zz_rule_types.go

// SPDX-FileCopyrightText: 2023 The Crossplane Authors <https://crossplane.io>
//
// SPDX-License-Identifier: Apache-2.0

/*
Copyright 2022 Upbound Inc.
*/

// Code generated by upjet. DO NOT EDIT.

package v1alpha1

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime/schema"

	v1 "github.com/crossplane/crossplane-runtime/apis/common/v1"
)

type AgentRuleInitParameters struct {

	// (String) Deprecated. It won't be applied anymore.
	// **Deprecated**. It won't be applied anymore.
	AgentRuleID *string `json:"agentRuleId,omitempty" tf:"agent_rule_id,omitempty"`

	// (String) Deprecated. It won't be applied anymore.
	// **Deprecated**. It won't be applied anymore.
	Expression *string `json:"expression,omitempty" tf:"expression,omitempty"`
}

type AgentRuleObservation struct {

	// (String) Deprecated. It won't be applied anymore.
	// **Deprecated**. It won't be applied anymore.
	AgentRuleID *string `json:"agentRuleId,omitempty" tf:"agent_rule_id,omitempty"`

	// (String) Deprecated. It won't be applied anymore.
	// **Deprecated**. It won't be applied anymore.
	Expression *string `json:"expression,omitempty" tf:"expression,omitempty"`
}

type AgentRuleParameters struct {

	// (String) Deprecated. It won't be applied anymore.
	// **Deprecated**. It won't be applied anymore.
	// +kubebuilder:validation:Optional
	AgentRuleID *string `json:"agentRuleId" tf:"agent_rule_id,omitempty"`

	// (String) Deprecated. It won't be applied anymore.
	// **Deprecated**. It won't be applied anymore.
	// +kubebuilder:validation:Optional
	Expression *string `json:"expression" tf:"expression,omitempty"`
}

type ImpossibleTravelOptionsInitParameters struct {

	// (Boolean) If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
	// If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to `false`.
	BaselineUserLocations *bool `json:"baselineUserLocations,omitempty" tf:"baseline_user_locations,omitempty"`
}

type ImpossibleTravelOptionsObservation struct {

	// (Boolean) If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
	// If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to `false`.
	BaselineUserLocations *bool `json:"baselineUserLocations,omitempty" tf:"baseline_user_locations,omitempty"`
}

type ImpossibleTravelOptionsParameters struct {

	// (Boolean) If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to false.
	// If true, signals are suppressed for the first 24 hours. During that time, Datadog learns the user's regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access. Defaults to `false`.
	// +kubebuilder:validation:Optional
	BaselineUserLocations *bool `json:"baselineUserLocations,omitempty" tf:"baseline_user_locations,omitempty"`
}

type NewValueOptionsInitParameters struct {

	// (Number) The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
	// The duration in days after which a learned value is forgotten. Valid values are `1`, `2`, `7`, `14`, `21`, `28`.
	ForgetAfter *float64 `json:"forgetAfter,omitempty" tf:"forget_after,omitempty"`

	// (Number) The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
	// The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are `0`, `1`, `7`. Defaults to `1`.
	LearningDuration *float64 `json:"learningDuration,omitempty" tf:"learning_duration,omitempty"`

	// (String) The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
	// The learning method used to determine when signals should be generated for values that weren't learned. Valid values are `duration`, `threshold`. Defaults to `"duration"`.
	LearningMethod *string `json:"learningMethod,omitempty" tf:"learning_method,omitempty"`

	// (Number) A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
	// A number of occurrences after which signals are generated for values that weren't learned. Valid values are `0`, `1`. Defaults to `0`.
	LearningThreshold *float64 `json:"learningThreshold,omitempty" tf:"learning_threshold,omitempty"`
}

type NewValueOptionsObservation struct {

	// (Number) The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
	// The duration in days after which a learned value is forgotten. Valid values are `1`, `2`, `7`, `14`, `21`, `28`.
	ForgetAfter *float64 `json:"forgetAfter,omitempty" tf:"forget_after,omitempty"`

	// (Number) The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
	// The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are `0`, `1`, `7`. Defaults to `1`.
	LearningDuration *float64 `json:"learningDuration,omitempty" tf:"learning_duration,omitempty"`

	// (String) The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
	// The learning method used to determine when signals should be generated for values that weren't learned. Valid values are `duration`, `threshold`. Defaults to `"duration"`.
	LearningMethod *string `json:"learningMethod,omitempty" tf:"learning_method,omitempty"`

	// (Number) A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
	// A number of occurrences after which signals are generated for values that weren't learned. Valid values are `0`, `1`. Defaults to `0`.
	LearningThreshold *float64 `json:"learningThreshold,omitempty" tf:"learning_threshold,omitempty"`
}

type NewValueOptionsParameters struct {

	// (Number) The duration in days after which a learned value is forgotten. Valid values are 1, 2, 7, 14, 21, 28.
	// The duration in days after which a learned value is forgotten. Valid values are `1`, `2`, `7`, `14`, `21`, `28`.
	// +kubebuilder:validation:Optional
	ForgetAfter *float64 `json:"forgetAfter" tf:"forget_after,omitempty"`

	// (Number) The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are 0, 1, 7. Defaults to 1.
	// The duration in days during which values are learned, and after which signals will be generated for values that weren't learned. If set to 0, a signal will be generated for all new values after the first value is learned. Valid values are `0`, `1`, `7`. Defaults to `1`.
	// +kubebuilder:validation:Optional
	LearningDuration *float64 `json:"learningDuration,omitempty" tf:"learning_duration,omitempty"`

	// (String) The learning method used to determine when signals should be generated for values that weren't learned. Valid values are duration, threshold. Defaults to "duration".
	// The learning method used to determine when signals should be generated for values that weren't learned. Valid values are `duration`, `threshold`. Defaults to `"duration"`.
	// +kubebuilder:validation:Optional
	LearningMethod *string `json:"learningMethod,omitempty" tf:"learning_method,omitempty"`

	// (Number) A number of occurrences after which signals are generated for values that weren't learned. Valid values are 0, 1. Defaults to 0.
	// A number of occurrences after which signals are generated for values that weren't learned. Valid values are `0`, `1`. Defaults to `0`.
	// +kubebuilder:validation:Optional
	LearningThreshold *float64 `json:"learningThreshold,omitempty" tf:"learning_threshold,omitempty"`
}

type QueryInitParameters struct {

	// (Block List, Deprecated) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource. (see below for nested schema)
	// **Deprecated**. It won't be applied anymore. **Deprecated.** `agent_rule` has been deprecated in favor of new Agent Rule resource.
	AgentRule []AgentRuleInitParameters `json:"agentRule,omitempty" tf:"agent_rule,omitempty"`

	// (String) The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
	// The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are `count`, `cardinality`, `sum`, `max`, `new_value`, `geo_data`, `event_count`, `none`. Defaults to `"count"`.
	Aggregation *string `json:"aggregation,omitempty" tf:"aggregation,omitempty"`

	// (List of String) Field for which the cardinality is measured. Sent as an array.
	// Field for which the cardinality is measured. Sent as an array.
	DistinctFields []*string `json:"distinctFields,omitempty" tf:"distinct_fields,omitempty"`

	// (List of String) Fields to group by. If empty, each log triggers a signal.
	// Fields to group by.
	GroupByFields []*string `json:"groupByFields,omitempty" tf:"group_by_fields,omitempty"`

	// (String, Deprecated) The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.
	// The target field to aggregate over when using the `sum`, `max`, or `geo_data` aggregations. **Deprecated.** Configure `metrics` instead. This attribute will be removed in the next major version of the provider.
	Metric *string `json:"metric,omitempty" tf:"metric,omitempty"`

	// (List of String) Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
	// Group of target fields to aggregate over when using the `sum`, `max`, `geo_data`, or `new_value` aggregations. The `sum`, `max`, and `geo_data` aggregations only accept one value in this list, whereas the `new_value` aggregation accepts up to five values.
	Metrics []*string `json:"metrics,omitempty" tf:"metrics,omitempty"`

	// (String) The name of the rule.
	// Name of the query. Not compatible with `new_value` aggregations.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query to run on logs.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`
}

type QueryObservation struct {

	// (Block List, Deprecated) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource. (see below for nested schema)
	// **Deprecated**. It won't be applied anymore. **Deprecated.** `agent_rule` has been deprecated in favor of new Agent Rule resource.
	AgentRule []AgentRuleObservation `json:"agentRule,omitempty" tf:"agent_rule,omitempty"`

	// (String) The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
	// The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are `count`, `cardinality`, `sum`, `max`, `new_value`, `geo_data`, `event_count`, `none`. Defaults to `"count"`.
	Aggregation *string `json:"aggregation,omitempty" tf:"aggregation,omitempty"`

	// (List of String) Field for which the cardinality is measured. Sent as an array.
	// Field for which the cardinality is measured. Sent as an array.
	DistinctFields []*string `json:"distinctFields,omitempty" tf:"distinct_fields,omitempty"`

	// (List of String) Fields to group by. If empty, each log triggers a signal.
	// Fields to group by.
	GroupByFields []*string `json:"groupByFields,omitempty" tf:"group_by_fields,omitempty"`

	// (String, Deprecated) The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.
	// The target field to aggregate over when using the `sum`, `max`, or `geo_data` aggregations. **Deprecated.** Configure `metrics` instead. This attribute will be removed in the next major version of the provider.
	Metric *string `json:"metric,omitempty" tf:"metric,omitempty"`

	// (List of String) Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
	// Group of target fields to aggregate over when using the `sum`, `max`, `geo_data`, or `new_value` aggregations. The `sum`, `max`, and `geo_data` aggregations only accept one value in this list, whereas the `new_value` aggregation accepts up to five values.
	Metrics []*string `json:"metrics,omitempty" tf:"metrics,omitempty"`

	// (String) The name of the rule.
	// Name of the query. Not compatible with `new_value` aggregations.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query to run on logs.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`
}

type QueryParameters struct {

	// (Block List, Deprecated) Deprecated. It won't be applied anymore. Deprecated. agent_rule has been deprecated in favor of new Agent Rule resource. (see below for nested schema)
	// **Deprecated**. It won't be applied anymore. **Deprecated.** `agent_rule` has been deprecated in favor of new Agent Rule resource.
	// +kubebuilder:validation:Optional
	AgentRule []AgentRuleParameters `json:"agentRule,omitempty" tf:"agent_rule,omitempty"`

	// (String) The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
	// The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are `count`, `cardinality`, `sum`, `max`, `new_value`, `geo_data`, `event_count`, `none`. Defaults to `"count"`.
	// +kubebuilder:validation:Optional
	Aggregation *string `json:"aggregation,omitempty" tf:"aggregation,omitempty"`

	// (List of String) Field for which the cardinality is measured. Sent as an array.
	// Field for which the cardinality is measured. Sent as an array.
	// +kubebuilder:validation:Optional
	DistinctFields []*string `json:"distinctFields,omitempty" tf:"distinct_fields,omitempty"`

	// (List of String) Fields to group by. If empty, each log triggers a signal.
	// Fields to group by.
	// +kubebuilder:validation:Optional
	GroupByFields []*string `json:"groupByFields,omitempty" tf:"group_by_fields,omitempty"`

	// (String, Deprecated) The target field to aggregate over when using the sum, max, or geo_data aggregations. Deprecated. Configure metrics instead. This attribute will be removed in the next major version of the provider.
	// The target field to aggregate over when using the `sum`, `max`, or `geo_data` aggregations. **Deprecated.** Configure `metrics` instead. This attribute will be removed in the next major version of the provider.
	// +kubebuilder:validation:Optional
	Metric *string `json:"metric,omitempty" tf:"metric,omitempty"`

	// (List of String) Group of target fields to aggregate over when using the sum, max, geo_data, or new_value aggregations. The sum, max, and geo_data aggregations only accept one value in this list, whereas the new_value aggregation accepts up to five values.
	// Group of target fields to aggregate over when using the `sum`, `max`, `geo_data`, or `new_value` aggregations. The `sum`, `max`, and `geo_data` aggregations only accept one value in this list, whereas the `new_value` aggregation accepts up to five values.
	// +kubebuilder:validation:Optional
	Metrics []*string `json:"metrics,omitempty" tf:"metrics,omitempty"`

	// (String) The name of the rule.
	// Name of the query. Not compatible with `new_value` aggregations.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query to run on logs.
	// +kubebuilder:validation:Optional
	Query *string `json:"query" tf:"query,omitempty"`
}

type RootQueryInitParameters struct {

	// (List of String) Fields to group by. If empty, each log triggers a signal.
	// Fields to group by. If empty, each log triggers a signal.
	GroupByFields []*string `json:"groupByFields,omitempty" tf:"group_by_fields,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query to filter logs.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`
}

type RootQueryObservation struct {

	// (List of String) Fields to group by. If empty, each log triggers a signal.
	// Fields to group by. If empty, each log triggers a signal.
	GroupByFields []*string `json:"groupByFields,omitempty" tf:"group_by_fields,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query to filter logs.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`
}

type RootQueryParameters struct {

	// (List of String) Fields to group by. If empty, each log triggers a signal.
	// Fields to group by. If empty, each log triggers a signal.
	// +kubebuilder:validation:Optional
	GroupByFields []*string `json:"groupByFields,omitempty" tf:"group_by_fields,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query to filter logs.
	// +kubebuilder:validation:Optional
	Query *string `json:"query" tf:"query,omitempty"`
}

type RuleCaseInitParameters struct {

	// (String) A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
	// A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.
	Condition *string `json:"condition,omitempty" tf:"condition,omitempty"`

	// (String) The name of the rule.
	// Name of the case.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (List of String) Notification targets for each rule case.
	// Notification targets for each rule case.
	Notifications []*string `json:"notifications,omitempty" tf:"notifications,omitempty"`

	// (String) Severity of the Security Signal. Valid values are info, low, medium, high, critical.
	// Severity of the Security Signal. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	Status *string `json:"status,omitempty" tf:"status,omitempty"`
}

type RuleCaseObservation struct {

	// (String) A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
	// A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.
	Condition *string `json:"condition,omitempty" tf:"condition,omitempty"`

	// (String) The name of the rule.
	// Name of the case.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (List of String) Notification targets for each rule case.
	// Notification targets for each rule case.
	Notifications []*string `json:"notifications,omitempty" tf:"notifications,omitempty"`

	// (String) Severity of the Security Signal. Valid values are info, low, medium, high, critical.
	// Severity of the Security Signal. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	Status *string `json:"status,omitempty" tf:"status,omitempty"`
}

type RuleCaseParameters struct {

	// (String) A rule case contains logical operations (>,>=, &&, ||) to determine if a signal should be generated based on the event counts in the previously defined queries.
	// A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.
	// +kubebuilder:validation:Optional
	Condition *string `json:"condition,omitempty" tf:"condition,omitempty"`

	// (String) The name of the rule.
	// Name of the case.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (List of String) Notification targets for each rule case.
	// Notification targets for each rule case.
	// +kubebuilder:validation:Optional
	Notifications []*string `json:"notifications,omitempty" tf:"notifications,omitempty"`

	// (String) Severity of the Security Signal. Valid values are info, low, medium, high, critical.
	// Severity of the Security Signal. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	// +kubebuilder:validation:Optional
	Status *string `json:"status" tf:"status,omitempty"`
}

type RuleFilterInitParameters struct {

	// (String) The type of filtering action. Valid values are require, suppress.
	// The type of filtering action. Valid values are `require`, `suppress`.
	Action *string `json:"action,omitempty" tf:"action,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query for selecting logs to apply the filtering action.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`
}

type RuleFilterObservation struct {

	// (String) The type of filtering action. Valid values are require, suppress.
	// The type of filtering action. Valid values are `require`, `suppress`.
	Action *string `json:"action,omitempty" tf:"action,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query for selecting logs to apply the filtering action.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`
}

type RuleFilterParameters struct {

	// (String) The type of filtering action. Valid values are require, suppress.
	// The type of filtering action. Valid values are `require`, `suppress`.
	// +kubebuilder:validation:Optional
	Action *string `json:"action" tf:"action,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Query for selecting logs to apply the filtering action.
	// +kubebuilder:validation:Optional
	Query *string `json:"query" tf:"query,omitempty"`
}

type RuleInitParameters struct {

	// (Block List, Max: 10) Cases for generating signals. (see below for nested schema)
	// Cases for generating signals.
	Case []RuleCaseInitParameters `json:"case,omitempty" tf:"case,omitempty"`

	// (Boolean) Whether the rule is enabled. Defaults to true.
	// Whether the rule is enabled. Defaults to `true`.
	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`

	// (Block List) Additional queries to filter matched events before they are processed. (see below for nested schema)
	// Additional queries to filter matched events before they are processed.
	Filter []RuleFilterInitParameters `json:"filter,omitempty" tf:"filter,omitempty"`

	// by values in their title. Defaults to false.
	// Whether the notifications include the triggering group-by values in their title. Defaults to `false`.
	HasExtendedTitle *bool `json:"hasExtendedTitle,omitempty" tf:"has_extended_title,omitempty"`

	// (String) Message for generated signals.
	// Message for generated signals.
	Message *string `json:"message,omitempty" tf:"message,omitempty"`

	// (String) The name of the rule.
	// The name of the rule.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Block List, Max: 1) Options on rules. (see below for nested schema)
	// Options on rules.
	Options []RuleOptionsInitParameters `json:"options,omitempty" tf:"options,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Queries for selecting logs which are part of the rule.
	Query []QueryInitParameters `json:"query,omitempty" tf:"query,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Queries for selecting logs which are part of the rule.
	SignalQuery []SignalQueryInitParameters `json:"signalQuery,omitempty" tf:"signal_query,omitempty"`

	// (Set of String) Tags for generated signals.
	// Tags for generated signals.
	// +listType=set
	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`

	// party rules. Only required and accepted for third-party rules (see below for nested schema)
	// Cases for generating signals for third-party rules. Only required and accepted for third-party rules
	ThirdPartyCase []ThirdPartyCaseInitParameters `json:"thirdPartyCase,omitempty" tf:"third_party_case,omitempty"`

	// (String) The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
	// The rule type. Valid values are `application_security`, `log_detection`, `workload_security`, `signal_correlation`. Defaults to `"log_detection"`.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type RuleObservation struct {

	// (Block List, Max: 10) Cases for generating signals. (see below for nested schema)
	// Cases for generating signals.
	Case []RuleCaseObservation `json:"case,omitempty" tf:"case,omitempty"`

	// (Boolean) Whether the rule is enabled. Defaults to true.
	// Whether the rule is enabled. Defaults to `true`.
	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`

	// (Block List) Additional queries to filter matched events before they are processed. (see below for nested schema)
	// Additional queries to filter matched events before they are processed.
	Filter []RuleFilterObservation `json:"filter,omitempty" tf:"filter,omitempty"`

	// by values in their title. Defaults to false.
	// Whether the notifications include the triggering group-by values in their title. Defaults to `false`.
	HasExtendedTitle *bool `json:"hasExtendedTitle,omitempty" tf:"has_extended_title,omitempty"`

	// (String) The ID of this resource.
	ID *string `json:"id,omitempty" tf:"id,omitempty"`

	// (String) Message for generated signals.
	// Message for generated signals.
	Message *string `json:"message,omitempty" tf:"message,omitempty"`

	// (String) The name of the rule.
	// The name of the rule.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Block List, Max: 1) Options on rules. (see below for nested schema)
	// Options on rules.
	Options []RuleOptionsObservation `json:"options,omitempty" tf:"options,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Queries for selecting logs which are part of the rule.
	Query []QueryObservation `json:"query,omitempty" tf:"query,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Queries for selecting logs which are part of the rule.
	SignalQuery []SignalQueryObservation `json:"signalQuery,omitempty" tf:"signal_query,omitempty"`

	// (Set of String) Tags for generated signals.
	// Tags for generated signals.
	// +listType=set
	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`

	// party rules. Only required and accepted for third-party rules (see below for nested schema)
	// Cases for generating signals for third-party rules. Only required and accepted for third-party rules
	ThirdPartyCase []ThirdPartyCaseObservation `json:"thirdPartyCase,omitempty" tf:"third_party_case,omitempty"`

	// (String) The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
	// The rule type. Valid values are `application_security`, `log_detection`, `workload_security`, `signal_correlation`. Defaults to `"log_detection"`.
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type RuleOptionsInitParameters struct {

	// production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
	// If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with `staging`, `test`, or `dev`. Only available when the rule type is `log_detection`. Defaults to `false`.
	DecreaseCriticalityBasedOnEnv *bool `json:"decreaseCriticalityBasedOnEnv,omitempty" tf:"decrease_criticality_based_on_env,omitempty"`

	// (String) The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party. Defaults to "threshold".
	// The detection method. Valid values are `threshold`, `new_value`, `anomaly_detection`, `impossible_travel`, `hardcoded`, `third_party`. Defaults to `"threshold"`.
	DetectionMethod *string `json:"detectionMethod,omitempty" tf:"detection_method,omitempty"`

	// (Number) A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
	// A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`.
	EvaluationWindow *float64 `json:"evaluationWindow,omitempty" tf:"evaluation_window,omitempty"`

	// (Block List, Max: 1) Options for rules using the impossible travel detection method. (see below for nested schema)
	// Options for rules using the impossible travel detection method.
	ImpossibleTravelOptions []ImpossibleTravelOptionsInitParameters `json:"impossibleTravelOptions,omitempty" tf:"impossible_travel_options,omitempty"`

	// (Number) Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
	// Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`, `10800`, `21600`.
	KeepAlive *float64 `json:"keepAlive,omitempty" tf:"keep_alive,omitempty"`

	// (Number) A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
	// A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`, `10800`, `21600`, `43200`, `86400`.
	MaxSignalDuration *float64 `json:"maxSignalDuration,omitempty" tf:"max_signal_duration,omitempty"`

	// (Block List, Max: 1) New value rules specific options. (see below for nested schema)
	// New value rules specific options.
	NewValueOptions []NewValueOptionsInitParameters `json:"newValueOptions,omitempty" tf:"new_value_options,omitempty"`

	// party detection method. (see below for nested schema)
	// Options for rules using the third-party detection method.
	ThirdPartyRuleOptions []ThirdPartyRuleOptionsInitParameters `json:"thirdPartyRuleOptions,omitempty" tf:"third_party_rule_options,omitempty"`
}

type RuleOptionsObservation struct {

	// production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
	// If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with `staging`, `test`, or `dev`. Only available when the rule type is `log_detection`. Defaults to `false`.
	DecreaseCriticalityBasedOnEnv *bool `json:"decreaseCriticalityBasedOnEnv,omitempty" tf:"decrease_criticality_based_on_env,omitempty"`

	// (String) The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party. Defaults to "threshold".
	// The detection method. Valid values are `threshold`, `new_value`, `anomaly_detection`, `impossible_travel`, `hardcoded`, `third_party`. Defaults to `"threshold"`.
	DetectionMethod *string `json:"detectionMethod,omitempty" tf:"detection_method,omitempty"`

	// (Number) A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
	// A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`.
	EvaluationWindow *float64 `json:"evaluationWindow,omitempty" tf:"evaluation_window,omitempty"`

	// (Block List, Max: 1) Options for rules using the impossible travel detection method. (see below for nested schema)
	// Options for rules using the impossible travel detection method.
	ImpossibleTravelOptions []ImpossibleTravelOptionsObservation `json:"impossibleTravelOptions,omitempty" tf:"impossible_travel_options,omitempty"`

	// (Number) Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
	// Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`, `10800`, `21600`.
	KeepAlive *float64 `json:"keepAlive,omitempty" tf:"keep_alive,omitempty"`

	// (Number) A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
	// A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`, `10800`, `21600`, `43200`, `86400`.
	MaxSignalDuration *float64 `json:"maxSignalDuration,omitempty" tf:"max_signal_duration,omitempty"`

	// (Block List, Max: 1) New value rules specific options. (see below for nested schema)
	// New value rules specific options.
	NewValueOptions []NewValueOptionsObservation `json:"newValueOptions,omitempty" tf:"new_value_options,omitempty"`

	// party detection method. (see below for nested schema)
	// Options for rules using the third-party detection method.
	ThirdPartyRuleOptions []ThirdPartyRuleOptionsObservation `json:"thirdPartyRuleOptions,omitempty" tf:"third_party_rule_options,omitempty"`
}

type RuleOptionsParameters struct {

	// production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with staging, test, or dev. Only available when the rule type is log_detection. Defaults to false.
	// If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce noise. The decrement is applied when the environment tag of the signal starts with `staging`, `test`, or `dev`. Only available when the rule type is `log_detection`. Defaults to `false`.
	// +kubebuilder:validation:Optional
	DecreaseCriticalityBasedOnEnv *bool `json:"decreaseCriticalityBasedOnEnv,omitempty" tf:"decrease_criticality_based_on_env,omitempty"`

	// (String) The detection method. Valid values are threshold, new_value, anomaly_detection, impossible_travel, hardcoded, third_party. Defaults to "threshold".
	// The detection method. Valid values are `threshold`, `new_value`, `anomaly_detection`, `impossible_travel`, `hardcoded`, `third_party`. Defaults to `"threshold"`.
	// +kubebuilder:validation:Optional
	DetectionMethod *string `json:"detectionMethod,omitempty" tf:"detection_method,omitempty"`

	// (Number) A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200.
	// A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`.
	// +kubebuilder:validation:Optional
	EvaluationWindow *float64 `json:"evaluationWindow,omitempty" tf:"evaluation_window,omitempty"`

	// (Block List, Max: 1) Options for rules using the impossible travel detection method. (see below for nested schema)
	// Options for rules using the impossible travel detection method.
	// +kubebuilder:validation:Optional
	ImpossibleTravelOptions []ImpossibleTravelOptionsParameters `json:"impossibleTravelOptions,omitempty" tf:"impossible_travel_options,omitempty"`

	// (Number) Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600.
	// Once a signal is generated, the signal will remain “open” if a case is matched at least once within this keep alive window (in seconds). Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`, `10800`, `21600`.
	// +kubebuilder:validation:Optional
	KeepAlive *float64 `json:"keepAlive,omitempty" tf:"keep_alive,omitempty"`

	// (Number) A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are 0, 60, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400.
	// A signal will “close” regardless of the query being matched once the time exceeds the maximum duration (in seconds). This time is calculated from the first seen timestamp. Valid values are `0`, `60`, `300`, `600`, `900`, `1800`, `3600`, `7200`, `10800`, `21600`, `43200`, `86400`.
	// +kubebuilder:validation:Optional
	MaxSignalDuration *float64 `json:"maxSignalDuration,omitempty" tf:"max_signal_duration,omitempty"`

	// (Block List, Max: 1) New value rules specific options. (see below for nested schema)
	// New value rules specific options.
	// +kubebuilder:validation:Optional
	NewValueOptions []NewValueOptionsParameters `json:"newValueOptions,omitempty" tf:"new_value_options,omitempty"`

	// party detection method. (see below for nested schema)
	// Options for rules using the third-party detection method.
	// +kubebuilder:validation:Optional
	ThirdPartyRuleOptions []ThirdPartyRuleOptionsParameters `json:"thirdPartyRuleOptions,omitempty" tf:"third_party_rule_options,omitempty"`
}

type RuleParameters struct {

	// (Block List, Max: 10) Cases for generating signals. (see below for nested schema)
	// Cases for generating signals.
	// +kubebuilder:validation:Optional
	Case []RuleCaseParameters `json:"case,omitempty" tf:"case,omitempty"`

	// (Boolean) Whether the rule is enabled. Defaults to true.
	// Whether the rule is enabled. Defaults to `true`.
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty" tf:"enabled,omitempty"`

	// (Block List) Additional queries to filter matched events before they are processed. (see below for nested schema)
	// Additional queries to filter matched events before they are processed.
	// +kubebuilder:validation:Optional
	Filter []RuleFilterParameters `json:"filter,omitempty" tf:"filter,omitempty"`

	// by values in their title. Defaults to false.
	// Whether the notifications include the triggering group-by values in their title. Defaults to `false`.
	// +kubebuilder:validation:Optional
	HasExtendedTitle *bool `json:"hasExtendedTitle,omitempty" tf:"has_extended_title,omitempty"`

	// (String) Message for generated signals.
	// Message for generated signals.
	// +kubebuilder:validation:Optional
	Message *string `json:"message,omitempty" tf:"message,omitempty"`

	// (String) The name of the rule.
	// The name of the rule.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (Block List, Max: 1) Options on rules. (see below for nested schema)
	// Options on rules.
	// +kubebuilder:validation:Optional
	Options []RuleOptionsParameters `json:"options,omitempty" tf:"options,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Queries for selecting logs which are part of the rule.
	// +kubebuilder:validation:Optional
	Query []QueryParameters `json:"query,omitempty" tf:"query,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// Queries for selecting logs which are part of the rule.
	// +kubebuilder:validation:Optional
	SignalQuery []SignalQueryParameters `json:"signalQuery,omitempty" tf:"signal_query,omitempty"`

	// (Set of String) Tags for generated signals.
	// Tags for generated signals.
	// +kubebuilder:validation:Optional
	// +listType=set
	Tags []*string `json:"tags,omitempty" tf:"tags,omitempty"`

	// party rules. Only required and accepted for third-party rules (see below for nested schema)
	// Cases for generating signals for third-party rules. Only required and accepted for third-party rules
	// +kubebuilder:validation:Optional
	ThirdPartyCase []ThirdPartyCaseParameters `json:"thirdPartyCase,omitempty" tf:"third_party_case,omitempty"`

	// (String) The rule type. Valid values are application_security, log_detection, workload_security, signal_correlation. Defaults to "log_detection".
	// The rule type. Valid values are `application_security`, `log_detection`, `workload_security`, `signal_correlation`. Defaults to `"log_detection"`.
	// +kubebuilder:validation:Optional
	Type *string `json:"type,omitempty" tf:"type,omitempty"`
}

type SignalQueryInitParameters struct {

	// (String) The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
	// The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are `count`, `cardinality`, `sum`, `max`, `new_value`, `geo_data`, `event_count`, `none`. Defaults to `"event_count"`.
	Aggregation *string `json:"aggregation,omitempty" tf:"aggregation,omitempty"`

	// (List of String) Fields to correlate by.
	// Fields to correlate by.
	CorrelatedByFields []*string `json:"correlatedByFields,omitempty" tf:"correlated_by_fields,omitempty"`

	// projected per query attributes of the rule. Defaults to "".
	// Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to `""`.
	CorrelatedQueryIndex *string `json:"correlatedQueryIndex,omitempty" tf:"correlated_query_index,omitempty"`

	// ONLY.
	// Default Rule ID of the signal to correlate. This value is READ-ONLY.
	DefaultRuleID *string `json:"defaultRuleId,omitempty" tf:"default_rule_id,omitempty"`

	// (String) The name of the rule.
	// Name of the query. Not compatible with `new_value` aggregations.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (String) Rule ID of the signal to correlate.
	// Rule ID of the signal to correlate.
	RuleID *string `json:"ruleId,omitempty" tf:"rule_id,omitempty"`
}

type SignalQueryObservation struct {

	// (String) The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
	// The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are `count`, `cardinality`, `sum`, `max`, `new_value`, `geo_data`, `event_count`, `none`. Defaults to `"event_count"`.
	Aggregation *string `json:"aggregation,omitempty" tf:"aggregation,omitempty"`

	// (List of String) Fields to correlate by.
	// Fields to correlate by.
	CorrelatedByFields []*string `json:"correlatedByFields,omitempty" tf:"correlated_by_fields,omitempty"`

	// projected per query attributes of the rule. Defaults to "".
	// Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to `""`.
	CorrelatedQueryIndex *string `json:"correlatedQueryIndex,omitempty" tf:"correlated_query_index,omitempty"`

	// ONLY.
	// Default Rule ID of the signal to correlate. This value is READ-ONLY.
	DefaultRuleID *string `json:"defaultRuleId,omitempty" tf:"default_rule_id,omitempty"`

	// (String) The name of the rule.
	// Name of the query. Not compatible with `new_value` aggregations.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (String) Rule ID of the signal to correlate.
	// Rule ID of the signal to correlate.
	RuleID *string `json:"ruleId,omitempty" tf:"rule_id,omitempty"`
}

type SignalQueryParameters struct {

	// (String) The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are count, cardinality, sum, max, new_value, geo_data, event_count, none. Defaults to "count".
	// The aggregation type. For Signal Correlation rules, it must be event_count. Valid values are `count`, `cardinality`, `sum`, `max`, `new_value`, `geo_data`, `event_count`, `none`. Defaults to `"event_count"`.
	// +kubebuilder:validation:Optional
	Aggregation *string `json:"aggregation,omitempty" tf:"aggregation,omitempty"`

	// (List of String) Fields to correlate by.
	// Fields to correlate by.
	// +kubebuilder:validation:Optional
	CorrelatedByFields []*string `json:"correlatedByFields,omitempty" tf:"correlated_by_fields,omitempty"`

	// projected per query attributes of the rule. Defaults to "".
	// Index of the rule query used to retrieve the correlated field. An empty string applies correlation on the non-projected per query attributes of the rule. Defaults to `""`.
	// +kubebuilder:validation:Optional
	CorrelatedQueryIndex *string `json:"correlatedQueryIndex,omitempty" tf:"correlated_query_index,omitempty"`

	// ONLY.
	// Default Rule ID of the signal to correlate. This value is READ-ONLY.
	// +kubebuilder:validation:Optional
	DefaultRuleID *string `json:"defaultRuleId,omitempty" tf:"default_rule_id,omitempty"`

	// (String) The name of the rule.
	// Name of the query. Not compatible with `new_value` aggregations.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (String) Rule ID of the signal to correlate.
	// Rule ID of the signal to correlate.
	// +kubebuilder:validation:Optional
	RuleID *string `json:"ruleId" tf:"rule_id,omitempty"`
}

type ThirdPartyCaseInitParameters struct {

	// (String) The name of the rule.
	// Name of the case.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (List of String) Notification targets for each rule case.
	// Notification targets for each rule case.
	Notifications []*string `json:"notifications,omitempty" tf:"notifications,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// A query to associate a third-party event to this case.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`

	// (String) Severity of the Security Signal. Valid values are info, low, medium, high, critical.
	// Severity of the Security Signal. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	Status *string `json:"status,omitempty" tf:"status,omitempty"`
}

type ThirdPartyCaseObservation struct {

	// (String) The name of the rule.
	// Name of the case.
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (List of String) Notification targets for each rule case.
	// Notification targets for each rule case.
	Notifications []*string `json:"notifications,omitempty" tf:"notifications,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// A query to associate a third-party event to this case.
	Query *string `json:"query,omitempty" tf:"query,omitempty"`

	// (String) Severity of the Security Signal. Valid values are info, low, medium, high, critical.
	// Severity of the Security Signal. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	Status *string `json:"status,omitempty" tf:"status,omitempty"`
}

type ThirdPartyCaseParameters struct {

	// (String) The name of the rule.
	// Name of the case.
	// +kubebuilder:validation:Optional
	Name *string `json:"name,omitempty" tf:"name,omitempty"`

	// (List of String) Notification targets for each rule case.
	// Notification targets for each rule case.
	// +kubebuilder:validation:Optional
	Notifications []*string `json:"notifications,omitempty" tf:"notifications,omitempty"`

	// (Block List) Queries for selecting logs which are part of the rule. (see below for nested schema)
	// A query to associate a third-party event to this case.
	// +kubebuilder:validation:Optional
	Query *string `json:"query,omitempty" tf:"query,omitempty"`

	// (String) Severity of the Security Signal. Valid values are info, low, medium, high, critical.
	// Severity of the Security Signal. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	// +kubebuilder:validation:Optional
	Status *string `json:"status" tf:"status,omitempty"`
}

type ThirdPartyRuleOptionsInitParameters struct {

	// party cases match.
	// Notification targets for the default rule case, when none of the third-party cases match.
	DefaultNotifications []*string `json:"defaultNotifications,omitempty" tf:"default_notifications,omitempty"`

	// party cases match. Valid values are info, low, medium, high, critical.
	// Severity of the default rule case, when none of the third-party cases match. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	DefaultStatus *string `json:"defaultStatus,omitempty" tf:"default_status,omitempty"`

	// party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. (see below for nested schema)
	// Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
	RootQuery []RootQueryInitParameters `json:"rootQuery,omitempty" tf:"root_query,omitempty"`

	// (String) A template for the signal title; if omitted, the title is generated based on the case name.
	// A template for the signal title; if omitted, the title is generated based on the case name.
	SignalTitleTemplate *string `json:"signalTitleTemplate,omitempty" tf:"signal_title_template,omitempty"`
}

type ThirdPartyRuleOptionsObservation struct {

	// party cases match.
	// Notification targets for the default rule case, when none of the third-party cases match.
	DefaultNotifications []*string `json:"defaultNotifications,omitempty" tf:"default_notifications,omitempty"`

	// party cases match. Valid values are info, low, medium, high, critical.
	// Severity of the default rule case, when none of the third-party cases match. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	DefaultStatus *string `json:"defaultStatus,omitempty" tf:"default_status,omitempty"`

	// party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. (see below for nested schema)
	// Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
	RootQuery []RootQueryObservation `json:"rootQuery,omitempty" tf:"root_query,omitempty"`

	// (String) A template for the signal title; if omitted, the title is generated based on the case name.
	// A template for the signal title; if omitted, the title is generated based on the case name.
	SignalTitleTemplate *string `json:"signalTitleTemplate,omitempty" tf:"signal_title_template,omitempty"`
}

type ThirdPartyRuleOptionsParameters struct {

	// party cases match.
	// Notification targets for the default rule case, when none of the third-party cases match.
	// +kubebuilder:validation:Optional
	DefaultNotifications []*string `json:"defaultNotifications,omitempty" tf:"default_notifications,omitempty"`

	// party cases match. Valid values are info, low, medium, high, critical.
	// Severity of the default rule case, when none of the third-party cases match. Valid values are `info`, `low`, `medium`, `high`, `critical`.
	// +kubebuilder:validation:Optional
	DefaultStatus *string `json:"defaultStatus" tf:"default_status,omitempty"`

	// party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. (see below for nested schema)
	// Queries to be combined with third-party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert.
	// +kubebuilder:validation:Optional
	RootQuery []RootQueryParameters `json:"rootQuery" tf:"root_query,omitempty"`

	// (String) A template for the signal title; if omitted, the title is generated based on the case name.
	// A template for the signal title; if omitted, the title is generated based on the case name.
	// +kubebuilder:validation:Optional
	SignalTitleTemplate *string `json:"signalTitleTemplate,omitempty" tf:"signal_title_template,omitempty"`
}

// RuleSpec defines the desired state of Rule
type RuleSpec struct {
	v1.ResourceSpec `json:",inline"`
	ForProvider     RuleParameters `json:"forProvider"`
	// THIS IS A BETA FIELD. It will be honored
	// unless the Management Policies feature flag is disabled.
	// InitProvider holds the same fields as ForProvider, with the exception
	// of Identifier and other resource reference fields. The fields that are
	// in InitProvider are merged into ForProvider when the resource is created.
	// The same fields are also added to the terraform ignore_changes hook, to
	// avoid updating them after creation. This is useful for fields that are
	// required on creation, but we do not desire to update them after creation,
	// for example because of an external controller is managing them, like an
	// autoscaler.
	InitProvider RuleInitParameters `json:"initProvider,omitempty"`
}

// RuleStatus defines the observed state of Rule.
type RuleStatus struct {
	v1.ResourceStatus `json:",inline"`
	AtProvider        RuleObservation `json:"atProvider,omitempty"`
}

// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
// +kubebuilder:storageversion

// Rule is the Schema for the Rules API. Provides a Datadog Security Monitoring Rule API resource. This can be used to create and manage Datadog security monitoring rules. To change settings for a default rule use datadog_security_default_rule instead.
// +kubebuilder:printcolumn:name="READY",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
// +kubebuilder:printcolumn:name="SYNCED",type="string",JSONPath=".status.conditions[?(@.type=='Synced')].status"
// +kubebuilder:printcolumn:name="EXTERNAL-NAME",type="string",JSONPath=".metadata.annotations.crossplane\\.io/external-name"
// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
// +kubebuilder:resource:scope=Cluster,categories={crossplane,managed,datadog}
type Rule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.message) || (has(self.initProvider) && has(self.initProvider.message))",message="spec.forProvider.message is a required parameter"
	// +kubebuilder:validation:XValidation:rule="!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || (has(self.initProvider) && has(self.initProvider.name))",message="spec.forProvider.name is a required parameter"
	Spec   RuleSpec   `json:"spec"`
	Status RuleStatus `json:"status,omitempty"`
}

// +kubebuilder:object:root=true

// RuleList contains a list of Rules
type RuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Rule `json:"items"`
}

// Repository type metadata.
var (
	Rule_Kind             = "Rule"
	Rule_GroupKind        = schema.GroupKind{Group: CRDGroup, Kind: Rule_Kind}.String()
	Rule_KindAPIVersion   = Rule_Kind + "." + CRDGroupVersion.String()
	Rule_GroupVersionKind = CRDGroupVersion.WithKind(Rule_Kind)
)

func init() {
	SchemeBuilder.Register(&Rule{}, &RuleList{})
}