| 1 | from datetime import datetime |
| 2 | from enum import Enum |
| 3 | from typing import List |
| 4 | from typing import Optional |
| 5 | |
| 6 | from pydantic import BaseModel |
| 7 | from pydantic import ConfigDict |
| 8 | from pydantic import Field |
| 9 | |
| 10 | |
| 11 | class EventType(str, Enum): |
| 12 | EDR = "EDR" |
| 13 | EPP = "EPP" |
| 14 | CLOUD_INTEGRATION = "Cloud Integration" |
| 15 | NETWORK_SECURITY = "Network Security" |
| 16 | |
| 17 | |
| 18 | class DisplayColumn(BaseModel): |
| 19 | """One column the SOC has chosen to surface in the event-search table.""" |
| 20 | |
| 21 | key: str = Field( |
| 22 | ..., |
| 23 | description="Field path in the event source's _source object (dotted, e.g. 'agent.name' or 'data.win.eventdata.targetUserName').", |
| 24 | ) |
| 25 | label: str = Field(..., description="Human-readable column header.") |
| 26 | width: Optional[int] = Field(None, description="Optional pixel width hint for the table column.") |
| 27 | |
| 28 | |
| 29 | class EventSourceCreate(BaseModel): |
| 30 | customer_code: str = Field(..., max_length=50) |
| 31 | name: str = Field(..., max_length=255) |
| 32 | index_pattern: str = Field(..., max_length=1024) |
| 33 | event_type: EventType |
| 34 | time_field: str = Field("timestamp", max_length=255) |
| 35 | enabled: bool = True |
| 36 | displayed_columns: Optional[List[DisplayColumn]] = Field( |
| 37 | None, |
| 38 | description="Per-source column layout for the event-search table. None or empty falls back to the frontend's hardcoded defaults.", |
| 39 | ) |
| 40 | |
| 41 | |
| 42 | class EventSourceUpdate(BaseModel): |
| 43 | name: Optional[str] = Field(None, max_length=255) |
| 44 | index_pattern: Optional[str] = Field(None, max_length=1024) |
| 45 | event_type: Optional[EventType] = None |
| 46 | time_field: Optional[str] = Field(None, max_length=255) |
| 47 | enabled: Optional[bool] = None |
| 48 | displayed_columns: Optional[List[DisplayColumn]] = None |
| 49 | |
| 50 | |
| 51 | class EventSourceResponse(BaseModel): |
| 52 | id: int |
| 53 | customer_code: str |
| 54 | name: str |
| 55 | index_pattern: str |
| 56 | event_type: str |
| 57 | time_field: str |
| 58 | enabled: bool |
| 59 | displayed_columns: Optional[List[DisplayColumn]] = None |
| 60 | created_at: datetime |
| 61 | updated_at: datetime |
| 62 | model_config = ConfigDict(from_attributes=True) |
| 63 | |
| 64 | |
| 65 | class EventSourcesListResponse(BaseModel): |
| 66 | event_sources: List[EventSourceResponse] |
| 67 | success: bool |
| 68 | message: str |
| 69 | |
| 70 | |
| 71 | class EventSourceOperationResponse(BaseModel): |
| 72 | event_source: Optional[EventSourceResponse] = None |
| 73 | success: bool |
| 74 | message: str |
| 75 | |
| 76 | |
| 77 | class EventSourceDeleteResponse(BaseModel): |
| 78 | success: bool |
| 79 | message: str |