models.py

# generated by datamodel-codegen:
#   filename:  <stdin>
#   timestamp: 2026-04-21T09:59:01+00:00

from __future__ import annotations

from datetime import datetime
from enum import IntEnum, StrEnum
from typing import Annotated, Dict, List, Literal, Optional, Union

from pydantic import AnyUrl, ConfigDict, Field, RootModel

from .base_model import BaseModelSdk, RootModelSdk


class AllowlistCreateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        str,
        Field(
            description='Name of the allowlist',
            max_length=200,
            min_length=1,
            title='Name',
        ),
    ]
    description: Annotated[
        Optional[str],
        Field(description='Description of the allowlist', title='Description'),
    ] = None


class AllowlistCreateResponse(BaseModelSdk):
    id: Annotated[
        str,
        Field(
            description='ID of the allowlist',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Id',
        ),
    ]
    organization_id: Annotated[
        str, Field(description='ID of the owner organization', title='Organization Id')
    ]
    name: Annotated[str, Field(description='Name of the allowlist', title='Name')]
    description: Annotated[
        Optional[str],
        Field(description='Description of the allowlist', title='Description'),
    ] = None
    created_at: Annotated[
        datetime,
        Field(description='Time the allowlist was created', title='Created At'),
    ]
    updated_at: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist was updated', title='Updated At'),
    ] = None
    from_cti_query: Annotated[
        Optional[str],
        Field(
            description='CTI query from which the blocklist was created',
            title='From Cti Query',
        ),
    ] = None
    since: Annotated[
        Optional[str],
        Field(
            description='Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days',
            title='Since',
        ),
    ] = None
    total_items: Annotated[
        int, Field(description='Number of items in the allowlist', title='Total Items')
    ]


class AllowlistItemUpdateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    description: Annotated[
        Optional[str],
        Field(description='Description of the allowlist entry', title='Description'),
    ] = None
    expiration: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist entry will expire', title='Expiration'),
    ] = None


class AllowlistItemsCreateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    items: Annotated[
        List[str],
        Field(description='List of values to add to the allowlist', title='Items'),
    ]
    description: Annotated[
        str,
        Field(description='Description of the allowlist entry', title='Description'),
    ]
    expiration: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist entry will expire', title='Expiration'),
    ] = None


class AllowlistScope(StrEnum):
    IP = 'ip'
    RANGE = 'range'


class AllowlistSubscriptionResponse(BaseModelSdk):
    updated: Annotated[
        Optional[List[str]],
        Field(
            description='List of updated allowlist ids',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Updated',
        ),
    ] = None
    errors: Annotated[
        Optional[List[Dict[str, str]]],
        Field(
            description='List of errors if any',
            examples=[{'5f9d88b9e5c4f5b9a3d3e8b1': 'error message'}],
            title='Errors',
        ),
    ] = None


class Name(RootModelSdk[str]):
    root: Annotated[
        str,
        Field(
            description='Name of the allowlist',
            max_length=200,
            min_length=1,
            title='Name',
        ),
    ]


class AllowlistUpdateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        Optional[Name], Field(description='Name of the allowlist', title='Name')
    ] = None
    description: Annotated[
        Optional[str],
        Field(description='Description of the allowlist', title='Description'),
    ] = None


class ApiKeyCredentials(BaseModelSdk):
    api_key: Annotated[
        str, Field(description='API key for the integration', title='Api Key')
    ]


class BasicAuthCredentials(BaseModelSdk):
    username: Annotated[
        str,
        Field(description='Basic auth username for the integration', title='Username'),
    ]
    password: Annotated[
        str,
        Field(description='Basic auth password for the integration', title='Password'),
    ]


class BlocklistAddIPsRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    ips: Annotated[List[str], Field(description='List of IPs or networks', title='Ips')]
    expiration: Annotated[
        Optional[datetime],
        Field(
            description='Expiration date',
            examples=['2030-01-01T00:00:00.000Z'],
            title='Expiration',
        ),
    ] = None


class BlocklistCategory(BaseModelSdk):
    name: Annotated[str, Field(title='Name')]
    label: Annotated[str, Field(title='Label')]
    description: Annotated[str, Field(title='Description')]
    priority: Annotated[int, Field(title='Priority')]


class BlocklistCreateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        str,
        Field(
            description='Blocklist name, must be unique within the organization',
            max_length=200,
            min_length=1,
            title='Name',
        ),
    ]
    label: Annotated[
        Optional[str],
        Field(
            description='Blocklist human readable name (Default: name)', title='Label'
        ),
    ] = None
    description: Annotated[
        str,
        Field(description='Blocklist description', min_length=1, title='Description'),
    ]
    references: Annotated[
        Optional[List[str]],
        Field(
            description="Useful references on the list's origins", title='References'
        ),
    ] = []
    tags: Annotated[
        Optional[List[str]], Field(description='Classification tags', title='Tags')
    ] = []


class BlocklistDeleteIPsRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    ips: Annotated[List[str], Field(description='List of IPs or networks', title='Ips')]


class BlocklistIncludeFilters(StrEnum):
    PUBLIC = 'public'
    PRIVATE = 'private'
    SHARED = 'shared'
    ALL = 'all'


class BlocklistSources(StrEnum):
    CROWDSEC = 'crowdsec'
    THIRD_PARTY = 'third_party'
    CUSTOM = 'custom'


class BlocklistSubscription(BaseModelSdk):
    id: Annotated[str, Field(title='Id')]
    remediation: Annotated[Optional[str], Field(title='Remediation')] = None
    name: Annotated[str, Field(title='Name')]
    label: Annotated[str, Field(title='Label')]


class BlocklistSubscriptionResponse(BaseModelSdk):
    updated: Annotated[
        Optional[List[str]],
        Field(
            description='List of updated blocklist ids',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Updated',
        ),
    ] = None
    errors: Annotated[
        Optional[List[Dict[str, str]]],
        Field(
            description='List of errors if any',
            examples=[{'5f9d88b9e5c4f5b9a3d3e8b1': 'error message'}],
            title='Errors',
        ),
    ] = None


class BlocklistUpdateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    label: Annotated[
        Optional[str], Field(description='Blocklist human readable name', title='Label')
    ] = None
    description: Annotated[
        Optional[str], Field(description='Blocklist description', title='Description')
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(description='Blocklist references', title='References'),
    ] = None
    tags: Annotated[
        Optional[List[str]], Field(description='Blocklist tags', title='Tags')
    ] = None
    from_cti_query: Annotated[
        Optional[str],
        Field(
            description='CTI query (doc link available soon)', title='From Cti Query'
        ),
    ] = None
    since: Annotated[
        Optional[str],
        Field(
            description='Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days',
            title='Since',
        ),
    ] = None


class BlocklistUsageStats(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    engines_subscribed_directly: Annotated[
        Optional[int], Field(title='Engines Subscribed Directly')
    ] = 0
    engines_subscribed_through_org: Annotated[
        Optional[int], Field(title='Engines Subscribed Through Org')
    ] = 0
    engines_subscribed_through_tag: Annotated[
        Optional[int], Field(title='Engines Subscribed Through Tag')
    ] = 0
    total_subscribed_engines: Annotated[
        Optional[int], Field(title='Total Subscribed Engines')
    ] = 0
    total_subscribed_organizations: Annotated[
        Optional[int], Field(title='Total Subscribed Organizations')
    ] = 0
    updated_at: Annotated[Optional[datetime], Field(title='Updated At')] = None


class BodyUploadBlocklistContent(BaseModelSdk):
    file: Annotated[
        bytes, Field(description='Blocklist file in txt format', title='File')
    ]


class CVESubscription(BaseModelSdk):
    id: Annotated[str, Field(description='CVE ID', title='Id')]


class CtiAs(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    as_num: Annotated[str, Field(title='As Num')]
    as_name: Annotated[str, Field(title='As Name')]
    total_ips: Annotated[int, Field(title='Total Ips')]


class CtiBehavior(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    name: Annotated[str, Field(title='Name')]
    label: Annotated[str, Field(title='Label')]
    description: Annotated[str, Field(title='Description')]
    references: Annotated[List[str], Field(title='References')]
    total_ips: Annotated[int, Field(title='Total Ips')]


class CtiCategory(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    name: Annotated[str, Field(title='Name')]
    label: Annotated[str, Field(title='Label')]
    description: Annotated[str, Field(title='Description')]
    total_ips: Annotated[int, Field(title='Total Ips')]


class CtiCountry(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    country_short: Annotated[str, Field(title='Country Short')]
    total_ips: Annotated[int, Field(title='Total Ips')]


class CtiIp(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    ip: Annotated[str, Field(title='Ip')]
    total_signals_1m: Annotated[int, Field(title='Total Signals 1M')]
    reputation: Annotated[Optional[str], Field(title='Reputation')] = 'unknown'


class CtiScenario(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    name: Annotated[str, Field(title='Name')]
    label: Annotated[str, Field(title='Label')]
    description: Annotated[str, Field(title='Description')]
    references: Annotated[List[str], Field(title='References')]
    total_ips: Annotated[int, Field(title='Total Ips')]


class DecisionCreateResponse(BaseModelSdk):
    uuid: Annotated[
        str, Field(description='UUID of the created decision', title='Uuid')
    ]


class DecisionTargetType(StrEnum):
    ORG = 'org'
    TAG = 'tag'
    ENTITY = 'entity'


class DecisionsSortBy(StrEnum):
    CREATED_AT = 'created_at'
    EXPIRE_AT = 'expire_at'


class DecisionsSortOrder(StrEnum):
    ASC = 'asc'
    DESC = 'desc'


class EntityType(StrEnum):
    ORG = 'org'
    TAG = 'tag'
    ENGINE = 'engine'
    FIREWALL_INTEGRATION = 'firewall_integration'
    REMEDIATION_COMPONENT_INTEGRATION = 'remediation_component_integration'
    REMEDIATION_COMPONENT = 'remediation_component'
    LOG_PROCESSOR = 'log_processor'


class FingerprintSubscription(BaseModelSdk):
    id: Annotated[str, Field(description='Fingerprint ID', title='Id')]


class InfoResponse(BaseModelSdk):
    organization_id: Annotated[
        str, Field(description='The organization ID', title='Organization Id')
    ]
    subscription_type: Annotated[
        str,
        Field(
            description='The organization subscription type', title='Subscription Type'
        ),
    ]
    api_key_name: Annotated[
        str, Field(description='The API key name that is used', title='Api Key Name')
    ]


class IntegrationType(StrEnum):
    FIREWALL_INTEGRATION = 'firewall_integration'
    REMEDIATION_COMPONENT_INTEGRATION = 'remediation_component_integration'


class Links(BaseModelSdk):
    first: Annotated[
        Optional[str], Field(examples=['/api/v1/users?limit=1&offset1'], title='First')
    ] = None
    last: Annotated[
        Optional[str], Field(examples=['/api/v1/users?limit=1&offset1'], title='Last')
    ] = None
    self: Annotated[
        Optional[str], Field(examples=['/api/v1/users?limit=1&offset1'], title='Self')
    ] = None
    next: Annotated[
        Optional[str], Field(examples=['/api/v1/users?limit=1&offset1'], title='Next')
    ] = None
    prev: Annotated[
        Optional[str], Field(examples=['/api/v1/users?limit=1&offset1'], title='Prev')
    ] = None


class MetricUnits(StrEnum):
    BYTE = 'byte'
    PACKET = 'packet'
    REQUEST = 'request'
    IP = 'ip'
    LINE = 'line'
    EVENT = 'event'


class OutputFormat(StrEnum):
    PLAIN_TEXT = 'plain_text'
    F5 = 'f5'
    REMEDIATION_COMPONENT = 'remediation_component'
    FORTIGATE = 'fortigate'
    PALOALTO = 'paloalto'
    CHECKPOINT = 'checkpoint'
    CISCO = 'cisco'
    JUNIPER = 'juniper'
    MIKROTIK = 'mikrotik'
    PFSENSE = 'pfsense'
    OPNSENSE = 'opnsense'
    SOPHOS = 'sophos'


class Permission(StrEnum):
    READ = 'read'
    WRITE = 'write'


class PricingTiers(StrEnum):
    FREE = 'free'
    PREMIUM = 'premium'
    PLATINUM = 'platinum'


class RemediationMetricsData(BaseModelSdk):
    value: Annotated[
        Union[int, float], Field(description='Value of the metric', title='Value')
    ]
    timestamp: Annotated[
        datetime, Field(description='Timestamp of the metric', title='Timestamp')
    ]


class Share(BaseModelSdk):
    organization_id: Annotated[str, Field(title='Organization Id')]
    permission: Permission


class SourceType(StrEnum):
    USER = 'user'
    APIKEY = 'apikey'


class Stats(BaseModelSdk):
    count: Annotated[
        int,
        Field(
            description='Number of total blocklists items the integration will pull',
            title='Count',
        ),
    ]


class SubscriberEntityType(StrEnum):
    ORG = 'org'
    TAG = 'tag'
    ENGINE = 'engine'
    FIREWALL_INTEGRATION = 'firewall_integration'
    REMEDIATION_COMPONENT_INTEGRATION = 'remediation_component_integration'


class ValidationError(BaseModelSdk):
    loc: Annotated[List[Union[str, int]], Field(title='Location')]
    msg: Annotated[str, Field(title='Message')]
    type: Annotated[str, Field(title='Error Type')]


class VendorSubscription(BaseModelSdk):
    id: Annotated[str, Field(description='Vendor ID', title='Id')]


class VersionDetail(BaseModelSdk):
    deprecated: Annotated[
        Optional[bool],
        Field(
            description='Indicates whether this version is deprecated.',
            title='Deprecated',
        ),
    ] = False
    digest: Annotated[
        str,
        Field(
            description='The SHA256 digest of the versioned file.',
            examples=['Detect FTP bruteforce (vsftpd)'],
            title='Digest',
        ),
    ]


class AdjustmentScore(BaseModelSdk):
    total: Annotated[
        Optional[int], Field(description='Total score adjustment', title='Total')
    ] = 0
    recency: Annotated[
        Optional[int], Field(description='Recency score adjustment', title='Recency')
    ] = 0
    low_info: Annotated[
        Optional[int],
        Field(description='Low information score adjustment', title='Low Info'),
    ] = 0


class AffectedComponent(BaseModelSdk):
    vendor: Annotated[
        Optional[str],
        Field(description='Vendor of the affected component', title='Vendor'),
    ] = None
    product: Annotated[
        Optional[str],
        Field(description='Product name of the affected component', title='Product'),
    ] = None


class AllowlistSubscription(BaseModelSdk):
    id: Annotated[str, Field(title='Id')]


class AttackDetail(BaseModelSdk):
    name: Annotated[str, Field(description='Attack detail name', title='Name')]
    label: Annotated[str, Field(description='Attack detail label', title='Label')]
    description: Annotated[
        str, Field(description='Attack detail description', title='Description')
    ]
    references: Annotated[
        Optional[List[str]],
        Field(description='Attack detail references', title='References'),
    ] = None


class AttackerObjective(StrEnum):
    INFRASTRUCTURE_TAKEOVER = 'infrastructure_takeover'
    RANSOMWARE = 'ransomware'
    DATA_EXFILTRATION = 'data_exfiltration'


class Behavior(BaseModelSdk):
    name: Annotated[str, Field(description='Behavior name', title='Name')]
    label: Annotated[str, Field(description='Behavior label', title='Label')]
    description: Annotated[
        str, Field(description='Behavior description', title='Description')
    ]


class CVEEventOutput(BaseModelSdk):
    name: Annotated[str, Field(title='Name')]
    date: Annotated[str, Field(title='Date')]
    description: Annotated[str, Field(title='Description')]
    label: Annotated[str, Field(title='Label')]
    sorting_priority: Annotated[int, Field(title='Sorting Priority')]


class CVEExploitationPhase(StrEnum):
    INSUFFICIENT_DATA = 'insufficient_data'
    EARLY_EXPLOITATION = 'early_exploitation'
    FRESH_AND_POPULAR = 'fresh_and_popular'
    TARGETED_EXPLOITATION = 'targeted_exploitation'
    MASS_EXPLOITATION = 'mass_exploitation'
    BACKGROUND_NOISE = 'background_noise'
    UNPOPULAR = 'unpopular'
    WEARING_OUT = 'wearing_out'
    UNCLASSIFIED = 'unclassified'


class CvssScore(RootModelSdk[float]):
    root: Annotated[
        float,
        Field(description='CVSS score of the CVE', ge=0.0, le=10.0, title='Cvss Score'),
    ]


class CVEsubscription(BaseModelSdk):
    id: Annotated[str, Field(title='Id')]


class CWE(BaseModelSdk):
    name: Annotated[str, Field(description='Name of the CWE', title='Name')]
    label: Annotated[str, Field(description='Label of the CWE', title='Label')]
    description: Annotated[
        str, Field(description='Description of the CWE', title='Description')
    ]


class Classification(BaseModelSdk):
    name: Annotated[str, Field(description='Classification name', title='Name')]
    label: Annotated[str, Field(description='Classification label', title='Label')]
    description: Annotated[
        str, Field(description='Classification description', title='Description')
    ]


class Classifications(BaseModelSdk):
    false_positives: Annotated[
        Optional[List[Classification]],
        Field(description='False positive classifications', title='False Positives'),
    ] = None
    classifications: Annotated[
        Optional[List[Classification]],
        Field(description='Main classifications', title='Classifications'),
    ] = None


class ExploitationPhase(BaseModelSdk):
    name: Annotated[
        str, Field(description='Name of the exploitation phase', title='Name')
    ]
    label: Annotated[
        str, Field(description='Label of the exploitation phase', title='Label')
    ]
    description: Annotated[
        str,
        Field(description='Description of the exploitation phase', title='Description'),
    ]


class ExploitationPhaseChangeEventItem(BaseModelSdk):
    cve_id: Annotated[str, Field(description='CVE identifier', title='Cve Id')]
    name: Annotated[str, Field(description='Event type name', title='Name')]
    date: Annotated[str, Field(description='Date of the phase change', title='Date')]
    label: Annotated[
        str, Field(description='Human-readable event label', title='Label')
    ]
    description: Annotated[
        str, Field(description='Rendered event description', title='Description')
    ]
    previous_phase: Annotated[
        str,
        Field(description='Previous exploitation phase label', title='Previous Phase'),
    ]
    new_phase: Annotated[
        str, Field(description='New exploitation phase label', title='New Phase')
    ]


class ExploitationPhaseChangeEventsResponsePage(BaseModelSdk):
    items: Annotated[List[ExploitationPhaseChangeEventItem], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class FacetBucket(BaseModelSdk):
    value: Annotated[str, Field(description='Facet value', title='Value')]
    count: Annotated[
        int, Field(description='Number of IPs matching this value', ge=0, title='Count')
    ]


class FingerprintEventOutput(BaseModelSdk):
    name: Annotated[str, Field(title='Name')]
    date: Annotated[str, Field(title='Date')]
    description: Annotated[str, Field(title='Description')]
    label: Annotated[str, Field(title='Label')]


class FingerprintTimelineItem(BaseModelSdk):
    timestamp: Annotated[
        datetime,
        Field(description='Timestamp of the timeline event', title='Timestamp'),
    ]
    count: Annotated[
        int, Field(description='Count of occurrences at the timestamp', title='Count')
    ]


class GetCVEsSortBy(StrEnum):
    RULE_RELEASE_DATE = 'rule_release_date'
    TRENDING = 'trending'
    NB_IPS = 'nb_ips'
    NAME = 'name'
    FIRST_SEEN = 'first_seen'


class GetCVEsSortOrder(StrEnum):
    ASC = 'asc'
    DESC = 'desc'


class History(BaseModelSdk):
    first_seen: Annotated[
        datetime, Field(description='First seen timestamp', title='First Seen')
    ]
    last_seen: Annotated[
        datetime, Field(description='Last seen timestamp', title='Last Seen')
    ]
    full_age: Annotated[int, Field(description='Full age in days', title='Full Age')]
    days_age: Annotated[int, Field(description='Days age', title='Days Age')]


class IndustryRiskProfile(StrEnum):
    TECHNOLOGY_BUSINESS = 'technology_business'
    TRADITIONAL_BUSINESS = 'traditional_business'
    CRITICAL_INFRASTRUCTURE = 'critical_infrastructure'
    PUBLIC_SERVICE = 'public_service'
    SOHO = 'SOHO'


class IndustryType(StrEnum):
    COMMERCE = 'commerce'
    FINANCIAL_SERVICES = 'financial_services'
    HEALTHCARE = 'healthcare'
    GOVERNMENT = 'government'
    NON_PROFIT = 'non_profit'
    INDUSTRY = 'industry'
    MEDIA = 'media'
    EDUCATION = 'education'
    SOHO = 'SOHO'


class IntegrationResponse(BaseModelSdk):
    tags: Annotated[Optional[List[str]], Field(title='Tags')] = []
    organization_id: Annotated[str, Field(title='Organization Id')]
    created_at: Annotated[
        Optional[datetime],
        Field(description='Time the integration was created', title='Created At'),
    ] = None
    entity_type: Annotated[EntityType, Field(description='Type of the integration')]
    id: Annotated[
        Optional[str], Field(description='ID of the integration', title='Id')
    ] = None
    blocklists: Annotated[
        Optional[List[BlocklistSubscription]], Field(title='Blocklists')
    ] = []
    allowlists: Annotated[
        Optional[List[AllowlistSubscription]], Field(title='Allowlists')
    ] = []
    cves: Annotated[Optional[List[CVEsubscription]], Field(title='Cves')] = None
    fingerprints: Annotated[
        Optional[List[FingerprintSubscription]], Field(title='Fingerprints')
    ] = None
    vendors: Annotated[Optional[List[VendorSubscription]], Field(title='Vendors')] = (
        None
    )
    name: Annotated[str, Field(description='Name of the integration', title='Name')]
    updated_at: Annotated[
        Optional[datetime],
        Field(description='Last time the integration was updated', title='Updated At'),
    ] = None
    description: Annotated[
        Optional[str],
        Field(description='Description of the integration', title='Description'),
    ] = None
    output_format: Annotated[
        OutputFormat, Field(description='Output format of the integration')
    ]
    last_pull: Annotated[
        Optional[datetime],
        Field(
            description='Last time the integration pulled blocklists', title='Last Pull'
        ),
    ] = None
    pull_limit: Annotated[
        Optional[int],
        Field(description='Maximum number of items to pull', title='Pull Limit'),
    ] = None
    enable_ip_aggregation: Annotated[
        Optional[bool],
        Field(
            description='Whether to enable IP aggregation into ranges',
            title='Enable Ip Aggregation',
        ),
    ] = False


class IntervalOptions(StrEnum):
    HOUR = 'hour'
    DAY = 'day'
    WEEK = 'week'


class IpsDetailsStats(BaseModelSdk):
    total: Annotated[
        int, Field(description='Total number of matching IPs', ge=0, title='Total')
    ]
    reputation: Annotated[
        List[FacetBucket],
        Field(description='IP count by reputation', title='Reputation'),
    ]
    country: Annotated[
        List[FacetBucket],
        Field(description='IP count by country (top 5)', title='Country'),
    ]
    as_name: Annotated[
        List[FacetBucket],
        Field(description='IP count by AS name (top 5)', title='As Name'),
    ]
    cves: Annotated[
        List[FacetBucket], Field(description='IP count by CVE (top 5)', title='Cves')
    ]
    classifications: Annotated[
        List[FacetBucket],
        Field(
            description='IP count by classification (top 5)', title='Classifications'
        ),
    ]


class Location(BaseModelSdk):
    country: Annotated[
        Optional[str], Field(description='Country code', title='Country')
    ] = None
    city: Annotated[Optional[str], Field(description='City name', title='City')] = None
    latitude: Annotated[
        Optional[float], Field(description='Latitude coordinate', title='Latitude')
    ] = None
    longitude: Annotated[
        Optional[float], Field(description='Longitude coordinate', title='Longitude')
    ] = None


class LookupListItemWithStats(BaseModelSdk):
    value: Annotated[str, Field(description='Lookup entry value', title='Value')]
    nb_cves: Annotated[
        Optional[int], Field(description='Number of CVEs', ge=0, title='Nb Cves')
    ] = 0
    nb_fingerprints: Annotated[
        Optional[int],
        Field(description='Number of fingerprint rules', ge=0, title='Nb Fingerprints'),
    ] = 0
    nb_ips: Annotated[
        Optional[int],
        Field(
            description='Total number of unique IPs targeting this entry',
            ge=0,
            title='Nb Ips',
        ),
    ] = 0
    nb_ips_cves: Annotated[
        Optional[int],
        Field(description='Number of IPs across CVEs', ge=0, title='Nb Ips Cves'),
    ] = 0
    nb_ips_fingerprints: Annotated[
        Optional[int],
        Field(
            description='Number of IPs across fingerprint rules',
            ge=0,
            title='Nb Ips Fingerprints',
        ),
    ] = 0
    latest_rule_release: Annotated[
        Optional[datetime],
        Field(
            description='Most recent rule release date for this entry',
            title='Latest Rule Release',
        ),
    ] = None


class LookupListWithStatsResponsePage(BaseModelSdk):
    items: Annotated[List[LookupListItemWithStats], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class MitreTechnique(BaseModelSdk):
    name: Annotated[str, Field(description='MITRE technique ID', title='Name')]
    label: Annotated[str, Field(description='MITRE technique label', title='Label')]
    description: Annotated[
        str, Field(description='MITRE technique description', title='Description')
    ]


class ProtectRuleTag(BaseModelSdk):
    tag: Annotated[str, Field(description='Tag identifier', title='Tag')]
    label: Annotated[str, Field(description='Human-readable tag label', title='Label')]


class Reference(BaseModelSdk):
    name: Annotated[str, Field(description='Reference name', title='Name')]
    label: Annotated[str, Field(description='Reference label', title='Label')]
    description: Annotated[
        str, Field(description='Reference description', title='Description')
    ]


class ScoreBreakdown(BaseModelSdk):
    aggressiveness: Annotated[
        int, Field(description='Aggressiveness score', title='Aggressiveness')
    ]
    threat: Annotated[int, Field(description='Threat score', title='Threat')]
    trust: Annotated[int, Field(description='Trust score', title='Trust')]
    anomaly: Annotated[int, Field(description='Anomaly score', title='Anomaly')]
    total: Annotated[int, Field(description='Total score', title='Total')]


class Scores(BaseModelSdk):
    overall: Annotated[ScoreBreakdown, Field(description='Overall scores')]
    last_day: Annotated[ScoreBreakdown, Field(description='Last day scores')]
    last_week: Annotated[ScoreBreakdown, Field(description='Last week scores')]
    last_month: Annotated[ScoreBreakdown, Field(description='Last month scores')]


class SinceOptions(IntEnum):
    INTEGER_1 = 1
    INTEGER_7 = 7
    INTEGER_30 = 30


class SubscribeCVEIntegrationRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        str, Field(description='Name of the integration to subscribe', title='Name')
    ]


class SubscribeFingerprintIntegrationRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        str, Field(description='Name of the integration to subscribe', title='Name')
    ]


class SubscribeVendorIntegrationRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        str, Field(description='Name of the integration to subscribe', title='Name')
    ]


class ThreatContext(BaseModelSdk):
    attacker_countries: Annotated[
        Optional[Dict[str, int]],
        Field(
            description='Attacker country distribution (country code → count)',
            examples=[{'FR': 18, 'NL': 23, 'US': 36}],
            title='Attacker Countries',
        ),
    ] = None
    defender_countries: Annotated[
        Optional[Dict[str, int]],
        Field(
            description='Defender country distribution (country code → count)',
            examples=[{'BE': 13, 'FR': 22, 'NL': 22}],
            title='Defender Countries',
        ),
    ] = None
    industry_types: Annotated[
        Optional[Dict[str, int]],
        Field(
            description='Industry type distribution (type → count)',
            examples=[{'commerce': 65, 'government': 5, 'non_profit': 30}],
            title='Industry Types',
        ),
    ] = None
    industry_risk_profiles: Annotated[
        Optional[Dict[str, int]],
        Field(
            description='Industry risk profile distribution (profile → count)',
            examples=[{'SOHO': 25, 'public_service': 10, 'technology_business': 65}],
            title='Industry Risk Profiles',
        ),
    ] = None
    attacker_objectives: Annotated[
        Optional[Dict[str, int]],
        Field(
            description='Attacker objective distribution (objective → count)',
            examples=[{'data_exfiltration': 10, 'infrastructure_takeover': 90}],
            title='Attacker Objectives',
        ),
    ] = None


class TimelineItem(BaseModelSdk):
    timestamp: Annotated[
        datetime,
        Field(description='Timestamp of the timeline event', title='Timestamp'),
    ]
    count: Annotated[
        int, Field(description='Count of occurrences at the timestamp', title='Count')
    ]


class TopProductItem(BaseModelSdk):
    value: Annotated[str, Field(description='Product name', title='Value')]
    nb_ips_cves: Annotated[
        Optional[int],
        Field(description='Number of IPs across CVEs', ge=0, title='Nb Ips Cves'),
    ] = 0
    nb_ips_fingerprints: Annotated[
        Optional[int],
        Field(
            description='Number of IPs across fingerprint rules',
            ge=0,
            title='Nb Ips Fingerprints',
        ),
    ] = 0


class VendorSortBy(StrEnum):
    VALUE = 'value'
    NB_CVES = 'nb_cves'
    NB_IPS = 'nb_ips'
    LATEST_RULE_RELEASE = 'latest_rule_release'


class VendorStatsResponse(BaseModelSdk):
    value: Annotated[str, Field(description='Vendor name', title='Value')]
    nb_cves: Annotated[
        Optional[int], Field(description='Number of CVEs', ge=0, title='Nb Cves')
    ] = 0
    nb_fingerprints: Annotated[
        Optional[int],
        Field(description='Number of fingerprint rules', ge=0, title='Nb Fingerprints'),
    ] = 0
    nb_ips: Annotated[
        Optional[int],
        Field(
            description='Total number of unique IPs targeting this vendor',
            ge=0,
            title='Nb Ips',
        ),
    ] = 0
    nb_ips_cves: Annotated[
        Optional[int],
        Field(description='Number of IPs across CVEs', ge=0, title='Nb Ips Cves'),
    ] = 0
    nb_ips_fingerprints: Annotated[
        Optional[int],
        Field(
            description='Number of IPs across fingerprint rules',
            ge=0,
            title='Nb Ips Fingerprints',
        ),
    ] = 0
    top_products: Annotated[
        Optional[List[TopProductItem]],
        Field(
            description='Top products for this vendor sorted by total IPs descending',
            title='Top Products',
        ),
    ] = None


class AllowlistsListAllowlistsQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class AllowlistsGetAllowlistPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsUpdateAllowlistPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsDeleteAllowlistQueryParameters(BaseModelSdk):
    force: Annotated[
        Optional[bool],
        Field(
            description='Force delete the allowlist, even if it has subscribers',
            title='Force',
        ),
    ] = False


class AllowlistsDeleteAllowlistPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsCreateAllowlistItemsPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsGetAllowlistItemsQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class AllowlistsGetAllowlistItemsPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsGetAllowlistItemPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]
    item_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Item Id')
    ]


class AllowlistsUpdateAllowlistItemPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]
    item_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Item Id')
    ]


class AllowlistsDeleteAllowlistItemPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]
    item_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Item Id')
    ]


class AllowlistsGetAllowlistSubscribersQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class AllowlistsGetAllowlistSubscribersPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsSubscribeAllowlistPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]


class AllowlistsUnsubscribeAllowlistPathParameters(BaseModelSdk):
    allowlist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Allowlist Id')
    ]
    entity_id: Annotated[str, Field(title='Entity Id')]


class BlocklistsGetBlocklistsQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    page_size: Annotated[
        Optional[int], Field(description='Page size', le=1000, title='Page Size')
    ] = 100
    subscribed_only: Annotated[
        Optional[bool],
        Field(description='only subscribed blocklists', title='Subscribed Only'),
    ] = False
    exclude_subscribed: Annotated[
        Optional[bool],
        Field(description='exclude subscribed blocklists', title='Exclude Subscribed'),
    ] = False
    include_filter: Annotated[
        Optional[List[BlocklistIncludeFilters]],
        Field(
            description='Include blocklists with the specified filters',
            title='Include Filter',
        ),
    ] = ['private', 'shared']
    category: Annotated[
        Optional[List[str]], Field(description='Filter by category', title='Category')
    ] = None
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class BlocklistsSearchBlocklistQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class BlocklistsGetBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsUpdateBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsDeleteBlocklistQueryParameters(BaseModelSdk):
    force: Annotated[
        Optional[bool],
        Field(
            description='Force delete the blocklist if it is shared or subscribed',
            title='Force',
        ),
    ] = False


class BlocklistsDeleteBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsUploadBlocklistContentQueryParameters(BaseModelSdk):
    expiration: Annotated[
        Optional[datetime],
        Field(
            description='Blocklist expiration',
            examples=['2026-04-17T08:43:44.302226+00:00'],
            title='Expiration',
        ),
    ] = None
    ignore_invalid_ips: Annotated[
        Optional[bool],
        Field(description='Ignore invalid IPs', title='Ignore Invalid Ips'),
    ] = False


class BlocklistsUploadBlocklistContentPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsAddIpsToBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsOverwriteIpsPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsDeleteIpsFromBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsDownloadBlocklistContentPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsDownloadBlocklistContentHeadersParameters(BaseModelSdk):
    if_modified_since: Annotated[
        Optional[str],
        Field(
            alias='if-modified-since',
            description='If_Modified_Since cache control header',
            title='If-Modified-Since',
        ),
    ] = None
    if_none_match: Annotated[
        Optional[str],
        Field(
            alias='if-none-match',
            description='If_None_Match cache control header',
            title='If-None-Match',
        ),
    ] = None


class BlocklistsSubscribeBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsGetBlocklistSubscribersQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class BlocklistsGetBlocklistSubscribersPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsUnsubscribeBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]
    entity_id: Annotated[str, Field(title='Entity Id')]


class BlocklistsShareBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]


class BlocklistsUnshareBlocklistPathParameters(BaseModelSdk):
    blocklist_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Blocklist Id')
    ]
    unshare_organization_id: Annotated[str, Field(title='Unshare Organization Id')]


class IntegrationsGetIntegrationsQueryParameters(BaseModelSdk):
    tag: Annotated[
        Optional[List[str]],
        Field(
            description='List of tags associated with the integrations (any of)',
            title='Tag',
        ),
    ] = None
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class IntegrationsGetIntegrationPathParameters(BaseModelSdk):
    integration_id: Annotated[str, Field(title='Integration Id')]


class IntegrationsUpdateIntegrationPathParameters(BaseModelSdk):
    integration_id: Annotated[str, Field(title='Integration Id')]


class IntegrationsDeleteIntegrationQueryParameters(BaseModelSdk):
    force: Annotated[
        Optional[bool],
        Field(
            description='Force delete the integration even if it has active subscriptions (it will unsubscribe from all lists)',
            title='Force',
        ),
    ] = False


class IntegrationsDeleteIntegrationPathParameters(BaseModelSdk):
    integration_id: Annotated[str, Field(title='Integration Id')]


class IntegrationsHeadIntegrationContentPathParameters(BaseModelSdk):
    integration_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Integration Id')
    ]


class PageSize(RootModelSdk[int]):
    root: Annotated[
        int,
        Field(
            description='Maximum number of items to return, 0 means no limit (default), should be greater than 10000',
            ge=10000,
            title='Page Size',
        ),
    ]


class IntegrationsGetIntegrationContentQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number to return', ge=1, title='Page')
    ] = 1
    page_size: Annotated[
        Optional[PageSize],
        Field(
            description='Maximum number of items to return, 0 means no limit (default), should be greater than 10000',
            title='Page Size',
        ),
    ] = None
    pull_limit: Annotated[Optional[int], Field(title='Pull Limit')] = None
    enable_ip_aggregation: Annotated[
        Optional[bool], Field(title='Enable Ip Aggregation')
    ] = False


class IntegrationsGetIntegrationContentPathParameters(BaseModelSdk):
    integration_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Integration Id')
    ]


class IntegrationsGetIntegrationContentStreamQueryParameters(BaseModelSdk):
    startup: Annotated[
        Optional[bool],
        Field(
            description="Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull.",
            title='Startup',
        ),
    ] = False


class IntegrationsGetIntegrationContentStreamPathParameters(BaseModelSdk):
    integration_id: Annotated[
        str, Field(examples=['5f9d88b9e5c4f5b9a3d3e8b1'], title='Integration Id')
    ]


class DecisionsGetDecisionsQueryParameters(BaseModelSdk):
    instance_ids: Annotated[
        Optional[List[str]],
        Field(description='Filter decisions by instance IDs', title='Instance Ids'),
    ] = []
    tag_ids: Annotated[
        Optional[List[str]],
        Field(description='Filter decisions by tag IDs', title='Tag Ids'),
    ] = []
    remediation_types: Annotated[
        Optional[List[str]],
        Field(
            description='Filter decisions by remediation types',
            title='Remediation Types',
        ),
    ] = []
    ips: Annotated[
        Optional[List[str]],
        Field(
            description='Filter decisions by IPs (only for IP decisions)', title='Ips'
        ),
    ] = []
    sort_by: Annotated[
        Optional[DecisionsSortBy],
        Field(
            description='Field to sort by (e.g., created_at, duration)', title='Sort By'
        ),
    ] = 'created_at'
    sort_order: Annotated[
        Optional[DecisionsSortOrder],
        Field(
            description="Sort order: 'asc' for ascending, 'desc' for descending",
            title='Sort Order',
        ),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class MetricsGetMetricsRemediationQueryParameters(BaseModelSdk):
    start_date: Annotated[
        Optional[datetime],
        Field(
            description='Start date of the metrics, default to last day',
            title='Start Date',
        ),
    ] = None
    end_date: Annotated[
        Optional[datetime],
        Field(description='End date of the metrics', title='End Date'),
    ] = None
    engine_ids: Annotated[
        Optional[List[str]], Field(description='List of engine ids', title='Engine Ids')
    ] = []
    integration_ids: Annotated[
        Optional[List[str]],
        Field(description='List of integration ids', title='Integration Ids'),
    ] = []
    tags: Annotated[
        Optional[List[str]], Field(description='List of tags', title='Tags')
    ] = []


class HubGetIndexQueryParameters(BaseModelSdk):
    with_content: Annotated[
        Optional[bool],
        Field(description='Include content in the index', title='With Content'),
    ] = False


class HubGetIndexPathParameters(BaseModelSdk):
    branch: Annotated[str, Field(title='Branch')]
    tenant: Annotated[str, Field(title='Tenant')]


class HubHeadIndexQueryParameters(BaseModelSdk):
    with_content: Annotated[
        Optional[bool],
        Field(description='Include content in the index', title='With Content'),
    ] = False


class HubHeadIndexPathParameters(BaseModelSdk):
    branch: Annotated[str, Field(title='Branch')]
    tenant: Annotated[str, Field(title='Tenant')]


class HubGetItemContentPathParameters(BaseModelSdk):
    item_path: Annotated[str, Field(title='Item Path')]
    branch: Annotated[str, Field(title='Branch')]
    tenant: Annotated[str, Field(title='Tenant')]


class HubHeadItemContentPathParameters(BaseModelSdk):
    item_path: Annotated[str, Field(title='Item Path')]
    branch: Annotated[str, Field(title='Branch')]
    tenant: Annotated[str, Field(title='Tenant')]


class CvesGetCvesQueryParameters(BaseModelSdk):
    query: Annotated[
        Optional[str], Field(description='Search query for CVEs', title='Query')
    ] = None
    sort_by: Annotated[
        Optional[GetCVEsSortBy], Field(description='Field to sort by', title='Sort By')
    ] = 'rule_release_date'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    exploitation_phase: Annotated[
        Optional[CVEExploitationPhase],
        Field(description='Filter by exploitation phase', title='Exploitation Phase'),
    ] = None
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class CvesGetCvePathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class CvesGetCveProtectRulesPathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class CvesDownloadCveIpsPathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class Since(RootModelSdk[str]):
    root: Annotated[
        str,
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            pattern='^\\d+[hd]$',
            title='Since',
        ),
    ]


class CvesGetCveIpsDetailsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[Since],
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            title='Since',
        ),
    ] = '14d'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class CvesGetCveIpsDetailsPathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class CvesGetCveIpsDetailsStatsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[Since],
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            title='Since',
        ),
    ] = '14d'


class CvesGetCveIpsDetailsStatsPathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class CvesSubscribeIntegrationToCvePathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class CvesGetCveSubscribedIntegrationsQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class CvesGetCveSubscribedIntegrationsPathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class CvesUnsubscribeIntegrationFromCvePathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]
    integration_name: Annotated[str, Field(title='Integration Name')]


class CvesGetCveTimelineQueryParameters(BaseModelSdk):
    since_days: Annotated[
        Optional[SinceOptions],
        Field(
            description='Time range for the timeline data (in days). Options: 1 (1 day), 7 (1 week), 30 (1 month). Default is 7 days.'
        ),
    ] = 7


class CvesGetCveTimelinePathParameters(BaseModelSdk):
    cve_id: Annotated[str, Field(title='Cve Id')]


class VendorsGetVendorsQueryParameters(BaseModelSdk):
    query: Annotated[
        Optional[str], Field(description='Search query for vendors', title='Query')
    ] = None
    sort_by: Annotated[
        Optional[VendorSortBy],
        Field(
            description='Sort by: value, nb_cves, nb_ips, latest_rule_release',
            title='Sort By',
        ),
    ] = None
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: asc or desc', title='Sort Order'),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class VendorsGetVendorStatsPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class VendorsDownloadVendorIpsPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class VendorsGetVendorIpsDetailsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[Since],
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            title='Since',
        ),
    ] = '14d'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class VendorsGetVendorIpsDetailsPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class VendorsGetVendorIpsDetailsStatsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[Since],
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            title='Since',
        ),
    ] = '14d'


class VendorsGetVendorIpsDetailsStatsPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class VendorsSubscribeIntegrationToVendorPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class VendorsGetVendorSubscribedIntegrationsQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class VendorsGetVendorSubscribedIntegrationsPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class VendorsUnsubscribeIntegrationFromVendorPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]
    integration_name: Annotated[str, Field(title='Integration Name')]


class VendorsGetVendorImpactQueryParameters(BaseModelSdk):
    sort_by: Annotated[
        Optional[GetCVEsSortBy], Field(description='Field to sort by', title='Sort By')
    ] = 'rule_release_date'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class VendorsGetVendorImpactPathParameters(BaseModelSdk):
    vendor: Annotated[str, Field(title='Vendor')]


class ProductsGetProductsQueryParameters(BaseModelSdk):
    query: Annotated[
        Optional[str], Field(description='Search query for products', title='Query')
    ] = None
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class ProductsGetProductImpactQueryParameters(BaseModelSdk):
    sort_by: Annotated[
        Optional[GetCVEsSortBy], Field(description='Field to sort by', title='Sort By')
    ] = 'rule_release_date'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class ProductsGetProductImpactPathParameters(BaseModelSdk):
    product: Annotated[str, Field(title='Product')]


class TrackerTagsGetTagsQueryParameters(BaseModelSdk):
    query: Annotated[
        Optional[str], Field(description='Search query for tags', title='Query')
    ] = None
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class TrackerTagsGetTagImpactQueryParameters(BaseModelSdk):
    sort_by: Annotated[
        Optional[GetCVEsSortBy], Field(description='Field to sort by', title='Sort By')
    ] = 'rule_release_date'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class TrackerTagsGetTagImpactPathParameters(BaseModelSdk):
    tag: Annotated[str, Field(title='Tag')]


class TrackerTagsGetTrackerTagsQueryParameters(BaseModelSdk):
    query: Annotated[
        Optional[str], Field(description='Search query for tags', title='Query')
    ] = None
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class TrackerTagsGetTrackerTagImpactQueryParameters(BaseModelSdk):
    sort_by: Annotated[
        Optional[GetCVEsSortBy], Field(description='Field to sort by', title='Sort By')
    ] = 'rule_release_date'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class TrackerTagsGetTrackerTagImpactPathParameters(BaseModelSdk):
    tag: Annotated[str, Field(title='Tag')]


class FingerprintsGetFingerprintRulesQueryParameters(BaseModelSdk):
    query: Annotated[
        Optional[str],
        Field(description='Search query for fingerprint rules', title='Query'),
    ] = None
    sort_by: Annotated[
        Optional[GetCVEsSortBy], Field(description='Field to sort by', title='Sort By')
    ] = 'rule_release_date'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class FingerprintsDownloadFingerprintIpsPathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class FingerprintsGetFingerprintIpsDetailsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[Since],
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            title='Since',
        ),
    ] = '14d'
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class FingerprintsGetFingerprintIpsDetailsPathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class FingerprintsGetFingerprintIpsDetailsStatsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[Since],
        Field(
            description='Filter IPs seen since this date, format duration (e.g., 7d, 24h), default to 14d',
            title='Since',
        ),
    ] = '14d'


class FingerprintsGetFingerprintIpsDetailsStatsPathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class FingerprintsSubscribeIntegrationToFingerprintPathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class FingerprintsGetFingerprintSubscribedIntegrationsQueryParameters(BaseModelSdk):
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class FingerprintsGetFingerprintSubscribedIntegrationsPathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class FingerprintsUnsubscribeIntegrationFromFingerprintPathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]
    integration_name: Annotated[str, Field(title='Integration Name')]


class FingerprintsGetFingerprintTimelineQueryParameters(BaseModelSdk):
    since_days: Annotated[
        Optional[SinceOptions],
        Field(
            description='Time range for the timeline data (in days). Options: 1 (1 day), 7 (1 week), 30 (1 month). Default is 7 days.'
        ),
    ] = 7
    interval: Annotated[
        Optional[IntervalOptions],
        Field(
            description="Interval for aggregating timeline data. Options: 'hour', 'day', 'week'. Default is adapted based on 'since' parameter.",
            title='Interval',
        ),
    ] = None


class FingerprintsGetFingerprintTimelinePathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class FingerprintsGetFingerprintRulePathParameters(BaseModelSdk):
    fingerprint: Annotated[str, Field(title='Fingerprint')]


class TrackerEventsGetExploitationPhaseChangeEventsQueryParameters(BaseModelSdk):
    since: Annotated[
        Optional[str],
        Field(
            description="Duration string (e.g. '30d', '24h') to filter events",
            title='Since',
        ),
    ] = '30d'
    sort_order: Annotated[
        Optional[GetCVEsSortOrder],
        Field(description='Sort order: ascending or descending', title='Sort Order'),
    ] = 'desc'
    cve_id: Annotated[
        Optional[str],
        Field(description='Filter by CVE identifier (exact match)', title='Cve Id'),
    ] = None
    previous_phase: Annotated[
        Optional[CVEExploitationPhase],
        Field(
            description='Filter by previous exploitation phase name',
            title='Previous Phase',
        ),
    ] = None
    new_phase: Annotated[
        Optional[CVEExploitationPhase],
        Field(description='Filter by new exploitation phase name', title='New Phase'),
    ] = None
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    size: Annotated[
        Optional[int], Field(description='Page size', ge=1, le=100, title='Size')
    ] = 50


class AllowlistSubscriberEntity(BaseModelSdk):
    id: Annotated[str, Field(description='Subscriber entity id', title='Id')]
    entity_type: SubscriberEntityType


class AllowlistSubscriberEntityPage(BaseModelSdk):
    items: Annotated[List[AllowlistSubscriberEntity], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class AllowlistSubscribersCount(BaseModelSdk):
    entity_type: Annotated[
        SubscriberEntityType, Field(description='Subscriber entity type')
    ]
    count: Annotated[int, Field(description='Subscriber entity count', title='Count')]


class AllowlistSubscriptionRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    ids: Annotated[
        Optional[List[str]],
        Field(description='List of subscriber entity id', title='Ids'),
    ] = None
    entity_type: EntityType


class AllowlistUpdateResponse(BaseModelSdk):
    id: Annotated[
        str,
        Field(
            description='ID of the allowlist',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Id',
        ),
    ]
    organization_id: Annotated[
        str, Field(description='ID of the owner organization', title='Organization Id')
    ]
    name: Annotated[str, Field(description='Name of the allowlist', title='Name')]
    description: Annotated[
        Optional[str],
        Field(description='Description of the allowlist', title='Description'),
    ] = None
    created_at: Annotated[
        datetime,
        Field(description='Time the allowlist was created', title='Created At'),
    ]
    updated_at: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist was updated', title='Updated At'),
    ] = None
    from_cti_query: Annotated[
        Optional[str],
        Field(
            description='CTI query from which the blocklist was created',
            title='From Cti Query',
        ),
    ] = None
    since: Annotated[
        Optional[str],
        Field(
            description='Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days',
            title='Since',
        ),
    ] = None
    total_items: Annotated[
        int, Field(description='Number of items in the allowlist', title='Total Items')
    ]
    subscribers: Annotated[
        Optional[List[AllowlistSubscribersCount]],
        Field(
            description='List of subscribers count by entity type', title='Subscribers'
        ),
    ] = []


class AttacksMetrics(BaseModelSdk):
    total: Annotated[
        Union[int, float], Field(description='Total value of the metric', title='Total')
    ]
    label: Annotated[
        str,
        Field(
            description='Label of the metric which is the attack type', title='Label'
        ),
    ]
    progression: Annotated[
        Optional[int],
        Field(
            description='Progression of the metric value from the previous period',
            title='Progression',
        ),
    ] = None
    data: Annotated[
        List[RemediationMetricsData], Field(description='Data points', title='Data')
    ]


class BlocklistContentStats(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    total_seen: Annotated[Optional[int], Field(title='Total Seen')] = 0
    total_fire: Annotated[Optional[int], Field(title='Total Fire')] = 0
    total_seen_1m: Annotated[Optional[int], Field(title='Total Seen 1M')] = 0
    total_in_other_lists: Annotated[
        Optional[int], Field(title='Total In Other Lists')
    ] = 0
    total_false_positive: Annotated[
        Optional[int], Field(title='Total False Positive')
    ] = 0
    false_positive_removed_by_crowdsec: Annotated[
        Optional[int], Field(title='False Positive Removed By Crowdsec')
    ] = 0
    most_present_behaviors: Annotated[
        Optional[List[CtiBehavior]], Field(title='Most Present Behaviors')
    ] = []
    most_present_categories: Annotated[
        Optional[List[CtiCategory]], Field(title='Most Present Categories')
    ] = []
    most_present_scenarios: Annotated[
        Optional[List[CtiScenario]], Field(title='Most Present Scenarios')
    ] = []
    top_as: Annotated[Optional[List[CtiAs]], Field(title='Top As')] = []
    top_attacking_countries: Annotated[
        Optional[List[CtiCountry]], Field(title='Top Attacking Countries')
    ] = []
    top_ips: Annotated[Optional[List[CtiIp]], Field(title='Top Ips')] = []
    updated_at: Annotated[Optional[datetime], Field(title='Updated At')] = None


class BlocklistOrigin(BaseModelSdk):
    label: Annotated[str, Field(description='Label of the blocklist', title='Label')]
    id: Annotated[str, Field(description='ID of the blocklist', title='Id')]
    pricing_tier: Annotated[
        PricingTiers, Field(description='Pricing tier of the blocklist')
    ]


class BlocklistSearchRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    page: Annotated[
        Optional[int], Field(description='Page number', ge=1, title='Page')
    ] = 1
    page_size: Annotated[
        Optional[int], Field(description='Page size', le=1000, title='Page Size')
    ] = 100
    pricing_tiers: Annotated[
        Optional[List[PricingTiers]],
        Field(description='Pricing tiers', title='Pricing Tiers'),
    ] = []
    query: Annotated[
        Optional[str], Field(description='Search query', title='Query')
    ] = ''
    targeted_countries: Annotated[
        Optional[List[str]],
        Field(description='Targeted countries', title='Targeted Countries'),
    ] = []
    classifications: Annotated[
        Optional[List[str]],
        Field(description='Classifications', title='Classifications'),
    ] = []
    behaviors: Annotated[
        Optional[List[str]], Field(description='Behaviors', title='Behaviors')
    ] = []
    min_ips: Annotated[
        Optional[int], Field(description='Minimum number of IPs', ge=0, title='Min Ips')
    ] = 0
    sources: Annotated[
        Optional[List[BlocklistSources]], Field(description='Sources', title='Sources')
    ] = []
    categories: Annotated[
        Optional[List[str]], Field(description='Categories', title='Categories')
    ] = []
    is_private: Annotated[
        Optional[bool], Field(description='Private blocklist', title='Is Private')
    ] = None
    is_subscribed: Annotated[
        Optional[bool],
        Field(description='Subscribed blocklist (None: all)', title='Is Subscribed'),
    ] = None


class BlocklistShareRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    organizations: Annotated[
        List[Share],
        Field(
            description='List of organizations to share the blocklist',
            title='Organizations',
        ),
    ]


class BlocklistStats(BaseModelSdk):
    model_config = ConfigDict(
        extra='allow',
    )
    content_stats: Annotated[Optional[BlocklistContentStats], Field()] = {
        'total_seen': 0,
        'total_fire': 0,
        'total_seen_1m': 0,
        'total_in_other_lists': 0,
        'total_false_positive': 0,
        'false_positive_removed_by_crowdsec': 0,
        'most_present_behaviors': [],
        'most_present_categories': [],
        'most_present_scenarios': [],
        'top_as': [],
        'top_attacking_countries': [],
        'top_ips': [],
    }
    usage_stats: Optional[BlocklistUsageStats] = {
        'engines_subscribed_directly': 0,
        'engines_subscribed_through_org': 0,
        'engines_subscribed_through_tag': 0,
        'total_subscribed_engines': 0,
        'total_subscribed_organizations': 0,
    }
    addition_2days: Annotated[Optional[int], Field(title='Addition 2Days')] = 0
    addition_month: Annotated[Optional[int], Field(title='Addition Month')] = 0
    suppression_2days: Annotated[Optional[int], Field(title='Suppression 2Days')] = 0
    suppression_month: Annotated[Optional[int], Field(title='Suppression Month')] = 0
    change_2days_percentage: Annotated[
        Optional[float], Field(title='Change 2Days Percentage')
    ] = 0.0
    change_month_percentage: Annotated[
        Optional[float], Field(title='Change Month Percentage')
    ] = 0.0
    count: Annotated[Optional[int], Field(title='Count')] = 0
    updated_at: Annotated[Optional[datetime], Field(title='Updated At')] = None


class BlocklistSubscriberEntity(BaseModelSdk):
    id: Annotated[str, Field(description='Subscriber entity id', title='Id')]
    entity_type: SubscriberEntityType
    remediation: Annotated[str, Field(description='Remediation', title='Remediation')]


class BlocklistSubscriberEntityPage(BaseModelSdk):
    items: Annotated[List[BlocklistSubscriberEntity], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class BlocklistSubscribersCount(BaseModelSdk):
    entity_type: Annotated[
        SubscriberEntityType, Field(description='Subscriber entity type')
    ]
    count: Annotated[int, Field(description='Subscriber entity count', title='Count')]


class BlocklistSubscriptionRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    ids: Annotated[
        Optional[List[str]],
        Field(description='List of subscriber entity id', title='Ids'),
    ] = None
    entity_type: SubscriberEntityType
    remediation: Annotated[
        Optional[str], Field(description='Remediation', title='Remediation')
    ] = None


class DecisionTargetModel(BaseModelSdk):
    type: Annotated[
        DecisionTargetType, Field(description='Type of the decision target')
    ]
    value: Annotated[
        str, Field(description='Value of the decision target', title='Value')
    ]


class HTTPValidationError(BaseModelSdk):
    detail: Annotated[Optional[List[ValidationError]], Field(title='Detail')] = None


class IntegrationCreateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        str, Field(description='Name of the integration', min_length=1, title='Name')
    ]
    description: Annotated[
        Optional[str],
        Field(
            description='Description of the integration',
            min_length=1,
            title='Description',
        ),
    ] = None
    entity_type: Annotated[
        IntegrationType, Field(description='Type of the integration')
    ]
    output_format: Annotated[
        OutputFormat, Field(description='Output format of the integration')
    ]
    pull_limit: Annotated[
        Optional[int],
        Field(description='Maximum number of items to pull', title='Pull Limit'),
    ] = None
    enable_ip_aggregation: Annotated[
        Optional[bool],
        Field(
            description='Whether to enable IP aggregation into ranges',
            title='Enable Ip Aggregation',
        ),
    ] = False


class IntegrationCreateResponse(BaseModelSdk):
    id: Annotated[str, Field(description='ID of the integration', title='Id')]
    name: Annotated[
        str,
        Field(
            description='Name of the integration. Should be unique within the organization',
            title='Name',
        ),
    ]
    organization_id: Annotated[
        str, Field(description='ID of the owner organization', title='Organization Id')
    ]
    description: Annotated[
        Optional[str],
        Field(description='Description of the integration', title='Description'),
    ] = None
    created_at: Annotated[
        datetime,
        Field(description='Time the integration was created', title='Created At'),
    ]
    updated_at: Annotated[
        datetime,
        Field(description='Last time the integration was updated', title='Updated At'),
    ]
    entity_type: Annotated[
        IntegrationType, Field(description='Type of the integration')
    ]
    output_format: Annotated[
        OutputFormat, Field(description='Output format of the integration')
    ]
    last_pull: Annotated[
        Optional[datetime],
        Field(
            description='Last time the integration pulled blocklists', title='Last Pull'
        ),
    ] = None
    blocklists: Annotated[
        List[BlocklistSubscription],
        Field(
            description='Blocklists that are subscribed by the integration',
            title='Blocklists',
        ),
    ]
    cves: Annotated[
        List[CVESubscription],
        Field(description='CVEs that are subscribed by the integration', title='Cves'),
    ]
    fingerprints: Annotated[
        List[FingerprintSubscription],
        Field(
            description='Fingerprints that are subscribed by the integration',
            title='Fingerprints',
        ),
    ]
    vendors: Annotated[
        List[VendorSubscription],
        Field(
            description='Vendors that are subscribed by the integration',
            title='Vendors',
        ),
    ]
    endpoint: Annotated[
        AnyUrl,
        Field(
            description="Url that should be used by the firewall or the remediation component to fetch the integration's content",
            title='Endpoint',
        ),
    ]
    stats: Annotated[Optional[Stats], Field(description='Stats of the integration')] = {
        'count': 0
    }
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the integration', title='Tags'),
    ] = []
    pull_limit: Annotated[
        Optional[int],
        Field(description='Maximum number of items to pull', title='Pull Limit'),
    ] = None
    enable_ip_aggregation: Annotated[
        Optional[bool],
        Field(
            description='Whether to enable IP aggregation into ranges',
            title='Enable Ip Aggregation',
        ),
    ] = False
    credentials: Annotated[
        Union[ApiKeyCredentials, BasicAuthCredentials],
        Field(
            description='Credentials that were generated for the integration',
            title='Credentials',
        ),
    ]


class IntegrationGetResponse(BaseModelSdk):
    id: Annotated[str, Field(description='ID of the integration', title='Id')]
    name: Annotated[
        str,
        Field(
            description='Name of the integration. Should be unique within the organization',
            title='Name',
        ),
    ]
    organization_id: Annotated[
        str, Field(description='ID of the owner organization', title='Organization Id')
    ]
    description: Annotated[
        Optional[str],
        Field(description='Description of the integration', title='Description'),
    ] = None
    created_at: Annotated[
        datetime,
        Field(description='Time the integration was created', title='Created At'),
    ]
    updated_at: Annotated[
        datetime,
        Field(description='Last time the integration was updated', title='Updated At'),
    ]
    entity_type: Annotated[
        IntegrationType, Field(description='Type of the integration')
    ]
    output_format: Annotated[
        OutputFormat, Field(description='Output format of the integration')
    ]
    last_pull: Annotated[
        Optional[datetime],
        Field(
            description='Last time the integration pulled blocklists', title='Last Pull'
        ),
    ] = None
    blocklists: Annotated[
        List[BlocklistSubscription],
        Field(
            description='Blocklists that are subscribed by the integration',
            title='Blocklists',
        ),
    ]
    cves: Annotated[
        List[CVESubscription],
        Field(description='CVEs that are subscribed by the integration', title='Cves'),
    ]
    fingerprints: Annotated[
        List[FingerprintSubscription],
        Field(
            description='Fingerprints that are subscribed by the integration',
            title='Fingerprints',
        ),
    ]
    vendors: Annotated[
        List[VendorSubscription],
        Field(
            description='Vendors that are subscribed by the integration',
            title='Vendors',
        ),
    ]
    endpoint: Annotated[
        AnyUrl,
        Field(
            description="Url that should be used by the firewall or the remediation component to fetch the integration's content",
            title='Endpoint',
        ),
    ]
    stats: Annotated[Optional[Stats], Field(description='Stats of the integration')] = {
        'count': 0
    }
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the integration', title='Tags'),
    ] = []
    pull_limit: Annotated[
        Optional[int],
        Field(description='Maximum number of items to pull', title='Pull Limit'),
    ] = None
    enable_ip_aggregation: Annotated[
        Optional[bool],
        Field(
            description='Whether to enable IP aggregation into ranges',
            title='Enable Ip Aggregation',
        ),
    ] = False


class IntegrationGetResponsePage(BaseModelSdk):
    items: Annotated[List[IntegrationGetResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class IntegrationUpdateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    name: Annotated[
        Optional[str], Field(description='New name', min_length=1, title='Name')
    ] = None
    description: Annotated[
        Optional[str],
        Field(description='New description', min_length=1, title='Description'),
    ] = None
    output_format: Annotated[
        Optional[OutputFormat], Field(description='New output format')
    ] = None
    regenerate_credentials: Annotated[
        Optional[bool],
        Field(
            description='Regenerate credentials for the integration',
            title='Regenerate Credentials',
        ),
    ] = None
    pull_limit: Annotated[
        Optional[int],
        Field(description='Maximum number of items to pull', title='Pull Limit'),
    ] = None
    enable_ip_aggregation: Annotated[
        Optional[bool],
        Field(
            description='Whether to enable IP aggregation into ranges',
            title='Enable Ip Aggregation',
        ),
    ] = False


class IntegrationUpdateResponse(BaseModelSdk):
    id: Annotated[str, Field(description='ID of the integration', title='Id')]
    name: Annotated[
        str,
        Field(
            description='Name of the integration. Should be unique within the organization',
            title='Name',
        ),
    ]
    organization_id: Annotated[
        str, Field(description='ID of the owner organization', title='Organization Id')
    ]
    description: Annotated[
        Optional[str],
        Field(description='Description of the integration', title='Description'),
    ] = None
    created_at: Annotated[
        datetime,
        Field(description='Time the integration was created', title='Created At'),
    ]
    updated_at: Annotated[
        datetime,
        Field(description='Last time the integration was updated', title='Updated At'),
    ]
    entity_type: Annotated[
        IntegrationType, Field(description='Type of the integration')
    ]
    output_format: Annotated[
        OutputFormat, Field(description='Output format of the integration')
    ]
    last_pull: Annotated[
        Optional[datetime],
        Field(
            description='Last time the integration pulled blocklists', title='Last Pull'
        ),
    ] = None
    blocklists: Annotated[
        List[BlocklistSubscription],
        Field(
            description='Blocklists that are subscribed by the integration',
            title='Blocklists',
        ),
    ]
    cves: Annotated[
        List[CVESubscription],
        Field(description='CVEs that are subscribed by the integration', title='Cves'),
    ]
    fingerprints: Annotated[
        List[FingerprintSubscription],
        Field(
            description='Fingerprints that are subscribed by the integration',
            title='Fingerprints',
        ),
    ]
    vendors: Annotated[
        List[VendorSubscription],
        Field(
            description='Vendors that are subscribed by the integration',
            title='Vendors',
        ),
    ]
    endpoint: Annotated[
        AnyUrl,
        Field(
            description="Url that should be used by the firewall or the remediation component to fetch the integration's content",
            title='Endpoint',
        ),
    ]
    stats: Annotated[Optional[Stats], Field(description='Stats of the integration')] = {
        'count': 0
    }
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the integration', title='Tags'),
    ] = []
    pull_limit: Annotated[
        Optional[int],
        Field(description='Maximum number of items to pull', title='Pull Limit'),
    ] = None
    enable_ip_aggregation: Annotated[
        Optional[bool],
        Field(
            description='Whether to enable IP aggregation into ranges',
            title='Enable Ip Aggregation',
        ),
    ] = False
    credentials: Annotated[
        Optional[Union[ApiKeyCredentials, BasicAuthCredentials]],
        Field(description='Credentials for the integration', title='Credentials'),
    ] = None


class OriginMetrics(BaseModelSdk):
    origin: Annotated[
        Optional[Union[BlocklistOrigin, str]],
        Field(description='Origin of the metric', title='Origin'),
    ] = None
    data: Annotated[
        List[RemediationMetricsData], Field(description='Data points', title='Data')
    ]


class PublicBlocklistResponse(BaseModelSdk):
    id: Annotated[str, Field(description='Blocklist id', title='Id')]
    created_at: Annotated[
        datetime, Field(description='Blocklist creation date', title='Created At')
    ]
    updated_at: Annotated[
        datetime, Field(description='Blocklist update date', title='Updated At')
    ]
    name: Annotated[
        str,
        Field(
            description='Blocklist name, unique within the organization', title='Name'
        ),
    ]
    label: Annotated[
        Optional[str], Field(description='Blocklist human readable name', title='Label')
    ] = None
    description: Annotated[
        str, Field(description='Blocklist description', title='Description')
    ]
    references: Annotated[
        Optional[List[str]],
        Field(description='Blocklist references', title='References'),
    ] = []
    is_private: Annotated[
        bool,
        Field(
            description='Private blocklist if True or public if False',
            title='Is Private',
        ),
    ]
    tags: Annotated[
        Optional[List[str]], Field(description='Classification tags', title='Tags')
    ] = []
    pricing_tier: Annotated[
        PricingTiers, Field(description='Pricing tier for Crowdsec blocklists only')
    ]
    source: Annotated[BlocklistSources, Field(description='Blocklist source')]
    stats: Annotated[BlocklistStats, Field(description='Blocklist stats')]
    from_cti_query: Annotated[
        Optional[str],
        Field(
            description='CTI query from which the blocklist was created',
            title='From Cti Query',
        ),
    ] = None
    since: Annotated[
        Optional[str],
        Field(
            description='Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days',
            title='Since',
        ),
    ] = None
    shared_with: Annotated[
        Optional[List[Share]],
        Field(description='List of organizations shared with', title='Shared With'),
    ] = []
    organization_id: Annotated[
        Optional[str],
        Field(
            description="Blocklists owner's organization id", title='Organization Id'
        ),
    ] = None
    subscribers: Annotated[
        Optional[List[BlocklistSubscribersCount]],
        Field(
            description='List of subscribers to the blocklist. Only subscribers belonging to your organization are returned',
            title='Subscribers',
        ),
    ] = []
    categories: Annotated[
        Optional[List[BlocklistCategory]],
        Field(description='List of categories for the blocklist', title='Categories'),
    ] = []


class PublicBlocklistResponsePage(BaseModelSdk):
    items: Annotated[List[PublicBlocklistResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class RemediationMetrics(BaseModelSdk):
    total: Annotated[
        Union[int, float], Field(description='Total value of the metric', title='Total')
    ]
    unit: Annotated[MetricUnits, Field(description='Unit of the metric')]
    progression: Annotated[
        Optional[int],
        Field(
            description='Progression of the metric value from the previous period',
            title='Progression',
        ),
    ] = None
    data: Annotated[
        List[OriginMetrics], Field(description='Data points per origin', title='Data')
    ]


class SourceInfo(BaseModelSdk):
    source_type: Annotated[
        SourceType,
        Field(description='The source type that created the allowlist entry'),
    ]
    identifier: Annotated[
        str,
        Field(
            description='The source identifier that created the allowlist entry',
            title='Identifier',
        ),
    ]


class AppsecConfigIndex(BaseModelSdk):
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class AppsecRuleIndex(BaseModelSdk):
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class CollectionIndex(BaseModelSdk):
    appsec_configs: Annotated[
        Optional[List[str]],
        Field(
            alias='appsec-configs',
            description='List of appsec-configs',
            title='Appsec-Configs',
        ),
    ] = None
    appsec_rules: Annotated[
        Optional[List[str]],
        Field(
            alias='appsec-rules',
            description='List of appsec-rules',
            title='Appsec-Rules',
        ),
    ] = None
    collections: Annotated[
        Optional[List[str]],
        Field(description='List of collections', title='Collections'),
    ] = None
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    contexts: Annotated[
        Optional[List[str]], Field(description='List of contexts', title='Contexts')
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    parsers: Annotated[
        Optional[List[str]], Field(description='List of parsers', title='Parsers')
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    postoverflows: Annotated[
        Optional[List[str]],
        Field(description='List of postoverflows', title='Postoverflows'),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    scenarios: Annotated[
        Optional[List[str]], Field(description='List of scenarios', title='Scenarios')
    ] = None
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class ContextIndex(BaseModelSdk):
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class ParserIndex(BaseModelSdk):
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    stage: Annotated[str, Field(description='The stage of the parser', title='Stage')]
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class PostoverflowIndex(BaseModelSdk):
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    stage: Annotated[
        str, Field(description='The stage of the postoverflow', title='Stage')
    ]
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class ScenarioIndex(BaseModelSdk):
    content: Annotated[
        Optional[str],
        Field(
            description='The YAML content of the item, in plaintext.',
            examples=[
                'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n  confidence: 3\n  spoofable: 0\n  classification:\n    - attack.T1110\n  behavior: "ftp:bruteforce"\n  label: "VSFTPD Bruteforce"\n  remediation: true\n  service: vsftpd'
            ],
            title='Content',
        ),
    ] = None
    description: Annotated[
        Optional[str],
        Field(
            description='A short, plaintext description of the item',
            title='Description',
        ),
    ] = None
    labels: Annotated[
        Optional[Dict[str, Union[str, List[str], int]]],
        Field(
            description='Classification labels for the item',
            examples=[
                {
                    'behavior': 'ftp:bruteforce',
                    'classification': ['attack.T1110'],
                    'confidence': 3,
                    'label': 'VSFTPD Bruteforce',
                    'remediation': True,
                    'service': 'vsftpd',
                    'spoofable': 0,
                }
            ],
            title='Labels',
        ),
    ] = None
    path: Annotated[
        Optional[str],
        Field(
            description="Relative path to the item's YAML content",
            examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'],
            title='Path',
        ),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='List of references to external resources', title='References'
        ),
    ] = None
    version: Annotated[
        Optional[str],
        Field(
            description='Current version of the collection',
            examples=['0.2'],
            title='Version',
        ),
    ] = None
    versions: Annotated[
        Optional[Dict[str, VersionDetail]],
        Field(
            description="A dictionary where each key is a version number (e.g., '0.1', '0.2')",
            examples=[
                {
                    '0.1': {
                        'deprecated': False,
                        'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1',
                    },
                    '0.2': {
                        'deprecated': False,
                        'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91',
                    },
                }
            ],
            title='Versions',
        ),
    ] = None


class CVEResponseBase(BaseModelSdk):
    id: Annotated[str, Field(description='ID of the CVE', title='Id')]
    name: Annotated[str, Field(description='Name of the CVE', title='Name')]
    title: Annotated[str, Field(description='Title of the CVE', title='Title')]
    affected_components: Annotated[
        List[AffectedComponent],
        Field(description='List of affected components', title='Affected Components'),
    ]
    crowdsec_score: Annotated[
        int,
        Field(
            description='Live Exploit Tracker score of the CVE',
            ge=0,
            le=10,
            title='Crowdsec Score',
        ),
    ]
    opportunity_score: Annotated[
        Optional[int],
        Field(
            description="Opportunity score indicating if it's an opportunistic(0) or targeted(5) attack (between 0-5)",
            ge=0,
            le=5,
            title='Opportunity Score',
        ),
    ] = 0
    momentum_score: Annotated[
        Optional[int],
        Field(
            description="Momentum score indicating the vulnerability's trendiness based on signal comparison with the previous month. Higher scores (4-5) indicate significantly more signals this month than last month's average, while lower scores (0-1) indicate declining activity (between 0-5)",
            ge=0,
            le=5,
            title='Momentum Score',
        ),
    ] = 0
    first_seen: Annotated[
        Optional[datetime], Field(description='First seen date', title='First Seen')
    ] = None
    last_seen: Annotated[
        Optional[datetime], Field(description='Last seen date', title='Last Seen')
    ] = None
    nb_ips: Annotated[
        int, Field(description='Number of unique IPs affected', ge=0, title='Nb Ips')
    ]
    published_date: Annotated[
        datetime, Field(description='Published date of the CVE', title='Published Date')
    ]
    cvss_score: Annotated[
        Optional[CvssScore],
        Field(description='CVSS score of the CVE', title='Cvss Score'),
    ] = None
    has_public_exploit: Annotated[
        bool,
        Field(
            description='Indicates if there is a public exploit for the CVE',
            title='Has Public Exploit',
        ),
    ]
    rule_release_date: Annotated[
        Optional[datetime],
        Field(
            description='Release date of the associated detection rule',
            title='Rule Release Date',
        ),
    ] = None
    exploitation_phase: Annotated[
        ExploitationPhase, Field(description='Current exploitation phase of the CVE')
    ]
    adjustment_score: Annotated[
        Optional[AdjustmentScore],
        Field(
            description='Score adjustments applied to the CVE score based on various factors'
        ),
    ] = None
    threat_context: Annotated[
        Optional[ThreatContext],
        Field(
            description='Threat context (attacker/defender countries, industries, objectives)'
        ),
    ] = None


class FingerprintRuleResponse(BaseModelSdk):
    id: Annotated[str, Field(description='Fingerprint rule identifier', title='Id')]
    name: Annotated[str, Field(description='Fingerprint rule name', title='Name')]
    title: Annotated[str, Field(description='Fingerprint rule title', title='Title')]
    affected_components: Annotated[
        List[AffectedComponent],
        Field(description='List of affected components', title='Affected Components'),
    ]
    crowdsec_score: Annotated[
        int,
        Field(
            description='Live Exploit Tracker score for the fingerprint rule',
            ge=0,
            le=10,
            title='Crowdsec Score',
        ),
    ]
    opportunity_score: Annotated[
        Optional[int],
        Field(description='Opportunity score', ge=0, le=5, title='Opportunity Score'),
    ] = 0
    momentum_score: Annotated[
        Optional[int],
        Field(description='Momentum score', ge=0, le=5, title='Momentum Score'),
    ] = 0
    first_seen: Annotated[
        Optional[datetime], Field(description='First seen date', title='First Seen')
    ] = None
    last_seen: Annotated[
        Optional[datetime], Field(description='Last seen date', title='Last Seen')
    ] = None
    nb_ips: Annotated[
        int, Field(description='Number of unique IPs observed', ge=0, title='Nb Ips')
    ]
    rule_release_date: Annotated[
        Optional[datetime],
        Field(
            description='Release date of the fingerprint rule',
            title='Rule Release Date',
        ),
    ] = None
    exploitation_phase: Annotated[
        ExploitationPhase, Field(description='Current exploitation phase')
    ]
    adjustment_score: Annotated[
        Optional[AdjustmentScore], Field(description='Score adjustment details')
    ] = None
    threat_context: Annotated[
        Optional[ThreatContext],
        Field(
            description='Threat context (attacker/defender countries, industries, objectives)'
        ),
    ] = None
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the fingerprint rule', title='Tags'),
    ] = None
    description: Annotated[
        Optional[str],
        Field(description='Fingerprint rule description', title='Description'),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='Reference links for the fingerprint rule', title='References'
        ),
    ] = None
    crowdsec_analysis: Annotated[
        Optional[str],
        Field(
            description='CrowdSec analysis for this fingerprint rule',
            title='Crowdsec Analysis',
        ),
    ] = None
    events: Annotated[
        Optional[List[FingerprintEventOutput]],
        Field(
            description='List of events related to the fingerprint rule', title='Events'
        ),
    ] = None


class FingerprintRuleSummary(BaseModelSdk):
    id: Annotated[str, Field(description='Fingerprint rule identifier', title='Id')]
    name: Annotated[str, Field(description='Fingerprint rule name', title='Name')]
    title: Annotated[str, Field(description='Fingerprint rule title', title='Title')]
    affected_components: Annotated[
        List[AffectedComponent],
        Field(description='List of affected components', title='Affected Components'),
    ]
    crowdsec_score: Annotated[
        int,
        Field(
            description='Live Exploit Tracker score for the fingerprint rule',
            ge=0,
            le=10,
            title='Crowdsec Score',
        ),
    ]
    opportunity_score: Annotated[
        Optional[int],
        Field(description='Opportunity score', ge=0, le=5, title='Opportunity Score'),
    ] = 0
    momentum_score: Annotated[
        Optional[int],
        Field(description='Momentum score', ge=0, le=5, title='Momentum Score'),
    ] = 0
    first_seen: Annotated[
        Optional[datetime], Field(description='First seen date', title='First Seen')
    ] = None
    last_seen: Annotated[
        Optional[datetime], Field(description='Last seen date', title='Last Seen')
    ] = None
    nb_ips: Annotated[
        int, Field(description='Number of unique IPs observed', ge=0, title='Nb Ips')
    ]
    rule_release_date: Annotated[
        Optional[datetime],
        Field(
            description='Release date of the fingerprint rule',
            title='Rule Release Date',
        ),
    ] = None
    exploitation_phase: Annotated[
        ExploitationPhase, Field(description='Current exploitation phase')
    ]
    adjustment_score: Annotated[
        Optional[AdjustmentScore], Field(description='Score adjustment details')
    ] = None
    threat_context: Annotated[
        Optional[ThreatContext],
        Field(
            description='Threat context (attacker/defender countries, industries, objectives)'
        ),
    ] = None


class GetCVEResponse(BaseModelSdk):
    id: Annotated[str, Field(description='ID of the CVE', title='Id')]
    name: Annotated[str, Field(description='Name of the CVE', title='Name')]
    title: Annotated[str, Field(description='Title of the CVE', title='Title')]
    affected_components: Annotated[
        List[AffectedComponent],
        Field(description='List of affected components', title='Affected Components'),
    ]
    crowdsec_score: Annotated[
        int,
        Field(
            description='Live Exploit Tracker score of the CVE',
            ge=0,
            le=10,
            title='Crowdsec Score',
        ),
    ]
    opportunity_score: Annotated[
        Optional[int],
        Field(
            description="Opportunity score indicating if it's an opportunistic(0) or targeted(5) attack (between 0-5)",
            ge=0,
            le=5,
            title='Opportunity Score',
        ),
    ] = 0
    momentum_score: Annotated[
        Optional[int],
        Field(
            description="Momentum score indicating the vulnerability's trendiness based on signal comparison with the previous month. Higher scores (4-5) indicate significantly more signals this month than last month's average, while lower scores (0-1) indicate declining activity (between 0-5)",
            ge=0,
            le=5,
            title='Momentum Score',
        ),
    ] = 0
    first_seen: Annotated[
        Optional[datetime], Field(description='First seen date', title='First Seen')
    ] = None
    last_seen: Annotated[
        Optional[datetime], Field(description='Last seen date', title='Last Seen')
    ] = None
    nb_ips: Annotated[
        int, Field(description='Number of unique IPs affected', ge=0, title='Nb Ips')
    ]
    published_date: Annotated[
        datetime, Field(description='Published date of the CVE', title='Published Date')
    ]
    cvss_score: Annotated[
        Optional[CvssScore],
        Field(description='CVSS score of the CVE', title='Cvss Score'),
    ] = None
    has_public_exploit: Annotated[
        bool,
        Field(
            description='Indicates if there is a public exploit for the CVE',
            title='Has Public Exploit',
        ),
    ]
    rule_release_date: Annotated[
        Optional[datetime],
        Field(
            description='Release date of the associated detection rule',
            title='Rule Release Date',
        ),
    ] = None
    exploitation_phase: Annotated[
        ExploitationPhase, Field(description='Current exploitation phase of the CVE')
    ]
    adjustment_score: Annotated[
        Optional[AdjustmentScore],
        Field(
            description='Score adjustments applied to the CVE score based on various factors'
        ),
    ] = None
    threat_context: Annotated[
        Optional[ThreatContext],
        Field(
            description='Threat context (attacker/defender countries, industries, objectives)'
        ),
    ] = None
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the CVE', title='Tags'),
    ] = None
    references: Annotated[
        List[str],
        Field(description='List of references for the CVE', title='References'),
    ]
    description: Annotated[
        str, Field(description='Description of the CVE', title='Description')
    ]
    crowdsec_analysis: Annotated[
        Optional[str],
        Field(description='CrowdSec analysis of the CVE', title='Crowdsec Analysis'),
    ] = None
    cwes: Annotated[
        List[CWE],
        Field(description='List of CWEs associated with the CVE', title='Cwes'),
    ]
    events: Annotated[
        Optional[List[CVEEventOutput]],
        Field(description='List of events related to the CVE', title='Events'),
    ] = None


class GetCVESubscribedIntegrationsResponsePage(BaseModelSdk):
    items: Annotated[List[IntegrationResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class GetCVEsResponsePage(BaseModelSdk):
    items: Annotated[List[CVEResponseBase], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class GetFingerprintRulesResponsePage(BaseModelSdk):
    items: Annotated[List[FingerprintRuleSummary], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class GetFingerprintSubscribedIntegrationsResponsePage(BaseModelSdk):
    items: Annotated[List[IntegrationResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class GetVendorSubscribedIntegrationsResponsePage(BaseModelSdk):
    items: Annotated[List[IntegrationResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class IPItem(BaseModelSdk):
    ip: Annotated[str, Field(description='IP address', title='Ip')]
    reputation: Annotated[
        Optional[str], Field(description='Reputation of the IP', title='Reputation')
    ] = None
    ip_range: Annotated[
        Optional[str], Field(description='IP range', title='Ip Range')
    ] = None
    ip_range_score: Annotated[
        Optional[int], Field(description='IP range score', title='Ip Range Score')
    ] = None
    ip_range_24: Annotated[
        Optional[str], Field(description='IP range /24', title='Ip Range 24')
    ] = None
    ip_range_24_reputation: Annotated[
        Optional[str],
        Field(description='IP range /24 reputation', title='Ip Range 24 Reputation'),
    ] = None
    ip_range_24_score: Annotated[
        Optional[int],
        Field(description='IP range /24 score', title='Ip Range 24 Score'),
    ] = None
    as_name: Annotated[Optional[str], Field(description='AS name', title='As Name')] = (
        None
    )
    as_num: Annotated[Optional[int], Field(description='AS number', title='As Num')] = (
        None
    )
    background_noise_score: Annotated[
        Optional[int],
        Field(description='Background noise score', title='Background Noise Score'),
    ] = None
    background_noise: Annotated[
        Optional[str],
        Field(description='Background noise level', title='Background Noise'),
    ] = None
    confidence: Annotated[
        Optional[str], Field(description='Confidence level', title='Confidence')
    ] = None
    location: Annotated[
        Optional[Location], Field(description='IP location information')
    ] = None
    reverse_dns: Annotated[
        Optional[str], Field(description='Reverse DNS', title='Reverse Dns')
    ] = None
    behaviors: Annotated[
        Optional[List[Behavior]],
        Field(description='List of behaviors', title='Behaviors'),
    ] = None
    references: Annotated[
        Optional[List[Reference]],
        Field(description='List of references', title='References'),
    ] = None
    history: Annotated[Optional[History], Field(description='Historical data')] = None
    classifications: Annotated[
        Optional[Classifications], Field(description='Classification data')
    ] = None
    mitre_techniques: Annotated[
        Optional[List[MitreTechnique]],
        Field(description='MITRE techniques', title='Mitre Techniques'),
    ] = None
    cves: Annotated[
        Optional[List[str]], Field(description='List of CVEs', title='Cves')
    ] = None
    attack_details: Annotated[
        Optional[List[AttackDetail]],
        Field(description='Attack details', title='Attack Details'),
    ] = None
    target_countries: Annotated[
        Optional[Dict[str, int]],
        Field(description='Target countries', title='Target Countries'),
    ] = None
    scores: Annotated[Optional[Scores], Field(description='Scoring information')] = None


class LookupImpactCVEItem(BaseModelSdk):
    id: Annotated[str, Field(description='ID of the CVE', title='Id')]
    name: Annotated[str, Field(description='Name of the CVE', title='Name')]
    title: Annotated[str, Field(description='Title of the CVE', title='Title')]
    affected_components: Annotated[
        List[AffectedComponent],
        Field(description='List of affected components', title='Affected Components'),
    ]
    crowdsec_score: Annotated[
        int,
        Field(
            description='Live Exploit Tracker score of the CVE',
            ge=0,
            le=10,
            title='Crowdsec Score',
        ),
    ]
    opportunity_score: Annotated[
        Optional[int],
        Field(
            description="Opportunity score indicating if it's an opportunistic(0) or targeted(5) attack (between 0-5)",
            ge=0,
            le=5,
            title='Opportunity Score',
        ),
    ] = 0
    momentum_score: Annotated[
        Optional[int],
        Field(
            description="Momentum score indicating the vulnerability's trendiness based on signal comparison with the previous month. Higher scores (4-5) indicate significantly more signals this month than last month's average, while lower scores (0-1) indicate declining activity (between 0-5)",
            ge=0,
            le=5,
            title='Momentum Score',
        ),
    ] = 0
    first_seen: Annotated[
        Optional[datetime], Field(description='First seen date', title='First Seen')
    ] = None
    last_seen: Annotated[
        Optional[datetime], Field(description='Last seen date', title='Last Seen')
    ] = None
    nb_ips: Annotated[
        int, Field(description='Number of unique IPs affected', ge=0, title='Nb Ips')
    ]
    published_date: Annotated[
        datetime, Field(description='Published date of the CVE', title='Published Date')
    ]
    cvss_score: Annotated[
        Optional[CvssScore],
        Field(description='CVSS score of the CVE', title='Cvss Score'),
    ] = None
    has_public_exploit: Annotated[
        bool,
        Field(
            description='Indicates if there is a public exploit for the CVE',
            title='Has Public Exploit',
        ),
    ]
    rule_release_date: Annotated[
        Optional[datetime],
        Field(
            description='Release date of the associated detection rule',
            title='Rule Release Date',
        ),
    ] = None
    exploitation_phase: Annotated[
        ExploitationPhase, Field(description='Current exploitation phase of the CVE')
    ]
    adjustment_score: Annotated[
        Optional[AdjustmentScore],
        Field(
            description='Score adjustments applied to the CVE score based on various factors'
        ),
    ] = None
    threat_context: Annotated[
        Optional[ThreatContext],
        Field(
            description='Threat context (attacker/defender countries, industries, objectives)'
        ),
    ] = None
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the CVE', title='Tags'),
    ] = None
    references: Annotated[
        List[str],
        Field(description='List of references for the CVE', title='References'),
    ]
    description: Annotated[
        str, Field(description='Description of the CVE', title='Description')
    ]
    crowdsec_analysis: Annotated[
        Optional[str],
        Field(description='CrowdSec analysis of the CVE', title='Crowdsec Analysis'),
    ] = None
    cwes: Annotated[
        List[CWE],
        Field(description='List of CWEs associated with the CVE', title='Cwes'),
    ]
    events: Annotated[
        Optional[List[CVEEventOutput]],
        Field(description='List of events related to the CVE', title='Events'),
    ] = None
    type: Annotated[
        Literal['cve'], Field(description='Resource type', title='Type')
    ] = 'cve'


class LookupImpactFingerprintItem(BaseModelSdk):
    id: Annotated[str, Field(description='Fingerprint rule identifier', title='Id')]
    name: Annotated[str, Field(description='Fingerprint rule name', title='Name')]
    title: Annotated[str, Field(description='Fingerprint rule title', title='Title')]
    affected_components: Annotated[
        List[AffectedComponent],
        Field(description='List of affected components', title='Affected Components'),
    ]
    crowdsec_score: Annotated[
        int,
        Field(
            description='Live Exploit Tracker score for the fingerprint rule',
            ge=0,
            le=10,
            title='Crowdsec Score',
        ),
    ]
    opportunity_score: Annotated[
        Optional[int],
        Field(description='Opportunity score', ge=0, le=5, title='Opportunity Score'),
    ] = 0
    momentum_score: Annotated[
        Optional[int],
        Field(description='Momentum score', ge=0, le=5, title='Momentum Score'),
    ] = 0
    first_seen: Annotated[
        Optional[datetime], Field(description='First seen date', title='First Seen')
    ] = None
    last_seen: Annotated[
        Optional[datetime], Field(description='Last seen date', title='Last Seen')
    ] = None
    nb_ips: Annotated[
        int, Field(description='Number of unique IPs observed', ge=0, title='Nb Ips')
    ]
    rule_release_date: Annotated[
        Optional[datetime],
        Field(
            description='Release date of the fingerprint rule',
            title='Rule Release Date',
        ),
    ] = None
    exploitation_phase: Annotated[
        ExploitationPhase, Field(description='Current exploitation phase')
    ]
    adjustment_score: Annotated[
        Optional[AdjustmentScore], Field(description='Score adjustment details')
    ] = None
    threat_context: Annotated[
        Optional[ThreatContext],
        Field(
            description='Threat context (attacker/defender countries, industries, objectives)'
        ),
    ] = None
    tags: Annotated[
        Optional[List[str]],
        Field(description='Tags associated with the fingerprint rule', title='Tags'),
    ] = None
    description: Annotated[
        Optional[str],
        Field(description='Fingerprint rule description', title='Description'),
    ] = None
    references: Annotated[
        Optional[List[str]],
        Field(
            description='Reference links for the fingerprint rule', title='References'
        ),
    ] = None
    crowdsec_analysis: Annotated[
        Optional[str],
        Field(
            description='CrowdSec analysis for this fingerprint rule',
            title='Crowdsec Analysis',
        ),
    ] = None
    events: Annotated[
        Optional[List[FingerprintEventOutput]],
        Field(
            description='List of events related to the fingerprint rule', title='Events'
        ),
    ] = None
    type: Annotated[
        Literal['fingerprint'], Field(description='Resource type', title='Type')
    ] = 'fingerprint'


class Items(RootModelSdk[Union[LookupImpactCVEItem, LookupImpactFingerprintItem]]):
    root: Annotated[
        Union[LookupImpactCVEItem, LookupImpactFingerprintItem],
        Field(discriminator='type'),
    ]


class LookupImpactResponsePage(BaseModelSdk):
    items: Annotated[List[Items], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class ProtectRule(BaseModelSdk):
    link: Annotated[str, Field(description='URL to the rule source', title='Link')]
    published_date: Annotated[
        Optional[datetime],
        Field(description='Date the rule was published', title='Published Date'),
    ] = None
    tags: Annotated[
        Optional[List[ProtectRuleTag]],
        Field(description='Tags associated with the rule', title='Tags'),
    ] = None
    name: Annotated[str, Field(description='Rule name', title='Name')]
    label: Annotated[str, Field(description='Human-readable rule label', title='Label')]
    content: Annotated[
        Optional[str], Field(description='Rule content/definition', title='Content')
    ] = None


class AllowlistGetItemsResponse(BaseModelSdk):
    id: Annotated[
        str,
        Field(
            description='ID of the allowlist entry',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Id',
        ),
    ]
    allowlist_id: Annotated[
        str,
        Field(
            description='ID of the allowlist',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Allowlist Id',
        ),
    ]
    description: Annotated[
        str,
        Field(
            description='Description of the allowlist entry',
            min_length=1,
            title='Description',
        ),
    ]
    scope: Annotated[AllowlistScope, Field(description='Scope of the allowlist entry')]
    value: Annotated[
        str, Field(description='Value of the allowlist entry', title='Value')
    ]
    created_at: Annotated[
        datetime,
        Field(description='Time the allowlist entry was created', title='Created At'),
    ]
    updated_at: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist entry was updated', title='Updated At'),
    ] = None
    created_by: Annotated[
        SourceInfo, Field(description='The source user who created the allowlist entry')
    ]
    updated_by: Annotated[
        Optional[SourceInfo],
        Field(description='The source user who updated the allowlist entry'),
    ] = None
    expiration: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist entry will expire', title='Expiration'),
    ] = None


class AllowlistGetItemsResponsePage(BaseModelSdk):
    items: Annotated[List[AllowlistGetItemsResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class AllowlistGetResponse(BaseModelSdk):
    id: Annotated[
        str,
        Field(
            description='ID of the allowlist',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Id',
        ),
    ]
    organization_id: Annotated[
        str, Field(description='ID of the owner organization', title='Organization Id')
    ]
    name: Annotated[str, Field(description='Name of the allowlist', title='Name')]
    description: Annotated[
        Optional[str],
        Field(description='Description of the allowlist', title='Description'),
    ] = None
    created_at: Annotated[
        datetime,
        Field(description='Time the allowlist was created', title='Created At'),
    ]
    updated_at: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist was updated', title='Updated At'),
    ] = None
    from_cti_query: Annotated[
        Optional[str],
        Field(
            description='CTI query from which the blocklist was created',
            title='From Cti Query',
        ),
    ] = None
    since: Annotated[
        Optional[str],
        Field(
            description='Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days',
            title='Since',
        ),
    ] = None
    total_items: Annotated[
        int, Field(description='Number of items in the allowlist', title='Total Items')
    ]
    subscribers: Annotated[
        Optional[List[AllowlistSubscribersCount]],
        Field(
            description='List of subscribers count by entity type', title='Subscribers'
        ),
    ] = []


class AllowlistGetResponsePage(BaseModelSdk):
    items: Annotated[List[AllowlistGetResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class AllowlistItemUpdateResponse(BaseModelSdk):
    id: Annotated[
        str,
        Field(
            description='ID of the allowlist entry',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Id',
        ),
    ]
    allowlist_id: Annotated[
        str,
        Field(
            description='ID of the allowlist',
            examples=['5f9d88b9e5c4f5b9a3d3e8b1'],
            title='Allowlist Id',
        ),
    ]
    description: Annotated[
        str,
        Field(
            description='Description of the allowlist entry',
            min_length=1,
            title='Description',
        ),
    ]
    scope: Annotated[AllowlistScope, Field(description='Scope of the allowlist entry')]
    value: Annotated[
        str, Field(description='Value of the allowlist entry', title='Value')
    ]
    created_at: Annotated[
        datetime,
        Field(description='Time the allowlist entry was created', title='Created At'),
    ]
    updated_at: Annotated[
        datetime,
        Field(description='Time the allowlist entry was updated', title='Updated At'),
    ]
    created_by: Annotated[
        SourceInfo, Field(description='The source user who created the allowlist entry')
    ]
    updated_by: Annotated[
        SourceInfo, Field(description='The source user who updated the allowlist entry')
    ]
    expiration: Annotated[
        Optional[datetime],
        Field(description='Time the allowlist entry will expire', title='Expiration'),
    ] = None


class ComputedSavedMetrics(BaseModelSdk):
    log_lines: Annotated[
        Optional[List[RemediationMetrics]],
        Field(description='estimated log lines saved', title='Log Lines'),
    ] = []
    storage: Annotated[
        Optional[List[RemediationMetrics]],
        Field(description='estimated storage saved', title='Storage'),
    ] = []
    egress_traffic: Annotated[
        Optional[List[RemediationMetrics]],
        Field(description='estimated egress traffic saved', title='Egress Traffic'),
    ] = []


class DecisionCreateRequest(BaseModelSdk):
    model_config = ConfigDict(
        extra='forbid',
    )
    created_at: Annotated[Optional[datetime], Field(title='Created At')] = None
    uuid: Annotated[
        Optional[str], Field(description='UUID of the decision', title='Uuid')
    ] = None
    id: Annotated[
        Optional[int], Field(description='ID of the decision', title='Id')
    ] = None
    duration: Annotated[
        str, Field(description='Duration of the decision', title='Duration')
    ]
    origin: Annotated[str, Field(description='Origin of the decision', title='Origin')]
    scenario: Annotated[
        str, Field(description='Scenario of the decision', title='Scenario')
    ]
    scope: Annotated[str, Field(description='Scope of the decision', title='Scope')]
    type: Annotated[str, Field(description='Type of the decision', title='Type')]
    value: Annotated[str, Field(description='Value of the decision', title='Value')]
    country: Annotated[
        Optional[str],
        Field(description='Country associated with the decision', title='Country'),
    ] = None
    as_name: Annotated[
        Optional[str],
        Field(description='AS name associated with the decision', title='As Name'),
    ] = None
    as_num: Annotated[
        Optional[int],
        Field(description='AS number associated with the decision', title='As Num'),
    ] = None
    city: Annotated[
        Optional[str],
        Field(description='City associated with the decision', title='City'),
    ] = None
    latitude: Annotated[
        Optional[float],
        Field(description='Latitude associated with the decision', title='Latitude'),
    ] = None
    longitude: Annotated[
        Optional[float],
        Field(description='Longitude associated with the decision', title='Longitude'),
    ] = None
    target: Annotated[DecisionTargetModel, Field(description='Target of the decision')]


class DecisionResponse(BaseModelSdk):
    created_at: Annotated[Optional[datetime], Field(title='Created At')] = None
    uuid: Annotated[str, Field(description='UUID of the decision', title='Uuid')]
    id: Annotated[int, Field(description='ID of the decision', title='Id')]
    duration: Annotated[
        str, Field(description='Duration of the decision', title='Duration')
    ]
    origin: Annotated[str, Field(description='Origin of the decision', title='Origin')]
    scenario: Annotated[
        str, Field(description='Scenario of the decision', title='Scenario')
    ]
    scope: Annotated[str, Field(description='Scope of the decision', title='Scope')]
    type: Annotated[str, Field(description='Type of the decision', title='Type')]
    value: Annotated[str, Field(description='Value of the decision', title='Value')]
    country: Annotated[
        Optional[str],
        Field(description='Country associated with the decision', title='Country'),
    ] = None
    as_name: Annotated[
        Optional[str],
        Field(description='AS name associated with the decision', title='As Name'),
    ] = None
    as_num: Annotated[
        Optional[int],
        Field(description='AS number associated with the decision', title='As Num'),
    ] = None
    city: Annotated[
        Optional[str],
        Field(description='City associated with the decision', title='City'),
    ] = None
    latitude: Annotated[
        Optional[float],
        Field(description='Latitude associated with the decision', title='Latitude'),
    ] = None
    longitude: Annotated[
        Optional[float],
        Field(description='Longitude associated with the decision', title='Longitude'),
    ] = None
    target: Annotated[DecisionTargetModel, Field(description='Target of the decision')]


class DecisionsGetResponsePage(BaseModelSdk):
    items: Annotated[List[DecisionResponse], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class RawMetrics(BaseModelSdk):
    dropped: Annotated[
        Optional[List[RemediationMetrics]],
        Field(description='dropped metrics', title='Dropped'),
    ] = []
    processed: Annotated[
        Optional[List[RemediationMetrics]],
        Field(description='processed metrics', title='Processed'),
    ] = []


class Index(BaseModelSdk):
    appsec_configs: Annotated[
        Optional[Dict[str, AppsecConfigIndex]],
        Field(alias='appsec-configs', title='Appsec-Configs'),
    ] = None
    appsec_rules: Annotated[
        Optional[Dict[str, AppsecRuleIndex]],
        Field(alias='appsec-rules', title='Appsec-Rules'),
    ] = None
    collections: Annotated[
        Optional[Dict[str, CollectionIndex]], Field(title='Collections')
    ] = None
    contexts: Annotated[Optional[Dict[str, ContextIndex]], Field(title='Contexts')] = (
        None
    )
    parsers: Annotated[Optional[Dict[str, ParserIndex]], Field(title='Parsers')] = None
    postoverflows: Annotated[
        Optional[Dict[str, PostoverflowIndex]], Field(title='Postoverflows')
    ] = None
    scenarios: Annotated[
        Optional[Dict[str, ScenarioIndex]], Field(title='Scenarios')
    ] = None


class GetCVEIPsResponsePage(BaseModelSdk):
    items: Annotated[List[IPItem], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class GetCVEProtectRulesResponse(BaseModelSdk):
    protect_rules: Annotated[
        Optional[List[ProtectRule]],
        Field(
            description='Protection/detection rules associated with the CVE',
            title='Protect Rules',
        ),
    ] = None


class GetFingerprintIPsResponsePage(BaseModelSdk):
    items: Annotated[List[IPItem], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class GetVendorIPsResponsePage(BaseModelSdk):
    items: Annotated[List[IPItem], Field(title='Items')]
    total: Annotated[int, Field(ge=0, title='Total')]
    page: Annotated[int, Field(ge=1, title='Page')]
    size: Annotated[int, Field(ge=1, title='Size')]
    pages: Annotated[int, Field(ge=0, title='Pages')]
    links: Links


class ComputedMetrics(BaseModelSdk):
    saved: Annotated[ComputedSavedMetrics, Field(description='estimated saved metrics')]
    dropped: Annotated[
        Optional[List[RemediationMetrics]],
        Field(description='estimated dropped metrics', title='Dropped'),
    ] = []
    prevented: Annotated[
        Optional[List[AttacksMetrics]],
        Field(description='prevented attacks metrics', title='Prevented'),
    ] = []


class GetRemediationMetricsResponse(BaseModelSdk):
    raw: Annotated[RawMetrics, Field(description='Raw metrics data')]
    computed: Annotated[ComputedMetrics, Field(description='Computed metrics data')]