elasticctl-api 0.10.0

Typed detection-rule model and endpoint wrappers for Elastic Security.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

use crate::diff::{Change, FieldChange};
use crate::model::{ExceptionItem, ExceptionList, Rule};
use serde::Serialize;
use serde_json::Value;

#[derive(Debug, Clone, PartialEq)]
pub struct StackIdentity {
    pub profile: String,
    pub host: String,
    pub space: String,
}

#[derive(Debug, Clone, PartialEq, Serialize)]
pub struct PullReport {
    pub pulled: usize,
    pub exception_lists: usize,
    pub exception_items: usize,
    pub dir: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub selected: Option<usize>,
    #[serde(skip_serializing_if = "is_zero")]
    pub value_lists: usize,
    #[serde(skip_serializing_if = "Vec::is_empty")]
    pub value_list_warnings: Vec<crate::value_lists::Warning>,
}

#[derive(Debug, Clone, PartialEq, Serialize)]
pub struct DiffReport {
    pub clean: bool,
    pub local: usize,
    pub remote: usize,
    pub changes: Vec<Change>,
    pub exceptions: ExceptionDrift,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub value_lists: Option<super::values::ValueListDrift>,
    #[serde(skip_serializing_if = "is_zero")]
    pub out_of_scope: usize,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub selected: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub local_total: Option<usize>,
}

#[derive(Debug, Clone, PartialEq, Serialize)]
pub struct PushReport {
    pub applied: bool,
    pub created: usize,
    pub updated: usize,
    pub skipped_remote_only: usize,
    pub failed: usize,
    pub pending: usize,
    pub lists_created: usize,
    pub lists_updated: usize,
    pub items_created: usize,
    pub items_updated: usize,
    pub items_removed: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub value_lists_created: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub value_lists_updated: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub values_added: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub values_removed: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub value_lists_unknown: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub value_lists_not_reached: usize,
    #[serde(skip_serializing_if = "is_zero")]
    pub out_of_scope: usize,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub selected: Option<usize>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub local_total: Option<usize>,
}

fn is_zero(n: &usize) -> bool {
    *n == 0
}

#[derive(Debug)]
pub struct Mirror {
    pub rules: Vec<Rule>,
    pub lists: Vec<ExceptionList>,
    pub items: Vec<ExceptionItem>,
    pub value_lists: Vec<crate::value_lists::LocalPair>,
    pub has_value_lists: bool,
}

#[derive(Debug, Clone, PartialEq, Serialize)]
pub struct ExceptionDrift {
    pub local: usize,
    pub remote: usize,
    pub changes: Vec<ListChange>,
    pub dangling: Vec<DanglingPointer>,
}

impl ExceptionDrift {
    pub fn is_clean(&self) -> bool {
        self.changes
            .iter()
            .all(|c| matches!(c, ListChange::Unchanged { .. }))
            && self.dangling.is_empty()
    }
}

#[derive(Debug, Clone, PartialEq, Serialize)]
#[serde(tag = "change", rename_all = "snake_case")]
pub enum ListChange {
    Added {
        list_id: String,
        name: String,
    },
    Modified {
        list_id: String,
        name: String,
        fields: Vec<FieldChange>,
    },
    Unchanged {
        list_id: String,
    },
    RemoteOnly {
        list_id: String,
        name: String,
    },
    ItemAdded {
        list_id: String,
        item_id: String,
    },
    ItemModified {
        list_id: String,
        item_id: String,
        fields: Vec<FieldChange>,
    },
    ItemRemoved {
        list_id: String,
        item_id: String,
    },
}

#[derive(Debug, Clone, PartialEq, Serialize)]
pub struct DanglingPointer {
    pub rule_id: String,
    pub list_id: String,
    pub stored_id: Value,
    pub live_id: Option<String>,
}