usp_entraid

Documentation

Index

• Variables
• type EntraIDAdapter
  • func NewEntraIDAdapter(ctx context.Context, conf EntraIDConfig) (*EntraIDAdapter, chan struct{}, error)
  • func (a *EntraIDAdapter) Close() error
• type EntraIDConfig
  • func (c *EntraIDConfig) Validate() error

Variables

var URL = map[string]string{
	"get_alerts": "https://graph.microsoft.com/v1.0/identityProtection/riskDetections",
}

Types

type EntraIDAdapter

type EntraIDAdapter struct {
	// contains filtered or unexported fields
}

func NewEntraIDAdapter

func NewEntraIDAdapter(ctx context.Context, conf EntraIDConfig) (*EntraIDAdapter, chan struct{}, error)

func (*EntraIDAdapter) Close

func (a *EntraIDAdapter) Close() error

type EntraIDConfig

type EntraIDConfig struct {
	ClientOptions uspclient.ClientOptions `json:"client_options" yaml:"client_options"`
	TenantID      string                  `json:"tenant_id" yaml:"tenant_id"`
	ClientID      string                  `json:"client_id" yaml:"client_id"`
	ClientSecret  string                  `json:"client_secret" yaml:"client_secret"`

	// Streams selects which Entra ID collections to poll, as comma separated
	// values. Supported values: "risk_detections" (Identity Protection risk
	// detections), "sign_ins" (auditLogs/signIns sign-in logs) and
	// "audit_logs" (auditLogs/directoryAudits directory audit logs). Empty
	// selects "risk_detections" only, preserving the historical behavior of
	// existing deployments.
	Streams string `json:"streams,omitempty" yaml:"streams,omitempty"`

	// Endpoint selects the Microsoft national cloud deployment. Valid values:
	// "enterprise" (default, global/commercial), "gcc-gov" (US Government GCC /
	// moderate, which runs on the worldwide endpoints), "gcc-high-gov" (US
	// Government GCC High / L4) and "dod-gov" (US Government DoD / L5). An
	// empty value defaults to "enterprise", so existing configs keep talking to
	// the commercial cloud unchanged.
	// Reference: https://learn.microsoft.com/en-us/graph/deployments
	Endpoint string `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`

	// LoginEndpoint overrides the base URL of the Microsoft identity platform
	// used for the OAuth2 client_credentials token exchange, derived from
	// Endpoint otherwise (https://login.microsoftonline.com for "enterprise").
	// It only overrides the host; the OAuth2 scope still follows Endpoint, so a
	// login_endpoint pointed at a gov host without also setting endpoint sends
	// the commercial scope and will fail auth.
	LoginEndpoint string `json:"login_endpoint,omitempty" yaml:"login_endpoint,omitempty"`

	// GraphEndpoint overrides the base URL of the Microsoft Graph API the
	// collections are fetched from, derived from Endpoint otherwise
	// (https://graph.microsoft.com for "enterprise"). It only overrides the
	// host; the OAuth2 scope still follows Endpoint, so a graph_endpoint
	// pointed at a gov host without also setting endpoint sends the commercial
	// scope and will 401.
	GraphEndpoint string `json:"graph_endpoint,omitempty" yaml:"graph_endpoint,omitempty"`

	// PollInterval overrides the wait between polls of each stream (default
	// 30s). It is not settable through a config file; it exists as a seam for
	// tests.
	PollInterval time.Duration `json:"-" yaml:"-"`
}

func (*EntraIDConfig) Validate

func (c *EntraIDConfig) Validate() error