added in v0.10.0 

type AppControlCommonResponse struct {
	Success          bool   `json:"success"`
	ID               string `json:"id"`
	StatusCode       int    `json:"statusCode"`
	StatusMessage    string `json:"statusMessage"`
	ValidationErrors []struct {
		Code    string `json:"code"`
		Message string `json:"message"`
		Value   string `json:"value"`
	} `json:"validationErrors"`

	Raw json.RawMessage `json:"-"`
}

AppControlCommonResponse is the response from create/update/delete operations.

func (*AppControlCommonResponse) UnmarshalJSON added in v0.10.0 

func (r *AppControlCommonResponse) UnmarshalJSON(b []byte) error

type AppControlConditions added in v0.10.0 

type AppControlConditions struct {
	Publisher          string `json:"publisher"`
	Path               string `json:"path"`
	Signer             string `json:"signer"`
	SHA256             string `json:"sha256"`
	Process            string `json:"process"`
	ParentProcess      string `json:"parentProcess"`
	ApplicationVersion string `json:"applicationVersion"`

	Raw json.RawMessage `json:"-"`
}

AppControlConditions describes rule match conditions (read model). It includes applicationVersion which the API returns but does not accept on writes; see AppControlConditionsInput for the write model.

func (*AppControlConditions) UnmarshalJSON added in v0.10.0 

func (c *AppControlConditions) UnmarshalJSON(b []byte) error

type AppControlConditionsInput added in v0.10.0 

type AppControlConditionsInput struct {
	Publisher     string `json:"publisher,omitempty"`
	Path          string `json:"path,omitempty"`
	Signer        string `json:"signer,omitempty"`
	SHA256        string `json:"sha256,omitempty"`
	Process       string `json:"process,omitempty"`
	ParentProcess string `json:"parentProcess,omitempty"`
}

AppControlConditionsInput is the write model for rule match conditions. Per the spec, applicationVersion is not accepted on writes. This is a write-only input struct; omitempty on plain strings is intentional for partial payloads (zero-value fields are omitted from the JSON body).

type AppControlLabel added in v0.10.0 

type AppControlLabel struct {
	ID        string `json:"id"`
	LabelName string `json:"labelName"`

	Raw json.RawMessage `json:"-"`
}

AppControlLabel is a label in the application control system.

func (*AppControlLabel) UnmarshalJSON added in v0.10.0 

func (l *AppControlLabel) UnmarshalJSON(b []byte) error

type AppControlOSType added in v0.10.0 

type AppControlOSType string

AppControlOSType is an OS type for application control rules. 

const (
	AppControlOSMacOS   AppControlOSType = "MACOS"
	AppControlOSWindows AppControlOSType = "WINDOWS"
)

type AppControlQueryParams added in v0.10.0 

type AppControlQueryParams struct {
	ScopeType      AppControlScopeLevel
	ScopeIDs       []string
	IncludeParents bool
	PageSize       int
	Cursor         string
}

AppControlQueryParams are parameters for querying application control rules.

type AppControlRule added in v0.10.0 

type AppControlRule struct {
	ID          string                 `json:"id"`
	RuleName    string                 `json:"ruleName"`
	Description string                 `json:"description"`
	Scope       *AppControlScopeInfo   `json:"scope,omitempty"`
	OSType      []AppControlOSType     `json:"osType"`
	Parameters  *AppControlConditions  `json:"parameters,omitempty"`
	Behavior    AppControlBehavior     `json:"behavior"`
	Propagation bool                   `json:"propagation"`
	Exceptions  []AppControlConditions `json:"exceptions"`
	CreatedAt   string                 `json:"createdAt"`
	CreatedBy   string                 `json:"createdBy"`

	Raw json.RawMessage `json:"-"`
}

AppControlRule is a SentinelOne application control (NAC) rule.

func (*AppControlRule) UnmarshalJSON added in v0.10.0 

func (r *AppControlRule) UnmarshalJSON(b []byte) error

type AppControlRuleInput added in v0.10.0 

type AppControlRuleInput struct {
	ID          *string                     `json:"id,omitempty"`
	RuleName    string                      `json:"ruleName"`
	Description *string                     `json:"description,omitempty"`
	Scope       *AppControlScope            `json:"scope,omitempty"`
	OSType      []AppControlOSType          `json:"osType,omitempty"`
	Propagation *bool                       `json:"propagation,omitempty"`
	Parameters  *AppControlConditionsInput  `json:"parameters,omitempty"`
	Exceptions  []AppControlConditionsInput `json:"exceptions,omitempty"`
	Behavior    AppControlBehavior          `json:"behavior,omitempty"`
}

AppControlRuleInput is the request body for creating or updating an application control rule.

type AppControlScope added in v0.10.0 

type AppControlScope struct {
	ScopeType AppControlScopeLevel `json:"scopeType"`
	ScopeIDs  []string             `json:"scopeIds"`
}

AppControlScope identifies the scope for application control operations.

type AppControlScopeInfo added in v0.10.0 

type AppControlScopeInfo struct {
	ScopeID    string `json:"scopeId"`
	ScopeLevel string `json:"scopeLevel"`
	ScopeName  string `json:"scopeName"`
	ScopePath  string `json:"scopePath"`

	Raw json.RawMessage `json:"-"`
}

AppControlScopeInfo is server-returned scope metadata on a rule.

func (*AppControlScopeInfo) UnmarshalJSON added in v0.10.0 

func (s *AppControlScopeInfo) UnmarshalJSON(b []byte) error

type AppControlScopeLevel added in v0.10.0 

type AppControlScopeLevel string

AppControlScopeLevel is the scope level for application control resources. 

const (
	AppControlScopeAccount AppControlScopeLevel = "ACCOUNT"
	AppControlScopeSite    AppControlScopeLevel = "SITE"
	AppControlScopeGroup   AppControlScopeLevel = "GROUP"
)

type AppControlSettings added in v0.10.0 

type AppControlSettings struct {
	FallbackBehavior          AppControlBehavior `json:"fallbackBehavior"`
	EnableApplicationControl  bool               `json:"enableApplicationControl"`
	InheritApplicationControl bool               `json:"inheritApplicationControl"`

	Raw json.RawMessage `json:"-"`
}

AppControlSettings is the application control (NAC) settings.

func (*AppControlSettings) UnmarshalJSON added in v0.10.0 

func (s *AppControlSettings) UnmarshalJSON(b []byte) error

type AppControlSettingsInput added in v0.10.0 

type AppControlSettingsInput struct {
	Scope                     *AppControlScope   `json:"scope,omitempty"`
	FallbackBehavior          AppControlBehavior `json:"fallbackBehavior,omitempty"`
	EnableApplicationControl  *bool              `json:"enableApplicationControl,omitempty"`
	InheritApplicationControl *bool              `json:"inheritApplicationControl,omitempty"`
}

AppControlSettingsInput is the request body for updating NAC settings.

type AppMgmtScanSchedule added in v0.10.0 

type AppMgmtScanSchedule struct {
	ScanEvery int    `json:"scanEvery"`
	RepeatOn  string `json:"repeatOn"`
	Timezone  string `json:"timezone"`
	Time      string `json:"time"`

	Raw json.RawMessage `json:"-"`
}

AppMgmtScanSchedule is the scan schedule in application management settings.

func (*AppMgmtScanSchedule) UnmarshalJSON added in v0.10.0 

func (s *AppMgmtScanSchedule) UnmarshalJSON(b []byte) error

type AppMgmtSettings added in v0.10.0 

type AppMgmtSettings struct {
	ExtensiveScanEnabled   bool                 `json:"extensiveScanEnabled"`
	IsDefaultPolicy        bool                 `json:"isDefaultPolicy"`
	ScanSchedule           *AppMgmtScanSchedule `json:"scanSchedule,omitempty"`
	HasBreakingInheritance bool                 `json:"hasBreakingInheritance"`

	Raw json.RawMessage `json:"-"`
}

AppMgmtSettings is the application management settings.

func (*AppMgmtSettings) UnmarshalJSON added in v0.10.0 

func (s *AppMgmtSettings) UnmarshalJSON(b []byte) error

type AppMgmtSettingsListParams added in v0.10.0 

type AppMgmtSettingsListParams struct {
	SiteIDs    []string
	GroupIDs   []string
	AccountIDs []string
}

AppMgmtSettingsListParams are query parameters for getting application management settings.

type AppMgmtSettingsScope added in v0.10.0 

type AppMgmtSettingsScope struct {
	Tenant     bool     `json:"tenant,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	AccountIDs []string `json:"accountIds,omitempty"`
}

AppMgmtSettingsScope identifies the scope for application management settings updates.

type AppMgmtSettingsUpdateData added in v0.10.0 

type AppMgmtSettingsUpdateData struct {
	ExtensiveScanEnabled *bool                `json:"extensiveScanEnabled,omitempty"`
	IsDefaultPolicy      *bool                `json:"isDefaultPolicy,omitempty"`
	ScanSchedule         *AppMgmtScanSchedule `json:"scanSchedule,omitempty"`
}

AppMgmtSettingsUpdateData is the data payload for updating application management settings.

type Application 

type Application struct {
	ID            string `json:"id"`
	Name          string `json:"name"`
	Version       string `json:"version"`
	Publisher     string `json:"publisher"`
	Size          int64  `json:"size"`
	InstalledDate string `json:"installedDate"`
	OSType        string `json:"osType"`
	AgentID       string `json:"agentId"`

	Raw json.RawMessage `json:"-"`
}

Application is a SentinelOne application inventory entry.

func (*Application) UnmarshalJSON 

func (a *Application) UnmarshalJSON(b []byte) error

type ApplicationCVE added in v0.4.0 

type ApplicationCVE struct {
	CveID               string `json:"cveId"`
	Severity            string `json:"severity"`
	NvdBaseScore        string `json:"nvdBaseScore"`
	RiskScore           string `json:"riskScore"`
	CvssVersion         string `json:"cvssVersion"`
	Description         string `json:"description"`
	NvdURL              string `json:"nvdUrl"`
	MitreURL            string `json:"mitreUrl"`
	PublishedDate       string `json:"publishedDate"`
	ExploitCodeMaturity string `json:"exploitCodeMaturity"`
	ExploitedInTheWild  string `json:"exploitedInTheWild"`
	RemediationLevel    string `json:"remediationLevel"`
	ReportConfidence    string `json:"reportConfidence"`

	Raw json.RawMessage `json:"-"`
}

ApplicationCVE is a CVE entry from the application risk CVEs endpoint.

func (*ApplicationCVE) UnmarshalJSON added in v0.4.0 

func (c *ApplicationCVE) UnmarshalJSON(b []byte) error

type ApplicationCVEListParams added in v0.4.0 

type ApplicationCVEListParams struct {
	SiteIDs             []string
	AccountIDs          []string
	GroupIDs            []string
	Severities          []string
	ApplicationName     string
	ApplicationVendor   string
	ApplicationVersions []string
	ApplicationIDs      []string
	CveID               string
	ExploitCodeMaturity []string
	ExploitedInTheWild  []string
	RemediationLevels   []string
	ReportConfidence    []string
	AnalystVerdict      []string
	SortBy              string
	SortOrder           string
	Limit               int
	Cursor              string
}

ApplicationCVEListParams are query parameters for listing application CVEs.

type ApplicationListParams 

type ApplicationListParams struct {
	AgentIDs  []string
	SiteIDs   []string
	Name      string
	Publisher string
	Version   string
	Limit     int
	Cursor    string
}

ApplicationListParams are query parameters for listing applications.

type ApplicationRisk added in v0.4.0 

type ApplicationRisk struct {
	ID                         string `json:"id"`
	CveID                      string `json:"cveId"`
	ApplicationName            string `json:"applicationName"`
	ApplicationVendor          string `json:"applicationVendor"`
	ApplicationVersion         string `json:"applicationVersion"`
	Application                string `json:"application"`
	Severity                   string `json:"severity"`
	BaseScore                  string `json:"baseScore"`
	NvdBaseScore               string `json:"nvdBaseScore"`
	RiskScore                  string `json:"riskScore"`
	CvssVersion                string `json:"cvssVersion"`
	NvdCvssVersion             string `json:"nvdCvssVersion"`
	ExploitCodeMaturity        string `json:"exploitCodeMaturity"`
	ExploitedInTheWild         string `json:"exploitedInTheWild"`
	RemediationLevel           string `json:"remediationLevel"`
	ReportConfidence           string `json:"reportConfidence"`
	MitigationStatus           string `json:"mitigationStatus"`
	MitigationStatusReason     string `json:"mitigationStatusReason"`
	MitigationStatusChangedBy  string `json:"mitigationStatusChangedBy"`
	MitigationStatusChangeTime string `json:"mitigationStatusChangeTime"`
	Status                     string `json:"status"`
	OSType                     string `json:"osType"`
	EndpointID                 string `json:"endpointId"`
	EndpointName               string `json:"endpointName"`
	EndpointType               string `json:"endpointType"`
	DetectionDate              string `json:"detectionDate"`
	PublishedDate              string `json:"publishedDate"`
	DaysDetected               int    `json:"daysDetected"`
	LastScanDate               string `json:"lastScanDate"`
	LastScanResult             string `json:"lastScanResult"`

	Raw json.RawMessage `json:"-"`
}

ApplicationRisk is a CVE risk entry from Application Risk Management.

func (*ApplicationRisk) UnmarshalJSON added in v0.4.0 

func (r *ApplicationRisk) UnmarshalJSON(b []byte) error

type ApplicationRiskListParams added in v0.4.0 

type ApplicationRiskListParams struct {
	SiteIDs             []string
	AccountIDs          []string
	Severities          []string
	ApplicationNames    []string
	ApplicationVendor   string
	ExploitCodeMaturity []string
	ExploitedInTheWild  []string
	MitigationStatus    []string
	OSVersions          []string
	AnalystVerdict      []string
	Domains             []string
	IncludeRemovals     *bool
	SortBy              string
	SortOrder           string
	Limit               int
	Cursor              string
}

ApplicationRiskListParams are query parameters for listing application risks.

type AssessmentScanSource added in v0.4.0 

type AssessmentScanSource string

AssessmentScanSource is the source type for a triggered assessment. 

const (
	AssessmentScanSourceAD    AssessmentScanSource = "AD"
	AssessmentScanSourceAzure AssessmentScanSource = "Azure"
)

type AssessmentStatus added in v0.4.0 

type AssessmentStatus string

AssessmentStatus is the overall status of a Ranger AD assessment. 

const (
	AssessmentStatusPending    AssessmentStatus = "PENDING"
	AssessmentStatusInProgress AssessmentStatus = "IN_PROGRESS"
	AssessmentStatusCompleted  AssessmentStatus = "COMPLETED"
)

type AssetType added in v0.10.1 

type AssetType string

AssetType identifies an XDR asset category or surface subtype. The string value is the URL slug used in API paths. 

const (
	AssetTypeAccount                AssetType = "account"
	AssetTypeAiMl                   AssetType = "ai-ml"
	AssetTypeApplicationIntegration AssetType = "application-integration"
	AssetTypeCloudApplication       AssetType = "cloud-application"
	AssetTypeContainer              AssetType = "container"
	AssetTypeDataAnalysis           AssetType = "data-analysis"
	AssetTypeDataStore              AssetType = "data-store"
	AssetTypeDeveloperTool          AssetType = "developer-tool"
	AssetTypeDevice                 AssetType = "device"
	AssetTypeFunction               AssetType = "function"
	AssetTypeGovernance             AssetType = "governance"
	AssetTypeIdentity               AssetType = "identity"
	AssetTypeNetwork                AssetType = "network"
	AssetTypeServer                 AssetType = "server"
	AssetTypeStorage                AssetType = "storage"
	AssetTypeWorkstation            AssetType = "workstation"

	AssetTypeSurfaceCloud            AssetType = "surface/cloud"
	AssetTypeSurfaceEndpoint         AssetType = "surface/endpoint"
	AssetTypeSurfaceIdentity         AssetType = "surface/identity"
	AssetTypeSurfaceNetworkDiscovery AssetType = "surface/networkDiscovery"
)

type AutomationExecutionListParams added in v0.10.0 

type AutomationExecutionListParams struct {
	SiteIDs      []string
	GroupIDs     []string
	AccountIDs   []string
	TriggerTypes []string
	States       []string
	ScopeIDs     []string
	Tags         []string
	WorkflowID   string
	NameContains string
	IsSnippet    *bool
	Limit        int
	Skip         int
	SortBy       string
	SortOrder    string
	CreatedAtGte string
	CreatedAtLt  string
}

AutomationExecutionListParams are the query parameters for listing executions.

type AutomationListParams added in v0.10.0 

type AutomationListParams struct {
	SiteIDs      []string
	GroupIDs     []string
	AccountIDs   []string
	Integrations []string
	TriggerTypes []string
	CoreActions  []string
	States       []string
	ScopeIDs     []string
	Tags         []string
	NameContains string
	NameEq       string
	IsSnippet    *bool
	Oversight    *bool
	Limit        int
	Skip         int
	SortBy       string
	SortOrder    string
}

AutomationListParams are the query parameters for listing workflows.

type AutomationPagination added in v0.10.0 

type AutomationPagination struct {
	NextCursor string `json:"nextCursor"`
	TotalItems int    `json:"totalItems"`
}

AutomationPagination is the pagination metadata for Hyperautomation. The API returns nextCursor but paging is driven by skip+limit.

type AutomationRunData added in v0.10.0 

type AutomationRunData struct {
	Payload                            *string               `json:"payload,omitempty"`
	SingularityResponseEventID         *string               `json:"singularity_response_event_id,omitempty"`
	SingularityResponseEventType       *SingularityEventType `json:"singularity_response_event_type,omitempty"`
	SingularityResponseExecutionSource *ExecutionSource      `json:"singularity_response_execution_source,omitempty"`
}

AutomationRunData is the body for triggering a workflow execution.

type AutomationScopeLevel added in v0.10.0 

type AutomationScopeLevel string

AutomationScopeLevel is the scope level for a workflow. 

const (
	AutomationScopeTenant  AutomationScopeLevel = "tenant"
	AutomationScopeAccount AutomationScopeLevel = "account"
	AutomationScopeSite    AutomationScopeLevel = "site"
)

type BlocklistCreate added in v0.7.0 

type BlocklistCreate struct {
	Type        BlocklistType   `json:"type"`
	OSType      BlocklistOSType `json:"osType"`
	Value       string          `json:"value,omitempty"`
	SHA256Value string          `json:"sha256Value,omitempty"`
	Description string          `json:"description,omitempty"`
	Source      string          `json:"source,omitempty"`
}

BlocklistCreate is the data payload for creating or updating a blocklist item. A blocklist item needs at least one of Value (SHA1) or SHA256Value.

type BlocklistItem added in v0.7.0 

type BlocklistItem struct {
	ID          string `json:"id"`
	Type        string `json:"type"`
	Value       string `json:"value"`
	SHA256Value string `json:"sha256Value"`
	OSType      string `json:"osType"`
	Source      string `json:"source"`
	Description string `json:"description"`
	ScopeName   string `json:"scopeName"`
	ScopePath   string `json:"scopePath"`
	Imported    bool   `json:"imported"`
	UserID      string `json:"userId"`
	UserName    string `json:"userName"`
	CreatedAt   string `json:"createdAt"`
	UpdatedAt   string `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

BlocklistItem is a SentinelOne blocklist (restrictions) entry: a SHA1 and/or SHA256 hash that agents block from executing.

func (*BlocklistItem) UnmarshalJSON added in v0.7.0 

func (b *BlocklistItem) UnmarshalJSON(data []byte) error

type BlocklistListParams added in v0.7.0 

type BlocklistListParams struct {
	SiteIDs    []string
	GroupIDs   []string
	AccountIDs []string
	IDs        []string
	OSTypes    []string
	Types      []string
	Sources    []string
	Query      string
	Value      string
	Tenant     *bool
	Limit      int
	Cursor     string
	SortBy     string
	SortOrder  string
}

BlocklistListParams are query parameters for listing blocklist items.

type BlocklistOSType added in v0.7.0 

type BlocklistOSType string

BlocklistOSType is the operating system a blocklist item targets. 

const (
	BlocklistOSLinux         BlocklistOSType = "linux"
	BlocklistOSMacOS         BlocklistOSType = "macos"
	BlocklistOSWindows       BlocklistOSType = "windows"
	BlocklistOSWindowsLegacy BlocklistOSType = "windows_legacy"
)

Blocklist OS types.

type BlocklistScope added in v0.7.0 

type BlocklistScope struct {
	AccountIDs []string
	SiteIDs    []string
	GroupIDs   []string
	Tenant     bool
}

BlocklistScope identifies the scope a write applies to. Set Tenant for the global blocklist, or one or more of the ID slices for account/site/group scopes.

type BlocklistStatus added in v0.7.0 

type BlocklistStatus string

BlocklistStatus is the recommendation status returned by BlocklistValidate. 

const (
	BlocklistStatusNotRecommended       BlocklistStatus = "Not recommended"
	BlocklistStatusNotAllowed           BlocklistStatus = "Not allowed"
	BlocklistStatusNone                 BlocklistStatus = "NONE"
	BlocklistStatusDuplicatedSHA1       BlocklistStatus = "duplicated_value_sha1"
	BlocklistStatusDuplicatedSHA256     BlocklistStatus = "duplicated_value_sha256"
	BlocklistStatusDuplicatedSHA1SHA256 BlocklistStatus = "duplicated_value_sha1_sha256"
	BlocklistStatusDuplication          BlocklistStatus = "Duplication"
)

Blocklist validation statuses.

type BlocklistType added in v0.7.0 

type BlocklistType string

BlocklistType is the restriction type. The API only supports black_hash; any other value creates an exclusion rather than a blocklist item. 

const (
	BlocklistTypeBlackHash BlocklistType = "black_hash"
)

Blocklist restriction types.

type BlocklistValidateInput added in v0.7.0 

type BlocklistValidateInput struct {
	OSType      BlocklistOSType `json:"osType,omitempty"`
	Value       string          `json:"value,omitempty"`
	SHA256Value string          `json:"sha256Value,omitempty"`
}

BlocklistValidateInput is the data payload for BlocklistValidate.

type BlocklistValidation added in v0.7.0 

type BlocklistValidation struct {
	Status  BlocklistStatus             `json:"status"`
	Details []BlocklistValidationDetail `json:"details"`

	Raw json.RawMessage `json:"-"`
}

BlocklistValidation is the recommendation returned by BlocklistValidate.

func (*BlocklistValidation) UnmarshalJSON added in v0.7.0 

func (b *BlocklistValidation) UnmarshalJSON(data []byte) error

type BlocklistValidationDetail added in v0.7.0 

type BlocklistValidationDetail struct {
	Field string `json:"field"`
	Error string `json:"error"`
}

BlocklistValidationDetail is one field-level validation error.

type CDAgentInfo added in v0.3.0 

type CDAgentInfo struct {
	AccountID   string `json:"accountId"`
	SiteID      string `json:"siteId"`
	Name        string `json:"name"`
	MachineType string `json:"machineType"`
	OSFamily    string `json:"osFamily"`
	OSName      string `json:"osName"`
	Version     string `json:"version"`
	UUID        string `json:"uuid"`

	Raw json.RawMessage `json:"-"`
}

CDAgentInfo contains the agent-level fields of a cloud detection alert.

func (*CDAgentInfo) UnmarshalJSON added in v0.4.0 

func (c *CDAgentInfo) UnmarshalJSON(b []byte) error

type CDAlertInfo added in v0.3.0 

type CDAlertInfo struct {
	AlertID        string `json:"alertId"`
	IncidentStatus string `json:"incidentStatus"`
	AnalystVerdict string `json:"analystVerdict"`
	Severity       string `json:"severity"`
	EventType      string `json:"eventType"`
	HitType        string `json:"hitType"`
	Source         string `json:"source"`
	CreatedAt      string `json:"createdAt"`
	ReportedAt     string `json:"reportedAt"`
	UpdatedAt      string `json:"updatedAt"`
	DstIP          string `json:"dstIp"`
	DstPort        string `json:"dstPort"`
	SrcIP          string `json:"srcIp"`
	SrcPort        string `json:"srcPort"`

	Raw json.RawMessage `json:"-"`
}

CDAlertInfo contains the alert-level fields of a cloud detection alert.

func (*CDAlertInfo) UnmarshalJSON added in v0.4.0 

func (c *CDAlertInfo) UnmarshalJSON(b []byte) error

type CDAlertListParams added in v0.3.0 

type CDAlertListParams struct {
	SiteIDs          []string
	AccountIDs       []string
	RuleNameContains []string
	Severity         []string
	IncidentStatus   []string
	AnalystVerdict   []string
	CreatedAtGt      string
	CreatedAtLt      string
	ReportedAtGt     string
	ReportedAtLt     string
	Query            string
	Limit            int
	Cursor           string
	SortBy           string
	SortOrder        string
}

CDAlertListParams are query parameters for listing cloud detection alerts.

type CDRuleInfo added in v0.3.0 

type CDRuleInfo struct {
	ID            string `json:"id"`
	Name          string `json:"name"`
	Description   string `json:"description"`
	Severity      string `json:"severity"`
	QueryType     string `json:"queryType"`
	ScopeLevel    string `json:"scopeLevel"`
	TreatAsThreat string `json:"treatAsThreat"`

	Raw json.RawMessage `json:"-"`
}

CDRuleInfo contains the rule-level fields of a cloud detection alert.

func (*CDRuleInfo) UnmarshalJSON added in v0.4.0 

func (c *CDRuleInfo) UnmarshalJSON(b []byte) error

type CancelPendingEmailsResult added in v0.7.0 

type CancelPendingEmailsResult struct {
	Canceled int `json:"canceled"`

	Raw json.RawMessage `json:"-"`
}

CancelPendingEmailsResult reports how many pending emails were cancelled.

func (*CancelPendingEmailsResult) UnmarshalJSON added in v0.7.0 

func (r *CancelPendingEmailsResult) UnmarshalJSON(b []byte) error

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client is a SentinelOne MGMT API client. Safe for concurrent use.

func NewClient 

func NewClient(consoleURL, token string, opts ...Option) *Client

NewClient builds a MGMT API client.

consoleURL is the console base URL (e.g. "https://your-console.sentinelone.net"). token is the API token. Auth is applied via the ApiToken header format.

func (*Client) AccountsCount added in v0.2.0 

func (c *Client) AccountsCount(ctx context.Context, params *AccountListParams) (int, error)

AccountsCount returns the count of accounts matching the filter.

func (*Client) AccountsExpireNow added in v0.7.0 

func (c *Client) AccountsExpireNow(ctx context.Context, id string) error

AccountsExpireNow expires an account immediately.

func (*Client) AccountsGet 

func (c *Client) AccountsGet(ctx context.Context, id string) (*Account, error)

AccountsGet returns a single account by ID (uses path param, not ?ids=).

func (*Client) AccountsList 

func (c *Client) AccountsList(ctx context.Context, params *AccountListParams) ([]Account, *Pagination, error)

AccountsList returns a paginated list of accounts.

func (*Client) AccountsReactivate added in v0.7.0 

func (c *Client) AccountsReactivate(ctx context.Context, id string, unlimited bool, expiration string) error

AccountsReactivate reactivates an expired account. Pass unlimited=true to reactivate with no expiration, or a non-empty RFC3339 expiration to bound the license window. The caller chooses one; the spec requires the data wrapper.

func (*Client) AccountsUninstallPasswordGenerate added in v0.7.0 

func (c *Client) AccountsUninstallPasswordGenerate(ctx context.Context, id, expiration string) (*UninstallPasswordMeta, error)

AccountsUninstallPasswordGenerate generates (or regenerates) the account's uninstall password and returns the resulting metadata. Per the spec this endpoint returns metadata, not the password itself — read it back with AccountsUninstallPasswordView. The spec requires data.expiration (yyyy-mm-dd), so it is always sent; callers must supply a non-empty value.

func (*Client) AccountsUninstallPasswordMetadata added in v0.7.0 

func (c *Client) AccountsUninstallPasswordMetadata(ctx context.Context, id string) (*UninstallPasswordMeta, error)

AccountsUninstallPasswordMetadata returns metadata about an account's uninstall password (no secret material).

func (*Client) AccountsUninstallPasswordRevoke added in v0.7.0 

func (c *Client) AccountsUninstallPasswordRevoke(ctx context.Context, id string) error

AccountsUninstallPasswordRevoke revokes the account's uninstall password.

func (*Client) AccountsUninstallPasswordView added in v0.7.0 

func (c *Client) AccountsUninstallPasswordView(ctx context.Context, id string) (*UninstallPassword, error)

AccountsUninstallPasswordView returns the account's current uninstall password. The returned value is sensitive.

func (*Client) ActivitiesCount added in v0.2.0 

func (c *Client) ActivitiesCount(ctx context.Context, params *ActivityListParams) (int, error)

ActivitiesCount returns the count of activities matching the filter.

func (*Client) ActivitiesExport added in v0.4.0 

func (c *Client) ActivitiesExport(ctx context.Context, params *ActivityExportParams) ([]byte, error)

ActivitiesExport returns the raw CSV export of activities matching the filter.

func (*Client) ActivitiesList 

func (c *Client) ActivitiesList(ctx context.Context, params *ActivityListParams) ([]Activity, *Pagination, error)

ActivitiesList returns a paginated list of activities.

func (*Client) ActivitiesTypes added in v0.4.0 

func (c *Client) ActivitiesTypes(ctx context.Context) ([]ActivityType, error)

ActivitiesTypes returns all available activity type codes.

func (*Client) AgentsAbortScan 

func (c *Client) AgentsAbortScan(ctx context.Context, filter ActionFilter) (int, error)

AgentsAbortScan aborts a running scan on agents.

func (*Client) AgentsApproveUninstall 

func (c *Client) AgentsApproveUninstall(ctx context.Context, filter ActionFilter) (int, error)

AgentsApproveUninstall approves a pending uninstall request on agents.

func (*Client) AgentsBroadcast added in v0.7.0 

func (c *Client) AgentsBroadcast(ctx context.Context, message string, filter ActionFilter) (int, error)

AgentsBroadcast displays a broadcast message on the endpoints of matching agents.

func (*Client) AgentsConnect 

func (c *Client) AgentsConnect(ctx context.Context, filter ActionFilter) (int, error)

AgentsConnect reconnects previously isolated agents.

func (*Client) AgentsCount 

func (c *Client) AgentsCount(ctx context.Context, params *AgentListParams) (int, error)

AgentsCount returns the count of agents matching the filter.

func (*Client) AgentsDecommission 

func (c *Client) AgentsDecommission(ctx context.Context, filter ActionFilter) (int, error)

AgentsDecommission decommissions agents.

func (*Client) AgentsDisableAgent 

func (c *Client) AgentsDisableAgent(ctx context.Context, filter ActionFilter) (int, error)

AgentsDisableAgent disables agents.

func (*Client) AgentsDisconnect 

func (c *Client) AgentsDisconnect(ctx context.Context, filter ActionFilter) (int, error)

AgentsDisconnect network-disconnects (isolates) agents.

func (*Client) AgentsEnableAgent 

func (c *Client) AgentsEnableAgent(ctx context.Context, filter ActionFilter) (int, error)

AgentsEnableAgent enables agents.

func (*Client) AgentsFetchFiles added in v0.7.0 

func (c *Client) AgentsFetchFiles(ctx context.Context, id string, paths []string, password string) (bool, error)

AgentsFetchFiles requests specific files from a single agent. The fetched files are uploaded to the console encrypted with password; paths lists up to 10 absolute file paths. Returns whether the request was accepted.

func (*Client) AgentsFetchFirewallRules added in v0.7.0 

func (c *Client) AgentsFetchFirewallRules(ctx context.Context, filter ActionFilter) (int, error)

AgentsFetchFirewallRules requests the current firewall-rules inventory from agents. The API requires a data object; an empty object requests the default (current, native) configuration.

func (*Client) AgentsFetchInstalledApps added in v0.7.0 

func (c *Client) AgentsFetchInstalledApps(ctx context.Context, filter ActionFilter) (int, error)

AgentsFetchInstalledApps requests the installed-applications inventory from agents (surfaced under application management once fetched).

func (*Client) AgentsFetchLogs 

func (c *Client) AgentsFetchLogs(ctx context.Context, filter ActionFilter) (int, error)

AgentsFetchLogs fetches diagnostic logs from agents.

func (*Client) AgentsFirewallLogging 

func (c *Client) AgentsFirewallLogging(ctx context.Context, enable bool, filter ActionFilter) (int, error)

AgentsFirewallLogging enables or disables firewall logging on agents.

func (*Client) AgentsGet 

func (c *Client) AgentsGet(ctx context.Context, id string) (*Agent, error)

AgentsGet returns a single agent by ID.

func (*Client) AgentsInitiateScan 

func (c *Client) AgentsInitiateScan(ctx context.Context, filter ActionFilter) (int, error)

AgentsInitiateScan starts a full disk scan on agents.

func (*Client) AgentsList 

func (c *Client) AgentsList(ctx context.Context, params *AgentListParams) ([]Agent, *Pagination, error)

AgentsList returns a paginated list of agents.

func (*Client) AgentsLocalUpgradeAuthGet added in v0.7.0 

func (c *Client) AgentsLocalUpgradeAuthGet(ctx context.Context, id string) (*AgentLocalUpgradeAuth, error)

AgentsLocalUpgradeAuthGet returns the local upgrade/downgrade authorization for a single agent.

func (*Client) AgentsLocalUpgradeAuthorization added in v0.7.0 

func (c *Client) AgentsLocalUpgradeAuthorization(ctx context.Context, filter ActionFilter, authorization string) (int, error)

AgentsLocalUpgradeAuthorization sets the local upgrade/downgrade approval on agents. authorization is the approval-expiration timestamp; an empty string clears the authorization (sends null).

func (*Client) AgentsMarkUpToDate 

func (c *Client) AgentsMarkUpToDate(ctx context.Context, filter ActionFilter) (int, error)

AgentsMarkUpToDate marks agents as up to date.

func (*Client) AgentsMoveToGroup added in v0.2.0 

func (c *Client) AgentsMoveToGroup(ctx context.Context, groupID string, filter ActionFilter) (int, error)

AgentsMoveToGroup moves agents to a different group within the same site. The group ID is the target group; the filter selects which agents to move.

func (*Client) AgentsMoveToSite 

func (c *Client) AgentsMoveToSite(ctx context.Context, siteID string, filter ActionFilter) (int, error)

AgentsMoveToSite moves agents to a different site.

func (*Client) AgentsPassphrases added in v0.7.0 

func (c *Client) AgentsPassphrases(ctx context.Context, params *AgentPassphraseParams) ([]AgentPassphrase, *Pagination, error)

AgentsPassphrases returns a paginated list of agent passphrases. The Passphrase field on each item is SECRET material — handle accordingly.

func (*Client) AgentsRandomizeUUID 

func (c *Client) AgentsRandomizeUUID(ctx context.Context, filter ActionFilter) (int, error)

AgentsRandomizeUUID randomizes the UUID on agents.

func (*Client) AgentsRanger added in v0.7.0 

func (c *Client) AgentsRanger(ctx context.Context, enable bool, filter ActionFilter) (int, error)

AgentsRanger enables or disables Ranger network discovery on agents.

func (*Client) AgentsRejectUninstall 

func (c *Client) AgentsRejectUninstall(ctx context.Context, filter ActionFilter) (int, error)

AgentsRejectUninstall rejects a pending uninstall request on agents.

func (*Client) AgentsResetLocalConfig 

func (c *Client) AgentsResetLocalConfig(ctx context.Context, filter ActionFilter) (int, error)

AgentsResetLocalConfig resets local configuration on agents.

func (*Client) AgentsResetPassphrase added in v0.7.0 

func (c *Client) AgentsResetPassphrase(ctx context.Context, filter ActionFilter) (int, error)

AgentsResetPassphrase resets the maintenance passphrase on agents. The API reports per-agent results; the returned count is the number of agents for which a reset was attempted.

func (*Client) AgentsRestartMachine 

func (c *Client) AgentsRestartMachine(ctx context.Context, filter ActionFilter) (int, error)

AgentsRestartMachine restarts the machines running agents.

func (*Client) AgentsSetExternalID 

func (c *Client) AgentsSetExternalID(ctx context.Context, externalID string, filter ActionFilter) (int, error)

AgentsSetExternalID sets the external ID on agents.

func (*Client) AgentsShutdown 

func (c *Client) AgentsShutdown(ctx context.Context, filter ActionFilter) (int, error)

AgentsShutdown shuts down agents.

func (*Client) AgentsUninstall 

func (c *Client) AgentsUninstall(ctx context.Context, filter ActionFilter) (int, error)

AgentsUninstall uninstalls agents.

func (*Client) AgentsUpdateSoftware 

func (c *Client) AgentsUpdateSoftware(ctx context.Context, filter ActionFilter, data UpdateSoftwareData) (int, error)

AgentsUpdateSoftware triggers a software update on agents.

func (*Client) AppControlLabelsList added in v0.10.0 

func (c *Client) AppControlLabelsList(ctx context.Context) ([]AppControlLabel, error)

AppControlLabelsList returns all application control labels.

func (*Client) AppControlRulesCreate added in v0.10.0 

func (c *Client) AppControlRulesCreate(ctx context.Context, input AppControlRuleInput) (*AppControlCommonResponse, error)

AppControlRulesCreate creates an application control rule.

func (*Client) AppControlRulesDelete added in v0.10.0 

func (c *Client) AppControlRulesDelete(ctx context.Context, ids []string, scope *AppControlScope) (*AppControlCommonResponse, error)

AppControlRulesDelete deletes application control rules by ID.

func (*Client) AppControlRulesGet added in v0.10.0 

func (c *Client) AppControlRulesGet(ctx context.Context, id string) (*AppControlRule, error)

AppControlRulesGet returns a single application control rule by ID.

func (*Client) AppControlRulesList added in v0.10.0 

func (c *Client) AppControlRulesList(ctx context.Context, params *AppControlQueryParams) ([]AppControlRule, string, int, error)

AppControlRulesList queries application control rules using relay-style cursor pagination.

func (*Client) AppControlRulesUpdate added in v0.10.0 

func (c *Client) AppControlRulesUpdate(ctx context.Context, id string, input AppControlRuleInput) (*AppControlCommonResponse, error)

AppControlRulesUpdate updates an application control rule by ID.

func (*Client) AppControlSettingsGet added in v0.10.0 

func (c *Client) AppControlSettingsGet(ctx context.Context) (*AppControlSettings, error)

AppControlSettingsGet returns application control (NAC) settings.

func (*Client) AppControlSettingsUpdate added in v0.10.0 

func (c *Client) AppControlSettingsUpdate(ctx context.Context, input AppControlSettingsInput) (*AppControlCommonResponse, error)

AppControlSettingsUpdate updates application control (NAC) settings.

func (*Client) AppMgmtSettingsGet added in v0.10.0 

func (c *Client) AppMgmtSettingsGet(ctx context.Context, params *AppMgmtSettingsListParams) (*AppMgmtSettings, error)

AppMgmtSettingsGet returns application management settings.

func (*Client) AppMgmtSettingsUpdate added in v0.10.0 

func (c *Client) AppMgmtSettingsUpdate(ctx context.Context, scope AppMgmtSettingsScope, data AppMgmtSettingsUpdateData) (*AppMgmtSettings, error)

AppMgmtSettingsUpdate updates application management settings.

func (*Client) ApplicationCVEsList added in v0.4.0 

func (c *Client) ApplicationCVEsList(ctx context.Context, params *ApplicationCVEListParams) ([]ApplicationCVE, *Pagination, error)

ApplicationCVEsList returns a paginated list of application CVEs.

func (*Client) ApplicationRisksList added in v0.4.0 

func (c *Client) ApplicationRisksList(ctx context.Context, params *ApplicationRiskListParams) ([]ApplicationRisk, *Pagination, error)

ApplicationRisksList returns a paginated list of application CVE risks.

func (*Client) ApplicationsList 

func (c *Client) ApplicationsList(ctx context.Context, params *ApplicationListParams) ([]Application, *Pagination, error)

ApplicationsList returns a paginated list of installed applications.

func (*Client) AutomationActivate added in v0.10.0 

func (c *Client) AutomationActivate(ctx context.Context, workflowID, versionID string) error

AutomationActivate activates a specific workflow version.

func (*Client) AutomationDeactivate added in v0.10.0 

func (c *Client) AutomationDeactivate(ctx context.Context, workflowID string) error

AutomationDeactivate deactivates the active version of a workflow.

func (*Client) AutomationExecutionGet added in v0.10.0 

func (c *Client) AutomationExecutionGet(ctx context.Context, executionID string) (*WorkflowExecutionDetail, error)

AutomationExecutionGet gets a workflow execution by ID.

func (*Client) AutomationExecutionOutput added in v0.10.0 

func (c *Client) AutomationExecutionOutput(ctx context.Context, executionID string) (json.RawMessage, error)

AutomationExecutionOutput gets the raw output of a workflow execution.

func (*Client) AutomationExecutions added in v0.10.0 

func (c *Client) AutomationExecutions(ctx context.Context, params *AutomationExecutionListParams) ([]WorkflowExecution, *AutomationPagination, error)

AutomationExecutions lists workflow executions.

func (*Client) AutomationExport added in v0.10.0 

func (c *Client) AutomationExport(ctx context.Context, workflowID, versionID string) (*WorkflowExport, error)

AutomationExport exports a specific workflow version.

func (*Client) AutomationImport added in v0.10.0 

func (c *Client) AutomationImport(ctx context.Context, data json.RawMessage, siteIDs []string) (*Workflow, error)

AutomationImport imports a workflow from an exported definition.

func (*Client) AutomationList added in v0.10.0 

func (c *Client) AutomationList(ctx context.Context, params *AutomationListParams) ([]WorkflowListItem, *AutomationPagination, error)

AutomationList lists all workflows.

func (*Client) AutomationRun added in v0.10.0 

func (c *Client) AutomationRun(ctx context.Context, workflowID, versionID string, data *AutomationRunData) (*WorkflowExecutionRun, error)

AutomationRun triggers a manual workflow execution.

func (*Client) AutomationVersions added in v0.10.0 

func (c *Client) AutomationVersions(ctx context.Context, workflowID string, params *AutomationListParams) ([]WorkflowVersion, error)

AutomationVersions lists all versions of a workflow.

func (*Client) BaseURL 

func (c *Client) BaseURL() string

BaseURL returns the resolved API base URL.

func (*Client) BlocklistCreate added in v0.7.0 

func (c *Client) BlocklistCreate(ctx context.Context, scope BlocklistScope, data BlocklistCreate) (*BlocklistItem, error)

BlocklistCreate adds a hash to the blocklist at the given scope.

func (*Client) BlocklistDelete added in v0.7.0 

func (c *Client) BlocklistDelete(ctx context.Context, ids []string) (int, error)

BlocklistDelete removes blocklist items by ID and returns the affected count.

func (*Client) BlocklistExport added in v0.7.0 

func (c *Client) BlocklistExport(ctx context.Context, params *BlocklistListParams) ([]byte, error)

BlocklistExport returns a CSV of blocklist items matching the filter.

func (*Client) BlocklistList added in v0.7.0 

func (c *Client) BlocklistList(ctx context.Context, params *BlocklistListParams) ([]BlocklistItem, *Pagination, error)

BlocklistList returns a paginated list of blocklist items.

func (*Client) BlocklistUpdate added in v0.7.0 

func (c *Client) BlocklistUpdate(ctx context.Context, id string, scope BlocklistScope, data BlocklistCreate) (*BlocklistItem, error)

BlocklistUpdate changes the properties of a blocklist item identified by id.

func (*Client) BlocklistValidate added in v0.7.0 

func (c *Client) BlocklistValidate(ctx context.Context, scope BlocklistScope, data BlocklistValidateInput) (*BlocklistValidation, error)

BlocklistValidate checks whether a hash is on SentinelOne's "Not Allowed" or "Not Recommended" list before it is added to the blocklist.

func (*Client) CloudDetectionAlertsList added in v0.3.0 

func (c *Client) CloudDetectionAlertsList(ctx context.Context, params *CDAlertListParams) ([]CloudDetectionAlert, *Pagination, error)

CloudDetectionAlertsList returns a paginated list of STAR cloud detection alerts.

func (*Client) ConfigOverrideBulkDelete added in v0.10.0 

func (c *Client) ConfigOverrideBulkDelete(ctx context.Context, filter ConfigOverrideDeleteFilter) (int, error)

ConfigOverrideBulkDelete deletes config overrides matching the filter and returns the number of affected items.

func (*Client) ConfigOverrideCreate added in v0.10.0 

func (c *Client) ConfigOverrideCreate(ctx context.Context, input ConfigOverrideCreateInput) (*ConfigOverride, error)

ConfigOverrideCreate creates a new config override and returns the created object.

func (*Client) ConfigOverrideDelete added in v0.10.0 

func (c *Client) ConfigOverrideDelete(ctx context.Context, id string) error

ConfigOverrideDelete deletes a single config override by ID.

func (*Client) ConfigOverrideGet added in v0.10.0 

func (c *Client) ConfigOverrideGet(ctx context.Context, id string) (*ConfigOverride, error)

ConfigOverrideGet returns a single config override by ID.

func (*Client) ConfigOverrideList added in v0.10.0 

func (c *Client) ConfigOverrideList(ctx context.Context, params *ConfigOverrideListParams) ([]ConfigOverride, *Pagination, error)

ConfigOverrideList returns a paginated list of config overrides.

func (*Client) ConfigOverrideUpdate added in v0.10.0 

func (c *Client) ConfigOverrideUpdate(ctx context.Context, id string, input ConfigOverrideUpdateInput) (*ConfigOverride, error)

ConfigOverrideUpdate updates an existing config override by ID and returns the updated object.

func (*Client) DVCancelQuery added in v0.2.0 

func (c *Client) DVCancelQuery(ctx context.Context, queryID string) error

DVCancelQuery cancels a running Deep Visibility query.

func (*Client) DVCreateQuery added in v0.2.0 

func (c *Client) DVCreateQuery(ctx context.Context, req *DVQueryRequest) (*DVQueryID, error)

DVCreateQuery initiates a Deep Visibility query and returns the query ID.

func (*Client) DVGetEvents added in v0.2.0 

func (c *Client) DVGetEvents(ctx context.Context, p *DVEventsParams) ([]DVEvent, *Pagination, error)

DVGetEvents fetches Deep Visibility events for a completed query.

func (*Client) DVGetQueryStatus added in v0.2.0 

func (c *Client) DVGetQueryStatus(ctx context.Context, queryID string) (*DVQueryStatus, error)

DVGetQueryStatus checks the status of a Deep Visibility query.

func (*Client) DeployCredDetailAdd added in v0.10.0 

func (c *Client) DeployCredDetailAdd(ctx context.Context, input DeployCredDetailAddInput) error

DeployCredDetailAdd adds credential details to a credential group.

func (*Client) DeployCredDetailDelete added in v0.10.0 

func (c *Client) DeployCredDetailDelete(ctx context.Context, detailID string) error

DeployCredDetailDelete deletes a credential detail by ID.

func (*Client) DeployCredDetailList added in v0.10.0 

func (c *Client) DeployCredDetailList(ctx context.Context, params *DeployCredDetailListParams) ([]DeployCredDetail, *Pagination, error)

DeployCredDetailList returns a paginated list of credential group details.

func (*Client) DeployCredDetailUpdate added in v0.10.0 

func (c *Client) DeployCredDetailUpdate(ctx context.Context, detailID string, input DeployCredDetailInput) (*DeployCredDetail, error)

DeployCredDetailUpdate updates a credential detail by ID.

func (*Client) DeployCredGroupCreate added in v0.10.0 

func (c *Client) DeployCredGroupCreate(ctx context.Context, input DeployCredGroupCreateInput) (*DeployCredGroup, error)

DeployCredGroupCreate creates a new credential group.

func (*Client) DeployCredGroupDelete added in v0.10.0 

func (c *Client) DeployCredGroupDelete(ctx context.Context, id string) error

DeployCredGroupDelete deletes a credential group by ID.

func (*Client) DeployCredGroupList added in v0.10.0 

func (c *Client) DeployCredGroupList(ctx context.Context, params *DeployCredGroupListParams) ([]DeployCredGroup, *Pagination, error)

DeployCredGroupList returns a paginated list of credential groups.

func (*Client) DetectionDataSourcesList added in v0.4.0 

func (c *Client) DetectionDataSourcesList(ctx context.Context) ([]DetectionKeyValue, error)

DetectionDataSourcesList returns the available detection data sources.

func (*Client) DetectionSurfacesList added in v0.4.0 

func (c *Client) DetectionSurfacesList(ctx context.Context) ([]DetectionKeyValue, error)

DetectionSurfacesList returns the available detection surfaces.

func (*Client) DeviceEventsList added in v0.4.0 

func (c *Client) DeviceEventsList(ctx context.Context, params *DeviceEventListParams) ([]DeviceEvent, *Pagination, error)

DeviceEventsList returns a paginated list of device control events.

func (*Client) DeviceRulesCopy added in v0.4.0 

func (c *Client) DeviceRulesCopy(ctx context.Context, filter DeviceRuleScopeFilter, targets []DeviceRuleCopyTarget) (int, error)

DeviceRulesCopy copies device control rules from a source scope to targets.

func (*Client) DeviceRulesCreate added in v0.2.0 

func (c *Client) DeviceRulesCreate(ctx context.Context, data DeviceRuleCreate, filter DeviceRuleScopeFilter) (*DeviceRule, error)

DeviceRulesCreate creates a device control rule at the specified scope.

func (*Client) DeviceRulesDelete added in v0.4.0 

func (c *Client) DeviceRulesDelete(ctx context.Context, ids []string) (int, error)

DeviceRulesDelete deletes device control rules by ID.

func (*Client) DeviceRulesGet 

func (c *Client) DeviceRulesGet(ctx context.Context, id string) (*DeviceRule, error)

DeviceRulesGet returns a single device control rule by ID.

func (*Client) DeviceRulesList 

func (c *Client) DeviceRulesList(ctx context.Context, params *DeviceRuleListParams) ([]DeviceRule, *Pagination, error)

DeviceRulesList returns a paginated list of device control rules.

func (*Client) DeviceRulesReorder added in v0.4.0 

func (c *Client) DeviceRulesReorder(ctx context.Context, orders []RuleOrder, filter DeviceRuleReorderFilter) error

DeviceRulesReorder changes the order of device control rules within a scope.

func (*Client) DeviceRulesSetStatus added in v0.4.0 

func (c *Client) DeviceRulesSetStatus(ctx context.Context, ids []string, status DeviceRuleStatus) (int, error)

DeviceRulesSetStatus enables or disables device control rules by ID.

func (*Client) DeviceRulesUpdate added in v0.2.0 

func (c *Client) DeviceRulesUpdate(ctx context.Context, id string, data DeviceRuleCreate) (*DeviceRule, error)

DeviceRulesUpdate updates a device control rule by ID.

func (*Client) ExclusionsCreate 

func (c *Client) ExclusionsCreate(ctx context.Context, siteIDs []string, excl ExclusionCreate) (*Exclusion, error)

ExclusionsCreate creates an exclusion.

func (*Client) ExclusionsDelete 

func (c *Client) ExclusionsDelete(ctx context.Context, ids []string) (int, error)

ExclusionsDelete deletes exclusions by ID.

func (*Client) ExclusionsGet 

func (c *Client) ExclusionsGet(ctx context.Context, id string) (*Exclusion, error)

ExclusionsGet returns a single exclusion by ID.

func (*Client) ExclusionsList 

func (c *Client) ExclusionsList(ctx context.Context, params *ExclusionListParams) ([]Exclusion, *Pagination, error)

ExclusionsList returns a paginated list of exclusions.

func (*Client) ExclusionsUpdate 

func (c *Client) ExclusionsUpdate(ctx context.Context, id string, data ExclusionCreate) (*Exclusion, error)

ExclusionsUpdate updates an exclusion.

func (*Client) FiltersCreate added in v0.7.0 

func (c *Client) FiltersCreate(ctx context.Context, body FilterCreate) (*Filter, error)

FiltersCreate saves a new filter and returns the created object.

func (*Client) FiltersDelete added in v0.7.0 

func (c *Client) FiltersDelete(ctx context.Context, id string) error

FiltersDelete deletes a saved filter by ID.

func (*Client) FiltersList added in v0.7.0 

func (c *Client) FiltersList(ctx context.Context, params *FilterListParams) ([]Filter, *Pagination, error)

FiltersList returns a paginated list of saved filters.

func (*Client) FiltersUpdate added in v0.7.0 

func (c *Client) FiltersUpdate(ctx context.Context, id string, body FilterUpdate) (*Filter, error)

FiltersUpdate updates an existing saved filter.

func (*Client) FirewallProtocolsList added in v0.4.0 

func (c *Client) FirewallProtocolsList(ctx context.Context, params *FirewallProtocolListParams) ([]FirewallProtocol, *Pagination, error)

FirewallProtocolsList returns the protocols available for firewall rules.

func (*Client) FirewallRulesCopy added in v0.4.0 

func (c *Client) FirewallRulesCopy(ctx context.Context, filter FirewallRuleReorderFilter, targets []FirewallRuleCopyTarget) (int, error)

FirewallRulesCopy copies firewall rules from a source scope to targets.

func (*Client) FirewallRulesCreate added in v0.2.0 

func (c *Client) FirewallRulesCreate(ctx context.Context, scope FirewallRuleScope, data FirewallRuleCreate) (*FirewallRule, error)

FirewallRulesCreate creates a firewall rule.

func (*Client) FirewallRulesDelete added in v0.4.0 

func (c *Client) FirewallRulesDelete(ctx context.Context, ids []string) (int, error)

FirewallRulesDelete deletes firewall rules by ID.

func (*Client) FirewallRulesExport added in v0.4.0 

func (c *Client) FirewallRulesExport(ctx context.Context, params *FirewallRuleListParams) ([]byte, error)

FirewallRulesExport exports firewall rules as raw JSON for the given scope.

func (*Client) FirewallRulesGet 

func (c *Client) FirewallRulesGet(ctx context.Context, id string) (*FirewallRule, error)

FirewallRulesGet returns a single firewall rule by ID.

func (*Client) FirewallRulesImport added in v0.4.0 

func (c *Client) FirewallRulesImport(ctx context.Context, scope FirewallImportScope, filename string, fileData []byte) error

FirewallRulesImport imports firewall rules from a JSON file into the given scope.

func (*Client) FirewallRulesList 

func (c *Client) FirewallRulesList(ctx context.Context, params *FirewallRuleListParams) ([]FirewallRule, *Pagination, error)

FirewallRulesList returns a paginated list of firewall rules.

func (*Client) FirewallRulesReorder added in v0.4.0 

func (c *Client) FirewallRulesReorder(ctx context.Context, orders []RuleOrder, filter FirewallRuleReorderFilter) error

FirewallRulesReorder changes the order of firewall rules within a scope.

func (*Client) FirewallRulesSetStatus added in v0.4.0 

func (c *Client) FirewallRulesSetStatus(ctx context.Context, ids []string, status FirewallStatus) (int, error)

FirewallRulesSetStatus enables or disables firewall rules by ID.

func (*Client) FirewallRulesUpdate added in v0.2.0 

func (c *Client) FirewallRulesUpdate(ctx context.Context, id string, data FirewallRuleCreate) (*FirewallRule, error)

FirewallRulesUpdate updates a firewall rule by ID.

func (*Client) GroupsCount added in v0.2.0 

func (c *Client) GroupsCount(ctx context.Context, params *GroupListParams) (int, error)

GroupsCount returns the count of groups matching the filter.

func (*Client) GroupsCreate 

func (c *Client) GroupsCreate(ctx context.Context, siteID string, data GroupCreate) (*Group, error)

GroupsCreate creates a group.

func (*Client) GroupsDelete 

func (c *Client) GroupsDelete(ctx context.Context, id string) error

GroupsDelete deletes a group.

func (*Client) GroupsGet 

func (c *Client) GroupsGet(ctx context.Context, id string) (*Group, error)

GroupsGet returns a single group by ID.

func (*Client) GroupsList 

func (c *Client) GroupsList(ctx context.Context, params *GroupListParams) ([]Group, *Pagination, error)

GroupsList returns a paginated list of groups.

func (*Client) GroupsUpdate 

func (c *Client) GroupsUpdate(ctx context.Context, id string, data GroupUpdate) (*Group, error)

GroupsUpdate updates a group.

func (*Client) GuardrailsCheck added in v0.7.0 

func (c *Client) GuardrailsCheck(ctx context.Context, in GuardrailCheckInput) (*GuardrailCheckResult, error)

GuardrailsCheck reports whether running a script on the given agents would trip a guardrail and require approval.

func (*Client) GuardrailsDelete added in v0.7.0 

func (c *Client) GuardrailsDelete(ctx context.Context, scope GuardrailScope) error

GuardrailsDelete removes a guardrail configuration for a scope.

func (*Client) GuardrailsGet added in v0.7.0 

func (c *Client) GuardrailsGet(ctx context.Context, scope GuardrailScope) (*Guardrails, error)

GuardrailsGet returns the guardrail configuration for a scope.

func (*Client) GuardrailsUpsert added in v0.7.0 

func (c *Client) GuardrailsUpsert(ctx context.Context, in GuardrailsUpsertInput) error

GuardrailsUpsert creates or updates (if it does not exist) a guardrail configuration for a scope.

func (*Client) IOCsCreate added in v0.4.0 

func (c *Client) IOCsCreate(ctx context.Context, iocs []IOCCreateInput) ([]IOC, error)

IOCsCreate creates threat intelligence IOCs and returns the created indicators.

func (*Client) IOCsDelete added in v0.4.0 

func (c *Client) IOCsDelete(ctx context.Context, uuids []string) (int, error)

IOCsDelete deletes threat intelligence IOCs by UUID.

func (*Client) IOCsList added in v0.4.0 

func (c *Client) IOCsList(ctx context.Context, params *IOCListParams) ([]IOC, *Pagination, error)

IOCsList returns a paginated list of threat intelligence IOCs.

func (*Client) IdentityADConfigurationAdd added in v0.10.0 

func (c *Client) IdentityADConfigurationAdd(ctx context.Context, params *IdentityParams, input ADConfigurationInput) error

IdentityADConfigurationAdd creates a new AD configuration. The input contains credentials (userName, password) — handle as secrets.

func (*Client) IdentityADConfigurationDelete added in v0.10.0 

func (c *Client) IdentityADConfigurationDelete(ctx context.Context, params *IdentityParams, ids []int64) error

IdentityADConfigurationDelete deletes AD configurations by ID.

func (*Client) IdentityADConfigurations added in v0.10.0 

func (c *Client) IdentityADConfigurations(ctx context.Context, params *IdentityParams) ([]ADConfiguration, error)

IdentityADConfigurations returns all AD configurations.

func (*Client) IdentityAvailableFeatures added in v0.10.0 

func (c *Client) IdentityAvailableFeatures(ctx context.Context, params *IdentityParams) ([]ADFeature, error)

IdentityAvailableFeatures returns the list of available AD features.

func (*Client) IdentityConnector added in v0.10.0 

func (c *Client) IdentityConnector(ctx context.Context, params *IdentityParams) (*Connector, error)

IdentityConnector returns the single Cloudlink connector configuration.

func (*Client) IdentityConnectorReplace added in v0.10.0 

func (c *Client) IdentityConnectorReplace(ctx context.Context, params *IdentityParams, agentUUID string) error

IdentityConnectorReplace replaces the AD connector with a new agent.

func (*Client) IdentityConnectors added in v0.10.0 

func (c *Client) IdentityConnectors(ctx context.Context, params *IdentityParams) ([]Connector, error)

IdentityConnectors returns all Cloudlink connector configurations.

func (*Client) IdentityDomains added in v0.10.0 

func (c *Client) IdentityDomains(ctx context.Context, params *IdentityParams) ([]DomainInfo, error)

IdentityDomains returns AD domain information.

func (*Client) IdentityOnboardingStatus added in v0.10.0 

func (c *Client) IdentityOnboardingStatus(ctx context.Context, params *IdentityParams) (*ADOnboardingStatus, error)

IdentityOnboardingStatus returns the current AD service onboarding status.

func (*Client) IdentityTimezones added in v0.10.0 

func (c *Client) IdentityTimezones(ctx context.Context, params *IdentityParams) ([]TimeZoneInfo, error)

IdentityTimezones returns the list of available timezone pairs.

func (*Client) IdentityWindowsAgents added in v0.10.0 

func (c *Client) IdentityWindowsAgents(ctx context.Context, params *WindowsAgentParams) ([]WindowsAgent, error)

IdentityWindowsAgents returns Windows unified agents matching the filter.

func (*Client) LocationsCreate added in v0.7.0 

func (c *Client) LocationsCreate(ctx context.Context, body LocationCreate) (*Location, error)

LocationsCreate creates a location and returns the created object.

func (*Client) LocationsDelete added in v0.7.0 

func (c *Client) LocationsDelete(ctx context.Context, ids []string) error

LocationsDelete deletes one or more locations. The IDs are sent in the body: the delete endpoint is on the collection path, not per-location.

func (*Client) LocationsList added in v0.7.0 

func (c *Client) LocationsList(ctx context.Context, params *LocationListParams) ([]Location, *Pagination, error)

LocationsList returns a paginated list of locations.

func (*Client) LocationsUpdate added in v0.7.0 

func (c *Client) LocationsUpdate(ctx context.Context, id string, body LocationUpdate) (*Location, error)

LocationsUpdate updates an existing location.

func (*Client) MaintenanceWindowsExport added in v0.7.0 

func (c *Client) MaintenanceWindowsExport(ctx context.Context, params *TasksConfigParams) ([]byte, error)

MaintenanceWindowsExport exports all maintenance-window occurrences for a scope as CSV. Only the flexible (policy_payload) format is supported.

func (*Client) MarketplaceAppConfig added in v0.10.1 

func (c *Client) MarketplaceAppConfig(ctx context.Context, appID string) (json.RawMessage, error)

MarketplaceAppConfig returns the configuration for an installed marketplace application.

func (*Client) MarketplaceAppList added in v0.10.1 

func (c *Client) MarketplaceAppList(ctx context.Context, params *MarketplaceAppListParams) ([]MarketplaceApp, *Pagination, error)

MarketplaceAppList lists installed marketplace applications.

func (*Client) MarketplaceAppLog added in v0.10.1 

func (c *Client) MarketplaceAppLog(ctx context.Context, appID string, onlyErrors *bool) ([]json.RawMessage, error)

MarketplaceAppLog returns log entries for an installed marketplace application.

func (*Client) MarketplaceCatalogConfig added in v0.10.1 

func (c *Client) MarketplaceCatalogConfig(ctx context.Context, catalogID string) (json.RawMessage, error)

MarketplaceCatalogConfig returns the configuration schema fields for a catalog application.

func (*Client) MarketplaceCatalogList added in v0.10.1 

func (c *Client) MarketplaceCatalogList(ctx context.Context, params *MarketplaceCatalogListParams) ([]MarketplaceCatalogItem, *Pagination, error)

MarketplaceCatalogList lists available applications in the Singularity Marketplace catalog.

func (*Client) MarketplaceDelete added in v0.10.1 

func (c *Client) MarketplaceDelete(ctx context.Context, filter *MarketplaceDeleteFilter) error

MarketplaceDelete deletes an installed marketplace application.

func (*Client) MarketplaceInstall added in v0.10.1 

func (c *Client) MarketplaceInstall(ctx context.Context, input *MarketplaceInstallInput) error

MarketplaceInstall installs a marketplace application.

func (*Client) MarketplaceSetMode added in v0.10.1 

func (c *Client) MarketplaceSetMode(ctx context.Context, mode string, filter *MarketplaceScopeFilter) error

MarketplaceSetMode enables or disables installed marketplace applications. mode must be "enable" or "disable".

func (*Client) MarketplaceUpdate added in v0.10.1 

func (c *Client) MarketplaceUpdate(ctx context.Context, input *MarketplaceUpdateInput) error

MarketplaceUpdate updates the configuration of an installed marketplace application.

func (*Client) NetworkQuarantineAddTags added in v0.7.0 

func (c *Client) NetworkQuarantineAddTags(ctx context.Context, filter FirewallActionFilter, tagIDs []string) (int, error)

NetworkQuarantineAddTags adds tags to matched network quarantine rules.

func (*Client) NetworkQuarantineConfigurationGet added in v0.7.0 

func (c *Client) NetworkQuarantineConfigurationGet(ctx context.Context, scope FirewallConfigScope) (*FirewallConfiguration, error)

NetworkQuarantineConfigurationGet returns the network quarantine configuration for a scope.

func (*Client) NetworkQuarantineConfigurationUpdate added in v0.7.0 

func (c *Client) NetworkQuarantineConfigurationUpdate(ctx context.Context, scope FirewallConfigScope, data FirewallConfigurationUpdate) (*FirewallConfiguration, error)

NetworkQuarantineConfigurationUpdate updates the network quarantine configuration for a scope.

func (*Client) NetworkQuarantineCopy added in v0.7.0 

func (c *Client) NetworkQuarantineCopy(ctx context.Context, filter FirewallRuleReorderFilter, targets []FirewallRuleCopyTarget) (int, error)

NetworkQuarantineCopy copies network quarantine rules from a source scope to targets.

func (*Client) NetworkQuarantineCreate added in v0.7.0 

func (c *Client) NetworkQuarantineCreate(ctx context.Context, scope FirewallRuleScope, data FirewallRuleCreate) (*FirewallRule, error)

NetworkQuarantineCreate creates a network quarantine rule.

func (*Client) NetworkQuarantineDelete added in v0.7.0 

func (c *Client) NetworkQuarantineDelete(ctx context.Context, ids []string) (int, error)

NetworkQuarantineDelete deletes network quarantine rules by ID.

func (*Client) NetworkQuarantineExport added in v0.7.0 

func (c *Client) NetworkQuarantineExport(ctx context.Context, params *FirewallRuleListParams) ([]byte, error)

NetworkQuarantineExport exports network quarantine rules as raw JSON for the given scope.

func (*Client) NetworkQuarantineGet added in v0.7.0 

func (c *Client) NetworkQuarantineGet(ctx context.Context, id string) (*FirewallRule, error)

NetworkQuarantineGet returns a single network quarantine rule by ID.

func (*Client) NetworkQuarantineImport added in v0.7.0 

func (c *Client) NetworkQuarantineImport(ctx context.Context, scope FirewallImportScope, filename string, fileData []byte) error

NetworkQuarantineImport imports network quarantine rules from a JSON file into the given scope.

func (*Client) NetworkQuarantineList added in v0.7.0 

func (c *Client) NetworkQuarantineList(ctx context.Context, params *FirewallRuleListParams) ([]FirewallRule, *Pagination, error)

NetworkQuarantineList returns a paginated list of network quarantine rules.

func (*Client) NetworkQuarantineMoveRules added in v0.7.0 

func (c *Client) NetworkQuarantineMoveRules(ctx context.Context, filter FirewallActionFilter, targets []FirewallRuleCopyTarget) (int, error)

NetworkQuarantineMoveRules moves matched network quarantine rules to target scopes.

func (*Client) NetworkQuarantineProtocolsList added in v0.7.0 

func (c *Client) NetworkQuarantineProtocolsList(ctx context.Context, params *FirewallProtocolListParams) ([]FirewallProtocol, *Pagination, error)

NetworkQuarantineProtocolsList returns the protocols available for network quarantine rules.

func (*Client) NetworkQuarantineRemoveTags added in v0.7.0 

func (c *Client) NetworkQuarantineRemoveTags(ctx context.Context, filter FirewallActionFilter, tagIDs []string) (int, error)

NetworkQuarantineRemoveTags removes tags from matched network quarantine rules.

func (*Client) NetworkQuarantineReorder added in v0.7.0 

func (c *Client) NetworkQuarantineReorder(ctx context.Context, orders []RuleOrder, filter FirewallRuleReorderFilter) error

NetworkQuarantineReorder changes the order of network quarantine rules within a scope.

func (*Client) NetworkQuarantineSetLocation added in v0.7.0 

func (c *Client) NetworkQuarantineSetLocation(ctx context.Context, filter FirewallActionFilter, loc FirewallLocationTarget) (int, error)

NetworkQuarantineSetLocation assigns a location to matched network quarantine rules.

func (*Client) NetworkQuarantineSetStatus added in v0.7.0 

func (c *Client) NetworkQuarantineSetStatus(ctx context.Context, ids []string, status FirewallStatus) (int, error)

NetworkQuarantineSetStatus enables or disables network quarantine rules by ID.

func (*Client) NetworkQuarantineUpdate added in v0.7.0 

func (c *Client) NetworkQuarantineUpdate(ctx context.Context, id string, data FirewallRuleCreate) (*FirewallRule, error)

NetworkQuarantineUpdate updates a network quarantine rule by ID.

func (*Client) PlatformRulesDisable added in v0.4.0 

func (c *Client) PlatformRulesDisable(ctx context.Context, filter PlatformRuleActionFilter) (int, error)

PlatformRulesDisable disables platform detection rules matching the filter.

func (*Client) PlatformRulesEnable added in v0.4.0 

func (c *Client) PlatformRulesEnable(ctx context.Context, filter PlatformRuleActionFilter) (int, error)

PlatformRulesEnable enables platform detection rules matching the filter.

func (*Client) PlatformRulesList added in v0.4.0 

func (c *Client) PlatformRulesList(ctx context.Context, params *PlatformRuleListParams) ([]PlatformRule, *Pagination, error)

PlatformRulesList returns a paginated list of platform detection rules.

func (*Client) PolicyGetAccount 

func (c *Client) PolicyGetAccount(ctx context.Context, accountID string) (*Policy, error)

PolicyGetAccount returns the policy for an account.

func (*Client) PolicyGetGroup 

func (c *Client) PolicyGetGroup(ctx context.Context, groupID string) (*Policy, error)

PolicyGetGroup returns the policy for a group.

func (*Client) PolicyGetSite 

func (c *Client) PolicyGetSite(ctx context.Context, siteID string) (*Policy, error)

PolicyGetSite returns the policy for a site.

func (*Client) PolicyRevertAccount added in v0.4.0 

func (c *Client) PolicyRevertAccount(ctx context.Context, accountID string) error

PolicyRevertAccount reverts an account policy to the global inherited values.

func (*Client) PolicyRevertGroup added in v0.4.0 

func (c *Client) PolicyRevertGroup(ctx context.Context, groupID string) error

PolicyRevertGroup reverts a group policy to its parent (site) inherited values.

func (*Client) PolicyRevertSite added in v0.4.0 

func (c *Client) PolicyRevertSite(ctx context.Context, siteID string) error

PolicyRevertSite reverts a site policy to its parent (account) inherited values.

func (*Client) PolicyUpdateAccount 

func (c *Client) PolicyUpdateAccount(ctx context.Context, accountID string, policy json.RawMessage) (*Policy, error)

PolicyUpdateAccount updates the policy for an account.

func (*Client) PolicyUpdateGroup 

func (c *Client) PolicyUpdateGroup(ctx context.Context, groupID string, policy json.RawMessage) (*Policy, error)

PolicyUpdateGroup updates the policy for a group.

func (*Client) PolicyUpdateSite 

func (c *Client) PolicyUpdateSite(ctx context.Context, siteID string, policy json.RawMessage) (*Policy, error)

PolicyUpdateSite updates the policy for a site.

func (*Client) RangerADAffectedObjects added in v0.4.0 

func (c *Client) RangerADAffectedObjects(ctx context.Context, params *ADAffectedObjectListParams) ([]ADAffectedObject, *Pagination, error)

RangerADAffectedObjects returns a paginated list of affected objects for a detection.

func (*Client) RangerADAssessmentStatus added in v0.4.0 

func (c *Client) RangerADAssessmentStatus(ctx context.Context, params *ADAssessmentStatusParams) (*ADAssessmentStatus, error)

RangerADAssessmentStatus returns the current Ranger AD assessment status.

func (*Client) RangerADExposures added in v0.4.0 

func (c *Client) RangerADExposures(ctx context.Context, params *ADExposureListParams) ([]ADExposure, *Pagination, error)

RangerADExposures returns a paginated list of AD exposures.

func (*Client) RangerADSetAckStatus added in v0.10.0 

func (c *Client) RangerADSetAckStatus(ctx context.Context, params *ADAckExposuresParams) (bool, string, error)

RangerADSetAckStatus sets the acknowledged status on exposures.

func (*Client) RangerADSetSkippedExposures added in v0.10.0 

func (c *Client) RangerADSetSkippedExposures(ctx context.Context, params *ADSkipExposuresParams) (bool, string, error)

RangerADSetSkippedExposures sets exposures as skipped or unskipped.

func (*Client) RangerADTriggerAssessment added in v0.4.0 

func (c *Client) RangerADTriggerAssessment(ctx context.Context, params *ADTriggerAssessmentParams) (bool, string, error)

RangerADTriggerAssessment triggers a new AD assessment scan.

func (*Client) RemoteScriptContent added in v0.7.0 

func (c *Client) RemoteScriptContent(ctx context.Context, id string) (string, error)

RemoteScriptContent returns the raw text content of a remote script.

func (*Client) RemoteScriptsEdit added in v0.7.0 

func (c *Client) RemoteScriptsEdit(ctx context.Context, id string, edit RemoteScriptEdit) (*RemoteScript, error)

RemoteScriptsEdit changes a script's content and metadata. The endpoint takes multipart/form-data; content is sent inline as the scriptContent field.

func (*Client) RemoteScriptsExecute added in v0.2.0 

func (c *Client) RemoteScriptsExecute(ctx context.Context, filter RemoteScriptsExecuteFilter, data RemoteScriptsExecuteParams) (*RemoteScriptsExecuteResult, error)

RemoteScriptsExecute runs a remote script on the specified agents.

func (*Client) RemoteScriptsGet 

func (c *Client) RemoteScriptsGet(ctx context.Context, id string) (*RemoteScript, error)

RemoteScriptsGet returns a single remote script by ID.

func (*Client) RemoteScriptsList 

func (c *Client) RemoteScriptsList(ctx context.Context, params *RemoteScriptListParams) ([]RemoteScript, *Pagination, error)

RemoteScriptsList returns a paginated list of remote scripts.

func (*Client) RemoteScriptsPendingDecision added in v0.7.0 

func (c *Client) RemoteScriptsPendingDecision(ctx context.Context, id string, approve bool) error

RemoteScriptsPendingDecision approves or declines a pending execution.

func (*Client) RemoteScriptsPendingList added in v0.7.0 

func (c *Client) RemoteScriptsPendingList(ctx context.Context, params *RemoteScriptsPendingParams) ([]PendingExecution, *Pagination, error)

RemoteScriptsPendingList returns a paginated list of pending executions.

func (*Client) RemoteScriptsStatus added in v0.2.0 

func (c *Client) RemoteScriptsStatus(ctx context.Context, params *RemoteScriptsStatusParams) ([]RemoteScriptTask, *Pagination, error)

RemoteScriptsStatus returns the status of remote script execution tasks.

func (*Client) RemoteScriptsUpdate added in v0.7.0 

func (c *Client) RemoteScriptsUpdate(ctx context.Context, id string, upd RemoteScriptUpdate) (*RemoteScript, error)

RemoteScriptsUpdate changes the metadata of an existing remote script.

func (*Client) RemoteScriptsUploadLimits added in v0.7.0 

func (c *Client) RemoteScriptsUploadLimits(ctx context.Context) (*UploadLimits, error)

RemoteScriptsUploadLimits returns the package upload size limits.

func (*Client) ReportDownload added in v0.4.0 

func (c *Client) ReportDownload(ctx context.Context, reportID, format string) ([]byte, error)

ReportDownload downloads a report in the specified format (pdf or html).

func (*Client) ReportTasksCreate added in v0.4.0 

func (c *Client) ReportTasksCreate(ctx context.Context, siteIDs, accountIDs []string, scope ReportScope, task ReportTaskCreate) error

ReportTasksCreate creates a new report task.

func (*Client) ReportTasksList added in v0.4.0 

func (c *Client) ReportTasksList(ctx context.Context, params *ReportTaskListParams) ([]ReportTask, *Pagination, error)

ReportTasksList returns a paginated list of report tasks.

func (*Client) ReportsInsightTypes added in v0.4.0 

func (c *Client) ReportsInsightTypes(ctx context.Context, params *InsightTypesParams) (json.RawMessage, error)

ReportsInsightTypes returns available report insight types.

func (*Client) ReportsList added in v0.4.0 

func (c *Client) ReportsList(ctx context.Context, params *ReportListParams) ([]Report, *Pagination, error)

ReportsList returns a paginated list of generated reports.

func (*Client) RoleCreate added in v0.7.0 

func (c *Client) RoleCreate(ctx context.Context, body RoleCreate) (*Role, error)

RoleCreate creates a new RBAC role.

func (*Client) RoleDelete added in v0.7.0 

func (c *Client) RoleDelete(ctx context.Context, id string) error

RoleDelete deletes an RBAC role by ID. Users still assigned to the role are left without it; use the console to reassign them to a replacement role.

func (*Client) RoleGet added in v0.7.0 

func (c *Client) RoleGet(ctx context.Context, id string) (*Role, error)

RoleGet returns a single role by ID, including its permission tree.

func (*Client) RoleTemplate added in v0.7.0 

func (c *Client) RoleTemplate(ctx context.Context) (*Role, error)

RoleTemplate returns the blank role template (description + permission tree with default values) used as a starting point for a new role.

func (*Client) RoleUpdate added in v0.7.0 

func (c *Client) RoleUpdate(ctx context.Context, id string, body RoleUpdate) (*Role, error)

RoleUpdate updates an existing RBAC role.

func (*Client) RolesList added in v0.7.0 

func (c *Client) RolesList(ctx context.Context, params *RoleListParams) ([]Role, *Pagination, error)

RolesList returns a paginated list of RBAC roles.

func (*Client) RulesCreate added in v0.2.0 

func (c *Client) RulesCreate(ctx context.Context, data RuleCreate) (*Rule, error)

RulesCreate creates a custom detection rule.

func (*Client) RulesDisable added in v0.3.0 

func (c *Client) RulesDisable(ctx context.Context, filter RuleActionFilter) (int, error)

RulesDisable deactivates custom detection rules matching the filter.

func (*Client) RulesEnable added in v0.3.0 

func (c *Client) RulesEnable(ctx context.Context, filter RuleActionFilter) (int, error)

RulesEnable activates custom detection rules matching the filter.

func (*Client) RulesGet added in v0.2.0 

func (c *Client) RulesGet(ctx context.Context, id string) (*Rule, error)

RulesGet returns a single custom detection rule by ID.

func (*Client) RulesList added in v0.2.0 

func (c *Client) RulesList(ctx context.Context, params *RuleListParams) ([]Rule, *Pagination, error)

RulesList returns a paginated list of custom detection rules.

func (*Client) RulesUpdate added in v0.2.0 

func (c *Client) RulesUpdate(ctx context.Context, id string, data RuleCreate) (*Rule, error)

RulesUpdate updates a custom detection rule by ID.

func (*Client) ServiceUsersBulkDelete added in v0.7.0 

func (c *Client) ServiceUsersBulkDelete(ctx context.Context, ids []string) (int, error)

ServiceUsersBulkDelete deletes service users by ID and returns the affected count.

func (*Client) ServiceUsersCreate added in v0.7.0 

func (c *Client) ServiceUsersCreate(ctx context.Context, data ServiceUserCreate) (*ServiceUser, error)

ServiceUsersCreate creates a service user and returns it. The returned APIToken.Value holds the newly generated token (shown only here).

func (*Client) ServiceUsersDelete added in v0.7.0 

func (c *Client) ServiceUsersDelete(ctx context.Context, id string) error

ServiceUsersDelete deletes a single service user by ID.

func (*Client) ServiceUsersExport added in v0.7.0 

func (c *Client) ServiceUsersExport(ctx context.Context, params *ServiceUserListParams) ([]byte, error)

ServiceUsersExport returns the service users matching the filter as a report.

func (*Client) ServiceUsersGenerateToken added in v0.7.0 

func (c *Client) ServiceUsersGenerateToken(ctx context.Context, id, expirationDate string) (*ServiceUserToken, error)

ServiceUsersGenerateToken issues a new API token for a service user, expiring on expirationDate (RFC3339). The returned Token is shown only once.

func (*Client) ServiceUsersGet added in v0.7.0 

func (c *Client) ServiceUsersGet(ctx context.Context, id string) (*ServiceUser, error)

ServiceUsersGet returns a single service user by ID.

func (*Client) ServiceUsersList added in v0.7.0 

func (c *Client) ServiceUsersList(ctx context.Context, params *ServiceUserListParams) ([]ServiceUser, *Pagination, error)

ServiceUsersList returns a paginated list of service users.

func (*Client) ServiceUsersUpdate added in v0.7.0 

func (c *Client) ServiceUsersUpdate(ctx context.Context, id string, data ServiceUserUpdate) (*ServiceUser, error)

ServiceUsersUpdate updates a service user and returns the updated resource.

func (*Client) SettingsADGet added in v0.7.0 

func (c *Client) SettingsADGet(ctx context.Context, params *SettingsParams) (*ADSettings, error)

SettingsADGet returns the Active Directory settings.

func (*Client) SettingsADScopeMappingGet added in v0.7.0 

func (c *Client) SettingsADScopeMappingGet(ctx context.Context, params *SettingsParams) (*ADScopeMapping, error)

SettingsADScopeMappingGet returns the Active Directory scope mapping.

func (*Client) SettingsADScopeMappingUpdate added in v0.7.0 

func (c *Client) SettingsADScopeMappingUpdate(ctx context.Context, params *SettingsParams, data ADScopeMapping) (*ADScopeMapping, error)

SettingsADScopeMappingUpdate updates the Active Directory scope mapping.

func (*Client) SettingsADTest added in v0.7.0 

func (c *Client) SettingsADTest(ctx context.Context, params *SettingsParams, data ADSettings) (*SettingsTestResult, error)

SettingsADTest probes connectivity using the provided Active Directory settings.

func (*Client) SettingsADUpdate added in v0.7.0 

func (c *Client) SettingsADUpdate(ctx context.Context, params *SettingsParams, data ADSettings) (*ADSettings, error)

SettingsADUpdate updates the Active Directory settings.

func (*Client) SettingsCancelPendingEmails added in v0.7.0 

func (c *Client) SettingsCancelPendingEmails(ctx context.Context, params *SettingsParams) (*CancelPendingEmailsResult, error)

SettingsCancelPendingEmails clears queued pending email notifications. The request body carries only a filter (no data envelope), per the spec.

func (*Client) SettingsNotificationsGet added in v0.4.0 

func (c *Client) SettingsNotificationsGet(ctx context.Context, params *SettingsParams) (*NotificationSettings, error)

SettingsNotificationsGet returns the notification settings.

func (*Client) SettingsNotificationsUpdate added in v0.4.0 

func (c *Client) SettingsNotificationsUpdate(ctx context.Context, params *SettingsParams, data NotificationSettings) (*NotificationSettings, error)

SettingsNotificationsUpdate updates the notification settings.

func (*Client) SettingsRecipientDelete added in v0.7.0 

func (c *Client) SettingsRecipientDelete(ctx context.Context, id string) error

SettingsRecipientDelete removes a notification recipient by ID.

func (*Client) SettingsRecipientsGet added in v0.7.0 

func (c *Client) SettingsRecipientsGet(ctx context.Context, params *SettingsParams) ([]NotificationRecipient, error)

SettingsRecipientsGet returns the configured notification recipients.

func (*Client) SettingsRecipientsUpdate added in v0.7.0 

func (c *Client) SettingsRecipientsUpdate(ctx context.Context, params *SettingsParams, data NotificationRecipient) (*NotificationRecipient, error)

SettingsRecipientsUpdate sets (creates or updates) a single notification recipient and returns the stored recipient.

func (*Client) SettingsSMSGet added in v0.7.0 

func (c *Client) SettingsSMSGet(ctx context.Context, params *SettingsParams) (*SMSSettings, error)

SettingsSMSGet returns the SMS settings.

func (*Client) SettingsSMSUpdate added in v0.7.0 

func (c *Client) SettingsSMSUpdate(ctx context.Context, params *SettingsParams, data SMSSettings) (*SMSSettings, error)

SettingsSMSUpdate updates the SMS settings.

func (*Client) SettingsSMTPGet added in v0.4.0 

func (c *Client) SettingsSMTPGet(ctx context.Context, params *SettingsParams) (*SMTPSettings, error)

SettingsSMTPGet returns the SMTP settings.

func (*Client) SettingsSMTPTest added in v0.4.0 

func (c *Client) SettingsSMTPTest(ctx context.Context, params *SettingsParams, data SMTPSettings) (*SettingsTestResult, error)

SettingsSMTPTest sends a test email using the provided SMTP settings.

func (*Client) SettingsSMTPUpdate added in v0.4.0 

func (c *Client) SettingsSMTPUpdate(ctx context.Context, params *SettingsParams, data SMTPSettings) (*SMTPSettings, error)

SettingsSMTPUpdate updates the SMTP settings.

func (*Client) SettingsSSOCert added in v0.7.0 

func (c *Client) SettingsSSOCert(ctx context.Context, params *SettingsParams) (*SSOServiceProviderCert, error)

SettingsSSOCert returns the SSO service-provider signing certificate metadata and PEM.

func (*Client) SettingsSSOCertDownload added in v0.7.0 

func (c *Client) SettingsSSOCertDownload(ctx context.Context, params *SettingsParams) ([]byte, error)

SettingsSSOCertDownload returns the raw SSO service-provider certificate file.

func (*Client) SettingsSSOGet added in v0.4.0 

func (c *Client) SettingsSSOGet(ctx context.Context, params *SettingsParams) (*SSOSettings, error)

SettingsSSOGet returns the SSO settings.

func (*Client) SettingsSSOUpdate added in v0.4.0 

func (c *Client) SettingsSSOUpdate(ctx context.Context, params *SettingsParams, data SSOSettings) (*SSOSettings, error)

SettingsSSOUpdate updates the SSO settings.

func (*Client) SettingsSyslogGet added in v0.4.0 

func (c *Client) SettingsSyslogGet(ctx context.Context, params *SettingsParams) (*SyslogSettings, error)

SettingsSyslogGet returns the syslog settings.

func (*Client) SettingsSyslogTest added in v0.4.0 

func (c *Client) SettingsSyslogTest(ctx context.Context, params *SettingsParams, data SyslogSettings) (*SettingsTestResult, error)

SettingsSyslogTest sends a test message using the provided syslog settings.

func (*Client) SettingsSyslogUpdate added in v0.4.0 

func (c *Client) SettingsSyslogUpdate(ctx context.Context, params *SettingsParams, data SyslogSettings) (*SyslogSettings, error)

SettingsSyslogUpdate updates the syslog settings.

func (*Client) SitesCount added in v0.2.0 

func (c *Client) SitesCount(ctx context.Context, params *SiteListParams) (int, error)

SitesCount returns the count of sites matching the filter.

func (*Client) SitesCreate 

func (c *Client) SitesCreate(ctx context.Context, data SiteCreate) (*Site, error)

SitesCreate creates a site.

func (*Client) SitesDelete 

func (c *Client) SitesDelete(ctx context.Context, id string) error

SitesDelete deletes a site.

func (*Client) SitesDuplicate added in v0.7.0 

func (c *Client) SitesDuplicate(ctx context.Context, data SiteDuplicate) (*Site, error)

SitesDuplicate creates a new site as a copy of an existing one.

func (*Client) SitesExpireNow added in v0.7.0 

func (c *Client) SitesExpireNow(ctx context.Context, id string) error

SitesExpireNow expires a site immediately.

func (*Client) SitesGet 

func (c *Client) SitesGet(ctx context.Context, id string) (*Site, error)

SitesGet returns a single site by ID.

func (*Client) SitesList 

func (c *Client) SitesList(ctx context.Context, params *SiteListParams) ([]Site, *Pagination, error)

SitesList returns a paginated list of sites.

func (*Client) SitesReactivate added in v0.7.0 

func (c *Client) SitesReactivate(ctx context.Context, id string, unlimited bool, expiration string) error

SitesReactivate reactivates an expired site. Pass unlimited=true to reactivate with no expiration, or a non-empty RFC3339 expiration to bound the license window. The caller chooses one; the spec requires the data wrapper.

func (*Client) SitesRegenerateKey added in v0.7.0 

func (c *Client) SitesRegenerateKey(ctx context.Context, id string) (*SiteToken, error)

SitesRegenerateKey regenerates a site's registration key and returns the new registration token. The returned token is sensitive.

func (*Client) SitesToken added in v0.7.0 

func (c *Client) SitesToken(ctx context.Context, id string) (*SiteToken, error)

SitesToken returns a site's current registration token. The returned token is sensitive.

func (*Client) SitesUpdate 

func (c *Client) SitesUpdate(ctx context.Context, id string, data SiteUpdate) (*Site, error)

SitesUpdate updates a site.

func (*Client) SystemInfo added in v0.4.0 

func (c *Client) SystemInfo(ctx context.Context) (*SystemInfo, error)

SystemInfo returns console version, build, and patch level.

func (*Client) SystemStatus added in v0.4.0 

func (c *Client) SystemStatus(ctx context.Context) (*SystemStatus, error)

SystemStatus returns the console health status.

func (*Client) TagRulesCreate added in v0.7.0 

func (c *Client) TagRulesCreate(ctx context.Context, body TagRuleWrite) (*TagRule, error)

TagRulesCreate creates a new dynamic tag rule and returns it.

func (*Client) TagRulesDelete added in v0.7.0 

func (c *Client) TagRulesDelete(ctx context.Context, ids []string) error

TagRulesDelete deletes dynamic tag rules by ID. The IDs travel as a query parameter (the endpoint is on the collection path).

func (*Client) TagRulesList added in v0.7.0 

func (c *Client) TagRulesList(ctx context.Context, params *TagRuleListParams) ([]TagRule, *Pagination, error)

TagRulesList returns a paginated list of dynamic tag rules.

func (*Client) TagRulesTest added in v0.7.0 

func (c *Client) TagRulesTest(ctx context.Context, body TagRuleWrite) (int, error)

TagRulesTest reports how many inventory assets a candidate tag rule matches, without saving it. The count is the total-items field of the match response.

func (*Client) TagRulesUpdate added in v0.7.0 

func (c *Client) TagRulesUpdate(ctx context.Context, body TagRuleWrite) (*TagRule, error)

TagRulesUpdate updates a dynamic tag rule. The rule ID travels in the body.

func (*Client) TagsCreate 

func (c *Client) TagsCreate(ctx context.Context, data TagCreate) (*Tag, error)

TagsCreate creates a tag.

func (*Client) TagsDelete 

func (c *Client) TagsDelete(ctx context.Context, id string) error

TagsDelete deletes a tag.

func (*Client) TagsGet 

func (c *Client) TagsGet(ctx context.Context, id string) (*Tag, error)

TagsGet returns a single tag by ID.

func (*Client) TagsList 

func (c *Client) TagsList(ctx context.Context, params *TagListParams) ([]Tag, *Pagination, error)

TagsList returns a paginated list of tags.

func (*Client) TagsUpdate 

func (c *Client) TagsUpdate(ctx context.Context, id string, data TagUpdate) (*Tag, error)

TagsUpdate updates a tag.

func (*Client) TasksConfigFlexibleGet added in v0.7.0 

func (c *Client) TasksConfigFlexibleGet(ctx context.Context, params *TasksConfigParams) (*TasksConfig, error)

TasksConfigFlexibleGet returns the task configuration in the flexible maintenance-window format (policyPayload). It requires the flexible maintenance-window SKU.

func (*Client) TasksConfigFlexibleUpdate added in v0.7.0 

func (c *Client) TasksConfigFlexibleUpdate(ctx context.Context, body json.RawMessage) (*TasksConfig, error)

TasksConfigFlexibleUpdate updates a task configuration in the flexible maintenance-window format. The body ({data, filter} with a policy_payload) is passed through verbatim because the flexible payload shape is SKU-gated and open-ended.

func (*Client) TasksConfigGet added in v0.7.0 

func (c *Client) TasksConfigGet(ctx context.Context, params *TasksConfigParams) (*TasksConfig, error)

TasksConfigGet returns the task configuration for a scope and task type.

func (*Client) TasksConfigUpdate added in v0.7.0 

func (c *Client) TasksConfigUpdate(ctx context.Context, body TasksConfigWrite) (*TasksConfig, error)

TasksConfigUpdate creates or updates a task configuration.

func (*Client) ThreatIntelConfigs added in v0.4.0 

func (c *Client) ThreatIntelConfigs(ctx context.Context) ([]ThreatIntelConfig, error)

ThreatIntelConfigs returns the threat intelligence user configuration entries, one per configured scope.

func (*Client) ThreatNotesCreate added in v0.2.0 

func (c *Client) ThreatNotesCreate(ctx context.Context, threatID, text string) (int, error)

ThreatNotesCreate adds a note to one or more threats.

func (*Client) ThreatNotesList added in v0.2.0 

func (c *Client) ThreatNotesList(ctx context.Context, threatID string, params *ThreatNotesListParams) ([]ThreatNote, *Pagination, error)

ThreatNotesList returns notes for a threat.

func (*Client) ThreatTimeline added in v0.4.0 

func (c *Client) ThreatTimeline(ctx context.Context, threatID string, params *ThreatTimelineParams) ([]ThreatTimelineEntry, *Pagination, error)

ThreatTimeline returns the activity timeline for a threat.

func (*Client) ThreatsAddToBlacklist 

func (c *Client) ThreatsAddToBlacklist(ctx context.Context, filter ActionFilter) (int, error)

ThreatsAddToBlacklist adds threat hashes to the blacklist.

func (*Client) ThreatsAddToExclusions added in v0.7.0 

func (c *Client) ThreatsAddToExclusions(ctx context.Context, filter ActionFilter, opts ThreatExclusionOptions) (int, error)

ThreatsAddToExclusions creates an exclusion from the selected threats.

func (*Client) ThreatsCount added in v0.2.0 

func (c *Client) ThreatsCount(ctx context.Context, params *ThreatListParams) (int, error)

ThreatsCount returns the count of threats matching the filter.

func (*Client) ThreatsExport added in v0.7.0 

func (c *Client) ThreatsExport(ctx context.Context, params *ThreatListParams) ([]byte, error)

ThreatsExport exports threats matching the filter as CSV bytes.

func (*Client) ThreatsFetchFile 

func (c *Client) ThreatsFetchFile(ctx context.Context, filter ActionFilter) (int, error)

ThreatsFetchFile fetches threat files for further analysis.

func (*Client) ThreatsGet 

func (c *Client) ThreatsGet(ctx context.Context, id string) (*Threat, error)

ThreatsGet returns a single threat by ID.

func (*Client) ThreatsList 

func (c *Client) ThreatsList(ctx context.Context, params *ThreatListParams) ([]Threat, *Pagination, error)

ThreatsList returns a paginated list of threats.

func (*Client) ThreatsMitigate 

func (c *Client) ThreatsMitigate(ctx context.Context, action string, filter ActionFilter) (int, error)

ThreatsMitigate applies a mitigation action to threats.

func (*Client) ThreatsMitigateAlerts added in v0.7.0 

func (c *Client) ThreatsMitigateAlerts(ctx context.Context, alerts []ThreatAlert, action ThreatMitigationAction) (int, error)

ThreatsMitigateAlerts marks the given alerts as threats and runs a mitigation action. Unlike the other threat actions this endpoint takes an explicit list of alerts (agent ID + storyline) rather than a filter.

func (*Client) ThreatsQuarantinedFiles added in v0.7.0 

func (c *Client) ThreatsQuarantinedFiles(ctx context.Context, threatID string) ([]QuarantinedFile, error)

ThreatsQuarantinedFiles returns the files quarantined for a threat.

func (*Client) ThreatsSetExternalTicketID added in v0.7.0 

func (c *Client) ThreatsSetExternalTicketID(ctx context.Context, filter ActionFilter, ticketID string) (int, error)

ThreatsSetExternalTicketID sets the external ticket ID on the selected threats.

func (*Client) ThreatsUpdateStatus 

func (c *Client) ThreatsUpdateStatus(ctx context.Context, status string, filter ActionFilter) (int, error)

ThreatsUpdateStatus updates the incident status on threats.

func (*Client) ThreatsUpdateVerdict 

func (c *Client) ThreatsUpdateVerdict(ctx context.Context, verdict string, filter ActionFilter) (int, error)

ThreatsUpdateVerdict updates the analyst verdict on threats.

func (*Client) ThreatsWhiteningOptions added in v0.7.0 

func (c *Client) ThreatsWhiteningOptions(ctx context.Context, threatID string) (*WhiteningOptions, error)

ThreatsWhiteningOptions returns the exclusion options available for a threat.

func (*Client) UnifiedExclusionsCount added in v0.4.0 

func (c *Client) UnifiedExclusionsCount(ctx context.Context, params *UnifiedExclusionListParams) (int, error)

UnifiedExclusionsCount returns the count of unified exclusions matching the filter.

func (*Client) UnifiedExclusionsCreate added in v0.4.0 

func (c *Client) UnifiedExclusionsCreate(ctx context.Context, scope UnifiedExclusionScope, data UnifiedExclusionCreate) (*UnifiedExclusion, error)

UnifiedExclusionsCreate creates a unified exclusion.

func (*Client) UnifiedExclusionsExport added in v0.4.0 

func (c *Client) UnifiedExclusionsExport(ctx context.Context, params *UnifiedExclusionListParams) (json.RawMessage, error)

UnifiedExclusionsExport exports unified exclusions as raw JSON.

func (*Client) UnifiedExclusionsList added in v0.4.0 

func (c *Client) UnifiedExclusionsList(ctx context.Context, params *UnifiedExclusionListParams) ([]UnifiedExclusion, *Pagination, error)

UnifiedExclusionsList returns a paginated list of unified exclusions.

func (*Client) UpdatesGet 

func (c *Client) UpdatesGet(ctx context.Context, id string) (*UpdatePackage, error)

UpdatesGet returns a single update package by ID.

func (*Client) UpdatesList 

func (c *Client) UpdatesList(ctx context.Context, params *UpdateListParams) ([]UpdatePackage, *Pagination, error)

UpdatesList returns a paginated list of update packages.

func (*Client) UpgradePackagesList added in v0.4.0 

func (c *Client) UpgradePackagesList(ctx context.Context, params *UpgradePackageListParams) ([]UpgradePackage, error)

UpgradePackagesList returns available packages for upgrade policies.

func (*Client) UpgradePoliciesActivate added in v0.4.0 

func (c *Client) UpgradePoliciesActivate(ctx context.Context, id string) error

UpgradePoliciesActivate activates an upgrade policy.

func (*Client) UpgradePoliciesCreate added in v0.4.0 

func (c *Client) UpgradePoliciesCreate(ctx context.Context, data UpgradePolicyCreate) error

UpgradePoliciesCreate creates an upgrade policy.

func (*Client) UpgradePoliciesDeactivate added in v0.4.0 

func (c *Client) UpgradePoliciesDeactivate(ctx context.Context, id string) error

UpgradePoliciesDeactivate deactivates an upgrade policy.

func (*Client) UpgradePoliciesDelete added in v0.4.0 

func (c *Client) UpgradePoliciesDelete(ctx context.Context, id string) error

UpgradePoliciesDelete deletes an upgrade policy by ID.

func (*Client) UpgradePoliciesList added in v0.4.0 

func (c *Client) UpgradePoliciesList(ctx context.Context, params *UpgradePolicyListParams) ([]UpgradePolicy, int, error)

UpgradePoliciesList returns upgrade policies for a given scope and OS type.

func (*Client) UpgradePoliciesUpdate added in v0.4.0 

func (c *Client) UpgradePoliciesUpdate(ctx context.Context, id string, data UpgradePolicyCreate) error

UpgradePoliciesUpdate updates an upgrade policy.

func (*Client) Users2FADisable added in v0.7.0 

func (c *Client) Users2FADisable(ctx context.Context, id string) error

Users2FADisable disables two-factor authentication for the user with the given ID.

func (*Client) Users2FAEnable added in v0.7.0 

func (c *Client) Users2FAEnable(ctx context.Context, id string) error

Users2FAEnable enables two-factor authentication for the user with the given ID.

func (*Client) UsersDelete 

func (c *Client) UsersDelete(ctx context.Context, id string) error

UsersDelete deletes a user.

func (*Client) UsersGenerateToken added in v0.7.0 

func (c *Client) UsersGenerateToken(ctx context.Context, forceLegacy bool) (string, error)

UsersGenerateToken generates an API token for the authenticated user and returns it. The token is shown only once. forceLegacy requests a legacy token even when the auth-tokens switch is on.

func (*Client) UsersGet 

func (c *Client) UsersGet(ctx context.Context, id string) (*User, error)

UsersGet returns a single user by ID.

func (*Client) UsersList 

func (c *Client) UsersList(ctx context.Context, params *UserListParams) ([]User, *Pagination, error)

UsersList returns a paginated list of users.

func (*Client) UsersRevokeToken added in v0.7.0 

func (c *Client) UsersRevokeToken(ctx context.Context, id string) error

UsersRevokeToken revokes the API token of the user with the given ID.

func (*Client) UsersTokenDetails added in v0.7.0 

func (c *Client) UsersTokenDetails(ctx context.Context) (*UserTokenDetails, error)

UsersTokenDetails returns the API-token metadata for the authenticated user.

func (*Client) UsersTokenDetailsByID added in v0.7.0 

func (c *Client) UsersTokenDetailsByID(ctx context.Context, id string) (*UserTokenDetails, error)

UsersTokenDetailsByID returns the API-token metadata for a specific user.

func (*Client) UsersUpdate added in v0.7.0 

func (c *Client) UsersUpdate(ctx context.Context, id string, data UserUpdate) (*User, error)

UsersUpdate updates a user and returns the updated resource.

func (*Client) XDRAssetAction added in v0.10.1 

func (c *Client) XDRAssetAction(ctx context.Context, assetType AssetType, body *XDRAssetActionInput) (int, error)

XDRAssetAction performs an action on assets of the given type and returns the affected count.

func (*Client) XDRAssetCategories added in v0.4.0 

func (c *Client) XDRAssetCategories(ctx context.Context, params *XDRAssetCountsParams) (*XDRAssetCategory, error)

XDRAssetCategories returns asset categories with counts.

func (*Client) XDRAssetCounts added in v0.4.0 

func (c *Client) XDRAssetCounts(ctx context.Context, params *XDRAssetCountsParams) (*XDRAssetCounts, error)

XDRAssetCounts returns asset counts grouped by category and surface.

func (*Client) XDRAssetExport added in v0.10.1 

func (c *Client) XDRAssetExport(ctx context.Context, assetType AssetType, params *XDRAssetListParams) ([]byte, error)

XDRAssetExport returns the raw export response (CSV or JSON) for the given asset type.

func (*Client) XDRAssetFilterAutocomplete added in v0.10.1 

func (c *Client) XDRAssetFilterAutocomplete(ctx context.Context, assetType AssetType, params *XDRAssetListParams) ([]json.RawMessage, error)

XDRAssetFilterAutocomplete returns filter autocomplete suggestions.

func (*Client) XDRAssetFilterCount added in v0.10.1 

func (c *Client) XDRAssetFilterCount(ctx context.Context, assetType AssetType, params *XDRAssetListParams) (json.RawMessage, error)

XDRAssetFilterCount returns per-filter-value counts.

func (*Client) XDRAssetFilterFreeText added in v0.10.1 

func (c *Client) XDRAssetFilterFreeText(ctx context.Context, assetType AssetType, params *XDRAssetListParams) ([]json.RawMessage, error)

XDRAssetFilterFreeText returns free-text filter fields.

func (*Client) XDRAssetList added in v0.10.1 

func (c *Client) XDRAssetList(ctx context.Context, assetType AssetType, params *XDRAssetListParams) ([]json.RawMessage, *Pagination, error)

XDRAssetList returns assets of the given type. When assetType is empty it lists across all types.

func (*Client) XDRAssetNoteCreate added in v0.10.1 

func (c *Client) XDRAssetNoteCreate(ctx context.Context, input *XDRAssetNoteInput) error

XDRAssetNoteCreate creates or updates a note on an asset.

func (*Client) XDRAssetNoteDelete added in v0.10.1 

func (c *Client) XDRAssetNoteDelete(ctx context.Context, input *XDRAssetNoteInput) error

XDRAssetNoteDelete deletes a note from an asset.

func (*Client) XDRAssetSubCategories added in v0.10.1 

func (c *Client) XDRAssetSubCategories(ctx context.Context, params *XDRAssetCountsParams) (json.RawMessage, error)

XDRAssetSubCategories returns sub-category information.

func (*Client) XDRAssetTagCount added in v0.10.1 

func (c *Client) XDRAssetTagCount(ctx context.Context, body any) (json.RawMessage, error)

XDRAssetTagCount returns tag counts.

func (*Client) XDRAssetTags added in v0.10.1 

func (c *Client) XDRAssetTags(ctx context.Context, params *XDRAssetListParams) ([]json.RawMessage, error)

XDRAssetTags returns asset tags.

type CloudDetectionAlert added in v0.3.0 

type CloudDetectionAlert struct {
	AlertInfo          CDAlertInfo `json:"alertInfo"`
	RuleInfo           CDRuleInfo  `json:"ruleInfo"`
	AgentDetectionInfo CDAgentInfo `json:"agentDetectionInfo"`

	Raw json.RawMessage `json:"-"`
}

CloudDetectionAlert is a STAR custom detection alert from the REST API.

func (*CloudDetectionAlert) UnmarshalJSON added in v0.3.0 

func (a *CloudDetectionAlert) UnmarshalJSON(b []byte) error

type ConfigOverride added in v0.10.0 

type ConfigOverride struct {
	ID            string                      `json:"id"`
	Name          string                      `json:"name"`
	Description   string                      `json:"description"`
	Config        json.RawMessage             `json:"config"`
	OSType        ConfigOverrideOSType        `json:"osType"`
	AgentVersion  string                      `json:"agentVersion"`
	VersionOption ConfigOverrideVersionOption `json:"versionOption"`
	Scope         ConfigOverrideScope         `json:"scope"`
	Site          *ConfigOverrideScopeRef     `json:"site,omitempty"`
	Group         *ConfigOverrideScopeRef     `json:"group,omitempty"`
	Account       *ConfigOverrideScopeRef     `json:"account,omitempty"`
	Agent         *ConfigOverrideScopeRef     `json:"agent,omitempty"`
	CreatedAt     string                      `json:"createdAt"`
	UpdatedAt     string                      `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

ConfigOverride is a SentinelOne agent configuration override.

func (*ConfigOverride) UnmarshalJSON added in v0.10.0 

func (c *ConfigOverride) UnmarshalJSON(data []byte) error

type ConfigOverrideCreateInput added in v0.10.0 

type ConfigOverrideCreateInput struct {
	Name          string                       `json:"name"`
	Description   *string                      `json:"description,omitempty"`
	OSType        ConfigOverrideOSType         `json:"osType"`
	Config        json.RawMessage              `json:"config"`
	Scope         ConfigOverrideScope          `json:"scope"`
	AgentVersion  *string                      `json:"agentVersion,omitempty"`
	VersionOption *ConfigOverrideVersionOption `json:"versionOption,omitempty"`
	Site          *ConfigOverrideScopeRef      `json:"site,omitempty"`
	Group         *ConfigOverrideScopeRef      `json:"group,omitempty"`
	Account       *ConfigOverrideScopeRef      `json:"account,omitempty"`
}

ConfigOverrideCreateInput is the data payload for creating a config override.

type ConfigOverrideDeleteFilter added in v0.10.0 

type ConfigOverrideDeleteFilter struct {
	IDs              []string                     `json:"ids,omitempty"`
	AgentIDs         []string                     `json:"agentIds,omitempty"`
	SiteIDs          []string                     `json:"siteIds,omitempty"`
	AccountIDs       []string                     `json:"accountIds,omitempty"`
	GroupIDs         []string                     `json:"groupIds,omitempty"`
	OSTypes          []string                     `json:"osTypes,omitempty"`
	AgentVersions    []string                     `json:"agentVersions,omitempty"`
	VersionOption    *ConfigOverrideVersionOption `json:"versionOption,omitempty"`
	NameLike         string                       `json:"name__like,omitempty"`
	DescriptionLike  string                       `json:"description__like,omitempty"`
	Query            string                       `json:"query,omitempty"`
	CreatedAtGt      string                       `json:"createdAt__gt,omitempty"`
	CreatedAtGte     string                       `json:"createdAt__gte,omitempty"`
	CreatedAtLt      string                       `json:"createdAt__lt,omitempty"`
	CreatedAtLte     string                       `json:"createdAt__lte,omitempty"`
	CreatedAtBetween string                       `json:"createdAt__between,omitempty"`
	Tenant           *bool                        `json:"tenant,omitempty"`
}

ConfigOverrideDeleteFilter is the filter for bulk-deleting config overrides.

type ConfigOverrideListParams added in v0.10.0 

type ConfigOverrideListParams struct {
	SiteIDs       []string
	AccountIDs    []string
	GroupIDs      []string
	IDs           []string
	AgentIDs      []string
	OSTypes       []string
	AgentVersions []string
	VersionOption string
	Query         string
	Tenant        *bool
	Limit         int
	Cursor        string
	SortBy        string
	SortOrder     string
}

ConfigOverrideListParams are query parameters for listing config overrides.

type ConfigOverrideOSType added in v0.10.0 

type ConfigOverrideOSType string

ConfigOverrideOSType is the operating system a config override targets. 

const (
	ConfigOverrideOSLinux         ConfigOverrideOSType = "linux"
	ConfigOverrideOSMacOS         ConfigOverrideOSType = "macos"
	ConfigOverrideOSWindows       ConfigOverrideOSType = "windows"
	ConfigOverrideOSWindowsLegacy ConfigOverrideOSType = "windows_legacy"
)

Config override OS types.

type ConfigOverrideScope added in v0.10.0 

type ConfigOverrideScope string

ConfigOverrideScope is the hierarchy level at which an override applies. 

const (
	ConfigOverrideScopeGroup   ConfigOverrideScope = "group"
	ConfigOverrideScopeSite    ConfigOverrideScope = "site"
	ConfigOverrideScopeAccount ConfigOverrideScope = "account"
	ConfigOverrideScopeTenant  ConfigOverrideScope = "tenant"
)

Config override scope levels.

type ConfigOverrideScopeRef added in v0.10.0 

type ConfigOverrideScopeRef struct {
	ID   string `json:"id"`
	Name string `json:"name,omitempty"`
}

ConfigOverrideScopeRef identifies the target scope object (site, group, or account) for a config override.

type ConfigOverrideUpdateInput added in v0.10.0 

type ConfigOverrideUpdateInput struct {
	Name          *string                      `json:"name,omitempty"`
	Description   *string                      `json:"description,omitempty"`
	OSType        *ConfigOverrideOSType        `json:"osType,omitempty"`
	Config        json.RawMessage              `json:"config,omitempty"`
	Scope         *ConfigOverrideScope         `json:"scope,omitempty"`
	AgentVersion  *string                      `json:"agentVersion,omitempty"`
	VersionOption *ConfigOverrideVersionOption `json:"versionOption,omitempty"`
	Site          *ConfigOverrideScopeRef      `json:"site,omitempty"`
	Group         *ConfigOverrideScopeRef      `json:"group,omitempty"`
	Account       *ConfigOverrideScopeRef      `json:"account,omitempty"`
}

ConfigOverrideUpdateInput is the data payload for updating a config override. All fields are optional; only provided fields are changed.

type ConfigOverrideVersionOption added in v0.10.0 

type ConfigOverrideVersionOption string

ConfigOverrideVersionOption controls which agent versions are targeted. 

const (
	ConfigOverrideVersionAll      ConfigOverrideVersionOption = "ALL"
	ConfigOverrideVersionSpecific ConfigOverrideVersionOption = "SPECIFIC"
)

Config override version options.

type Connector added in v0.10.0 

type Connector struct {
	CloudlinkID    int64           `json:"cloudlinkId"`
	MgmtID         int             `json:"mgmtId"`
	Status         ConnectorStatus `json:"status"`
	ComputerName   string          `json:"computerName"`
	AgentType      string          `json:"agentType"`
	OSName         string          `json:"osName"`
	Version        string          `json:"version"`
	GUID           string          `json:"guid"`
	IsUnifiedAgent bool            `json:"isUnifiedAgent"`
	IPAddress      string          `json:"ipAddress"`
	DomainName     string          `json:"domainName"`
	LastSeen       string          `json:"lastSeen"`
	ScopePath      string          `json:"scopePath"`

	Raw json.RawMessage `json:"-"`
}

Connector is a Cloudlink (AD connector) configuration.

func (*Connector) UnmarshalJSON added in v0.10.0 

func (c *Connector) UnmarshalJSON(b []byte) error

type ConnectorStatus added in v0.10.0 

type ConnectorStatus string

ConnectorStatus is the status of an AD connector (Cloudlink). 

const (
	ConnectorStatusActive   ConnectorStatus = "ACTIVE"
	ConnectorStatusInactive ConnectorStatus = "INACTIVE"
)

type DVEvent added in v0.2.0 

type DVEvent struct {
	ID          string `json:"id"`
	EventType   string `json:"eventType"`
	ProcessName string `json:"processName"`
	AgentName   string `json:"agentName"`
	AgentOS     string `json:"agentOs"`
	CreatedAt   string `json:"createdAt"`
	User        string `json:"user"`
	ObjectType  string `json:"objectType"`
	ProcessCmd  string `json:"processCmd"`
	SrcIP       string `json:"agentIp"`
	DstIP       string `json:"dstIp"`
	DstPort     int    `json:"dstPort"`
	FilePath    string `json:"fileFullName"`
	SHA256      string `json:"sha256"`

	Raw json.RawMessage `json:"-"`
}

DVEvent is a single Deep Visibility event.

func (DVEvent) MarshalJSON added in v0.2.0 

func (d DVEvent) MarshalJSON() ([]byte, error)

func (*DVEvent) UnmarshalJSON added in v0.2.0 

func (d *DVEvent) UnmarshalJSON(b []byte) error

type DVEventsParams added in v0.2.0 

type DVEventsParams struct {
	QueryID   string
	Limit     int
	Cursor    string
	SortBy    string
	SortOrder string
	SubQuery  string
}

DVEventsParams are query parameters for GET /dv/events.

type DVQueryID added in v0.2.0 

type DVQueryID struct {
	QueryID string `json:"queryId"`

	Raw json.RawMessage `json:"-"`
}

DVQueryID is the response from POST /dv/init-query.

func (*DVQueryID) UnmarshalJSON added in v0.2.0 

func (d *DVQueryID) UnmarshalJSON(b []byte) error

type DVQueryRequest added in v0.2.0 

type DVQueryRequest struct {
	Query      string      `json:"query"`
	FromDate   string      `json:"fromDate"`
	ToDate     string      `json:"toDate"`
	QueryType  DVQueryType `json:"queryType,omitempty"`
	AccountIDs []string    `json:"accountIds,omitempty"`
	SiteIDs    []string    `json:"siteIds,omitempty"`
	IsVerbose  bool        `json:"isVerbose,omitempty"`
	Limit      int         `json:"limit,omitempty"`
}

DVQueryRequest is the body for POST /dv/init-query.

type DVQueryStatus added in v0.2.0 

type DVQueryStatus struct {
	ResponseState  DVResponseState `json:"responseState"`
	ProgressStatus int             `json:"progressStatus"`
	ResponseError  string          `json:"responseError,omitempty"`

	Raw json.RawMessage `json:"-"`
}

DVQueryStatus is the response from GET /dv/query-status.

func (*DVQueryStatus) UnmarshalJSON added in v0.2.0 

func (d *DVQueryStatus) UnmarshalJSON(b []byte) error

type DVQueryType added in v0.2.0 

type DVQueryType string

DVQueryType is the Deep Visibility query type. 

const (
	DVQueryTypeEvents       DVQueryType = "events"
	DVQueryTypeProcessState DVQueryType = "processState"
)

type DVResponseState added in v0.2.0 

type DVResponseState string

DVResponseState is the state of a Deep Visibility query. 

const (
	DVStateRunning        DVResponseState = "RUNNING"
	DVStateProcessRunning DVResponseState = "PROCESS_RUNNING"
	DVStateEventsRunning  DVResponseState = "EVENTS_RUNNING"
	DVStateFinished       DVResponseState = "FINISHED"
	DVStateFailed         DVResponseState = "FAILED"
	DVStateFailedClient   DVResponseState = "FAILED_CLIENT"
	DVStateError          DVResponseState = "ERROR"
	DVStateCancelled      DVResponseState = "QUERY_CANCELLED"
	DVStateTimedOut       DVResponseState = "TIMED_OUT"
	DVStateExpired        DVResponseState = "QUERY_EXPIRED"
)

func (DVResponseState) IsSuccess added in v0.2.0 

func (s DVResponseState) IsSuccess() bool

IsSuccess reports whether the query completed successfully.

func (DVResponseState) IsTerminal added in v0.2.0 

func (s DVResponseState) IsTerminal() bool

IsTerminal reports whether the state is a terminal state (query will not change further).

type DeployCredDetail added in v0.10.0 

type DeployCredDetail struct {
	ID          string `json:"id"`
	CredGroupID string `json:"credGroupId"`
	Title       string `json:"title"`
	CredType    string `json:"credType"`
	CreatedAt   string `json:"createdAt"`
	UpdatedAt   string `json:"updatedAt"`
	CreatedBy   string `json:"createdBy"`
	UpdatedBy   string `json:"updatedBy"`

	Raw json.RawMessage `json:"-"`
}

DeployCredDetail is a single credential entry within a credential group.

func (*DeployCredDetail) UnmarshalJSON added in v0.10.0 

func (d *DeployCredDetail) UnmarshalJSON(data []byte) error

type DeployCredDetailAddInput added in v0.10.0 

type DeployCredDetailAddInput struct {
	CredGroupID string                  `json:"credGroupId"`
	Details     []DeployCredDetailInput `json:"details"`
}

DeployCredDetailAddInput is the data payload for adding credential details to a group.

type DeployCredDetailInput added in v0.10.0 

type DeployCredDetailInput struct {
	Title         string `json:"title"`
	CredType      string `json:"credType"`
	EncryptedKey  string `json:"encryptedKey"`
	EncryptedCred string `json:"encryptedCred"`
}

DeployCredDetailInput is a single credential detail for creation.

type DeployCredDetailListParams added in v0.10.0 

type DeployCredDetailListParams struct {
	SiteIDs      []string
	AccountIDs   []string
	IDs          []string
	CredGroupIDs []string
	Title        string
	TitleLike    string
	CredTypeLike string
	Limit        int
	Cursor       string
	SortBy       string
	SortOrder    string
}

DeployCredDetailListParams are query parameters for listing credential group details.

type DeployCredGroup added in v0.10.0 

type DeployCredGroup struct {
	ID              string         `json:"id"`
	GroupName       string         `json:"groupName"`
	GroupPassphrase string         `json:"groupPassphrase"`
	ScopeID         string         `json:"scopeId"`
	Domain          string         `json:"domain"`
	TargetOS        DeployTargetOS `json:"targetOs"`
	TotalDetails    int            `json:"totalDetails"`

	Raw json.RawMessage `json:"-"`
}

DeployCredGroup is a Sentinel Deploy (Ranger) credential group used for deploying agents to unprotected endpoints.

func (*DeployCredGroup) UnmarshalJSON added in v0.10.0 

func (d *DeployCredGroup) UnmarshalJSON(data []byte) error

type DeployCredGroupCreateInput added in v0.10.0 

type DeployCredGroupCreateInput struct {
	GroupName       string          `json:"groupName"`
	GroupPassphrase string          `json:"groupPassphrase"`
	ScopeID         string          `json:"scopeId"`
	Domain          *string         `json:"domain,omitempty"`
	TargetOS        *DeployTargetOS `json:"targetOs,omitempty"`
}

DeployCredGroupCreateInput is the data payload for creating a credential group.

type DeployCredGroupListParams added in v0.10.0 

type DeployCredGroupListParams struct {
	SiteIDs       []string
	AccountIDs    []string
	IDs           []string
	GroupName     string
	GroupNameLike string
	TargetOS      string
	Limit         int
	Cursor        string
	SortBy        string
	SortOrder     string
}

DeployCredGroupListParams are query parameters for listing credential groups.

type DeployTargetOS added in v0.10.0 

type DeployTargetOS string

DeployTargetOS is the operating system for a Sentinel Deploy credential group. 

const (
	DeployTargetOSWindows  DeployTargetOS = "windows"
	DeployTargetOSOSXLinux DeployTargetOS = "osx_linux"
)

Deploy target OS types.

type DetectionKeyValue added in v0.4.0 

type DetectionKeyValue struct {
	Key   string `json:"key"`
	Value string `json:"value"`

	Raw json.RawMessage `json:"-"`
}

DetectionKeyValue is a key-value pair returned by detection library lookups.

func (*DetectionKeyValue) UnmarshalJSON added in v0.4.0 

func (d *DetectionKeyValue) UnmarshalJSON(b []byte) error

type DeviceEvent added in v0.4.0 

type DeviceEvent struct {
	ID                   string `json:"id"`
	EventID              string `json:"eventId"`
	Interface            string `json:"interface"`
	DeviceClass          string `json:"deviceClass"`
	ServiceClass         string `json:"serviceClass"`
	RuleID               string `json:"ruleId"`
	VendorID             string `json:"vendorId"`
	ProductID            string `json:"productId"`
	EventTime            string `json:"eventTime"`
	EventType            string `json:"eventType"`
	DeviceName           string `json:"deviceName"`
	UID                  string `json:"uId"`
	AgentID              string `json:"agentId"`
	MinorClass           string `json:"minorClass"`
	ProfileUUIDs         string `json:"profileUuids"`
	LMPVersion           string `json:"lmpVersion"`
	AccessPermission     string `json:"accessPermission"`
	ComputerName         string `json:"computerName"`
	LastLoggedInUserName string `json:"lastLoggedInUserName"`
	DeviceID             string `json:"deviceId"`
	CreatedAt            string `json:"createdAt"`
	UpdatedAt            string `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

DeviceEvent is a device control event from an endpoint.

func (*DeviceEvent) UnmarshalJSON added in v0.4.0 

func (d *DeviceEvent) UnmarshalJSON(b []byte) error

type DeviceEventListParams added in v0.4.0 

type DeviceEventListParams struct {
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	Query      string
	Interfaces []string
	Limit      int
	Cursor     string
}

DeviceEventListParams are query parameters for listing device control events.

type DeviceRule 

type DeviceRule struct {
	ID               string                     `json:"id"`
	RuleName         string                     `json:"ruleName"`
	Status           DeviceRuleStatus           `json:"status"`
	Action           DeviceRuleAction           `json:"action"`
	Interface        DeviceRuleInterface        `json:"interface"`
	RuleType         DeviceRuleType             `json:"ruleType"`
	AccessPermission DeviceRuleAccessPermission `json:"accessPermission"`
	DeviceClass      string                     `json:"deviceClass"`
	DeviceID         string                     `json:"deviceId"`
	VendorID         string                     `json:"vendorId"`
	ProductID        string                     `json:"productId"`
	UID              string                     `json:"uid"`
	Version          string                     `json:"version"`
	Order            int                        `json:"order"`
	Scope            DeviceRuleScope            `json:"scope"`
	ScopeID          string                     `json:"scopeId"`
	ScopeName        string                     `json:"scopeName"`
	OSType           string                     `json:"osType"`
	MinorClasses     []string                   `json:"minorClasses"`
	BluetoothAddress string                     `json:"bluetoothAddress"`
	GattService      []string                   `json:"gattService"`
	ManufacturerName string                     `json:"manufacturerName"`
	DeviceName       string                     `json:"deviceName"`
	CreatedAt        string                     `json:"createdAt"`
	UpdatedAt        string                     `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

DeviceRule is a SentinelOne device control rule.

func (*DeviceRule) UnmarshalJSON 

func (d *DeviceRule) UnmarshalJSON(b []byte) error

type DeviceRuleAccessPermission added in v0.2.0 

type DeviceRuleAccessPermission string

DeviceRuleAccessPermission is the access permission for a device rule. 

const (
	DeviceRuleAccessReadOnly      DeviceRuleAccessPermission = "Read-Only"
	DeviceRuleAccessReadWrite     DeviceRuleAccessPermission = "Read-Write"
	DeviceRuleAccessNotApplicable DeviceRuleAccessPermission = "Not-Applicable"
)

type DeviceRuleAction added in v0.2.0 

type DeviceRuleAction string

DeviceRuleAction is the action of a device control rule. 

const (
	DeviceRuleActionAllow DeviceRuleAction = "Allow"
	DeviceRuleActionBlock DeviceRuleAction = "Block"
)

type DeviceRuleCopyTarget added in v0.4.0 

type DeviceRuleCopyTarget struct {
	AccountID *string  `json:"accountId,omitempty"`
	SiteID    *string  `json:"siteId,omitempty"`
	GroupIDs  []string `json:"groupIds,omitempty"`
}

DeviceRuleCopyTarget specifies a destination scope for copying rules.

type DeviceRuleCreate added in v0.2.0 

type DeviceRuleCreate struct {
	RuleName         string                     `json:"ruleName"`
	Interface        DeviceRuleInterface        `json:"interface"`
	RuleType         DeviceRuleType             `json:"ruleType"`
	Action           DeviceRuleAction           `json:"action"`
	Status           DeviceRuleStatus           `json:"status"`
	AccessPermission DeviceRuleAccessPermission `json:"accessPermission"`
	DeviceClass      string                     `json:"deviceClass,omitempty"`
	DeviceID         string                     `json:"deviceId,omitempty"`
	VendorID         string                     `json:"vendorId,omitempty"`
	ProductID        string                     `json:"productId,omitempty"`
	UID              string                     `json:"uid,omitempty"`
	Version          string                     `json:"version,omitempty"`
	MinorClasses     []string                   `json:"minorClasses,omitempty"`
	BluetoothAddress string                     `json:"bluetoothAddress,omitempty"`
	GattService      []string                   `json:"gattService,omitempty"`
	ManufacturerName string                     `json:"manufacturerName,omitempty"`
	DeviceName       string                     `json:"deviceName,omitempty"`
}

DeviceRuleCreate is the request body for creating a device control rule.

type DeviceRuleInterface added in v0.2.0 

type DeviceRuleInterface string

DeviceRuleInterface is the physical bus type of a device. 

const (
	DeviceRuleInterfaceUSB         DeviceRuleInterface = "USB"
	DeviceRuleInterfaceBluetooth   DeviceRuleInterface = "Bluetooth"
	DeviceRuleInterfaceThunderbolt DeviceRuleInterface = "Thunderbolt"
	DeviceRuleInterfaceSDCard      DeviceRuleInterface = "SDCard"
)

type DeviceRuleListParams 

type DeviceRuleListParams struct {
	SiteIDs    []string
	AccountIDs []string
	Query      string
	Limit      int
	Cursor     string
}

DeviceRuleListParams are query parameters for listing device rules.

type DeviceRuleReorderFilter added in v0.4.0 

type DeviceRuleReorderFilter struct {
	AccountIDs []string             `json:"accountIds,omitempty"`
	SiteIDs    []string             `json:"siteIds,omitempty"`
	GroupIDs   []string             `json:"groupIds,omitempty"`
	Tenant     *bool                `json:"tenant,omitempty"`
	Interface  *DeviceRuleInterface `json:"interface,omitempty"`
}

DeviceRuleReorderFilter scopes a reorder operation.

type DeviceRuleScope added in v0.2.0 

type DeviceRuleScope string

DeviceRuleScope is the scope level of a device control rule. 

const (
	DeviceRuleScopeGlobal  DeviceRuleScope = "global"
	DeviceRuleScopeAccount DeviceRuleScope = "account"
	DeviceRuleScopeSite    DeviceRuleScope = "site"
	DeviceRuleScopeGroup   DeviceRuleScope = "group"
)

type DeviceRuleScopeFilter added in v0.2.0 

type DeviceRuleScopeFilter struct {
	AccountIDs []string `json:"accountIds,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	Tenant     *bool    `json:"tenant,omitempty"`
}

DeviceRuleScopeFilter sets the scope for a new device control rule.

type DeviceRuleStatus added in v0.2.0 

type DeviceRuleStatus string

DeviceRuleStatus is the status of a device control rule. 

const (
	DeviceRuleStatusEnabled  DeviceRuleStatus = "Enabled"
	DeviceRuleStatusDisabled DeviceRuleStatus = "Disabled"
)

type DeviceRuleType added in v0.2.0 

type DeviceRuleType string

DeviceRuleType is the rule type that determines which fields are required. 

const (
	DeviceRuleTypeClass            DeviceRuleType = "class"
	DeviceRuleTypeProductID        DeviceRuleType = "productId"
	DeviceRuleTypeVendorID         DeviceRuleType = "vendorId"
	DeviceRuleTypeDeviceID         DeviceRuleType = "deviceId"
	DeviceRuleTypeUID              DeviceRuleType = "uid"
	DeviceRuleTypeHWIdentifiers    DeviceRuleType = "hwIdentifiers"
	DeviceRuleTypeBluetoothVersion DeviceRuleType = "bluetoothVersion"
	DeviceRuleTypeSDCard           DeviceRuleType = "sdCard"
)

type DomainInfo added in v0.10.0 

type DomainInfo struct {
	Domain       string `json:"domain"`
	ParentDomain string `json:"parentDomain"`
	Root         bool   `json:"root"`

	Raw json.RawMessage `json:"-"`
}

DomainInfo describes an AD domain.

func (*DomainInfo) UnmarshalJSON added in v0.10.0 

func (d *DomainInfo) UnmarshalJSON(b []byte) error

type DomainStatus added in v0.4.0 

type DomainStatus struct {
	DomainName      string `json:"domainName"`
	ForestName      string `json:"forestName"`
	TotalJobs       int    `json:"totalJobs"`
	CompletedJobs   int    `json:"completedJobs"`
	DomainCompleted bool   `json:"domainCompletedStatus"`

	Raw json.RawMessage `json:"-"`
}

DomainStatus is the assessment status for a single AD domain.

func (*DomainStatus) UnmarshalJSON added in v0.4.0 

func (d *DomainStatus) UnmarshalJSON(b []byte) error

type EncryptionMethod added in v0.10.0 

type EncryptionMethod string

EncryptionMethod is the LDAP encryption method for an AD configuration. 

const (
	EncryptionMethodLDAP  EncryptionMethod = "LDAP"
	EncryptionMethodLDAPS EncryptionMethod = "LDAPS"
)

type Exclusion 

type Exclusion struct {
	ID                string   `json:"id"`
	Type              string   `json:"type"`
	Value             string   `json:"value"`
	Source            string   `json:"source"`
	OSType            string   `json:"osType"`
	Mode              string   `json:"mode"`
	Description       string   `json:"description"`
	ScopeName         string   `json:"scopeName"`
	ScopePath         string   `json:"scopePath"`
	PathExclusionType string   `json:"pathExclusionType"`
	ApplicationName   string   `json:"applicationName"`
	Actions           []string `json:"actions"`
	Imported          bool     `json:"imported"`
	Inject            bool     `json:"inject"`
	UserID            string   `json:"userId"`
	UserName          string   `json:"userName"`
	CreatedAt         string   `json:"createdAt"`
	UpdatedAt         string   `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

Exclusion is a SentinelOne exclusion entry.

func (*Exclusion) UnmarshalJSON 

func (e *Exclusion) UnmarshalJSON(b []byte) error

type ExclusionCreate 

type ExclusionCreate struct {
	Type              string   `json:"type"`
	Value             string   `json:"value"`
	OSType            string   `json:"osType"`
	Mode              string   `json:"mode,omitempty"`
	Description       string   `json:"description,omitempty"`
	PathExclusionType string   `json:"pathExclusionType,omitempty"`
	GroupIDs          []string `json:"groupIds,omitempty"`
	SiteIDs           []string `json:"siteIds,omitempty"`
}

ExclusionCreate is the request body for creating an exclusion.

type ExclusionListParams 

type ExclusionListParams struct {
	SiteIDs    []string
	GroupIDs   []string
	AccountIDs []string
	Types      []string
	OSTypes    []string
	Query      string
	Limit      int
	Cursor     string
	SortBy     string
	SortOrder  string
}

ExclusionListParams are query parameters for listing exclusions.

type ExecutionErrorAction added in v0.10.0 

type ExecutionErrorAction struct {
	ActionID            string `json:"action_id"`
	ActionExecutionName string `json:"action_execution_name"`
	ActionDisplayName   string `json:"action_display_name"`
	ActionError         string `json:"action_error"`
}

ExecutionErrorAction describes a failed action within an execution.

type ExecutionSource added in v0.10.0 

type ExecutionSource string

ExecutionSource is the source of an execution trigger. 

const (
	ExecutionSourceAutomatic ExecutionSource = "automatic"
	ExecutionSourceOnDemand  ExecutionSource = "on_demand"
	ExecutionSourceRerun     ExecutionSource = "rerun"
)

type ExecutionState added in v0.10.0 

type ExecutionState string

ExecutionState is the state of a workflow execution. 

const (
	ExecutionStateRunning             ExecutionState = "Running"
	ExecutionStatePending             ExecutionState = "Pending"
	ExecutionStateStuck               ExecutionState = "Stuck"
	ExecutionStateCompleted           ExecutionState = "Completed"
	ExecutionStateError               ExecutionState = "Error"
	ExecutionStateWaiting             ExecutionState = "Waiting"
	ExecutionStateAborted             ExecutionState = "Aborted"
	ExecutionStateCompletedWithErrors ExecutionState = "CompletedWithErrors"
)

type ExposureDetectionStatus added in v0.4.0 

type ExposureDetectionStatus string

ExposureDetectionStatus is the detection status of an AD exposure. 

const (
	ExposureStatusVulnerable    ExposureDetectionStatus = "Vulnerable"
	ExposureStatusNotVulnerable ExposureDetectionStatus = "Not_Vulnerable"
	ExposureStatusSkipped       ExposureDetectionStatus = "Skipped"
	ExposureStatusInProgress    ExposureDetectionStatus = "In_Progress"
	ExposureStatusPending       ExposureDetectionStatus = "Pending"
	ExposureStatusMitigated     ExposureDetectionStatus = "Mitigated"
)

type ExposureSeverity added in v0.4.0 

type ExposureSeverity string

ExposureSeverity is the severity level of an AD exposure. 

const (
	ExposureSeverityCritical ExposureSeverity = "Critical"
	ExposureSeverityHigh     ExposureSeverity = "High"
	ExposureSeverityMedium   ExposureSeverity = "Medium"
	ExposureSeverityLow      ExposureSeverity = "Low"
)

type ExposureSource added in v0.4.0 

type ExposureSource string

ExposureSource is the source of an AD exposure detection. 

const (
	ExposureSourceOnPremAD ExposureSource = "OnPremAD"
	ExposureSourceAzureAD  ExposureSource = "AzureAD"
)

type FeatureStatusInfo added in v0.10.0 

type FeatureStatusInfo struct {
	FeatureType     ADFeatureType   `json:"featureType"`
	Status          ADFeatureStatus `json:"status"`
	StatusMessage   string          `json:"statusMessage"`
	DetailedMessage string          `json:"detailedMessage"`
	StartTime       string          `json:"startTime"`
	EndTime         string          `json:"endTime"`

	Raw json.RawMessage `json:"-"`
}

FeatureStatusInfo is the status detail for a single feature on an AD config.

func (*FeatureStatusInfo) UnmarshalJSON added in v0.10.0 

func (f *FeatureStatusInfo) UnmarshalJSON(b []byte) error

type Filter added in v0.7.0 

type Filter struct {
	ID           string          `json:"id"`
	Name         string          `json:"name"`
	ScopeID      string          `json:"scopeId"`
	ScopeLevel   string          `json:"scopeLevel"`
	FilterFields json.RawMessage `json:"filterFields,omitempty"`
	CreatedAt    string          `json:"createdAt"`
	UpdatedAt    string          `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

Filter is a saved endpoint filter. A saved filter pairs a name with a filterFields definition (the set of endpoint criteria to match) and can be used to run bulk agent actions or to back a dynamic group.

filterFields is an open-ended set of endpoint criteria whose keys track the agents query surface; it is captured verbatim as a raw blob rather than fully typed so a filter round-trips faithfully without pinning the SDK to an unstable field set.

func (*Filter) UnmarshalJSON added in v0.7.0 

func (f *Filter) UnmarshalJSON(b []byte) error

type FilterCreate added in v0.7.0 

type FilterCreate struct {
	Data   FilterData   `json:"data"`
	Filter *FilterScope `json:"filter,omitempty"`
}

FilterCreate is the request body for creating a saved filter.

type FilterData added in v0.7.0 

type FilterData struct {
	Name         string          `json:"name"`
	FilterFields json.RawMessage `json:"filterFields,omitempty"`
}

FilterData is the declarative payload of a saved filter: its name and the filterFields criteria set.

type FilterListParams added in v0.7.0 

type FilterListParams struct {
	Query      string
	IDs        []string
	SiteIDs    []string
	AccountIDs []string
	SortBy     string
	SortOrder  string
	Limit      int
	Cursor     string
}

FilterListParams are query parameters for listing saved filters.

type FilterScope added in v0.7.0 

type FilterScope struct {
	SiteIDs    []string `json:"siteIds,omitempty"`
	AccountIDs []string `json:"accountIds,omitempty"`
}

FilterScope targets the scope a new saved filter is created in. Leave both empty to create a global (tenant) filter.

type FilterUpdate added in v0.7.0 

type FilterUpdate struct {
	Data FilterData `json:"data"`
}

FilterUpdate is the request body for updating a saved filter. Supplying filterFields replaces the existing criteria set.

type FirewallAction added in v0.2.0 

type FirewallAction string

FirewallAction is the action taken by a firewall rule. 

const (
	FirewallActionAllow FirewallAction = "Allow"
	FirewallActionBlock FirewallAction = "Block"
)

type FirewallActionFilter added in v0.7.0 

type FirewallActionFilter struct {
	IDs        []string `json:"ids,omitempty"`
	AccountIDs []string `json:"accountIds,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	Query      string   `json:"query,omitempty"`
	Tenant     *bool    `json:"tenant,omitempty"`
}

FirewallActionFilter selects the rules a firewall-control action applies to.

type FirewallAppType added in v0.2.0 

type FirewallAppType string

FirewallAppType is the type of an application matcher in a firewall rule. 

const (
	FirewallAppAny    FirewallAppType = "any"
	FirewallAppPath   FirewallAppType = "path"
	FirewallAppSHA1   FirewallAppType = "sha1"
	FirewallAppSystem FirewallAppType = "system"
)

type FirewallApplication added in v0.2.0 

type FirewallApplication struct {
	Type   FirewallAppType `json:"type"`
	Values []string        `json:"values,omitempty"`

	Raw json.RawMessage `json:"-"`
}

FirewallApplication describes an application matcher.

func (*FirewallApplication) UnmarshalJSON added in v0.4.0 

func (f *FirewallApplication) UnmarshalJSON(b []byte) error

type FirewallCategory added in v0.7.0 

type FirewallCategory string

FirewallCategory selects a rule category within the shared firewall-control endpoint family. The default (empty or "firewall") targets the standard firewall; "network-quarantine" targets Network Quarantine, which is the same operations addressed under an extra path segment. 

const (
	// FirewallCategoryFirewall is the default category (bare /firewall-control paths).
	FirewallCategoryFirewall FirewallCategory = "firewall"
	// FirewallCategoryNetworkQuarantine addresses Network Quarantine rules.
	FirewallCategoryNetworkQuarantine FirewallCategory = "network-quarantine"
)

type FirewallConfigScope added in v0.7.0 

type FirewallConfigScope struct {
	AccountIDs []string `json:"accountIds,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	Tenant     *bool    `json:"tenant,omitempty"`
}

FirewallConfigScope scopes a configuration read/write to an account, site, group, or the whole tenant.

type FirewallConfiguration added in v0.7.0 

type FirewallConfiguration struct {
	Enabled                 bool     `json:"enabled"`
	LocationAware           bool     `json:"locationAware"`
	ReportBlocked           bool     `json:"reportBlocked"`
	Inherits                bool     `json:"inherits"`
	InheritedFrom           string   `json:"inheritedFrom"`
	SelectedTags            []string `json:"selectedTags"`
	InheritSettings         bool     `json:"inheritSettings"`
	InheritAllFirewallRules bool     `json:"inheritAllFirewallRules"`

	Raw json.RawMessage `json:"-"`
}

FirewallConfiguration is the firewall-control configuration for a scope.

func (*FirewallConfiguration) UnmarshalJSON added in v0.7.0 

func (f *FirewallConfiguration) UnmarshalJSON(b []byte) error

type FirewallConfigurationUpdate added in v0.7.0 

type FirewallConfigurationUpdate struct {
	Enabled                 *bool    `json:"enabled,omitempty"`
	LocationAware           *bool    `json:"locationAware,omitempty"`
	ReportBlocked           *bool    `json:"reportBlocked,omitempty"`
	Inherits                *bool    `json:"inherits,omitempty"`
	InheritedFrom           *string  `json:"inheritedFrom,omitempty"`
	SelectedTags            []string `json:"selectedTags,omitempty"`
	InheritSettings         *bool    `json:"inheritSettings,omitempty"`
	InheritAllFirewallRules *bool    `json:"inheritAllFirewallRules,omitempty"`
}

FirewallConfigurationUpdate is the mutable firewall-control configuration. Pointer fields are only sent when set, so callers patch individual toggles.

type FirewallDirection added in v0.2.0 

type FirewallDirection string

FirewallDirection is the traffic direction of a firewall rule. 

const (
	FirewallDirectionAny      FirewallDirection = "any"
	FirewallDirectionInbound  FirewallDirection = "inbound"
	FirewallDirectionOutbound FirewallDirection = "outbound"
)

type FirewallHost added in v0.2.0 

type FirewallHost struct {
	Type   FirewallHostType `json:"type"`
	Values []string         `json:"values,omitempty"`

	Raw json.RawMessage `json:"-"`
}

FirewallHost describes a host matcher (local or remote).

func (*FirewallHost) UnmarshalJSON added in v0.4.0 

func (f *FirewallHost) UnmarshalJSON(b []byte) error

type FirewallHostType added in v0.2.0 

type FirewallHostType string

FirewallHostType is the type of a host matcher in a firewall rule. 

const (
	FirewallHostAny       FirewallHostType = "any"
	FirewallHostCIDR      FirewallHostType = "cidr"
	FirewallHostRange     FirewallHostType = "range"
	FirewallHostAddresses FirewallHostType = "addresses"
	FirewallHostFQDN      FirewallHostType = "fqdn"
)

type FirewallImportScope added in v0.4.0 

type FirewallImportScope struct {
	AccountIDs []string
	SiteIDs    []string
	GroupIDs   []string
	Tenant     bool
}

FirewallImportScope identifies the target scope for importing rules.

type FirewallLocation added in v0.2.0 

type FirewallLocation struct {
	Type   FirewallLocationType `json:"type"`
	Values []string             `json:"values,omitempty"`

	Raw json.RawMessage `json:"-"`
}

FirewallLocation describes a location matcher.

func (*FirewallLocation) UnmarshalJSON added in v0.4.0 

func (f *FirewallLocation) UnmarshalJSON(b []byte) error

type FirewallLocationTarget added in v0.7.0 

type FirewallLocationTarget struct {
	Type   FirewallLocationType    `json:"type"`
	Values []FirewallLocationValue `json:"values,omitempty"`
}

FirewallLocationTarget is the desired location assignment for matched rules.

type FirewallLocationType added in v0.2.0 

type FirewallLocationType string

FirewallLocationType is the type of a location matcher in a firewall rule. 

const (
	FirewallLocationAll      FirewallLocationType = "all"
	FirewallLocationSpecific FirewallLocationType = "specific"
	FirewallLocationFallback FirewallLocationType = "fallback"
)

type FirewallLocationValue added in v0.7.0 

type FirewallLocationValue struct {
	ID    string `json:"id"`
	Name  string `json:"name,omitempty"`
	Scope string `json:"scope,omitempty"`
}

FirewallLocationValue identifies a location a rule is scoped to.

type FirewallPort added in v0.2.0 

type FirewallPort struct {
	Type   FirewallPortType `json:"type"`
	Values []string         `json:"values,omitempty"`

	Raw json.RawMessage `json:"-"`
}

FirewallPort describes a port matcher (local or remote).

func (*FirewallPort) UnmarshalJSON added in v0.4.0 

func (f *FirewallPort) UnmarshalJSON(b []byte) error

type FirewallPortType added in v0.2.0 

type FirewallPortType string

FirewallPortType is the type of a port matcher in a firewall rule. 

const (
	FirewallPortAny   FirewallPortType = "any"
	FirewallPortPorts FirewallPortType = "ports"
	FirewallPortRange FirewallPortType = "range"
)

type FirewallProtocol added in v0.4.0 

type FirewallProtocol struct {
	Value string `json:"value"`
	Name  string `json:"name"`

	Raw json.RawMessage `json:"-"`
}

FirewallProtocol is a protocol available for firewall rules.

func (*FirewallProtocol) UnmarshalJSON added in v0.4.0 

func (f *FirewallProtocol) UnmarshalJSON(b []byte) error

type FirewallProtocolListParams added in v0.4.0 

type FirewallProtocolListParams struct {
	Query string
	Limit int
}

FirewallProtocolListParams are query parameters for listing protocols.

type FirewallRule 

type FirewallRule struct {
	ID           string               `json:"id"`
	Name         string               `json:"name"`
	Description  string               `json:"description"`
	Status       FirewallStatus       `json:"status"`
	Action       FirewallAction       `json:"action"`
	Direction    FirewallDirection    `json:"direction"`
	Protocol     string               `json:"protocol"`
	OSType       string               `json:"osType"`
	OSTypes      []string             `json:"osTypes"`
	Order        int                  `json:"order"`
	Application  *FirewallApplication `json:"application,omitempty"`
	LocalHost    *FirewallHost        `json:"localHost,omitempty"`
	LocalPort    *FirewallPort        `json:"localPort,omitempty"`
	RemoteHosts  []FirewallHost       `json:"remoteHosts,omitempty"`
	RemotePort   *FirewallPort        `json:"remotePort,omitempty"`
	Location     *FirewallLocation    `json:"location,omitempty"`
	Scope        string               `json:"scope"`
	ScopeID      string               `json:"scopeId"`
	Editable     bool                 `json:"editable"`
	RuleCategory string               `json:"ruleCategory"`
	TagIDs       []string             `json:"tagIds"`
	TagNames     []string             `json:"tagNames"`
	Creator      string               `json:"creator"`
	CreatorID    string               `json:"creatorId"`
	CreatedAt    string               `json:"createdAt"`
	UpdatedAt    string               `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

FirewallRule is a SentinelOne firewall rule.

func (*FirewallRule) UnmarshalJSON 

func (f *FirewallRule) UnmarshalJSON(b []byte) error

type FirewallRuleCopyTarget added in v0.4.0 

type FirewallRuleCopyTarget struct {
	AccountID *string `json:"accountId,omitempty"`
	SiteID    *string `json:"siteId,omitempty"`
	GroupID   *string `json:"groupId,omitempty"`
	Tenant    *bool   `json:"tenant,omitempty"`
}

FirewallRuleCopyTarget specifies a destination scope for copying rules.

type FirewallRuleCreate added in v0.2.0 

type FirewallRuleCreate struct {
	Name        string               `json:"name"`
	Description string               `json:"description,omitempty"`
	Direction   FirewallDirection    `json:"direction"`
	Protocol    string               `json:"protocol,omitempty"`
	OSTypes     []string             `json:"osTypes,omitempty"`
	Action      FirewallAction       `json:"action"`
	Status      FirewallStatus       `json:"status"`
	Application *FirewallApplication `json:"application,omitempty"`
	LocalHost   *FirewallHost        `json:"localHost,omitempty"`
	LocalPort   *FirewallPort        `json:"localPort,omitempty"`
	RemoteHosts []FirewallHost       `json:"remoteHosts,omitempty"`
	RemotePort  *FirewallPort        `json:"remotePort,omitempty"`
	Location    *FirewallLocation    `json:"location,omitempty"`
	TagIDs      []string             `json:"tagIds,omitempty"`
}

FirewallRuleCreate is the request body for creating or updating a firewall rule.

type FirewallRuleListParams 

type FirewallRuleListParams struct {
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	Query      string
	Limit      int
	Cursor     string
}

FirewallRuleListParams are query parameters for listing firewall rules.

type FirewallRuleReorderFilter added in v0.4.0 

type FirewallRuleReorderFilter struct {
	AccountIDs []string `json:"accountIds,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	Tenant     *bool    `json:"tenant,omitempty"`
}

FirewallRuleReorderFilter scopes a reorder operation.

type FirewallRuleScope added in v0.2.0 

type FirewallRuleScope struct {
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
}

FirewallRuleScope identifies the scope for creating a firewall rule.

type FirewallStatus added in v0.2.0 

type FirewallStatus string

FirewallStatus is the status of a firewall rule. 

const (
	FirewallStatusEnabled  FirewallStatus = "Enabled"
	FirewallStatusDisabled FirewallStatus = "Disabled"
)

type Group 

type Group struct {
	ID                string `json:"id"`
	Name              string `json:"name"`
	SiteID            string `json:"siteId"`
	Type              string `json:"type"`
	TotalAgents       int    `json:"totalAgents"`
	FilterID          string `json:"filterId"`
	FilterName        string `json:"filterName"`
	IsDefault         bool   `json:"isDefault"`
	Rank              int    `json:"rank"`
	RegistrationToken string `json:"registrationToken"`
	CreatedAt         string `json:"createdAt"`
	UpdatedAt         string `json:"updatedAt"`
	Description       string `json:"description"`

	Raw json.RawMessage `json:"-"`
}

Group is a SentinelOne network group.

func (*Group) UnmarshalJSON 

func (g *Group) UnmarshalJSON(b []byte) error

type GroupCreate 

type GroupCreate struct {
	Name        string `json:"name"`
	SiteID      string `json:"siteId"`
	Description string `json:"description,omitempty"`
}

GroupCreate is the request body for creating a group.

type GroupListParams 

type GroupListParams struct {
	SiteIDs   []string
	Types     []string
	Query     string
	Limit     int
	Cursor    string
	SortBy    string
	SortOrder string
	CountOnly bool
}

GroupListParams are query parameters for listing groups.

type GroupUpdate 

type GroupUpdate struct {
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
}

GroupUpdate is the request body for updating a group.

type GuardrailCheckInput added in v0.7.0 

type GuardrailCheckInput struct {
	ScriptID string   `json:"scriptId"`
	AgentIDs []string `json:"agentIds"`
}

GuardrailCheckInput is the body for a guardrail check.

type GuardrailCheckResult added in v0.7.0 

type GuardrailCheckResult struct {
	RequiresApproval bool `json:"requiresApproval"`

	Raw json.RawMessage `json:"-"`
}

GuardrailCheckResult reports whether a guardrail requires approval for an execution.

func (*GuardrailCheckResult) UnmarshalJSON added in v0.7.0 

func (r *GuardrailCheckResult) UnmarshalJSON(b []byte) error

type GuardrailScope added in v0.7.0 

type GuardrailScope struct {
	ScopeID    string
	ScopeLevel GuardrailScopeLevel
}

GuardrailScope identifies a guardrail configuration by scope.

type GuardrailScopeLevel added in v0.7.0 

type GuardrailScopeLevel string

GuardrailScopeLevel is the scope at which a guardrail applies. 

const (
	GuardrailScopeAccount GuardrailScopeLevel = "account"
	GuardrailScopeSite    GuardrailScopeLevel = "site"
	GuardrailScopeGroup   GuardrailScopeLevel = "group"
)

type Guardrails added in v0.7.0 

type Guardrails struct {
	EndpointsQuantity *int     `json:"endpointsQuantity"`
	ScriptTypes       []string `json:"scriptTypes"`
	Inherited         bool     `json:"inherited"`
	Enabled           bool     `json:"enabled"`

	Raw json.RawMessage `json:"-"`
}

Guardrails is a remote-script guardrail configuration for a scope. A guardrail requires approval before scripts of the listed types run on more than EndpointsQuantity endpoints.

func (*Guardrails) UnmarshalJSON added in v0.7.0 

func (g *Guardrails) UnmarshalJSON(b []byte) error

type GuardrailsUpsertInput added in v0.7.0 

type GuardrailsUpsertInput struct {
	ScopeID           string              `json:"scopeId"`
	ScopeLevel        GuardrailScopeLevel `json:"scopeLevel"`
	EndpointsQuantity *int                `json:"endpointsQuantity"`
	ScriptTypes       []string            `json:"scriptTypes"`
	Enabled           bool                `json:"enabled"`
}

GuardrailsUpsertInput is the body for creating or updating a guardrail. The endpointsQuantity threshold is required by the spec and may be null.

type IOC added in v0.4.0 

type IOC struct {
	UUID              string      `json:"uuid"`
	Type              IOCType     `json:"type"`
	Value             string      `json:"value"`
	Source            string      `json:"source"`
	Severity          IOCSeverity `json:"severity"`
	Method            string      `json:"method"`
	Name              string      `json:"name"`
	Description       string      `json:"description"`
	ExternalID        string      `json:"externalId"`
	BatchID           string      `json:"batchId"`
	Creator           string      `json:"creator"`
	Scope             IOCScope    `json:"scope"`
	ScopeID           string      `json:"scopeId"`
	ParentScopeID     string      `json:"parentScopeId"`
	Category          []string    `json:"category"`
	Labels            []string    `json:"labels"`
	MalwareNames      []string    `json:"malwareNames"`
	CampaignNames     []string    `json:"campaignNames"`
	ThreatActors      []string    `json:"threatActors"`
	ThreatActorTypes  []string    `json:"threatActorTypes"`
	IntrusionSets     []string    `json:"intrusionSets"`
	MitreTactic       []string    `json:"mitreTactic"`
	Metadata          string      `json:"metadata"`
	OriginalRiskScore int         `json:"originalRiskScore"`
	PatternType       string      `json:"patternType"`
	Pattern           string      `json:"pattern"`
	Reference         []string    `json:"reference"`
	ValidUntil        string      `json:"validUntil"`
	CreationTime      string      `json:"creationTime"`
	UpdatedAt         string      `json:"updatedAt"`
	UploadTime        string      `json:"uploadTime"`

	Raw json.RawMessage `json:"-"`
}

IOC is a SentinelOne threat intelligence indicator of compromise.

func (*IOC) UnmarshalJSON added in v0.4.0 

func (ioc *IOC) UnmarshalJSON(b []byte) error

type IOCCreateInput added in v0.4.0 

type IOCCreateInput struct {
	Type        IOCType      `json:"type"`
	Value       string       `json:"value"`
	Source      string       `json:"source"`
	Severity    *IOCSeverity `json:"severity,omitempty"`
	Method      string       `json:"method,omitempty"`
	Name        string       `json:"name,omitempty"`
	Description string       `json:"description,omitempty"`
	ExternalID  string       `json:"externalId,omitempty"`
	ValidUntil  string       `json:"validUntil,omitempty"`
}

IOCCreateInput is the payload for creating a threat intelligence IOC. Source, Type, and Value are required. Method defaults to EQUALS when empty.

type IOCListParams added in v0.4.0 

type IOCListParams struct {
	AccountIDs []string
	SiteIDs    []string
	UUIDs      []string
	Type       IOCType
	Severities []IOCSeverity
	Sources    []string
	Value      string
	ExternalID string
	BatchID    string
	Creators   []string // free-text creator filter (creator__contains)
	Limit      int
	Cursor     string
	SortBy     string
	SortOrder  string
}

IOCListParams are query parameters for listing threat intelligence IOCs.

type IOCScope added in v0.4.0 

type IOCScope string

IOCScope is the scope at which a threat intelligence object is defined. 

const (
	IOCScopeGlobal  IOCScope = "global"
	IOCScopeAccount IOCScope = "account"
	IOCScopeSite    IOCScope = "site"
	IOCScopeGroup   IOCScope = "group"
)

type IOCSeverity added in v0.4.0 

type IOCSeverity int

IOCSeverity is the potential impact of a threat intelligence IOC. The API represents it as an OCSF-style integer score in the range 0-7. 

const (
	IOCSeverityUnknown       IOCSeverity = 0
	IOCSeverityInformational IOCSeverity = 1
	IOCSeverityLow           IOCSeverity = 2
	IOCSeverityMedium        IOCSeverity = 3
	IOCSeverityHigh          IOCSeverity = 4
	IOCSeverityCritical      IOCSeverity = 5
	IOCSeverityFatal         IOCSeverity = 6
)

OCSF severity scores. The API accepts 0-7; 7 has no OCSF name and is rendered numerically.

func (IOCSeverity) String added in v0.4.0 

func (s IOCSeverity) String() string

String returns the OCSF severity name, or the numeric score when unnamed.

type IOCType added in v0.4.0 

type IOCType string

IOCType is the indicator type for a threat intelligence IOC. 

const (
	IOCTypeDNS    IOCType = "DNS"
	IOCTypeIPv4   IOCType = "IPV4"
	IOCTypeIPv6   IOCType = "IPV6"
	IOCTypeMD5    IOCType = "MD5"
	IOCTypeSHA1   IOCType = "SHA1"
	IOCTypeSHA256 IOCType = "SHA256"
	IOCTypeURL    IOCType = "URL"
)

type IdentityParams added in v0.10.0 

type IdentityParams struct {
	SiteIDs    string
	AccountIDs string
}

IdentityParams are common query parameters for Identity AD Service endpoints.

type InsightTypesParams added in v0.4.0 

type InsightTypesParams struct {
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
}

InsightTypesParams are query parameters for listing insight types.

type Location added in v0.7.0 

type Location struct {
	ID                 string           `json:"id"`
	Name               string           `json:"name"`
	Description        string           `json:"description"`
	Operator           LocationOperator `json:"operator"`
	Scope              string           `json:"scope"`
	ScopeID            string           `json:"scopeId"`
	ScopeName          string           `json:"scopeName"`
	Editable           bool             `json:"editable"`
	IsFallback         bool             `json:"isFallback"`
	ReportingAgents    int              `json:"reportingAgents"`
	ActiveFirewallRule int              `json:"activeFirewallRules"`
	CreatedAt          string           `json:"createdAt"`
	UpdatedAt          string           `json:"updatedAt"`

	DNSLookup          json.RawMessage `json:"dnsLookup,omitempty"`
	DNSServers         json.RawMessage `json:"dnsServers,omitempty"`
	RegistryKeys       json.RawMessage `json:"registryKeys,omitempty"`
	ServerConnectivity json.RawMessage `json:"serverConnectivity,omitempty"`
	NetworkInterfaces  json.RawMessage `json:"networkInterfaces,omitempty"`
	IPAddresses        json.RawMessage `json:"ipAddresses,omitempty"`

	Raw json.RawMessage `json:"-"`
}

Location is a firewall location definition. Agents detect their location from endpoint network parameters (IP, DNS, NIC, registry key, or management connectivity) and apply Location Aware firewall rules that match.

The six detection-parameter groups (dnsLookup, dnsServers, registryKeys, serverConnectivity, networkInterfaces, ipAddresses) are captured verbatim as raw blobs rather than fully typed: each is a nested object whose shape varies by parameter kind, and keeping them raw lets a location round-trip faithfully.

func (*Location) UnmarshalJSON added in v0.7.0 

func (l *Location) UnmarshalJSON(b []byte) error

type LocationCreate added in v0.7.0 

type LocationCreate struct {
	Data   LocationData  `json:"data"`
	Filter LocationScope `json:"filter"`
}

LocationCreate is the request body for creating a location.

type LocationData added in v0.7.0 

type LocationData struct {
	Name               string           `json:"name"`
	Description        string           `json:"description,omitempty"`
	Operator           LocationOperator `json:"operator"`
	DNSLookup          json.RawMessage  `json:"dnsLookup,omitempty"`
	DNSServers         json.RawMessage  `json:"dnsServers,omitempty"`
	RegistryKeys       json.RawMessage  `json:"registryKeys,omitempty"`
	ServerConnectivity json.RawMessage  `json:"serverConnectivity,omitempty"`
	NetworkInterfaces  json.RawMessage  `json:"networkInterfaces,omitempty"`
	IPAddresses        json.RawMessage  `json:"ipAddresses,omitempty"`
}

LocationData is the declarative payload of a location: its name, description, the logical operator, and the detection-parameter groups.

type LocationListParams added in v0.7.0 

type LocationListParams struct {
	IDs        []string
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	SortBy     string
	SortOrder  string
	Limit      int
	Cursor     string
}

LocationListParams are query parameters for listing locations.

type LocationOperator added in v0.7.0 

type LocationOperator string

LocationOperator is the logical operator applied between a location's detection parameters. 

const (
	LocationOperatorAll  LocationOperator = "all"
	LocationOperatorAny  LocationOperator = "any"
	LocationOperatorNone LocationOperator = "none"
)

Location detection operators.

type LocationScope added in v0.7.0 

type LocationScope struct {
	SiteIDs    []string `json:"siteIds,omitempty"`
	AccountIDs []string `json:"accountIds,omitempty"`
}

LocationScope targets the scope a new location is created in.

type LocationUpdate added in v0.7.0 

type LocationUpdate struct {
	Data LocationData `json:"data"`
}

LocationUpdate is the request body for updating a location.

type MarketplaceApp added in v0.10.1 

type MarketplaceApp struct {
	ApplicationCatalogID string                `json:"applicationCatalogId"`
	Name                 string                `json:"name"`
	HasAlert             bool                  `json:"hasAlert"`
	LastInstalledAt      string                `json:"lastInstalledAt"`
	Scopes               []MarketplaceAppScope `json:"scopes"`
	Raw                  json.RawMessage       `json:"-"`
}

MarketplaceApp is an installed application in the Singularity Marketplace.

func (*MarketplaceApp) UnmarshalJSON added in v0.10.1 

func (m *MarketplaceApp) UnmarshalJSON(b []byte) error

type MarketplaceAppListParams added in v0.10.1 

type MarketplaceAppListParams struct {
	ApplicationCatalogID string
	ID                   string
	NameContains         string
	CreatorContains      string
	Query                string
	AccountIDs           []string
	SiteIDs              []string
	Cursor               string
	Limit                int
	CountOnly            *bool
	SortBy               string
	SortOrder            string
}

MarketplaceAppListParams are the query parameters for listing installed applications.

type MarketplaceAppScope added in v0.10.1 

type MarketplaceAppScope struct {
	ID                      string          `json:"id"`
	ApplicationInstanceName string          `json:"applicationInstanceName"`
	Status                  string          `json:"status"`
	ScopeLevel              string          `json:"scopeLevel"`
	SiteID                  string          `json:"siteId"`
	Raw                     json.RawMessage `json:"-"`
}

MarketplaceAppScope is a per-installation scope entry for a marketplace app.

func (*MarketplaceAppScope) UnmarshalJSON added in v0.10.1 

func (m *MarketplaceAppScope) UnmarshalJSON(b []byte) error

type MarketplaceCatalogItem added in v0.10.1 

type MarketplaceCatalogItem struct {
	ID          string          `json:"id"`
	Name        string          `json:"name"`
	Key         string          `json:"key"`
	Category    string          `json:"category"`
	CategoryID  string          `json:"categoryId"`
	Description string          `json:"description"`
	Summary     string          `json:"summary"`
	Type        string          `json:"type"`
	Installed   bool            `json:"installed"`
	ToggleState string          `json:"toggleState"`
	Raw         json.RawMessage `json:"-"`
}

MarketplaceCatalogItem is a catalog application in the Singularity Marketplace.

func (*MarketplaceCatalogItem) UnmarshalJSON added in v0.10.1 

func (m *MarketplaceCatalogItem) UnmarshalJSON(b []byte) error

type MarketplaceCatalogListParams added in v0.10.1 

type MarketplaceCatalogListParams struct {
	ID                  string
	CategoryContains    string
	NameContains        string
	DescriptionContains string
	Query               string
	CategoryIDs         []string
	Cursor              string
	Limit               int
	SortBy              string
	SortOrder           string
}

MarketplaceCatalogListParams are the query parameters for listing catalog applications.

type MarketplaceConfig added in v0.10.1 

type MarketplaceConfig struct {
	ID    string `json:"id"`
	Value string `json:"value"`
}

MarketplaceConfig is a configuration key-value pair for marketplace apps.

type MarketplaceDeleteFilter added in v0.10.1 

type MarketplaceDeleteFilter struct {
	ID                   []string `json:"id,omitempty"`
	ApplicationCatalogID []string `json:"application_catalog_id,omitempty"`
	NameContains         string   `json:"name__contains,omitempty"`
	CreatorContains      string   `json:"creator__contains,omitempty"`
	Query                string   `json:"query,omitempty"`
	SiteIDs              []string `json:"siteIds,omitempty"`
	AccountIDs           []string `json:"accountIds,omitempty"`
	GroupIDs             []string `json:"groupIds,omitempty"`
	Tenant               *bool    `json:"tenant,omitempty"`
}

MarketplaceDeleteFilter scopes a marketplace delete to specific resources. The delete endpoint uses different JSON keys than the shared scope filter.

type MarketplaceInstallInput added in v0.10.1 

type MarketplaceInstallInput struct {
	Data struct {
		Name           string              `json:"applicationInstanceName"`
		Configurations []MarketplaceConfig `json:"configurations"`
	} `json:"data"`
	Filter MarketplaceScopeFilter `json:"filter"`
}

MarketplaceInstallInput is the request body for installing a marketplace application.

type MarketplaceScopeFilter added in v0.10.1 

type MarketplaceScopeFilter struct {
	ApplicationCatalogID string   `json:"applicationCatalogId,omitempty"`
	IDs                  []string `json:"ids,omitempty"`
	ApplicationID        string   `json:"applicationId,omitempty"`
	AccountIDs           []string `json:"accountIds,omitempty"`
	SiteIDs              []string `json:"siteIds,omitempty"`
	GroupIDs             []string `json:"groupIds,omitempty"`
	Tenant               *bool    `json:"tenant,omitempty"`
}

MarketplaceScopeFilter scopes a marketplace mutation to specific resources.

type MarketplaceUpdateInput added in v0.10.1 

type MarketplaceUpdateInput struct {
	Data struct {
		NameMap        map[string]string   `json:"applicationIdToNameMap,omitempty"`
		Configurations []MarketplaceConfig `json:"configurations"`
	} `json:"data"`
	Filter MarketplaceScopeFilter `json:"filter"`
}

MarketplaceUpdateInput is the request body for updating a marketplace application.

type MitreTactic added in v0.4.0 

type MitreTactic struct {
	Tactic     string           `json:"tactic"`
	Techniques []MitreTechnique `json:"techniques"`

	Raw json.RawMessage `json:"-"`
}

MitreTactic is a MITRE ATT&CK tactic with associated techniques.

func (*MitreTactic) UnmarshalJSON added in v0.4.0 

func (m *MitreTactic) UnmarshalJSON(b []byte) error

type MitreTechnique added in v0.4.0 

type MitreTechnique struct {
	ID    string `json:"id"`
	Title string `json:"title"`
	Link  string `json:"link"`

	Raw json.RawMessage `json:"-"`
}

MitreTechnique is a MITRE ATT&CK technique reference.

func (*MitreTechnique) UnmarshalJSON added in v0.4.0 

func (m *MitreTechnique) UnmarshalJSON(b []byte) error

type NotificationConfig added in v0.4.0 

type NotificationConfig struct {
	Email  string `json:"email"`
	SMS    string `json:"sms"`
	Syslog string `json:"syslog"`

	Raw json.RawMessage `json:"-"`
}

NotificationConfig holds email, SMS, and syslog notification configuration.

func (*NotificationConfig) UnmarshalJSON added in v0.4.0 

func (n *NotificationConfig) UnmarshalJSON(b []byte) error

type NotificationLastModified added in v0.4.0 

type NotificationLastModified struct {
	UpdatedAt string `json:"updatedAt"`
	UpdatedBy string `json:"updatedBy"`

	Raw json.RawMessage `json:"-"`
}

NotificationLastModified tracks who last modified notification settings.

func (*NotificationLastModified) UnmarshalJSON added in v0.4.0 

func (n *NotificationLastModified) UnmarshalJSON(b []byte) error

type NotificationRecipient added in v0.7.0 

type NotificationRecipient struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Email     string `json:"email"`
	SMS       string `json:"sms"`
	CreatedAt string `json:"createdAt"`
	UpdatedAt string `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

NotificationRecipient is a single notification recipient. The GET endpoint returns a list of these; PUT sets (creates or updates) one at a time.

func (*NotificationRecipient) UnmarshalJSON added in v0.7.0 

func (r *NotificationRecipient) UnmarshalJSON(b []byte) error

type NotificationSettings added in v0.4.0 

type NotificationSettings struct {
	Configurations NotificationConfig       `json:"configurations"`
	Notifications  json.RawMessage          `json:"notifications"`
	LastModified   NotificationLastModified `json:"lastModified"`

	Raw json.RawMessage `json:"-"`
}

NotificationSettings is the full notification settings object.

func (*NotificationSettings) UnmarshalJSON added in v0.4.0 

func (n *NotificationSettings) UnmarshalJSON(b []byte) error

type OnboardingStatus added in v0.10.0 

type OnboardingStatus string

OnboardingStatus is the onboarding status of the AD service. 

const (
	OnboardingStatusComplete   OnboardingStatus = "COMPLETE"
	OnboardingStatusIncomplete OnboardingStatus = "INCOMPLETE"
)

type Option 

type Option func(*Client)

Option customizes a Client.

func WithHTTPClient 

func WithHTTPClient(h *http.Client) Option

WithHTTPClient overrides the underlying *http.Client.

func WithRateLimit added in v0.2.0 

func WithRateLimit(rps float64, burst int) Option

WithRateLimit overrides the default rate limiter. rps is the sustained requests-per-second rate; burst is the maximum burst size.

type OutputDestination added in v0.2.0 

type OutputDestination string

OutputDestination controls where remote script output is sent. 

const (
	OutputSentinelCloud  OutputDestination = "SentinelCloud"
	OutputLocal          OutputDestination = "Local"
	OutputNone           OutputDestination = "None"
	OutputSingularityXDR OutputDestination = "SingularityXDR"
)

type PackageEndpointExpiration added in v0.7.0 

type PackageEndpointExpiration string

PackageEndpointExpiration controls when a script package is removed from the endpoint after execution. 

const (
	PackageExpirationNone      PackageEndpointExpiration = "None"
	PackageExpirationImmediate PackageEndpointExpiration = "Immediate"
	PackageExpirationOnRestart PackageEndpointExpiration = "OnRestart"
	PackageExpirationTime      PackageEndpointExpiration = "Time"
)

type Pagination 

type Pagination struct {
	TotalItems int    `json:"totalItems"`
	NextCursor string `json:"nextCursor"`
}

Pagination is the standard SentinelOne pagination envelope.

type PendingExecution added in v0.7.0 

type PendingExecution struct {
	PendingExecutionID  string                `json:"pendingExecutionId"`
	State               PendingExecutionState `json:"state"`
	CreatedAt           string                `json:"createdAt"`
	Creator             string                `json:"creator"`
	CreatorID           string                `json:"creatorId"`
	Reviewer            string                `json:"reviewer"`
	TotalEndpoints      int                   `json:"totalEndpoints"`
	CanApproveOrDecline bool                  `json:"canApproveOrDecline"`
	ScriptData          struct {
		ID         string `json:"id"`
		ScriptName string `json:"scriptName"`
		ScriptType string `json:"scriptType"`
	} `json:"scriptData"`
	ExecutionData struct {
		ScriptID          string `json:"scriptId"`
		TaskDescription   string `json:"taskDescription"`
		OutputDestination string `json:"outputDestination"`
	} `json:"executionData"`

	Raw json.RawMessage `json:"-"`
}

PendingExecution is a remote-script execution awaiting approval.

func (*PendingExecution) UnmarshalJSON added in v0.7.0 

func (p *PendingExecution) UnmarshalJSON(b []byte) error

type PendingExecutionAction added in v0.7.0 

type PendingExecutionAction string

PendingExecutionAction is the decision applied to a pending execution. 

const (
	PendingActionApprove PendingExecutionAction = "approve"
	PendingActionDecline PendingExecutionAction = "decline"
)

type PendingExecutionState added in v0.7.0 

type PendingExecutionState string

PendingExecutionState is the review state of a pending remote-script execution. 

const (
	PendingStateWaiting  PendingExecutionState = "waiting"
	PendingStateApproved PendingExecutionState = "approved"
	PendingStateDeclined PendingExecutionState = "declined"
	PendingStateExpired  PendingExecutionState = "expired"
)

type PlatformRule added in v0.4.0 

type PlatformRule struct {
	ID                    string               `json:"id"`
	Name                  string               `json:"name"`
	Description           string               `json:"description"`
	Severity              PlatformRuleSeverity `json:"severity"`
	Status                PlatformRuleStatus   `json:"status"`
	ScopeLevel            PlatformRuleScope    `json:"scopeLevel"`
	HighestInheritedScope PlatformRuleScope    `json:"highestInheritedScopeLevel"`
	QueryType             string               `json:"queryType"`
	S1QL                  string               `json:"s1ql"`
	CreatedBy             string               `json:"createdBy"`
	AttackSurfaces        []string             `json:"attackSurfaces"`
	Sources               []string             `json:"sources"`
	Tags                  []string             `json:"tags"`
	ActiveResponse        bool                 `json:"activeResponse"`
	NetworkQuarantine     bool                 `json:"networkQuarantine"`
	TreatAsThreat         RuleTreatAsThreat    `json:"treatAsThreat"`
	GeneratedAlerts       int                  `json:"generatedAlerts"`
	Mitre                 []MitreTactic        `json:"mitre"`
	CreatedAt             string               `json:"createdAt"`
	UpdatedAt             string               `json:"updatedAt"`
	LastAlertTime         string               `json:"lastAlertTime"`

	Raw json.RawMessage `json:"-"`
}

PlatformRule is a SentinelOne platform (pre-built) detection rule.

func (*PlatformRule) UnmarshalJSON added in v0.4.0 

func (r *PlatformRule) UnmarshalJSON(b []byte) error

type PlatformRuleActionFilter added in v0.4.0 

type PlatformRuleActionFilter struct {
	PlatformRuleIDs []string `json:"platformRuleIds,omitempty"`
	ScopeID         string   `json:"scopeId,omitempty"`
	ScopeLevel      string   `json:"scopeLevel,omitempty"`
}

PlatformRuleActionFilter selects which platform rules to enable or disable.

type PlatformRuleCategory added in v0.4.0 

type PlatformRuleCategory string

PlatformRuleCategory is the category of a platform detection rule. 

const (
	PlatformRuleCategoryEvents        PlatformRuleCategory = "Events"
	PlatformRuleCategoryCorrelation   PlatformRuleCategory = "Correlation"
	PlatformRuleCategoryUEBAFirstSeen PlatformRuleCategory = "UEBAFirstSeen"
	PlatformRuleCategoryScheduled     PlatformRuleCategory = "Scheduled"
)

type PlatformRuleListParams added in v0.4.0 

type PlatformRuleListParams struct {
	IDs            []string
	ScopeID        string
	ScopeLevel     string
	Severities     []string
	Statuses       []string
	AttackSurfaces []string
	Sources        []string
	Categories     []string
	Tags           []string
	MitreTactics   []string
	NameContains   string
	S1QLContains   string
	DescContains   string
	Limit          int
	Cursor         string
}

PlatformRuleListParams are query parameters for listing platform detection rules.

type PlatformRuleScope added in v0.4.0 

type PlatformRuleScope string

PlatformRuleScope is the scope level of a platform detection rule. 

const (
	PlatformRuleScopeGlobal  PlatformRuleScope = "global"
	PlatformRuleScopeAccount PlatformRuleScope = "account"
	PlatformRuleScopeSite    PlatformRuleScope = "site"
	PlatformRuleScopeGroup   PlatformRuleScope = "group"
)

type PlatformRuleSeverity added in v0.4.0 

type PlatformRuleSeverity string

PlatformRuleSeverity is the severity of a platform detection rule. 

const (
	PlatformRuleSeverityInfo     PlatformRuleSeverity = "Info"
	PlatformRuleSeverityLow      PlatformRuleSeverity = "Low"
	PlatformRuleSeverityMedium   PlatformRuleSeverity = "Medium"
	PlatformRuleSeverityHigh     PlatformRuleSeverity = "High"
	PlatformRuleSeverityCritical PlatformRuleSeverity = "Critical"
)

type PlatformRuleStatus added in v0.4.0 

type PlatformRuleStatus string

PlatformRuleStatus is the status of a platform detection rule. 

const (
	PlatformRuleStatusDraft      PlatformRuleStatus = "Draft"
	PlatformRuleStatusActivating PlatformRuleStatus = "Activating"
	PlatformRuleStatusActive     PlatformRuleStatus = "Active"
	PlatformRuleStatusDisabling  PlatformRuleStatus = "Disabling"
	PlatformRuleStatusDisabled   PlatformRuleStatus = "Disabled"
	PlatformRuleStatusDeleted    PlatformRuleStatus = "Deleted"
	PlatformRuleStatusDeleting   PlatformRuleStatus = "Deleting"
)

type Policy 

type Policy struct {
	MitigationMode           string `json:"mitigationMode"`
	MitigationModeSuspicious string `json:"mitigationModeSuspicious"`
	AntiTamperingOn          bool   `json:"antiTamperingOn"`
	NetworkQuarantineOn      bool   `json:"networkQuarantineOn"`
	SnapshotsOn              bool   `json:"snapshotsOn"`
	Ioc                      bool   `json:"ioc"`
	InheritedFrom            string `json:"inheritedFrom"`
	AllowRemoteShell         bool   `json:"allowRemoteShell"`
	ScanNewAgents            bool   `json:"scanNewAgents"`
	AutoDecommissionOn       bool   `json:"autoDecommissionOn"`
	AutoDecommissionDays     int    `json:"autoDecommissionDays"`
	CreatedAt                string `json:"createdAt"`
	UpdatedAt                string `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

Policy is a SentinelOne endpoint policy (at site, group, or account scope).

func (*Policy) UnmarshalJSON 

func (p *Policy) UnmarshalJSON(b []byte) error

type PolicyUsage added in v0.10.0 

type PolicyUsage struct {
	FeatureName  ADFeatureName `json:"featureName"`
	PolicyActive bool          `json:"policyActive"`

	Raw json.RawMessage `json:"-"`
}

PolicyUsage shows whether a feature's policy is active.

func (*PolicyUsage) UnmarshalJSON added in v0.10.0 

func (p *PolicyUsage) UnmarshalJSON(b []byte) error

type QuarantinedFile added in v0.7.0 

type QuarantinedFile struct {
	FilePath string `json:"filePath"`
	FileName string `json:"fileName"`
	FileSize int64  `json:"fileSize"`

	Raw json.RawMessage `json:"-"`
}

QuarantinedFile is a file quarantined for a threat.

func (QuarantinedFile) MarshalJSON added in v0.7.0 

func (f QuarantinedFile) MarshalJSON() ([]byte, error)

func (*QuarantinedFile) UnmarshalJSON added in v0.7.0 

func (f *QuarantinedFile) UnmarshalJSON(b []byte) error

type RemoteScript 

type RemoteScript struct {
	ID          string   `json:"id"`
	FileName    string   `json:"fileName"`
	FileType    string   `json:"fileType"`
	ScriptType  string   `json:"scriptType"`
	OSTypes     []string `json:"osTypes"`
	ScopeID     string   `json:"scopeId"`
	ScopeLevel  string   `json:"scopeLevel"`
	CreatedAt   string   `json:"createdAt"`
	CreatorID   string   `json:"creatorId"`
	CreatorName string   `json:"creatorName"`

	Raw json.RawMessage `json:"-"`
}

RemoteScript is a SentinelOne remote ops script.

func (*RemoteScript) UnmarshalJSON 

func (r *RemoteScript) UnmarshalJSON(b []byte) error

type RemoteScriptEdit added in v0.7.0 

type RemoteScriptEdit struct {
	ScriptName                       string
	ScriptType                       RemoteScriptType
	OSTypes                          []string
	InputRequired                    bool
	InputExample                     string
	InputInstructions                string
	ScriptRuntimeTimeoutSeconds      int
	ScriptContent                    string
	ScriptContentEncoded             bool
	ScriptDescription                string
	ConsoleData                      string
	SendActivity                     *bool
	PackageRemoved                   bool
	PackageMaxSize                   string
	PackageEndpointExpiration        PackageEndpointExpiration
	PackageEndpointExpirationSeconds int
}

RemoteScriptEdit is the full editable definition of a remote script, used to change the script content along with its metadata via the multipart /remote-scripts/edit/{id} endpoint. Content is supplied inline via ScriptContent (set ScriptContentEncoded when it is base64).

type RemoteScriptListParams 

type RemoteScriptListParams struct {
	SiteIDs    []string
	AccountIDs []string
	OSTypes    []string
	Query      string
	Limit      int
	Cursor     string
}

RemoteScriptListParams are query parameters for listing remote scripts.

type RemoteScriptTask added in v0.2.0 

type RemoteScriptTask struct {
	ID                string `json:"id"`
	ParentTaskID      string `json:"parentTaskId"`
	Type              string `json:"type"`
	Description       string `json:"description"`
	Status            string `json:"status"`
	DetailedStatus    string `json:"detailedStatus"`
	AgentComputerName string `json:"agentComputerName"`
	AgentOSType       string `json:"agentOsType"`
	InitiatedBy       string `json:"initiatedBy"`
	AccountName       string `json:"accountName"`
	CreatedAt         string `json:"createdAt"`
	UpdatedAt         string `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

RemoteScriptTask is the status of a single agent's remote script execution.

func (*RemoteScriptTask) UnmarshalJSON added in v0.2.0 

func (t *RemoteScriptTask) UnmarshalJSON(b []byte) error

type RemoteScriptType added in v0.7.0 

type RemoteScriptType string

RemoteScriptType is the category of a remote script. 

const (
	ScriptTypeArtifactCollection RemoteScriptType = "artifactCollection"
	ScriptTypeDataCollection     RemoteScriptType = "dataCollection"
	ScriptTypeAction             RemoteScriptType = "action"
)

type RemoteScriptUpdate added in v0.7.0 

type RemoteScriptUpdate struct {
	ConsoleData  string                 `json:"consoleData,omitempty"`
	Data         RemoteScriptUpdateData `json:"data"`
	SendActivity *bool                  `json:"sendActivity,omitempty"`
}

RemoteScriptUpdate is the body of a metadata update (PUT /remote-scripts/{id}). It changes a script's properties (name, timeout, input requirements) but not its content; use RemoteScriptsEdit to change the script body.

type RemoteScriptUpdateData added in v0.7.0 

type RemoteScriptUpdateData struct {
	ScriptName                       string                    `json:"scriptName"`
	ScriptType                       RemoteScriptType          `json:"scriptType"`
	OSTypes                          []string                  `json:"osTypes"`
	InputRequired                    bool                      `json:"inputRequired"`
	InputExample                     string                    `json:"inputExample"`
	InputInstructions                string                    `json:"inputInstructions"`
	ScriptDescription                string                    `json:"scriptDescription,omitempty"`
	ScriptRuntimeTimeoutSeconds      int                       `json:"scriptRuntimeTimeoutSeconds"`
	PackageEndpointExpiration        PackageEndpointExpiration `json:"packageEndpointExpiration,omitempty"`
	PackageEndpointExpirationSeconds int                       `json:"packageEndpointExpirationSeconds,omitempty"`
}

RemoteScriptUpdateData is the editable metadata of a remote script.

type RemoteScriptsExecuteFilter added in v0.2.0 

type RemoteScriptsExecuteFilter struct {
	IDs        []string `json:"ids,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	AccountIDs []string `json:"accountIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
}

RemoteScriptsExecuteFilter identifies which agents to execute the script on.

type RemoteScriptsExecuteParams added in v0.2.0 

type RemoteScriptsExecuteParams struct {
	ScriptID          string            `json:"scriptId"`
	OutputDestination OutputDestination `json:"outputDestination"`
	TaskDescription   string            `json:"taskDescription"`
	InputParams       string            `json:"inputParams,omitempty"`
	TimeoutSeconds    int               `json:"scriptRuntimeTimeoutSeconds,omitempty"`
}

RemoteScriptsExecuteParams holds parameters for executing a remote script.

type RemoteScriptsExecuteResult added in v0.2.0 

type RemoteScriptsExecuteResult struct {
	Affected           int    `json:"affected"`
	ParentTaskID       string `json:"parentTaskId"`
	Pending            bool   `json:"pending"`
	PendingExecutionID string `json:"pendingExecutionId"`
}

RemoteScriptsExecuteResult is the response from executing a remote script.

type RemoteScriptsPendingParams added in v0.7.0 

type RemoteScriptsPendingParams struct {
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	SortBy     string
	SortOrder  string
	Limit      int
	Cursor     string
}

RemoteScriptsPendingParams are query parameters for listing pending executions.

type RemoteScriptsStatusParams added in v0.2.0 

type RemoteScriptsStatusParams struct {
	ParentTaskID string
	Status       []string
	Limit        int
	Cursor       string
}

RemoteScriptsStatusParams are query parameters for getting remote script task status.

type Report added in v0.4.0 

type Report struct {
	ID              string             `json:"id"`
	Name            string             `json:"name"`
	Scope           ReportScope        `json:"scope"`
	Frequency       ReportFrequency    `json:"frequency"`
	Interval        string             `json:"interval"`
	ScheduleType    ReportScheduleType `json:"scheduleType"`
	CreatorID       string             `json:"creatorId"`
	CreatorName     string             `json:"creatorName"`
	CreatedAt       string             `json:"createdAt"`
	FromDate        string             `json:"fromDate"`
	ToDate          string             `json:"toDate"`
	InsightTypes    json.RawMessage    `json:"insightTypes"`
	AttachmentTypes []string           `json:"attachmentTypes"`
	Status          string             `json:"status"`
	Sites           string             `json:"sites"`

	Raw json.RawMessage `json:"-"`
}

Report is a generated SentinelOne report.

func (*Report) UnmarshalJSON added in v0.4.0 

func (r *Report) UnmarshalJSON(b []byte) error

type ReportFrequency added in v0.4.0 

type ReportFrequency string

ReportFrequency is how often a scheduled report runs. 

const (
	ReportFrequencyManually ReportFrequency = "manually"
	ReportFrequencyWeekly   ReportFrequency = "weekly"
	ReportFrequencyMonthly  ReportFrequency = "monthly"
)

type ReportListParams added in v0.4.0 

type ReportListParams struct {
	SiteIDs      []string
	AccountIDs   []string
	IDs          []string
	Name         string
	Scope        ReportScope
	Frequency    ReportFrequency
	ScheduleType ReportScheduleType
	Query        string
	TaskID       string
	Limit        int
	Cursor       string
	SortBy       string
	SortOrder    string
}

ReportListParams are query parameters for listing reports.

type ReportScheduleType added in v0.4.0 

type ReportScheduleType string

ReportScheduleType distinguishes scheduled reports from one-off runs. 

const (
	ReportScheduleManually  ReportScheduleType = "manually"
	ReportScheduleScheduled ReportScheduleType = "scheduled"
)

type ReportScope added in v0.4.0 

type ReportScope string

ReportScope is the scope a report covers. 

const (
	ReportScopeGroup   ReportScope = "group"
	ReportScopeSite    ReportScope = "site"
	ReportScopeAccount ReportScope = "account"
	ReportScopeTenant  ReportScope = "tenant"
)

type ReportTask added in v0.4.0 

type ReportTask struct {
	ID              string             `json:"id"`
	Name            string             `json:"name"`
	Scope           ReportScope        `json:"scope"`
	Frequency       ReportFrequency    `json:"frequency"`
	Day             string             `json:"day"`
	ScheduleType    ReportScheduleType `json:"scheduleType"`
	CreatorID       string             `json:"creatorId"`
	CreatorName     string             `json:"creatorName"`
	InsightTypes    json.RawMessage    `json:"insightTypes"`
	AttachmentTypes []string           `json:"attachmentTypes"`
	Sites           string             `json:"sites"`
	FromDate        string             `json:"fromDate"`
	ToDate          string             `json:"toDate"`
	Recipients      []string           `json:"recipients"`
	IsTrend         bool               `json:"isTrend"`

	Raw json.RawMessage `json:"-"`
}

ReportTask is a SentinelOne report task or schedule.

func (*ReportTask) UnmarshalJSON added in v0.4.0 

func (t *ReportTask) UnmarshalJSON(b []byte) error

type ReportTaskCreate added in v0.4.0 

type ReportTaskCreate struct {
	Name            string             `json:"name"`
	ScheduleType    ReportScheduleType `json:"scheduleType"`
	InsightTypes    json.RawMessage    `json:"insightTypes"`
	Frequency       ReportFrequency    `json:"frequency,omitempty"`
	Day             string             `json:"day,omitempty"`
	FromDate        string             `json:"fromDate,omitempty"`
	ToDate          string             `json:"toDate,omitempty"`
	AttachmentTypes []string           `json:"attachmentTypes,omitempty"`
	Recipients      []string           `json:"recipients,omitempty"`
	IsTrend         *bool              `json:"isTrend,omitempty"`
}

ReportTaskCreate is the input for creating a report task.

type ReportTaskListParams added in v0.4.0 

type ReportTaskListParams struct {
	SiteIDs      []string
	AccountIDs   []string
	IDs          []string
	Name         string
	Scope        ReportScope
	Frequency    ReportFrequency
	ScheduleType ReportScheduleType
	Query        string
	Limit        int
	Cursor       string
	SortBy       string
	SortOrder    string
}

ReportTaskListParams are query parameters for listing report tasks.

type Role added in v0.7.0 

type Role struct {
	ID             string    `json:"id"`
	Name           string    `json:"name"`
	Description    string    `json:"description"`
	Scope          RoleScope `json:"scope"`
	ScopeID        string    `json:"scopeId"`
	PredefinedRole bool      `json:"predefinedRole"`
	UsersInRoles   int       `json:"usersInRoles"`
	AccountName    string    `json:"accountName"`
	SiteName       string    `json:"siteName"`
	Creator        string    `json:"creator"`
	CreatorID      string    `json:"creatorId"`
	UpdatedBy      string    `json:"updatedBy"`
	UpdatedByID    string    `json:"updatedById"`
	CreatedAt      string    `json:"createdAt"`
	UpdatedAt      string    `json:"updatedAt"`

	// Pages is the nested permission tree returned by get/template (absent on
	// list). It round-trips untyped; writes use RoleData.PermissionIDs instead.
	Pages json.RawMessage `json:"pages,omitempty"`

	Raw json.RawMessage `json:"-"`
}

Role is a SentinelOne RBAC role.

The permission set is modeled two ways by the API, so it is modeled two ways here. Reads (list/get/template) return a deeply nested "pages" tree — each page carries permissions with per-permission booleans and dependency IDs — which is captured verbatim as the Pages raw blob rather than fully typed: the tree is large, and writes never consume it. Writes (create/update) take a flat PermissionIDs slice on RoleData instead. Keeping Pages as json.RawMessage lets a role be pulled and re-serialized faithfully without pinning the SDK to an unstable permission-tree shape.

func (*Role) UnmarshalJSON added in v0.7.0 

func (r *Role) UnmarshalJSON(b []byte) error

type RoleCreate added in v0.7.0 

type RoleCreate struct {
	Data   RoleData        `json:"data"`
	Filter RoleScopeFilter `json:"filter"`
}

RoleCreate is the request body for creating a role. Both data and filter are required: filter names the scope the new role is created in.

type RoleData added in v0.7.0 

type RoleData struct {
	Name          string   `json:"name"`
	Description   string   `json:"description"`
	PermissionIDs []string `json:"permissionIds,omitempty"`
}

RoleData is the declarative payload shared by role create and update: the role name, description, and the flat list of permission IDs it grants. PermissionIDs is omitted from the JSON when empty; whether the API then preserves the role's existing permissions or clears them on update is not documented, so callers that intend to keep permissions must send them.

type RoleListParams added in v0.7.0 

type RoleListParams struct {
	AccountIDs     []string
	SiteIDs        []string
	GroupIDs       []string
	IDs            []string
	Query          string
	Name           string
	PredefinedRole *bool // true: system roles only; false: custom roles only
	Tenant         *bool
	SortBy         string
	SortOrder      string
	Limit          int
	Skip           int
	Cursor         string
}

RoleListParams are query parameters for listing RBAC roles.

type RoleScope added in v0.7.0 

type RoleScope string

RoleScope is the scope level an RBAC role is defined at. 

const (
	RoleScopeGroup   RoleScope = "Group"
	RoleScopeSite    RoleScope = "Site"
	RoleScopeAccount RoleScope = "Account"
	RoleScopeTenant  RoleScope = "Tenant"
)

RBAC role scope levels.

type RoleScopeFilter added in v0.7.0 

type RoleScopeFilter struct {
	AccountIDs []string `json:"accountIds,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	Tenant     bool     `json:"tenant,omitempty"`
}

RoleScopeFilter targets the scope a role write applies to. Set Tenant for the global scope, or one or more of the ID slices for account/site/group scopes.

type RoleUpdate added in v0.7.0 

type RoleUpdate struct {
	Data   RoleData         `json:"data"`
	Filter *RoleScopeFilter `json:"filter,omitempty"`
}

RoleUpdate is the request body for updating a role. Filter is optional (the role is already identified by its ID in the path).

type Rule added in v0.2.0 

type Rule struct {
	ID                string             `json:"id"`
	Name              string             `json:"name"`
	Description       string             `json:"description"`
	Status            RuleStatus         `json:"status"`
	StatusReason      string             `json:"statusReason"`
	Severity          RuleSeverity       `json:"severity"`
	S1QL              string             `json:"s1ql"`
	QueryType         RuleQueryType      `json:"queryType"`
	QueryLang         string             `json:"queryLang"`
	Scope             RuleScope          `json:"scope"`
	ScopeID           []string           `json:"scopeId"`
	ExpirationMode    RuleExpirationMode `json:"expirationMode"`
	Expiration        string             `json:"expiration"`
	Expired           bool               `json:"expired"`
	TreatAsThreat     RuleTreatAsThreat  `json:"treatAsThreat"`
	ActiveResponse    bool               `json:"activeResponse"`
	NetworkQuarantine bool               `json:"networkQuarantine"`
	GeneratedAlerts   int                `json:"generatedAlerts"`
	ReachedLimit      bool               `json:"reachedLimit"`
	Creator           string             `json:"creator"`
	CreatorID         string             `json:"creatorId"`
	AccountID         string             `json:"accountId"`
	AccountName       string             `json:"accountName"`
	SiteID            string             `json:"siteId"`
	SiteName          string             `json:"siteName"`
	CreatedAt         string             `json:"createdAt"`
	UpdatedAt         string             `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

Rule is a SentinelOne custom detection rule (STAR).

func (*Rule) UnmarshalJSON added in v0.2.0 

func (r *Rule) UnmarshalJSON(b []byte) error

type RuleActionFilter added in v0.3.0 

type RuleActionFilter struct {
	IDs        []string `json:"ids,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	AccountIDs []string `json:"accountIds,omitempty"`
}

RuleActionFilter selects which rules to enable or disable.

type RuleCreate added in v0.2.0 

type RuleCreate struct {
	Name              string             `json:"name"`
	Description       string             `json:"description,omitempty"`
	S1QL              string             `json:"s1ql"`
	Severity          RuleSeverity       `json:"severity"`
	Status            RuleStatus         `json:"status"`
	QueryType         RuleQueryType      `json:"queryType"`
	QueryLang         string             `json:"queryLang,omitempty"`
	ExpirationMode    RuleExpirationMode `json:"expirationMode"`
	Expiration        string             `json:"expiration,omitempty"`
	TreatAsThreat     RuleTreatAsThreat  `json:"treatAsThreat"`
	NetworkQuarantine bool               `json:"networkQuarantine"`
}

RuleCreate is the request body for creating or updating a custom detection rule.

type RuleExpirationMode added in v0.2.0 

type RuleExpirationMode string

RuleExpirationMode indicates whether a rule is permanent or temporary. 

const (
	RuleExpirationPermanent RuleExpirationMode = "Permanent"
	RuleExpirationTemporary RuleExpirationMode = "Temporary"
)

type RuleListParams added in v0.2.0 

type RuleListParams struct {
	SiteIDs      []string
	AccountIDs   []string
	GroupIDs     []string
	IDs          []string
	Status       []string
	Severity     []string
	Scopes       []string
	QueryType    []string
	NameContains string
	Query        string
	Limit        int
	Cursor       string
	SortBy       string
	SortOrder    string
}

RuleListParams are query parameters for listing custom detection rules.

type RuleOrder added in v0.4.0 

type RuleOrder struct {
	ID    string `json:"id"`
	Order int    `json:"order"`

	Raw json.RawMessage `json:"-"`
}

RuleOrder specifies a rule's desired position.

func (*RuleOrder) UnmarshalJSON added in v0.4.0 

func (r *RuleOrder) UnmarshalJSON(b []byte) error

type RuleQueryType added in v0.2.0 

type RuleQueryType string

RuleQueryType is the query type of a custom detection rule. 

const (
	RuleQueryTypeEvents        RuleQueryType = "events"
	RuleQueryTypeCorrelation   RuleQueryType = "correlation"
	RuleQueryTypeUEBAFirstSeen RuleQueryType = "uebafirstseen"
	RuleQueryTypeScheduled     RuleQueryType = "scheduled"
)

type RuleScope added in v0.2.0 

type RuleScope string

RuleScope is the scope level of a custom detection rule. 

const (
	RuleScopeGlobal  RuleScope = "global"
	RuleScopeAccount RuleScope = "account"
	RuleScopeSite    RuleScope = "site"
	RuleScopeGroup   RuleScope = "group"
)

type RuleSeverity added in v0.2.0 

type RuleSeverity string

RuleSeverity is the severity level of a custom detection rule. 

const (
	RuleSeverityInfo     RuleSeverity = "Info"
	RuleSeverityLow      RuleSeverity = "Low"
	RuleSeverityMedium   RuleSeverity = "Medium"
	RuleSeverityHigh     RuleSeverity = "High"
	RuleSeverityCritical RuleSeverity = "Critical"
)

type RuleStatus added in v0.2.0 

type RuleStatus string

RuleStatus is the status of a custom detection rule. 

const (
	RuleStatusDraft      RuleStatus = "Draft"
	RuleStatusActivating RuleStatus = "Activating"
	RuleStatusActive     RuleStatus = "Active"
	RuleStatusDisabling  RuleStatus = "Disabling"
	RuleStatusDisabled   RuleStatus = "Disabled"
	RuleStatusDeleted    RuleStatus = "Deleted"
	RuleStatusDeleting   RuleStatus = "Deleting"
)

type RuleTreatAsThreat added in v0.2.0 

type RuleTreatAsThreat string

RuleTreatAsThreat is the auto-response threat classification. 

const (
	RuleTreatUndefined  RuleTreatAsThreat = "UNDEFINED"
	RuleTreatSuspicious RuleTreatAsThreat = "Suspicious"
	RuleTreatMalicious  RuleTreatAsThreat = "Malicious"
)

type SMSSettings added in v0.7.0 

type SMSSettings struct {
	Enabled bool `json:"enabled"`

	Raw json.RawMessage `json:"-"`
}

SMSSettings is the SMS notification service configuration for a site or account. Per the spec the only field the API exposes is the enabled flag.

func (*SMSSettings) UnmarshalJSON added in v0.7.0 

func (s *SMSSettings) UnmarshalJSON(b []byte) error

type SMTPSettings added in v0.4.0 

type SMTPSettings struct {
	Inherits     bool   `json:"inherits"`
	Enabled      bool   `json:"enabled"`
	Host         string `json:"host"`
	Port         int    `json:"port"`
	Encryption   string `json:"encryption"`
	Username     string `json:"username"`
	Password     string `json:"password"`
	NoReplyEmail string `json:"noReplyEmail"`

	Raw json.RawMessage `json:"-"`
}

SMTPSettings is the SMTP mail configuration for a site or account.

func (*SMTPSettings) UnmarshalJSON added in v0.4.0 

func (s *SMTPSettings) UnmarshalJSON(b []byte) error

type SSOServiceProviderCert added in v0.7.0 

type SSOServiceProviderCert struct {
	FileName  string `json:"fileName"`
	PEM       string `json:"pem"`
	IssuedAt  string `json:"issuedAt"`
	ExpiresAt string `json:"expiresAt"`

	Raw json.RawMessage `json:"-"`
}

SSOServiceProviderCert is the SAML service-provider signing certificate. The PEM is public key material (safe to print), not a secret.

func (*SSOServiceProviderCert) UnmarshalJSON added in v0.7.0 

func (s *SSOServiceProviderCert) UnmarshalJSON(b []byte) error

type SSOSettings added in v0.4.0 

type SSOSettings struct {
	Enabled                         bool     `json:"enabled"`
	IDPSsoURL                       string   `json:"idpSsoUrl"`
	IDPEntityID                     string   `json:"idpEntityId"`
	IDPCertName                     string   `json:"idpCertName"`
	SPAcsURL                        string   `json:"spAcsUrl"`
	SPEntityID                      string   `json:"spEntityId"`
	DefaultUserRole                 string   `json:"defaultUserRole"`
	DefaultUserRoleID               string   `json:"defaultUserRoleId"`
	AutoProvisioning                bool     `json:"autoProvisioning"`
	Domains                         []string `json:"domains"`
	SSOPropagateDomainsToChildren   bool     `json:"ssoPropagateDomainsToChildren"`
	SSOInheritDomainsFrom           []string `json:"ssoInheritDomainsFrom"`
	SSOElevatedSessionReauthType    string   `json:"ssoElevatedSessionReauthType"`
	SSOElevatedSessionReauthEnabled bool     `json:"ssoElevatedSessionReauthTypeEnabled"`
	SignRequest                     bool     `json:"signRequest"`

	Raw json.RawMessage `json:"-"`
}

SSOSettings is the SSO configuration for a site or account.

func (*SSOSettings) UnmarshalJSON added in v0.4.0 

func (s *SSOSettings) UnmarshalJSON(b []byte) error

type ScopeInfo added in v0.10.0 

type ScopeInfo struct {
	ScopeID    string     `json:"scopeId"`
	ScopeLevel ScopeLevel `json:"scopeLevel"`
	ScopeName  string     `json:"scopeName"`
	ScopePath  string     `json:"scopePath"`

	Raw json.RawMessage `json:"-"`
}

ScopeInfo identifies the scope where an AD configuration was created.

func (*ScopeInfo) UnmarshalJSON added in v0.10.0 

func (s *ScopeInfo) UnmarshalJSON(b []byte) error

type ScopeLevel added in v0.10.0 

type ScopeLevel string

ScopeLevel is the scope level for an AD configuration. 

const (
	ScopeLevelAccount ScopeLevel = "ACCOUNT"
	ScopeLevelSite    ScopeLevel = "SITE"
	ScopeLevelGroup   ScopeLevel = "GROUP"
)

type ServiceUser added in v0.7.0 

type ServiceUser struct {
	ID             string                 `json:"id"`
	Name           string                 `json:"name"`
	Description    string                 `json:"description"`
	Scope          ServiceUserScope       `json:"scope"`
	ScopeRoles     []ServiceUserScopeRole `json:"scopeRoles"`
	CreatedAt      string                 `json:"createdAt"`
	UpdatedAt      string                 `json:"updatedAt"`
	LastActivation string                 `json:"lastActivation"`
	CreatedBy      ServiceUserRef         `json:"createdBy"`
	UpdatedBy      ServiceUserRef         `json:"updatedBy"`
	APIToken       ServiceUserAPIToken    `json:"apiToken"`

	Raw json.RawMessage `json:"-"`
}

ServiceUser is a SentinelOne service user: a non-interactive identity that authenticates with an API token.

func (*ServiceUser) UnmarshalJSON added in v0.7.0 

func (s *ServiceUser) UnmarshalJSON(b []byte) error

type ServiceUserAPIToken added in v0.7.0 

type ServiceUserAPIToken struct {
	Value     string `json:"value"`
	CreatedAt string `json:"createdAt"`
	ExpiresAt string `json:"expiresAt"`
}

ServiceUserAPIToken holds a service user's API token metadata. Value carries the secret token and is populated only on create; read responses return metadata only (CreatedAt/ExpiresAt).

type ServiceUserCreate added in v0.7.0 

type ServiceUserCreate struct {
	Name           string                      `json:"name"`
	Description    string                      `json:"description,omitempty"`
	ExpirationDate string                      `json:"expirationDate"`
	Scope          ServiceUserScope            `json:"scope"`
	ScopeRoles     []ServiceUserScopeRoleInput `json:"scopeRoles,omitempty"`
}

ServiceUserCreate is the payload for creating a service user. Name, Scope, and ExpirationDate (RFC3339) are required by the API.

type ServiceUserListParams added in v0.7.0 

type ServiceUserListParams struct {
	SiteIDs    []string
	AccountIDs []string
	IDs        []string
	RoleIDs    []string
	Query      string
	Limit      int
	Cursor     string
	SortBy     string
	SortOrder  string
}

ServiceUserListParams are query parameters for listing service users.

type ServiceUserRef added in v0.7.0 

type ServiceUserRef struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

ServiceUserRef is a minimal user reference (creator/updater).

type ServiceUserScope added in v0.7.0 

type ServiceUserScope string

ServiceUserScope is the access scope a service user is bound to. 

const (
	ServiceUserScopeTenant  ServiceUserScope = "tenant"
	ServiceUserScopeAccount ServiceUserScope = "account"
	ServiceUserScopeSite    ServiceUserScope = "site"
)

Service user scopes.

type ServiceUserScopeRole added in v0.7.0 

type ServiceUserScopeRole struct {
	ID          string   `json:"id"`
	RoleID      string   `json:"roleId"`
	RoleName    string   `json:"roleName"`
	Roles       []string `json:"roles"`
	Name        string   `json:"name"`
	AccountName string   `json:"accountName"`
}

ServiceUserScopeRole binds a scope (account/site) to an RBAC role.

type ServiceUserScopeRoleInput added in v0.7.0 

type ServiceUserScopeRoleInput struct {
	ID       string   `json:"id,omitempty"`
	RoleID   string   `json:"roleId,omitempty"`
	RoleName string   `json:"roleName,omitempty"`
	Roles    []string `json:"roles,omitempty"`
}

ServiceUserScopeRoleInput assigns an RBAC role at a scope. ID is required for account/site scopes; tenant (global) roles omit it.

type ServiceUserToken added in v0.7.0 

type ServiceUserToken struct {
	Token     string `json:"token"`
	CreatedAt string `json:"createdAt"`
	ExpiresAt string `json:"expiresAt"`

	Raw json.RawMessage `json:"-"`
}

ServiceUserToken is the result of generating an API token for a service user. Token is the secret and is returned exactly once.

func (*ServiceUserToken) UnmarshalJSON added in v0.7.0 

func (t *ServiceUserToken) UnmarshalJSON(b []byte) error

type ServiceUserUpdate added in v0.7.0 

type ServiceUserUpdate struct {
	Description string                      `json:"description,omitempty"`
	Scope       ServiceUserScope            `json:"scope,omitempty"`
	ScopeRoles  []ServiceUserScopeRoleInput `json:"scopeRoles,omitempty"`
}

ServiceUserUpdate is the payload for updating a service user. All fields are optional; only provided fields change.

type SettingsParams added in v0.4.0 

type SettingsParams struct {
	SiteIDs    []string
	AccountIDs []string
}

SettingsParams are query parameters for settings endpoints.

type SettingsTestResult added in v0.4.0 

type SettingsTestResult struct {
	Status bool `json:"status"`

	Raw json.RawMessage `json:"-"`
}

SettingsTestResult is the response from an SMTP or syslog test.

func (*SettingsTestResult) UnmarshalJSON added in v0.4.0 

func (s *SettingsTestResult) UnmarshalJSON(b []byte) error

type SingularityEventType added in v0.10.0 

type SingularityEventType string

SingularityEventType is the event type for singularity response triggers. 

const (
	SingularityEventAlert            SingularityEventType = "alert"
	SingularityEventIncident         SingularityEventType = "incident"
	SingularityEventMisconfiguration SingularityEventType = "misconfiguration"
	SingularityEventVulnerability    SingularityEventType = "vulnerability"
	SingularityEventActivity         SingularityEventType = "activity"
)

type Site 

type Site struct {
	ID                string `json:"id"`
	Name              string `json:"name"`
	AccountID         string `json:"accountId"`
	AccountName       string `json:"accountName"`
	State             string `json:"state"`
	SiteType          string `json:"siteType"`
	TotalLicenses     int    `json:"totalLicenses"`
	ActiveLicenses    int    `json:"activeLicenses"`
	CreatedAt         string `json:"createdAt"`
	UpdatedAt         string `json:"updatedAt"`
	Expiration        string `json:"expiration"`
	IsDefault         bool   `json:"isDefault"`
	RegistrationToken string `json:"registrationToken"`
	Description       string `json:"description"`
	UnlimitedLicenses bool   `json:"unlimitedLicenses"`

	Raw json.RawMessage `json:"-"`
}

Site is a SentinelOne site.

func (*Site) UnmarshalJSON 

func (s *Site) UnmarshalJSON(b []byte) error

type SiteCreate 

type SiteCreate struct {
	Name              string `json:"name"`
	AccountID         string `json:"accountId"`
	SiteType          string `json:"siteType,omitempty"`
	Description       string `json:"description,omitempty"`
	Expiration        string `json:"expiration,omitempty"`
	UnlimitedLicenses bool   `json:"unlimitedLicenses"`
	TotalLicenses     int    `json:"totalLicenses"`
}

SiteCreate is the request body for creating a site.

type SiteDuplicate added in v0.7.0 

type SiteDuplicate struct {
	Name              string           `json:"name"`
	SourceSiteID      int64            `json:"sourceSiteId"`
	PolicySource      SitePolicySource `json:"policySource"`
	CopyUsers         bool             `json:"copyUsers"`
	UnlimitedLicenses bool             `json:"unlimitedLicenses"`
	TotalLicenses     *int             `json:"totalLicenses,omitempty"`
}

SiteDuplicate is the request body for duplicating a site. Name, SourceSiteID, PolicySource, and CopyUsers are required by the API.

type SiteListParams 

type SiteListParams struct {
	AccountIDs []string
	States     []string
	SiteType   string
	Query      string
	Limit      int
	Cursor     string
	SortBy     string
	SortOrder  string
	CountOnly  bool
}

SiteListParams are query parameters for listing sites.

type SitePolicySource added in v0.7.0 

type SitePolicySource string

SitePolicySource selects the policy origin for a duplicated site. 

const (
	PolicySourceInheritGlobal  SitePolicySource = "inherit_global"
	PolicySourceCopySourceSite SitePolicySource = "copy_source_site"
	PolicySourceCustom         SitePolicySource = "custom"
)

type SiteToken added in v0.7.0 

type SiteToken struct {
	Token             string `json:"token"`
	RegistrationToken string `json:"registrationToken"`

	Raw json.RawMessage `json:"-"`
}

SiteToken carries a site registration token. The GET token endpoint returns it under "token"; regenerate-key returns it under "registrationToken". Both values are sensitive registration material.

func (*SiteToken) UnmarshalJSON added in v0.7.0 

func (t *SiteToken) UnmarshalJSON(b []byte) error

func (*SiteToken) Value added in v0.7.0 

func (t *SiteToken) Value() string

Value returns the registration token regardless of which field the API populated.

type SiteUpdate 

type SiteUpdate struct {
	Name              *string `json:"name,omitempty"`
	Description       *string `json:"description,omitempty"`
	Expiration        *string `json:"expiration,omitempty"`
	UnlimitedLicenses *bool   `json:"unlimitedLicenses,omitempty"`
	TotalLicenses     *int    `json:"totalLicenses,omitempty"`
}

SiteUpdate is the request body for updating a site.

type SyslogSettings added in v0.4.0 

type SyslogSettings struct {
	Enabled           bool   `json:"enabled"`
	Host              string `json:"host"`
	Port              int    `json:"port"`
	SSL               bool   `json:"ssl"`
	Format            string `json:"format"`
	ServerCertName    string `json:"serverCertName"`
	ServerCertContent string `json:"serverCertContent"`
	ClientCertName    string `json:"clientCertName"`
	ClientCertContent string `json:"clientCertContent"`
	ClientKeyName     string `json:"clientKeyName"`
	ClientKeyContent  string `json:"clientKeyContent"`
	Token             string `json:"token"`

	Raw json.RawMessage `json:"-"`
}

SyslogSettings is the syslog forwarding configuration for a site or account.

func (*SyslogSettings) UnmarshalJSON added in v0.4.0 

func (s *SyslogSettings) UnmarshalJSON(b []byte) error

type SystemInfo added in v0.4.0 

type SystemInfo struct {
	Release            string `json:"release"`
	Version            string `json:"version"`
	Build              string `json:"build"`
	Patch              string `json:"patch"`
	LatestAgentVersion string `json:"latestAgentVersion"`

	Raw json.RawMessage `json:"-"`
}

func (*SystemInfo) UnmarshalJSON added in v0.4.0 

func (s *SystemInfo) UnmarshalJSON(b []byte) error

type SystemStatus added in v0.4.0 

type SystemStatus struct {
	Health string `json:"health"`

	Raw json.RawMessage `json:"-"`
}

func (*SystemStatus) UnmarshalJSON added in v0.4.0 

func (s *SystemStatus) UnmarshalJSON(b []byte) error

type Tag 

type Tag struct {
	ID          string `json:"id"`
	Key         string `json:"key"`
	Value       string `json:"value"`
	Description string `json:"description"`
	Scope       string `json:"scope"`
	ScopeID     string `json:"scopeId"`
	CreatedAt   string `json:"createdAt"`
	UpdatedAt   string `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

Tag is a SentinelOne endpoint tag.

func (*Tag) UnmarshalJSON 

func (t *Tag) UnmarshalJSON(b []byte) error

type TagCreate 

type TagCreate struct {
	Key         string `json:"key"`
	Value       string `json:"value"`
	Description string `json:"description,omitempty"`
	Scope       string `json:"scope,omitempty"`
	ScopeID     string `json:"scopeId,omitempty"`
}

TagCreate is the request body for creating a tag.

type TagListParams 

type TagListParams struct {
	Type       string
	SiteIDs    []string
	AccountIDs []string
	Query      string
	Limit      int
	Cursor     string
}

TagListParams are query parameters for listing tags.

type TagRule added in v0.7.0 

type TagRule struct {
	ID             string          `json:"id"`
	Name           string          `json:"name"`
	Description    string          `json:"description"`
	Status         string          `json:"status"`
	SiteID         string          `json:"siteId"`
	AccountID      string          `json:"accountId"`
	MgmtID         string          `json:"mgmtId"`
	Conditions     json.RawMessage `json:"conditions,omitempty"`
	Scopes         json.RawMessage `json:"scopes,omitempty"`
	Tags           json.RawMessage `json:"tags,omitempty"`
	ExcludedAssets json.RawMessage `json:"excludedAssets,omitempty"`
	CreatedByEmail string          `json:"createdByEmail"`
	UpdatedByEmail string          `json:"updatedByEmail"`
	CreatedAt      string          `json:"createdAt"`
	UpdatedAt      string          `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

TagRule is a dynamic asset tag rule: a set of conditions that automatically applies tags to matching XDR inventory assets.

conditions, scopes, tags, and excludedAssets are nested structures captured verbatim as raw blobs rather than fully typed: the condition tree is large and open-ended, and keeping it raw lets a rule round-trip faithfully.

func (*TagRule) UnmarshalJSON added in v0.7.0 

func (t *TagRule) UnmarshalJSON(b []byte) error

type TagRuleListParams added in v0.7.0 

type TagRuleListParams struct {
	Name       string
	Status     string
	TagIDs     []string
	IDs        []string
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	SortBy     string
	SortOrder  string
	Limit      int
	Cursor     string
}

TagRuleListParams are query parameters for listing dynamic tag rules.

type TagRuleWrite added in v0.7.0 

type TagRuleWrite struct {
	ID             string          `json:"id,omitempty"`
	Name           string          `json:"name"`
	Description    string          `json:"description,omitempty"`
	Status         string          `json:"status,omitempty"`
	Conditions     json.RawMessage `json:"conditions,omitempty"`
	Scopes         json.RawMessage `json:"scopes,omitempty"`
	Tags           json.RawMessage `json:"tags,omitempty"`
	ExcludedAssets json.RawMessage `json:"excludedAssets,omitempty"`
}

TagRuleWrite is the request body for creating, updating, or testing a tag rule. name and conditions are required; ID is set on update to identify the rule. The body is sent bare (not wrapped in a data envelope).

type TagUpdate 

type TagUpdate struct {
	Key         *string `json:"key,omitempty"`
	Value       *string `json:"value,omitempty"`
	Description *string `json:"description,omitempty"`
}

TagUpdate is the request body for updating a tag.

type TaskType added in v0.7.0 

type TaskType string

TaskType identifies the task category a maintenance-window / concurrency configuration applies to. 

const (
	TaskTypeAgentsUpgrade       TaskType = "agents_upgrade"
	TaskTypeAgentVersionChange  TaskType = "agent_version_change"
	TaskTypeAutoDeploy          TaskType = "auto_deploy"
	TaskTypeScriptExecution     TaskType = "script_execution"
	TaskTypeCISScan             TaskType = "cis_scan"
	TaskTypeGAD                 TaskType = "gad"
	TaskTypeForensicsCollection TaskType = "forensics_collection"
)

Task types for maintenance-window configuration.

type TasksConfig added in v0.7.0 

type TasksConfig struct {
	InheritParentConcurrencyConfig bool     `json:"inheritParentConcurrencyConfig"`
	InheritParentMaintenanceConfig bool     `json:"inheritParentMaintenanceConfig"`
	MaxConcurrent                  int      `json:"maxConcurrent"`
	ParentMaxConcurrent            int      `json:"parentMaxConcurrent"`
	TimezoneGMT                    string   `json:"timezoneGmt"`
	TaskType                       TaskType `json:"taskType"`
	MaintenanceConfigUpdatedAt     string   `json:"maintenanceConfigUpdatedAt"`
	MaintenanceConfigUpdatedBy     string   `json:"maintenanceConfigUpdatedBy"`
	ConcurrencyConfigUpdatedAt     string   `json:"concurrencyConfigUpdatedAt"`
	ConcurrencyConfigUpdatedBy     string   `json:"concurrencyConfigUpdatedBy"`

	MaintenanceWindowsByDay json.RawMessage `json:"maintenanceWindowsByDay,omitempty"`
	PolicyPayload           json.RawMessage `json:"policyPayload,omitempty"`

	Raw json.RawMessage `json:"-"`
}

TasksConfig is the task configuration of a scope: concurrency limits and the maintenance windows during which the task type may run.

maintenanceWindowsByDay and policyPayload are nested structures captured verbatim as raw blobs. maintenanceWindowsByDay is the classic per-day window map; policyPayload carries the flexible maintenance-window format and is populated only by the flexible endpoints.

func (*TasksConfig) UnmarshalJSON added in v0.7.0 

func (t *TasksConfig) UnmarshalJSON(b []byte) error

type TasksConfigData added in v0.7.0 

type TasksConfigData struct {
	InheritParentConcurrencyConfig bool            `json:"inheritParentConcurrencyConfig"`
	InheritParentMaintenanceConfig bool            `json:"inheritParentMaintenanceConfig"`
	MaxConcurrent                  int             `json:"maxConcurrent"`
	TimezoneGMT                    string          `json:"timezoneGmt"`
	MaintenanceWindowsByDay        json.RawMessage `json:"maintenanceWindowsByDay,omitempty"`
}

TasksConfigData is the declarative concurrency + maintenance-window payload of a task configuration write.

type TasksConfigFilter added in v0.7.0 

type TasksConfigFilter struct {
	TaskType   TaskType `json:"taskType"`
	AccountIDs []string `json:"accountIds,omitempty"`
	SiteIDs    []string `json:"siteIds,omitempty"`
	GroupIDs   []string `json:"groupIds,omitempty"`
	Tenant     bool     `json:"tenant,omitempty"`
}

TasksConfigFilter targets the scope and task type a configuration write applies to. TaskType is required.

type TasksConfigParams added in v0.7.0 

type TasksConfigParams struct {
	TaskType   TaskType
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	Tenant     bool
}

TasksConfigParams selects the scope and task type of a task configuration. TaskType is required by the API.

type TasksConfigWrite added in v0.7.0 

type TasksConfigWrite struct {
	Data   TasksConfigData   `json:"data"`
	Filter TasksConfigFilter `json:"filter"`
}

TasksConfigWrite is the request body for updating a task configuration.

type TenantStatus added in v0.4.0 

type TenantStatus struct {
	TenantID        string `json:"tenantId"`
	TotalJobs       int    `json:"totalJobs"`
	CompletedJobs   int    `json:"completedJobs"`
	TenantCompleted bool   `json:"tenantCompletedStatus"`

	Raw json.RawMessage `json:"-"`
}

TenantStatus is the assessment status for an Azure tenant.

func (*TenantStatus) UnmarshalJSON added in v0.4.0 

func (t *TenantStatus) UnmarshalJSON(b []byte) error

type Threat 

type Threat struct {
	ID                   string `json:"-"`
	AgentID              string `json:"-"`
	AgentComputerName    string `json:"-"`
	Classification       string `json:"-"`
	ClassificationSource string `json:"-"`
	ConfidenceLevel      string `json:"-"`
	ThreatName           string `json:"-"`
	FilePath             string `json:"-"`
	MitigationStatus     string `json:"-"`
	AnalystVerdict       string `json:"-"`
	IncidentStatus       string `json:"-"`
	CreatedAt            string `json:"-"`
	UpdatedAt            string `json:"-"`

	Raw json.RawMessage `json:"-"`
}

Threat is a SentinelOne threat. The API returns nested objects (threatInfo, agentRealtimeInfo); fields are flattened here via a custom UnmarshalJSON.

func (Threat) MarshalJSON 

func (t Threat) MarshalJSON() ([]byte, error)

func (*Threat) UnmarshalJSON 

func (t *Threat) UnmarshalJSON(b []byte) error

type ThreatAlert added in v0.7.0 

type ThreatAlert struct {
	AgentID   string `json:"agentId"`
	Storyline string `json:"storyline"`
}

ThreatAlert identifies a Deep Visibility alert to mark as a threat and mitigate. Both AgentID and Storyline are required by the API.

type ThreatExclusionMode added in v0.7.0 

type ThreatExclusionMode string

ThreatExclusionMode is the exclusion mode (path exclusions only). 

const (
	ThreatExclusionModeSuppress                 ThreatExclusionMode = "suppress"
	ThreatExclusionModeSuppressDynamicOnly      ThreatExclusionMode = "suppress_dynamic_only"
	ThreatExclusionModeSuppressDFIOnly          ThreatExclusionMode = "suppress_dfi_only"
	ThreatExclusionModeDisableInProcMonitor     ThreatExclusionMode = "disable_in_process_monitor"
	ThreatExclusionModeDisableInProcMonitorDeep ThreatExclusionMode = "disable_in_process_monitor_deep"
	ThreatExclusionModeDisableAllMonitors       ThreatExclusionMode = "disable_all_monitors"
	ThreatExclusionModeDisableAllMonitorsDeep   ThreatExclusionMode = "disable_all_monitors_deep"
	ThreatExclusionModeSuppressAppControl       ThreatExclusionMode = "suppress_app_control"
	ThreatExclusionModeSuppressDriftDetection   ThreatExclusionMode = "suppress_drift_detection"
)

type ThreatExclusionOptions added in v0.7.0 

type ThreatExclusionOptions struct {
	TargetScope       ThreatExclusionScope `json:"targetScope"`
	Type              ThreatExclusionType  `json:"type"`
	Value             string               `json:"value,omitempty"`
	Description       string               `json:"description,omitempty"`
	Mode              ThreatExclusionMode  `json:"mode,omitempty"`
	PathExclusionType string               `json:"pathExclusionType,omitempty"`
	Note              string               `json:"note,omitempty"`
	ExternalTicketID  string               `json:"externalTicketId,omitempty"`
	Actions           []string             `json:"actions,omitempty"`
}

ThreatExclusionOptions configure how a threat is added to exclusions. TargetScope and Type are required; Value defaults to the relevant value from the threat when omitted.

type ThreatExclusionScope added in v0.7.0 

type ThreatExclusionScope string

ThreatExclusionScope is the scope in which an exclusion is created. 

const (
	ThreatExclusionScopeGroup   ThreatExclusionScope = "group"
	ThreatExclusionScopeSite    ThreatExclusionScope = "site"
	ThreatExclusionScopeAccount ThreatExclusionScope = "account"
	ThreatExclusionScopeTenant  ThreatExclusionScope = "tenant"
)

type ThreatExclusionType added in v0.7.0 

type ThreatExclusionType string

ThreatExclusionType is the exclusion type created from a threat. 

const (
	ThreatExclusionTypeHash        ThreatExclusionType = "hash"
	ThreatExclusionTypePath        ThreatExclusionType = "path"
	ThreatExclusionTypeCertificate ThreatExclusionType = "certificate"
	ThreatExclusionTypeBrowser     ThreatExclusionType = "browser"
	ThreatExclusionTypeFileType    ThreatExclusionType = "file_type"
)

type ThreatIntelConfig added in v0.4.0 

type ThreatIntelConfig struct {
	ScopeID             string   `json:"scopeId"`
	ScopeLevel          IOCScope `json:"scopeLevel"`
	Description         string   `json:"description"`
	ThreatMinScore      int      `json:"threatMinScore"`
	ThreatExcludeFields []string `json:"threatExcludeFields"`
	ExcludeTII          []string `json:"excludeTii"`
	DisableRH           bool     `json:"disableRh"`
	DisableThreat       bool     `json:"disableThreat"`
	EnableXDRMatching   bool     `json:"enableXdrMatching"`
	CreatedAt           string   `json:"createdAt"`
	UpdatedAt           string   `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

ThreatIntelConfig is a threat intelligence user configuration entry.

func (*ThreatIntelConfig) UnmarshalJSON added in v0.4.0 

func (c *ThreatIntelConfig) UnmarshalJSON(b []byte) error

type ThreatListParams 

type ThreatListParams struct {
	SiteIDs            []string
	AccountIDs         []string
	GroupIDs           []string
	AgentIDs           []string
	Classifications    []string
	MitigationStatuses []string
	AnalystVerdicts    []string
	IncidentStatuses   []string
	ConfidenceLevels   []string
	Query              string
	Limit              int
	Cursor             string
	SortBy             string
	SortOrder          string
	CountOnly          bool
}

ThreatListParams are query parameters for listing threats.

type ThreatMitigationAction added in v0.7.0 

type ThreatMitigationAction string

ThreatMitigationAction is a mitigation action applied to threats or alerts. 

const (
	ThreatMitigationKill                ThreatMitigationAction = "kill"
	ThreatMitigationRemediate           ThreatMitigationAction = "remediate"
	ThreatMitigationRollbackRemediation ThreatMitigationAction = "rollback-remediation"
	ThreatMitigationQuarantine          ThreatMitigationAction = "quarantine"
	ThreatMitigationUnQuarantine        ThreatMitigationAction = "un-quarantine"
	ThreatMitigationRemoveMacros        ThreatMitigationAction = "remove_macros"
	ThreatMitigationRestoreMacros       ThreatMitigationAction = "restore_macros"
)

type ThreatNote added in v0.2.0 

type ThreatNote struct {
	ID        string `json:"id"`
	Text      string `json:"text"`
	Creator   string `json:"creator"`
	CreatorID string `json:"creatorId"`
	CreatedAt string `json:"createdAt"`
	UpdatedAt string `json:"updatedAt"`
	Edited    bool   `json:"edited"`

	Raw json.RawMessage `json:"-"`
}

ThreatNote is a note attached to a threat.

func (ThreatNote) MarshalJSON added in v0.2.0 

func (n ThreatNote) MarshalJSON() ([]byte, error)

func (*ThreatNote) UnmarshalJSON added in v0.2.0 

func (n *ThreatNote) UnmarshalJSON(b []byte) error

type ThreatNotesListParams added in v0.2.0 

type ThreatNotesListParams struct {
	Limit     int
	Cursor    string
	SortBy    string
	SortOrder string
}

ThreatNotesListParams are query parameters for listing threat notes.

type ThreatTimelineEntry added in v0.4.0 

type ThreatTimelineEntry struct {
	ID                   string          `json:"id"`
	ActivityType         int             `json:"activityType"`
	PrimaryDescription   string          `json:"primaryDescription"`
	SecondaryDescription string          `json:"secondaryDescription"`
	Data                 json.RawMessage `json:"data"`
	AccountID            string          `json:"accountId"`
	SiteID               string          `json:"siteId"`
	GroupID              string          `json:"groupId"`
	AgentID              string          `json:"agentId"`
	ThreatID             string          `json:"threatId"`
	UserID               string          `json:"userId"`
	Hash                 string          `json:"hash"`
	OSFamily             string          `json:"osFamily"`
	CreatedAt            string          `json:"createdAt"`
	UpdatedAt            string          `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

func (ThreatTimelineEntry) MarshalJSON added in v0.4.0 

func (e ThreatTimelineEntry) MarshalJSON() ([]byte, error)

func (*ThreatTimelineEntry) UnmarshalJSON added in v0.4.0 

func (e *ThreatTimelineEntry) UnmarshalJSON(b []byte) error

type ThreatTimelineParams added in v0.4.0 

type ThreatTimelineParams struct {
	ActivityTypes []int
	Query         string
	Limit         int
	Cursor        string
	SortBy        string
	SortOrder     string
}

type TimeZoneInfo added in v0.10.0 

type TimeZoneInfo struct {
	TimeZoneID  string `json:"timeZoneId"`
	DisplayName string `json:"displayName"`

	Raw json.RawMessage `json:"-"`
}

TimeZoneInfo is a timezone pair returned by the timezones endpoint.

func (*TimeZoneInfo) UnmarshalJSON added in v0.10.0 

func (t *TimeZoneInfo) UnmarshalJSON(b []byte) error

type TriggerType added in v0.10.0 

type TriggerType string

TriggerType is the type of workflow trigger. 

const (
	TriggerHTTP                TriggerType = "http_trigger"
	TriggerScheduled           TriggerType = "scheduled_trigger"
	TriggerEmail               TriggerType = "email_trigger"
	TriggerManual              TriggerType = "manual_trigger"
	TriggerSingularityResponse TriggerType = "singularity_response_trigger"
	TriggerSnippet             TriggerType = "snippet_trigger"
)

type UnifiedExclusion added in v0.4.0 

type UnifiedExclusion struct {
	ID                string          `json:"id"`
	ExclusionName     string          `json:"exclusionName"`
	OSType            string          `json:"osType"`
	ThreatType        string          `json:"threatType"`
	ModeType          string          `json:"modeType"`
	InteractionLevel  string          `json:"interactionLevel"`
	Description       string          `json:"description"`
	Reason            string          `json:"reason"`
	Source            string          `json:"source"`
	Type              string          `json:"type"`
	Value             any             `json:"value"`
	PathExclusionType string          `json:"pathExclusionType"`
	Engines           string          `json:"engines"`
	ChildProcess      bool            `json:"childProcess"`
	Recommendation    string          `json:"recommendation"`
	Scope             json.RawMessage `json:"scope"`
	ScopeName         string          `json:"scopeName"`
	ScopePath         string          `json:"scopePath"`
	UserName          string          `json:"userName"`
	CreatorName       string          `json:"creatorName"`
	NotRecommended    string          `json:"notRecommended"`
	InAppInventory    bool            `json:"inAppInventory"`
	Imported          bool            `json:"imported"`
	LastHit           string          `json:"lastHit"`
	Hits30d           int             `json:"hits30d"`
	Hits90d           int             `json:"hits90d"`
	HitsAllTime       int             `json:"hitsAllTime"`
	CreatedAt         string          `json:"createdAt"`
	UpdatedAt         string          `json:"updatedAt"`
	Raw               json.RawMessage `json:"-"`
}

UnifiedExclusion is a SentinelOne unified exclusion entry.

func (*UnifiedExclusion) UnmarshalJSON added in v0.4.0 

func (u *UnifiedExclusion) UnmarshalJSON(b []byte) error

type UnifiedExclusionCreate added in v0.4.0 

type UnifiedExclusionCreate struct {
	ExclusionName     string                           `json:"exclusionName"`
	OSType            UnifiedExclusionOSType           `json:"osType"`
	ThreatType        UnifiedExclusionThreatType       `json:"threatType"`
	ModeType          UnifiedExclusionModeType         `json:"modeType"`
	Reason            string                           `json:"reason"`
	Type              UnifiedExclusionType             `json:"type,omitempty"`
	Description       string                           `json:"description,omitempty"`
	InteractionLevel  UnifiedExclusionInteractionLevel `json:"interactionLevel,omitempty"`
	Source            UnifiedExclusionSource           `json:"source,omitempty"`
	Value             any                              `json:"value,omitempty"`
	PathExclusionType UnifiedExclusionPathType         `json:"pathExclusionType,omitempty"`
	Engines           string                           `json:"engines,omitempty"`
	ChildProcess      *bool                            `json:"childProcess,omitempty"`
	Actions           []string                         `json:"actions,omitempty"`
	TagIDs            []string                         `json:"tagIds,omitempty"`
}

UnifiedExclusionCreate is the request body for creating a unified exclusion.

type UnifiedExclusionInteractionLevel added in v0.4.0 

type UnifiedExclusionInteractionLevel string

UnifiedExclusionInteractionLevel is the interaction between a unified exclusion and the agent processes. 

const (
	UnifiedExclusionInteractionDisableInProcessMonitor UnifiedExclusionInteractionLevel = "disable_in_process_monitor"
	UnifiedExclusionInteractionDisableAllMonitors      UnifiedExclusionInteractionLevel = "disable_all_monitors"
	UnifiedExclusionInteractionIdentityOnly            UnifiedExclusionInteractionLevel = "identity_only"
)

type UnifiedExclusionListParams added in v0.4.0 

type UnifiedExclusionListParams struct {
	AccountIDs       []string
	SiteIDs          []string
	GroupIDs         []string
	IDs              []string
	OSTypes          []string
	Source           []string
	ModeType         []string
	ThreatType       []string
	Engines          []string
	InteractionLevel []string
	Conditions       []string
	NameContains     []string
	ValueContains    []string
	IncludeParents   *bool
	IncludeChildren  *bool
	Imported         *bool
	Tenant           *bool
	Limit            int
	Cursor           string
	SortBy           string
	SortOrder        string
	CountOnly        bool
}

UnifiedExclusionListParams are query parameters for listing unified exclusions.

type UnifiedExclusionModeType added in v0.4.0 

type UnifiedExclusionModeType string

UnifiedExclusionModeType is the mode of a unified exclusion. 

const (
	UnifiedExclusionModeAll                   UnifiedExclusionModeType = "all"
	UnifiedExclusionModeSuppression           UnifiedExclusionModeType = "suppression"
	UnifiedExclusionModeAgentInteroperability UnifiedExclusionModeType = "agent_interoperability"
	UnifiedExclusionModeBinaryVault           UnifiedExclusionModeType = "binary_vault"
)

type UnifiedExclusionOSType added in v0.4.0 

type UnifiedExclusionOSType string

UnifiedExclusionOSType is the OS a unified exclusion applies to. 

const (
	UnifiedExclusionOSLinux         UnifiedExclusionOSType = "linux"
	UnifiedExclusionOSMacOS         UnifiedExclusionOSType = "macos"
	UnifiedExclusionOSWindows       UnifiedExclusionOSType = "windows"
	UnifiedExclusionOSWindowsLegacy UnifiedExclusionOSType = "windows_legacy"
)

type UnifiedExclusionPathType added in v0.4.0 

type UnifiedExclusionPathType string

UnifiedExclusionPathType is the path match mode for path exclusions. 

const (
	UnifiedExclusionPathFile       UnifiedExclusionPathType = "file"
	UnifiedExclusionPathFolder     UnifiedExclusionPathType = "folder"
	UnifiedExclusionPathSubfolders UnifiedExclusionPathType = "subfolders"
)

type UnifiedExclusionScope added in v0.4.0 

type UnifiedExclusionScope struct {
	ScopeLevel   UnifiedExclusionScopeLevel `json:"scopeLevel"`
	ScopeLevelID *int64                     `json:"scopeLevelId,omitempty"`
}

UnifiedExclusionScope defines the scope for a unified exclusion operation.

type UnifiedExclusionScopeLevel added in v0.4.0 

type UnifiedExclusionScopeLevel string

UnifiedExclusionScopeLevel is the scope level of a unified exclusion. 

const (
	UnifiedExclusionScopeGroup   UnifiedExclusionScopeLevel = "group"
	UnifiedExclusionScopeSite    UnifiedExclusionScopeLevel = "site"
	UnifiedExclusionScopeAccount UnifiedExclusionScopeLevel = "account"
	UnifiedExclusionScopeTenant  UnifiedExclusionScopeLevel = "tenant"
)

type UnifiedExclusionSource added in v0.4.0 

type UnifiedExclusionSource string

UnifiedExclusionSource is the source of creation of a unified exclusion. 

const (
	UnifiedExclusionSourceUser               UnifiedExclusionSource = "user"
	UnifiedExclusionSourceActionFromThreat   UnifiedExclusionSource = "action_from_threat"
	UnifiedExclusionSourceCatalog            UnifiedExclusionSource = "catalog"
	UnifiedExclusionSourcePerformanceInsight UnifiedExclusionSource = "performance_insight"
)

type UnifiedExclusionThreatType added in v0.4.0 

type UnifiedExclusionThreatType string

UnifiedExclusionThreatType is the threat type a unified exclusion targets. 

const (
	UnifiedExclusionThreatEDR UnifiedExclusionThreatType = "EDR"
	UnifiedExclusionThreatIDR UnifiedExclusionThreatType = "IDR"
)

type UnifiedExclusionType added in v0.4.0 

type UnifiedExclusionType string

UnifiedExclusionType is the condition type of a unified exclusion. 

const (
	UnifiedExclusionTypePath            UnifiedExclusionType = "path"
	UnifiedExclusionTypeCertificate     UnifiedExclusionType = "certificate"
	UnifiedExclusionTypeBrowser         UnifiedExclusionType = "browser"
	UnifiedExclusionTypeFileType        UnifiedExclusionType = "file_type"
	UnifiedExclusionTypeWhiteHash       UnifiedExclusionType = "white_hash"
	UnifiedExclusionTypeCommandline     UnifiedExclusionType = "commandline"
	UnifiedExclusionTypeContainerNative UnifiedExclusionType = "container_native"
)

type UninstallPassword added in v0.7.0 

type UninstallPassword struct {
	Password string `json:"password"`

	Raw json.RawMessage `json:"-"`
}

UninstallPassword is the agent uninstall password for an account. The password value is sensitive secret material.

func (*UninstallPassword) UnmarshalJSON added in v0.7.0 

func (p *UninstallPassword) UnmarshalJSON(b []byte) error

type UninstallPasswordMeta added in v0.7.0 

type UninstallPasswordMeta struct {
	Expiration      string `json:"expiration"`
	Version         int    `json:"version"`
	CreatedAt       string `json:"createdAt"`
	LastRevoked     string `json:"lastRevoked"`
	RevokedByID     int    `json:"revokedById"`
	RevokedByName   string `json:"revokedByName"`
	GeneratedByID   int    `json:"generatedById"`
	GeneratedByName string `json:"generatedByName"`

	Raw json.RawMessage `json:"-"`
}

UninstallPasswordMeta describes an account's uninstall password without exposing the secret itself.

func (*UninstallPasswordMeta) UnmarshalJSON added in v0.7.0 

func (m *UninstallPasswordMeta) UnmarshalJSON(b []byte) error

type UpdateListParams 

type UpdateListParams struct {
	SiteIDs    []string
	AccountIDs []string
	OSTypes    []string
	Status     string
	Query      string
	Limit      int
	Cursor     string
}

UpdateListParams are query parameters for listing update packages.

type UpdatePackage 

type UpdatePackage struct {
	ID        string `json:"id"`
	FileName  string `json:"fileName"`
	Version   string `json:"version"`
	OSType    string `json:"osType"`
	Status    string `json:"status"`
	FileSize  int64  `json:"fileSize"`
	ScopeID   string `json:"scopeId"`
	ScopeName string `json:"scopeName"`
	CreatedAt string `json:"createdAt"`

	Raw json.RawMessage `json:"-"`
}

UpdatePackage is a SentinelOne agent update package.

func (*UpdatePackage) UnmarshalJSON 

func (u *UpdatePackage) UnmarshalJSON(b []byte) error

type UpdateSoftwareData added in v0.4.0 

type UpdateSoftwareData struct {
	PackageID       string `json:"packageId,omitempty"`
	FileName        string `json:"fileName,omitempty"`
	Path            string `json:"path,omitempty"`
	OSType          string `json:"osType,omitempty"`
	PackageType     string `json:"packageType,omitempty"`
	IsScheduled     *bool  `json:"isScheduled,omitempty"`
	AllowDowngrade  *bool  `json:"allowDowngrade,omitempty"`
	IgnoreConflicts *bool  `json:"ignoreConflicts,omitempty"`
}

UpdateSoftwareData specifies which package to use for an agent software update. Exactly one of PackageID, FileName, or Path must be set.

type UpgradePackage added in v0.4.0 

type UpgradePackage struct {
	Build       string               `json:"build"`
	Major       string               `json:"major"`
	Minor       string               `json:"minor"`
	DisplayName string               `json:"displayName"`
	FileNames   []UpgradePackageFile `json:"fileNames"`

	Raw json.RawMessage `json:"-"`
}

UpgradePackage is an available agent package for upgrade policies.

func (*UpgradePackage) UnmarshalJSON added in v0.4.0 

func (u *UpgradePackage) UnmarshalJSON(b []byte) error

type UpgradePackageFile added in v0.4.0 

type UpgradePackageFile struct {
	ID   string `json:"id"`
	Name string `json:"name"`

	Raw json.RawMessage `json:"-"`
}

UpgradePackageFile identifies a downloadable package file.

func (*UpgradePackageFile) UnmarshalJSON added in v0.4.0 

func (u *UpgradePackageFile) UnmarshalJSON(b []byte) error

type UpgradePackageListParams added in v0.4.0 

type UpgradePackageListParams struct {
	ScopeLevel          string // required: account, group, site, tenant
	ScopeID             string
	OSType              string // required: linux, macos, windows
	DisplayNameContains string
}

UpgradePackageListParams are query parameters for listing available upgrade packages.

type UpgradePolicy added in v0.4.0 

type UpgradePolicy struct {
	ID           string           `json:"id"`
	Name         string           `json:"name"`
	Description  string           `json:"description"`
	OSType       string           `json:"osType"`
	ScopeLevel   string           `json:"scopeLevel"`
	ScopeID      string           `json:"scopeId"`
	IsActive     bool             `json:"isActive"`
	IsScheduled  bool             `json:"isScheduled"`
	AllEndpoints bool             `json:"allEndpoints"`
	MaxRetries   int              `json:"maxRetries"`
	Priority     int              `json:"priority"`
	Package      UpgradePolicyPkg `json:"package"`
	Tags         []string         `json:"tags"`
	ActivatedAt  string           `json:"activatedAt"`
	CreatedAt    string           `json:"createdAt"`
	UpdatedAt    string           `json:"updatedAt"`

	Raw json.RawMessage `json:"-"`
}

UpgradePolicy is a SentinelOne agent auto-upgrade policy.

func (*UpgradePolicy) UnmarshalJSON added in v0.4.0 

func (u *UpgradePolicy) UnmarshalJSON(b []byte) error

type UpgradePolicyCreate added in v0.4.0 

type UpgradePolicyCreate struct {
	Name         string                  `json:"name"`
	Description  string                  `json:"description,omitempty"`
	OSType       UpgradePolicyOSType     `json:"osType"`
	ScopeLevel   UpgradePolicyScopeLevel `json:"scopeLevel"`
	ScopeID      string                  `json:"scopeId,omitempty"`
	IsActive     bool                    `json:"isActive"`
	IsScheduled  bool                    `json:"isScheduled"`
	AllEndpoints bool                    `json:"allEndpoints"`
	MaxRetries   int                     `json:"maxRetries"`
	Package      UpgradePolicyPkg        `json:"package"`
	Tags         []string                `json:"tags,omitempty"`
}

UpgradePolicyCreate is the request body for creating an upgrade policy.

type UpgradePolicyListParams added in v0.4.0 

type UpgradePolicyListParams struct {
	ScopeLevel string // required: account, group, site, tenant
	ScopeID    string
	OSType     string // required: linux, macos, windows
	Limit      int    // required
	Skip       int
	SortBy     string // required (e.g. priority)
	SortOrder  string // required (asc, desc)
}

UpgradePolicyListParams are query parameters for listing upgrade policies.

type UpgradePolicyOSType added in v0.4.0 

type UpgradePolicyOSType string

UpgradePolicyOSType is the OS targeted by an upgrade policy. 

const (
	UpgradePolicyOSLinux   UpgradePolicyOSType = "linux"
	UpgradePolicyOSMacOS   UpgradePolicyOSType = "macos"
	UpgradePolicyOSWindows UpgradePolicyOSType = "windows"
)

type UpgradePolicyPkg added in v0.4.0 

type UpgradePolicyPkg struct {
	Build  string `json:"build"`
	FileID string `json:"fileId"`
	Major  string `json:"major"`
	Minor  string `json:"minor"`

	Raw json.RawMessage `json:"-"`
}

UpgradePolicyPkg identifies the agent package targeted by an upgrade policy.

func (*UpgradePolicyPkg) UnmarshalJSON added in v0.4.0 

func (u *UpgradePolicyPkg) UnmarshalJSON(b []byte) error

type UpgradePolicyScopeLevel added in v0.4.0 

type UpgradePolicyScopeLevel string

UpgradePolicyScopeLevel is the scope level of an upgrade policy. 

const (
	UpgradePolicyScopeAccount UpgradePolicyScopeLevel = "account"
	UpgradePolicyScopeGroup   UpgradePolicyScopeLevel = "group"
	UpgradePolicyScopeSite    UpgradePolicyScopeLevel = "site"
	UpgradePolicyScopeTenant  UpgradePolicyScopeLevel = "tenant"
)

type UploadLimits added in v0.7.0 

type UploadLimits struct {
	Raw json.RawMessage
}

UploadLimits holds the package upload limits for remote scripts. The API response shape is not fixed by the spec, so the data object is preserved as raw JSON.

func (UploadLimits) MarshalJSON added in v0.7.0 

func (u UploadLimits) MarshalJSON() ([]byte, error)

MarshalJSON emits the preserved upload-limits data object.

type User 

type User struct {
	ID         string `json:"id"`
	Email      string `json:"email"`
	FullName   string `json:"fullName"`
	Scope      string `json:"scope"`
	ScopeRoles []struct {
		ID   string `json:"id"`
		Name string `json:"name"`
	} `json:"scopeRoles"`
	Source       string `json:"source"`
	TwoFaEnabled bool   `json:"twoFaEnabled"`
	DateJoined   string `json:"dateJoined"`
	LastLogin    string `json:"lastLogin"`

	Raw json.RawMessage `json:"-"`
}

User is a SentinelOne user.

func (*User) UnmarshalJSON 

func (u *User) UnmarshalJSON(b []byte) error

type UserListParams 

type UserListParams struct {
	SiteIDs    []string
	AccountIDs []string
	Query      string
	Limit      int
	Cursor     string
	SortBy     string
	SortOrder  string
}

UserListParams are query parameters for listing users.

type UserTokenDetails added in v0.7.0 

type UserTokenDetails struct {
	CreatedAt string `json:"createdAt"`
	ExpiresAt string `json:"expiresAt"`
	Token     string `json:"token"`

	Raw json.RawMessage `json:"-"`
}

UserTokenDetails is API-token metadata. The endpoints return only timestamps; Token is defensive — if the API ever echoes the secret it is captured here so callers can redact it rather than print it.

func (*UserTokenDetails) UnmarshalJSON added in v0.7.0 

func (d *UserTokenDetails) UnmarshalJSON(b []byte) error

type UserUpdate added in v0.7.0 

type UserUpdate struct {
	FullName            string `json:"fullName,omitempty"`
	Email               string `json:"email,omitempty"`
	Scope               string `json:"scope,omitempty"`
	CanGenerateAPIToken *bool  `json:"canGenerateApiToken,omitempty"`
	AllowRemoteShell    *bool  `json:"allowRemoteShell,omitempty"`
}

UserUpdate is the payload for updating a user. All fields are optional; only provided fields change. Pointer fields distinguish "unset" from "false".

type WhiteningOptions added in v0.7.0 

type WhiteningOptions struct {
	WhiteningOptions []string `json:"whiteningOptions"`
	ThreatType       []string `json:"threatType"`
	ThreatPolicy     string   `json:"threatPolicy"`

	Raw json.RawMessage `json:"-"`
}

WhiteningOptions describes the exclusion ("whitening") options available for a threat.

func (WhiteningOptions) MarshalJSON added in v0.7.0 

func (o WhiteningOptions) MarshalJSON() ([]byte, error)

func (*WhiteningOptions) UnmarshalJSON added in v0.7.0 

func (o *WhiteningOptions) UnmarshalJSON(b []byte) error

type WindowsAgent added in v0.10.0 

type WindowsAgent struct {
	ID           int    `json:"id"`
	MgmtID       int    `json:"mgmtId"`
	UUID         string `json:"uuid"`
	OSName       string `json:"osName"`
	IPAddress    string `json:"ipAddress"`
	AgentVersion string `json:"agentVersion"`
	AgentType    string `json:"agentType"`
	DomainName   string `json:"domainName"`
	Status       string `json:"status"`
	HostName     string `json:"hostName"`
	ScopePath    string `json:"scopePath"`

	Raw json.RawMessage `json:"-"`
}

WindowsAgent is a Windows unified agent returned by the connector endpoints.

func (*WindowsAgent) UnmarshalJSON added in v0.10.0 

func (w *WindowsAgent) UnmarshalJSON(b []byte) error

type WindowsAgentParams added in v0.10.0 

type WindowsAgentParams struct {
	SiteIDs     string
	AccountIDs  string
	FilterInput string
	RequestID   string
}

WindowsAgentParams are query parameters for listing Windows unified agents.

type Workflow added in v0.10.0 

type Workflow struct {
	ID                 string                 `json:"id"`
	VersionID          string                 `json:"version_id"`
	Name               string                 `json:"name"`
	Description        string                 `json:"description"`
	State              WorkflowState          `json:"state"`
	LifecycleState     WorkflowLifecycleState `json:"lifecycle_state"`
	Status             WorkflowStatus         `json:"status"`
	ScopeID            string                 `json:"scope_id"`
	ScopeLevel         AutomationScopeLevel   `json:"scope_level"`
	MgmtID             string                 `json:"mgmt_id"`
	CreatedAt          string                 `json:"created_at"`
	UpdatedAt          string                 `json:"updated_at"`
	ActivatedAt        string                 `json:"activated_at"`
	CreatedBy          string                 `json:"created_by"`
	UpdatedBy          string                 `json:"updated_by"`
	CreatedByUser      *WorkflowUser          `json:"created_by_user"`
	UpdatedByUser      *WorkflowUser          `json:"updated_by_user"`
	Tags               []string               `json:"tags"`
	SiteName           string                 `json:"site_name"`
	AccountName        string                 `json:"account_name"`
	ParentScopeID      string                 `json:"parent_scope_id"`
	SiteState          string                 `json:"site_state"`
	AccountState       string                 `json:"account_state"`
	VersionDescription string                 `json:"version_description"`
	VersionCount       int                    `json:"version_count"`
	Timeout            int                    `json:"timeout"`
	DailyMaxExecutions int                    `json:"daily_max_executions"`
	MaxConcurrency     int                    `json:"max_concurrency"`
	NotifyTo           []string               `json:"notify_to"`
	TimeSaved          int                    `json:"time_saved"`
	TimeSavedUnit      string                 `json:"time_saved_unit"`
	IsSnippet          bool                   `json:"is_snippet"`
	Dimensions         *WorkflowDimensions    `json:"dimensions"`
	AvailableUntil     string                 `json:"available_until"`
	Raw                json.RawMessage        `json:"-"`
}

Workflow is the full workflow object returned by list and import.

func (*Workflow) UnmarshalJSON added in v0.10.0 

func (w *Workflow) UnmarshalJSON(b []byte) error

type WorkflowAction added in v0.10.0 

type WorkflowAction struct {
	ID            string `json:"id"`
	IntegrationID string `json:"integration_id"`
	Type          string `json:"type"`
}

WorkflowAction is a summary action in a workflow listing.

type WorkflowDimensions added in v0.10.0 

type WorkflowDimensions struct {
	Width  *float64 `json:"width"`
	Height *float64 `json:"height"`
}

WorkflowDimensions is the canvas dimensions of a workflow.

type WorkflowExecution added in v0.10.0 

type WorkflowExecution struct {
	ID                  string               `json:"id"`
	VersionID           string               `json:"version_id"`
	WorkflowID          string               `json:"workflow_id"`
	State               ExecutionState       `json:"state"`
	OffloadState        string               `json:"offload_state"`
	Duration            string               `json:"duration"`
	TimeSaved           float64              `json:"time_saved"`
	ExecutedActions     int                  `json:"executed_actions"`
	HasExecutionOutput  bool                 `json:"has_execution_output"`
	ScopeID             string               `json:"scope_id"`
	ScopeLevel          AutomationScopeLevel `json:"scope_level"`
	MgmtID              string               `json:"mgmt_id"`
	CreatedAt           string               `json:"created_at"`
	UpdatedAt           string               `json:"updated_at"`
	WorkflowName        string               `json:"workflow_name"`
	WorkflowDescription string               `json:"workflow_description"`
	WorkflowTags        []string             `json:"workflow_tags"`
	VersionCount        int                  `json:"version_count"`
	Trigger             TriggerType          `json:"trigger"`
	SiteName            string               `json:"site_name"`
	AccountName         string               `json:"account_name"`
	ParentScopeID       string               `json:"parent_scope_id"`
	SiteState           string               `json:"site_state"`
	AccountState        string               `json:"account_state"`
	Raw                 json.RawMessage      `json:"-"`
}

WorkflowExecution is a workflow execution record.

func (*WorkflowExecution) UnmarshalJSON added in v0.10.0 

func (e *WorkflowExecution) UnmarshalJSON(b []byte) error

type WorkflowExecutionDetail added in v0.10.0 

type WorkflowExecutionDetail struct {
	ID                           string                 `json:"id"`
	VersionID                    string                 `json:"version_id"`
	WorkflowID                   string                 `json:"workflow_id"`
	State                        ExecutionState         `json:"state"`
	Duration                     string                 `json:"duration"`
	TimeSaved                    float64                `json:"time_saved"`
	ExecutedActions              int                    `json:"executed_actions"`
	HasExecutionOutput           bool                   `json:"has_execution_output"`
	ScopeID                      string                 `json:"scope_id"`
	ScopeLevel                   AutomationScopeLevel   `json:"scope_level"`
	MgmtID                       string                 `json:"mgmt_id"`
	CreatedAt                    string                 `json:"created_at"`
	UpdatedAt                    string                 `json:"updated_at"`
	WorkflowState                WorkflowState          `json:"workflow_state"`
	SingularityResponseEventType SingularityEventType   `json:"singularity_response_event_type"`
	SingularityResponseEventID   string                 `json:"singularity_response_event_id"`
	ErrorActions                 []ExecutionErrorAction `json:"error_actions"`
	Raw                          json.RawMessage        `json:"-"`
}

WorkflowExecutionDetail is the detailed execution returned by get-by-ID.

func (*WorkflowExecutionDetail) UnmarshalJSON added in v0.10.0 

func (e *WorkflowExecutionDetail) UnmarshalJSON(b []byte) error

type WorkflowExecutionRun added in v0.10.0 

type WorkflowExecutionRun struct {
	ID                 string               `json:"id"`
	VersionID          string               `json:"version_id"`
	WorkflowID         string               `json:"workflow_id"`
	State              ExecutionState       `json:"state"`
	OffloadState       string               `json:"offload_state"`
	Duration           string               `json:"duration"`
	TimeSaved          float64              `json:"time_saved"`
	ExecutedActions    int                  `json:"executed_actions"`
	HasExecutionOutput bool                 `json:"has_execution_output"`
	ScopeID            string               `json:"scope_id"`
	ScopeLevel         AutomationScopeLevel `json:"scope_level"`
	MgmtID             string               `json:"mgmt_id"`
	CreatedAt          string               `json:"created_at"`
	UpdatedAt          string               `json:"updated_at"`
	Raw                json.RawMessage      `json:"-"`
}

WorkflowExecutionRun is the response from triggering a workflow execution.

func (*WorkflowExecutionRun) UnmarshalJSON added in v0.10.0 

func (e *WorkflowExecutionRun) UnmarshalJSON(b []byte) error

type WorkflowExport added in v0.10.0 

type WorkflowExport struct {
	Name        string                `json:"name"`
	Description string                `json:"description"`
	Actions     []WorkflowExportEntry `json:"actions"`
	Raw         json.RawMessage       `json:"-"`
}

WorkflowExport is the exported representation of a workflow version.

func (*WorkflowExport) UnmarshalJSON added in v0.10.0 

func (w *WorkflowExport) UnmarshalJSON(b []byte) error

type WorkflowExportEdge added in v0.10.0 

type WorkflowExportEdge struct {
	Target       int             `json:"target"`
	CustomHandle json.RawMessage `json:"custom_handle"`
	Payload      json.RawMessage `json:"payload"`
}

WorkflowExportEdge is an edge between actions in an exported workflow.

type WorkflowExportEntry added in v0.10.0 

type WorkflowExportEntry struct {
	Action       json.RawMessage      `json:"action"`
	ExportID     int                  `json:"export_id"`
	ConnectedTo  []WorkflowExportEdge `json:"connected_to"`
	ParentAction *int                 `json:"parent_action"`
}

WorkflowExportEntry is an action entry in an exported workflow.

type WorkflowLifecycleState added in v0.10.0 

type WorkflowLifecycleState string

WorkflowLifecycleState is the lifecycle state of a workflow. 

const (
	WorkflowLifecycleActive   WorkflowLifecycleState = "active"
	WorkflowLifecycleArchived WorkflowLifecycleState = "archived"
	WorkflowLifecycleDeleted  WorkflowLifecycleState = "deleted"
)

type WorkflowListItem added in v0.10.0 

type WorkflowListItem struct {
	ID       string           `json:"id"`
	Workflow Workflow         `json:"workflow"`
	Actions  []WorkflowAction `json:"actions"`
	Raw      json.RawMessage  `json:"-"`
}

WorkflowListItem wraps a workflow with its actions in list responses.

func (*WorkflowListItem) UnmarshalJSON added in v0.10.0 

func (w *WorkflowListItem) UnmarshalJSON(b []byte) error

type WorkflowState added in v0.10.0 

type WorkflowState string

WorkflowState is the state of a workflow (active/inactive version state). 

const (
	WorkflowStateActive      WorkflowState = "active"
	WorkflowStateInactive    WorkflowState = "inactive"
	WorkflowStateDeactivated WorkflowState = "deactivated"
	WorkflowStateDraft       WorkflowState = "draft"
)

type WorkflowStatus added in v0.10.0 

type WorkflowStatus string

WorkflowStatus is the run status of a workflow. 

const (
	WorkflowStatusIdle    WorkflowStatus = "idle"
	WorkflowStatusRunning WorkflowStatus = "running"
)

type WorkflowUser added in v0.10.0 

type WorkflowUser struct {
	ID    string `json:"id"`
	Name  string `json:"name"`
	Email string `json:"email"`
}

WorkflowUser is a user reference in a workflow.

type WorkflowVersion added in v0.10.0 

type WorkflowVersion struct {
	ID                 string                 `json:"id"`
	VersionID          string                 `json:"version_id"`
	Name               string                 `json:"name"`
	Description        string                 `json:"description"`
	State              WorkflowState          `json:"state"`
	LifecycleState     WorkflowLifecycleState `json:"lifecycle_state"`
	Status             WorkflowStatus         `json:"status"`
	ScopeID            string                 `json:"scope_id"`
	ScopeLevel         AutomationScopeLevel   `json:"scope_level"`
	MgmtID             string                 `json:"mgmt_id"`
	CreatedAt          string                 `json:"created_at"`
	UpdatedAt          string                 `json:"updated_at"`
	ActivatedAt        string                 `json:"activated_at"`
	CreatedBy          string                 `json:"created_by"`
	UpdatedBy          string                 `json:"updated_by"`
	CreatedByUser      *WorkflowUser          `json:"created_by_user"`
	UpdatedByUser      *WorkflowUser          `json:"updated_by_user"`
	VersionDescription string                 `json:"version_description"`
	VersionCount       int                    `json:"version_count"`
	Timeout            int                    `json:"timeout"`
	DailyMaxExecutions int                    `json:"daily_max_executions"`
	MaxConcurrency     int                    `json:"max_concurrency"`
	NotifyTo           []string               `json:"notify_to"`
	TimeSaved          int                    `json:"time_saved"`
	TimeSavedUnit      string                 `json:"time_saved_unit"`
	IsSnippet          bool                   `json:"is_snippet"`
	Dimensions         *WorkflowDimensions    `json:"dimensions"`
	ExecutionTime      string                 `json:"execution_time"`
	ExecutionStatus    ExecutionState         `json:"execution_status"`
	Raw                json.RawMessage        `json:"-"`
}

WorkflowVersion is a version entry returned by the versions endpoint.

func (*WorkflowVersion) UnmarshalJSON added in v0.10.0 

func (w *WorkflowVersion) UnmarshalJSON(b []byte) error

type XDRAssetActionInput added in v0.10.1 

type XDRAssetActionInput struct {
	ActionName string   `json:"actionName"`
	IDIn       []string `json:"id__in,omitempty"`
	IDNin      []string `json:"id__nin,omitempty"`
}

XDRAssetActionInput is the request body for asset actions.

type XDRAssetCategory added in v0.4.0 

type XDRAssetCategory struct {
	Account     int `json:"account"`
	Container   int `json:"container"`
	Device      int `json:"device"`
	Identity    int `json:"identity"`
	Inventory   int `json:"inventory"`
	Server      int `json:"server"`
	Storage     int `json:"storage"`
	Workstation int `json:"workstation"`

	Raw json.RawMessage `json:"-"`
}

XDRAssetCategory holds simple per-category counts (flat).

func (*XDRAssetCategory) UnmarshalJSON added in v0.4.0 

func (x *XDRAssetCategory) UnmarshalJSON(b []byte) error

type XDRAssetCounts added in v0.4.0 

type XDRAssetCounts struct {
	Categories XDRCategoryDetails `json:"categories"`
	Surfaces   XDRSurfaceDetails  `json:"surfaces"`

	Raw json.RawMessage `json:"-"`
}

XDRAssetCounts holds asset counts grouped by category and surface.

func (*XDRAssetCounts) UnmarshalJSON added in v0.4.0 

func (x *XDRAssetCounts) UnmarshalJSON(b []byte) error

type XDRAssetCountsParams added in v0.4.0 

type XDRAssetCountsParams struct {
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
}

XDRAssetCountsParams are query parameters for asset counts.

type XDRAssetListParams added in v0.10.1 

type XDRAssetListParams struct {
	Limit      int
	Skip       int
	Cursor     string
	SortBy     string
	SortOrder  string
	CountOnly  *bool
	SkipCount  *bool
	SiteIDs    []string
	AccountIDs []string
	GroupIDs   []string
	Extra      url.Values // type-specific filter passthrough
}

XDRAssetListParams holds common query parameters for asset listing endpoints.

type XDRAssetNoteInput added in v0.10.1 

type XDRAssetNoteInput struct {
	ID         string `json:"id,omitempty"`
	ResourceID string `json:"resourceId,omitempty"`
	Note       string `json:"note,omitempty"`
}

XDRAssetNoteInput is the request body for asset note operations.

type XDRCategoryCount added in v0.4.0 

type XDRCategoryCount struct {
	Count int `json:"count"`

	Raw json.RawMessage `json:"-"`
}

XDRCategoryCount is a single category's count.

func (*XDRCategoryCount) UnmarshalJSON added in v0.4.0 

func (x *XDRCategoryCount) UnmarshalJSON(b []byte) error

type XDRCategoryDetails added in v0.4.0 

type XDRCategoryDetails struct {
	Account                XDRCategoryCount `json:"account"`
	AiMl                   XDRCategoryCount `json:"aiMl"`
	ApplicationIntegration XDRCategoryCount `json:"applicationIntegration"`
	CloudApplication       XDRCategoryCount `json:"cloudApplication"`
	Code                   XDRCategoryCount `json:"code"`
	Container              XDRCategoryCount `json:"container"`
	DataAnalysis           XDRCategoryCount `json:"dataAnalysis"`
	DataStore              XDRCategoryCount `json:"dataStore"`
	DeveloperTool          XDRCategoryCount `json:"developerTool"`
	Device                 XDRCategoryCount `json:"device"`
	Function               XDRCategoryCount `json:"function"`
	Governance             XDRCategoryCount `json:"governance"`
	Identity               XDRCategoryCount `json:"identity"`
	Inventory              XDRCategoryCount `json:"inventory"`
	Network                XDRCategoryCount `json:"network"`
	Secrets                XDRCategoryCount `json:"secrets"`
	Server                 XDRCategoryCount `json:"server"`
	Storage                XDRCategoryCount `json:"storage"`
	Workstation            XDRCategoryCount `json:"workstation"`

	Raw json.RawMessage `json:"-"`
}

XDRCategoryDetails holds per-category counts and subcategories.

func (*XDRCategoryDetails) UnmarshalJSON added in v0.4.0 

func (x *XDRCategoryDetails) UnmarshalJSON(b []byte) error

type XDRSurfaceCount added in v0.4.0 

type XDRSurfaceCount struct {
	Count int `json:"count"`

	Raw json.RawMessage `json:"-"`
}

XDRSurfaceCount is a single surface's count.

func (*XDRSurfaceCount) UnmarshalJSON added in v0.4.0 

func (x *XDRSurfaceCount) UnmarshalJSON(b []byte) error

type XDRSurfaceDetails added in v0.4.0 

type XDRSurfaceDetails struct {
	Cloud            XDRSurfaceCount `json:"cloud"`
	Endpoint         XDRSurfaceCount `json:"endpoint"`
	Identity         XDRSurfaceCount `json:"identity"`
	Network          XDRSurfaceCount `json:"network"`
	NetworkDiscovery XDRSurfaceCount `json:"networkDiscovery"`

	Raw json.RawMessage `json:"-"`
}

XDRSurfaceDetails holds per-surface counts.

func (*XDRSurfaceDetails) UnmarshalJSON added in v0.4.0 

func (x *XDRSurfaceDetails) UnmarshalJSON(b []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.