From eaf5db9133b441db3f76558446b4873581cd42bb Mon Sep 17 00:00:00 2001 From: he2ss <19668340+he2ss@users.noreply.github.com> Date: Mon, 18 Nov 2024 16:31:45 +0000 Subject: [PATCH] Update python SDK 1.43.1 --- crowdsec_service_api/__init__.py | 15 +- .../__pycache__/base_model.cpython-311.pyc | Bin 3205 -> 3628 bytes .../__pycache__/http_client.cpython-311.pyc | Bin 7533 -> 7533 bytes crowdsec_service_api/base_model.py | 11 +- crowdsec_service_api/models.py | 729 +++++++++++++++++- .../__pycache__/__init__.cpython-311.pyc | Bin 248 -> 248 bytes crowdsec_service_api/services/blocklists.py | 3 +- crowdsec_service_api/services/integrations.py | 3 +- doc/Blocklists.md | 7 +- doc/Hub.md | 16 +- doc/Integrations.md | 2 + doc/Models.md | 169 +++- doc/README.md | 24 +- openapi.json | 2 +- pyproject.toml | 2 +- 15 files changed, 903 insertions(+), 80 deletions(-) diff --git a/crowdsec_service_api/__init__.py b/crowdsec_service_api/__init__.py index e56a2db..de07407 100644 --- a/crowdsec_service_api/__init__.py +++ b/crowdsec_service_api/__init__.py @@ -1,6 +1,6 @@ from enum import Enum -from .base_model import Page from .models import * +from .base_model import Page from .services.blocklists import Blocklists from .services.integrations import Integrations from .services.info import Info @@ -18,6 +18,7 @@ class Server(Enum): 'ApiKeyCredentials', 'BasicAuthCredentials', 'BlocklistAddIPsRequest', + 'BlocklistCategory', 'BlocklistContentStats', 'BlocklistCreateRequest', 'BlocklistCreateResponse', @@ -43,7 +44,6 @@ class Server(Enum): 'CtiCountry', 'CtiIp', 'CtiScenario', - 'EntityType', 'HTTPValidationError', 'InfoResponse', 'IntegrationCreateRequest', @@ -61,10 +61,17 @@ class Server(Enum): 'PricingTiers', 'Share', 'Stats', + 'SubscriberEntityType', 'ValidationError', - 'HubItem', - 'HubType', + 'AppsecConfigIndex', + 'AppsecRuleIndex', + 'CollectionIndex', + 'ContextIndex', 'Index', + 'ParserIndex', + 'PostoverflowIndex', + 'ScenarioIndex', + 'VersionDetail', 'ApiKeyAuth', 'Server', 'Page' diff --git a/crowdsec_service_api/__pycache__/base_model.cpython-311.pyc b/crowdsec_service_api/__pycache__/base_model.cpython-311.pyc index e755ef949eb7f37d74731030e01981d1e81ffd92..71900855e9aedd53cc8a70006a6e00afd7cfe219 100644 GIT binary patch delta 1412 zcmb7D&2Jk;6rb6hU9TN~G|iXe=EE@|joYR^(4q>Wh_-4)5lW&~q{s(Wi+7sZxa%;x zMpa~#A{Akzf+9^J6+$QnBtYWOq9E>^xZzeoMEh5yDhEC;yf^EntrQN-&i?kj-+TM! z&6_tL4u3zA{w9@55Ez&Lnphq+@1=LNwVy%#h-?r}%G4!g?G55muDjYS@SJgD82!}% zR#&XaW6!W`U)I={HIa2=Ws65qoF~Dpt|< z+vGYer!JA=!H_LF%RG!-;^Mt(1q8cNuW~PtpXvzM6Ll|KOpvXiKWkno83Aa^Di(ZruBJ=@-8QXR|uMs#wwc$aLL<~*Y zvxpWt=v6Nen20E#%G_!tP_+{!)KlH^R(QQ`+eIp-f%Wk`Uy-}4fAlwypqNjdoz!55 z;k?fVWxr9os2StCK@z8qP@wwd;^^iHu;Ho$xC(I@DB$&jD z@_jS+f~t6=1L^Ak&>>GX$boKO@3qKt@>laH9hd)@!}Poyh`Dq{uExH~X>i~*te6_E z;j$K~(w4p%ha>NoOV%(o<%)IgEiBur{!*!=8X)TDL{!|wl2dQ;b3!yks4w$CU_Rm$ z0_GT+e&s5^#zWKNLA_B?wGLU$Z+LLrYAfTiFFrkb9GB>QocUgdp@+XE-;BSkou%@2 zeE#sRN%{-xCvMMm`p&@ob`s$3^iMNC%-kz&l_Ii}JR@0RY6kC%zzZU>2)KqyUiDv8 zG1Y7c1$jBqqKD*mV(GL>KZ)LH1og8Dqr3-@!yBX`{B6x%Yq-ripA+YS!#47B@|~U^ ePo*jL!T#8uy)(4g`(^H-vj6e4S3xc&PyP$s`!=Bf delta 1038 zcmZ{i&1(}u6u@_~AK7faOl!YlW75>7U2D<`7Da;}hk_s!p%^4kmzbTlThfirZlsn% zdrS{kQu<&x1jQ zV^TX?pS>Wy3~hT>pRwsWhq*k`xxD8Rhj}dYfsHFz)KQj=u!OyBTF;(Zeow6cT3yV` zySzx*qm3mWTT7wJ#b6N`*m@eQ$vn$u`q|}8(xh#Qn6%U({{YmnA|Xmn0^t4 zl_SjAI=6zV9GwtTQ58+8$nlwY$=0s1ovOzXEL@r;1N5etScPy_H^UmY9q#%Vj=vAb ztHQhR(1-9)O&%h!qzYt!{YVlp2si}V0Exi31JDWZ0(u#ou%;DEvuqb^qikB5Mr6?P zhG~;H7$smT=tl9FO-4Y`1%Ozj2M}!nB3Snr*8Y0vU1^~oiK)-re?ZTBuXn>~9r&;1NaG#;0a`eP73>$McvUr9>BH^CGku}XQ4O`Qe_w6J&)6^WK zOY-P}7_%;V7@7hZ02g0#^tG&`B|7MPeAtFd?1&B7+L2bJb;00P_^Lub`O-+FK4tO> zWM!E@IX32|M)fyRrsN8x3Z5jSOdNg=+XRAHuC6JL|CxO zCM%?S-x%FeMq()l5ozA+PlG_ItrxVeoI)9z@lPecOWgk6N9g|XT4$QQ8<(HVJe+x; zZEB5qEs&;9{i!rGaVsDJ@Bfz7Z6H95{_wA$B((y$bMEN_U>yR$X&Y`_>-NU@C1)4Q rdZmOT8Fi7ErVYAGdS@Z>Dbxf diff --git a/crowdsec_service_api/__pycache__/http_client.cpython-311.pyc b/crowdsec_service_api/__pycache__/http_client.cpython-311.pyc index 34d8f788a6455029c03cecd44debb0108c6710ab..73c8b05b9302cbcc7394bfba5c630411a0d04dd0 100644 GIT binary patch delta 21 bcmaEB_121KIWI340}zD&R7~H "Page[T]": - return client.next_page(self) + def __init__(self, _client: "Service", **data): + super().__init__(**data) + self._client = _client + + def next(self, client: "Service" = None) -> "Page[T]": + return (client if client is not None else self._client).next_page(self) class Service: @@ -41,5 +46,5 @@ def next_page(self, page: Page[T]) -> Page[T]: response = self.http_client.get( f"{parsed_url.scheme}://{parsed_url.netloc}{page.links['next']}" ) - return Page[T](**response.json()) + return page.__class__(_client=self, **response.json()) return None diff --git a/crowdsec_service_api/models.py b/crowdsec_service_api/models.py index f373f80..a21bb5c 100644 --- a/crowdsec_service_api/models.py +++ b/crowdsec_service_api/models.py @@ -1,6 +1,6 @@ # generated by datamodel-codegen: # filename: -# timestamp: 2024-09-23T13:03:35+00:00 +# timestamp: 2024-11-18T16:31:43+00:00 from __future__ import annotations @@ -40,6 +40,13 @@ class BlocklistAddIPsRequest(BaseModelSdk): ] = None +class BlocklistCategory(BaseModelSdk): + name: Annotated[str, Field(title='Name')] + label: Annotated[str, Field(title='Label')] + description: Annotated[str, Field(title='Description')] + priority: Annotated[int, Field(title='Priority')] + + class BlocklistCreateRequest(BaseModelSdk): model_config = ConfigDict( extra='forbid', @@ -181,6 +188,9 @@ class BlocklistUsageStats(BaseModelSdk): total_subscribed_engines: Annotated[ Optional[int], Field(title='Total Subscribed Engines') ] = 0 + total_subscribed_organizations: Annotated[ + Optional[int], Field(title='Total Subscribed Organizations') + ] = 0 updated_at: Annotated[Optional[AwareDatetime], Field(title='Updated At')] = None @@ -248,14 +258,6 @@ class CtiScenario(BaseModelSdk): total_ips: Annotated[int, Field(title='Total Ips')] -class EntityType(Enum): - ORG = 'org' - TAG = 'tag' - ENGINE = 'engine' - FIREWALL_INTEGRATION = 'firewall_integration' - REMEDIATION_COMPONENT_INTEGRATION = 'remediation_component_integration' - - class InfoResponse(BaseModelSdk): organization_id: Annotated[ str, Field(description='The organization ID', title='Organization Id') @@ -346,28 +348,36 @@ class Stats(BaseModelSdk): ] +class SubscriberEntityType(Enum): + ORG = 'org' + TAG = 'tag' + ENGINE = 'engine' + FIREWALL_INTEGRATION = 'firewall_integration' + REMEDIATION_COMPONENT_INTEGRATION = 'remediation_component_integration' + + class ValidationError(BaseModelSdk): loc: Annotated[List[Union[str, int]], Field(title='Location')] msg: Annotated[str, Field(title='Message')] type: Annotated[str, Field(title='Error Type')] -class HubItem(BaseModelSdk): - pass - - -class HubType(Enum): - PARSERS = 'parsers' - POSTOVERFLOWS = 'postoverflows' - SCENARIOS = 'scenarios' - COLLECTIONS = 'collections' - CONTEXTS = 'contexts' - APPSEC_CONFIGS = 'appsec-configs' - APPSEC_RULES = 'appsec-rules' - - -class Index(RootModel[Optional[Dict[str, Dict[str, HubItem]]]]): - root: Optional[Dict[str, Dict[str, HubItem]]] = None +class VersionDetail(BaseModelSdk): + deprecated: Annotated[ + Optional[bool], + Field( + description='Indicates whether this version is deprecated.', + title='Deprecated', + ), + ] = False + digest: Annotated[ + Optional[str], + Field( + description='The SHA256 digest of the versioned file.', + examples=['Detect FTP bruteforce (vsftpd)'], + title='Digest', + ), + ] = None class BlocklistsGetBlocklistsQueryParameters(BaseModelSdk): @@ -379,14 +389,11 @@ class BlocklistsGetBlocklistsQueryParameters(BaseModelSdk): ] = 100 subscribed_only: Annotated[ Optional[bool], - Field( - description='Fetch only blocklists subscribed by your organization, engines or tags', - title='Subscribed Only', - ), + Field(description='only subscribed blocklists', title='Subscribed Only'), ] = False exclude_subscribed: Annotated[ Optional[bool], - Field(description='Exclude subscribed blocklists', title='Exclude Subscribed'), + Field(description='exclude subscribed blocklists', title='Exclude Subscribed'), ] = False include_filter: Annotated[ Optional[List[BlocklistIncludeFilters]], @@ -395,6 +402,9 @@ class BlocklistsGetBlocklistsQueryParameters(BaseModelSdk): title='Include Filter', ), ] = ['private', 'shared'] + category: Annotated[ + Optional[List[str]], Field(description='Filter by category', title='Category') + ] = None size: Annotated[ Optional[int], Field(description='Page size', ge=1, le=100, title='Size') ] = 50 @@ -431,7 +441,11 @@ class BlocklistsDeleteBlocklistPathParameters(BaseModelSdk): class BlocklistsUploadBlocklistContentQueryParameters(BaseModelSdk): expiration: Annotated[ Optional[AwareDatetime], - Field(description='Blocklist expiration', title='Expiration'), + Field( + description='Blocklist expiration', + examples='2024-11-18T16:31:37.285809+00:00', + title='Expiration', + ), ] = None ignore_invalid_ips: Annotated[ Optional[bool], @@ -515,6 +529,13 @@ class BlocklistsUnshareBlocklistPathParameters(BaseModelSdk): class IntegrationsGetIntegrationsQueryParameters(BaseModelSdk): + tag: Annotated[ + Optional[List[str]], + Field( + description='List of tags associated with the integrations (any of)', + title='Tag', + ), + ] = None page: Annotated[ Optional[int], Field(description='Page number', ge=1, title='Page') ] = 1 @@ -690,6 +711,9 @@ class BlocklistSearchRequest(BaseModelSdk): sources: Annotated[ Optional[List[BlocklistSources]], Field(description='Sources', title='Sources') ] = [] + categories: Annotated[ + Optional[List[str]], Field(description='Categories', title='Categories') + ] = [] is_private: Annotated[ Optional[bool], Field(description='Private blocklist', title='Is Private') ] = None @@ -735,6 +759,7 @@ class BlocklistStats(BaseModelSdk): 'engines_subscribed_through_org': 0, 'engines_subscribed_through_tag': 0, 'total_subscribed_engines': 0, + 'total_subscribed_organizations': 0, } addition_2days: Annotated[Optional[int], Field(title='Addition 2Days')] = 0 addition_month: Annotated[Optional[int], Field(title='Addition Month')] = 0 @@ -752,7 +777,7 @@ class BlocklistStats(BaseModelSdk): class BlocklistSubscriberEntity(BaseModelSdk): id: Annotated[str, Field(description='Subscriber entity id', title='Id')] - entity_type: EntityType + entity_type: SubscriberEntityType remediation: Annotated[str, Field(description='Remediation', title='Remediation')] @@ -771,7 +796,7 @@ class BlocklistSubscriptionRequest(BaseModelSdk): Optional[List[str]], Field(description='List of subscriber entity id', title='Ids'), ] = None - entity_type: EntityType + entity_type: SubscriberEntityType remediation: Annotated[ Optional[str], Field(description='Remediation', title='Remediation') ] = None @@ -857,6 +882,10 @@ class IntegrationCreateResponse(BaseModelSdk): stats: Annotated[Optional[Stats], Field(description='Stats of the integration')] = { 'count': 0 } + tags: Annotated[ + Optional[List[str]], + Field(description='Tags associated with the integration', title='Tags'), + ] = [] credentials: Annotated[ Union[ApiKeyCredentials, BasicAuthCredentials], Field( @@ -919,6 +948,10 @@ class IntegrationGetResponse(BaseModelSdk): stats: Annotated[Optional[Stats], Field(description='Stats of the integration')] = { 'count': 0 } + tags: Annotated[ + Optional[List[str]], + Field(description='Tags associated with the integration', title='Tags'), + ] = [] class IntegrationUpdateRequest(BaseModelSdk): @@ -997,6 +1030,10 @@ class IntegrationUpdateResponse(BaseModelSdk): stats: Annotated[Optional[Stats], Field(description='Stats of the integration')] = { 'count': 0 } + tags: Annotated[ + Optional[List[str]], + Field(description='Tags associated with the integration', title='Tags'), + ] = [] credentials: Annotated[ Optional[Union[ApiKeyCredentials, BasicAuthCredentials]], Field(description='Credentials for the integration', title='Credentials'), @@ -1012,6 +1049,596 @@ class PageIntegrationGetResponse(BaseModelSdk): links: Links +class AppsecConfigIndex(BaseModelSdk): + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + +class AppsecRuleIndex(BaseModelSdk): + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + +class CollectionIndex(BaseModelSdk): + appsec_configs: Annotated[ + Optional[List[str]], + Field( + alias='appsec-configs', + description='List of appsec-configs', + title='Appsec-Configs', + ), + ] = None + appsec_rules: Annotated[ + Optional[List[str]], + Field( + alias='appsec-rules', + description='List of appsec-rules', + title='Appsec-Rules', + ), + ] = None + collections: Annotated[ + Optional[List[str]], + Field(description='List of collections', title='Collections'), + ] = None + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + contexts: Annotated[ + Optional[List[str]], Field(description='List of contexts', title='Contexts') + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + parsers: Annotated[ + Optional[List[str]], Field(description='List of parsers', title='Parsers') + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + postoverflows: Annotated[ + Optional[List[str]], + Field(description='List of postoverflows', title='Postoverflows'), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + scenarios: Annotated[ + Optional[List[str]], Field(description='List of scenarios', title='Scenarios') + ] = None + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + +class ContextIndex(BaseModelSdk): + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + +class ParserIndex(BaseModelSdk): + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + stage: Annotated[str, Field(description='The stage of the parser', title='Stage')] + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + +class PostoverflowIndex(BaseModelSdk): + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + stage: Annotated[ + str, Field(description='The stage of the postoverflow', title='Stage') + ] + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + +class ScenarioIndex(BaseModelSdk): + content: Annotated[ + Optional[str], + Field( + description='The YAML content of the item, in plaintext.', + examples=[ + 'type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: "Detect FTP bruteforce (vsftpd)"\nfilter: evt.Meta.log_type == \'ftp_failed_auth\'\nleakspeed: "10s"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: "ftp:bruteforce"\n label: "VSFTPD Bruteforce"\n remediation: true\n service: vsftpd' + ], + title='Content', + ), + ] = None + description: Annotated[ + Optional[str], + Field( + description='A short, plaintext description of the item', + title='Description', + ), + ] = None + labels: Annotated[ + Optional[Dict[str, Union[str, List[str], int]]], + Field( + description='Classification labels for the item', + examples=[ + { + 'behavior': 'ftp:bruteforce', + 'classification': ['attack.T1110'], + 'confidence': 3, + 'label': 'VSFTPD Bruteforce', + 'remediation': True, + 'service': 'vsftpd', + 'spoofable': 0, + } + ], + title='Labels', + ), + ] = None + path: Annotated[ + Optional[str], + Field( + description="Relative path to the item's YAML content", + examples=['scenarios/crowdsecurity/vsftpd-bf.yaml'], + title='Path', + ), + ] = None + references: Annotated[ + Optional[List[str]], + Field( + description='List of references to external resources', title='References' + ), + ] = None + version: Annotated[ + Optional[str], + Field( + description='Current version of the collection', + examples=['0.2'], + title='Version', + ), + ] = None + versions: Annotated[ + Optional[Dict[str, VersionDetail]], + Field( + description="A dictionary where each key is a version number (e.g., '0.1', '0.2')", + examples=[ + { + '0.1': { + 'deprecated': False, + 'digest': '3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1', + }, + '0.2': { + 'deprecated': False, + 'digest': 'd1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91', + }, + } + ], + title='Versions', + ), + ] = None + + class BlocklistCreateResponse(BaseModelSdk): id: Annotated[str, Field(description='Blocklist id', title='Id')] created_at: Annotated[ @@ -1079,6 +1706,10 @@ class BlocklistCreateResponse(BaseModelSdk): title='Subscribers', ), ] + categories: Annotated[ + Optional[List[BlocklistCategory]], + Field(description='List of categories for the blocklist', title='Categories'), + ] = [] class BlocklistGetResponse(BaseModelSdk): @@ -1148,6 +1779,10 @@ class BlocklistGetResponse(BaseModelSdk): title='Subscribers', ), ] + categories: Annotated[ + Optional[List[BlocklistCategory]], + Field(description='List of categories for the blocklist', title='Categories'), + ] = [] class BlocklistResponse(BaseModelSdk): @@ -1217,6 +1852,10 @@ class BlocklistResponse(BaseModelSdk): title='Subscribers', ), ] + categories: Annotated[ + Optional[List[BlocklistCategory]], + Field(description='List of categories for the blocklist', title='Categories'), + ] = [] class PageBlocklistResponse(BaseModelSdk): @@ -1238,3 +1877,27 @@ class PaginatedBlocklistResponse(BaseModelSdk): ] size: Annotated[int, Field(description='Page size', title='Size')] pages: Annotated[int, Field(description='Total number of pages', title='Pages')] + + +class Index(BaseModelSdk): + appsec_configs: Annotated[ + Optional[Dict[str, AppsecConfigIndex]], + Field(alias='appsec-configs', title='Appsec-Configs'), + ] = None + appsec_rules: Annotated[ + Optional[Dict[str, AppsecRuleIndex]], + Field(alias='appsec-rules', title='Appsec-Rules'), + ] = None + collections: Annotated[ + Optional[Dict[str, CollectionIndex]], Field(title='Collections') + ] = None + contexts: Annotated[Optional[Dict[str, ContextIndex]], Field(title='Contexts')] = ( + None + ) + parsers: Annotated[Optional[Dict[str, ParserIndex]], Field(title='Parsers')] = None + postoverflows: Annotated[ + Optional[Dict[str, PostoverflowIndex]], Field(title='Postoverflows') + ] = None + scenarios: Annotated[ + Optional[Dict[str, ScenarioIndex]], Field(title='Scenarios') + ] = None diff --git a/crowdsec_service_api/services/__pycache__/__init__.cpython-311.pyc b/crowdsec_service_api/services/__pycache__/__init__.cpython-311.pyc index 120523afbf452e4e97e55a20e368094670fa54cc..cfc1d6b50a0f4f6e0a7be8f1c81ae01b9644a44c 100644 GIT binary patch delta 20 acmeyt_=AyWIWI340}zD&R7{`9^9BGumj){U delta 20 acmeyt_=AyWIWI340}xzr_?R}4=M4ZsoCdl8 diff --git a/crowdsec_service_api/services/blocklists.py b/crowdsec_service_api/services/blocklists.py index 6364c85..0e0d3e8 100644 --- a/crowdsec_service_api/services/blocklists.py +++ b/crowdsec_service_api/services/blocklists.py @@ -14,6 +14,7 @@ def get_blocklists( subscribed_only: bool = False, exclude_subscribed: bool = False, include_filter: list[BlocklistIncludeFilters] = ['private', 'shared'], + category: Optional[list[str]] = None, size: int = 50, )-> Page[BlocklistResponse]: endpoint_url = "/blocklists" @@ -30,7 +31,7 @@ def get_blocklists( url=endpoint_url, path_params=path_params, params=params, headers=headers ) - return Page[BlocklistResponse](**response.json()) + return Page[BlocklistResponse](_client=self, **response.json()) def create_blocklist( self, diff --git a/crowdsec_service_api/services/integrations.py b/crowdsec_service_api/services/integrations.py index 1bdaeb2..9a18957 100644 --- a/crowdsec_service_api/services/integrations.py +++ b/crowdsec_service_api/services/integrations.py @@ -9,6 +9,7 @@ class Integrations(Service): def get_integrations( self, + tag: Optional[list[str]] = None, page: int = 1, size: int = 50, )-> Page[IntegrationGetResponse]: @@ -26,7 +27,7 @@ def get_integrations( url=endpoint_url, path_params=path_params, params=params, headers=headers ) - return Page[IntegrationGetResponse](**response.json()) + return Page[IntegrationGetResponse](_client=self, **response.json()) def create_integration( self, diff --git a/doc/Blocklists.md b/doc/Blocklists.md index c21461b..a6d48ef 100644 --- a/doc/Blocklists.md +++ b/doc/Blocklists.md @@ -28,9 +28,10 @@ | --------- | ---- | ----------- | -------- | ------- | | page | int | Page number | False | 1 | | page_size | int | Page size | False | 100 | -| subscribed_only | bool | Fetch only blocklists subscribed by your organization, engines or tags | False | False | -| exclude_subscribed | bool | Exclude subscribed blocklists | False | False | +| subscribed_only | bool | only subscribed blocklists | False | False | +| exclude_subscribed | bool | exclude subscribed blocklists | False | False | | include_filter | list[BlocklistIncludeFilters] | Include blocklists with the specified filters | False | ['private', 'shared'] | +| category | Optional[list[str]] | Filter by category | False | None | | size | int | Page size | False | 50 | ### Returns: [Page[BlocklistResponse]](./Models.md#page[blocklistresponse]) @@ -54,6 +55,7 @@ response = client.get_blocklists( subscribed_only=True, exclude_subscribed=True, include_filter=['private', 'shared'], + category=None, size=50, ) print(response) @@ -137,6 +139,7 @@ request = BlocklistSearchRequest( behaviors=['sample-item'], min_ips=1, sources=None, + categories=['sample-item'], is_private=None, is_subscribed=None, ) diff --git a/doc/Hub.md b/doc/Hub.md index bf91eef..677fb51 100644 --- a/doc/Hub.md +++ b/doc/Hub.md @@ -5,12 +5,12 @@ | ------ | ----------- | | [get_index](#get_index) | Get a (minimized) index file for 'cscli hub update'. May or may not include unused fields (content, long descriptions, labels...) or redundant ones (author, name). | -| [head_index](#head_index) | This endpoint returns cache-related headers for the index file without the full content. -It is useful for validating cache, checking resource freshness, and managing client-side +| [head_index](#head_index) | This endpoint returns cache-related headers for the index file without the full content. +It is useful for validating cache, checking resource freshness, and managing client-side cache expiration policies. No body content is returned. | | [get_item_content](#get_item_content) | Get an item's content from its path. This is usually a YAML file. | -| [head_item_content](#head_item_content) | This endpoint returns cache-related headers for an item's content. It is useful for validating -cache, checking resource freshness, and managing client-side cache expiration policies. No body +| [head_item_content](#head_item_content) | This endpoint returns cache-related headers for an item's content. It is useful for validating +cache, checking resource freshness, and managing client-side cache expiration policies. No body content is returned. | ## **get_index** @@ -51,8 +51,8 @@ print(response) ## **head_index** -### This endpoint returns cache-related headers for the index file without the full content. -It is useful for validating cache, checking resource freshness, and managing client-side +### This endpoint returns cache-related headers for the index file without the full content. +It is useful for validating cache, checking resource freshness, and managing client-side cache expiration policies. No body content is returned. - Endpoint: `/hub/index/{tenant}/{branch}/.index.json` - Method: `HEAD` @@ -124,8 +124,8 @@ print(response) ## **head_item_content** -### This endpoint returns cache-related headers for an item's content. It is useful for validating -cache, checking resource freshness, and managing client-side cache expiration policies. No body +### This endpoint returns cache-related headers for an item's content. It is useful for validating +cache, checking resource freshness, and managing client-side cache expiration policies. No body content is returned. - Endpoint: `/hub/index/{tenant}/{branch}/{item_path}` - Method: `HEAD` diff --git a/doc/Integrations.md b/doc/Integrations.md index 7f35b0d..1af5355 100644 --- a/doc/Integrations.md +++ b/doc/Integrations.md @@ -20,6 +20,7 @@ ### Parameters: | Parameter | Type | Description | Required | Default | | --------- | ---- | ----------- | -------- | ------- | +| tag | Optional[list[str]] | List of tags associated with the integrations (any of) | False | None | | page | int | Page number | False | 1 | | size | int | Page size | False | 50 | ### Returns: @@ -39,6 +40,7 @@ from crowdsec_service_api import ( auth = ApiKeyAuth(api_key='your_api_key') client = Integrations(base_url=Server.production_server.value, auth=auth) response = client.get_integrations( + tag=None, page=1, size=50, ) diff --git a/doc/Models.md b/doc/Models.md index 802a743..0c71410 100644 --- a/doc/Models.md +++ b/doc/Models.md @@ -26,6 +26,17 @@ ips | ips | list[str] | List of IPs or networks || | expiration | str | Expiration date || +# **BlocklistCategory** +## Required: +name, label, description, priority +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| name | str | None || +| label | str | None || +| description | str | None || +| priority | int | None || + # **BlocklistContentStats** ## Properties | Property | Type | Description | Example | @@ -75,12 +86,13 @@ id, created_at, updated_at, name, label, description, references, is_private, ta | tags | list[str] | Classification tags || | pricing_tier | str | None || | source | str | None || -| stats | object | None || +| stats | BlocklistStats | None || | from_cti_query | Optional[str] | CTI query from which the blocklist was created || | since | Optional[str] | Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days || | shared_with | list[Share] | List of organizations shared with || | organization_id | Optional[str] | Blocklists owner's organization id || | subscribers | list[BlocklistSubscriberEntity] | List of subscribers to the blocklist. Only subscribers belonging to your organization are returned || +| categories | list[BlocklistCategory] | List of categories for the blocklist || # **BlocklistDeleteIPsRequest** ## Required: @@ -107,12 +119,13 @@ id, created_at, updated_at, name, label, description, references, is_private, ta | tags | list[str] | Classification tags || | pricing_tier | str | None || | source | str | None || -| stats | object | None || +| stats | BlocklistStats | None || | from_cti_query | Optional[str] | CTI query from which the blocklist was created || | since | Optional[str] | Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days || | shared_with | list[Share] | List of organizations shared with || | organization_id | Optional[str] | Blocklists owner's organization id || | subscribers | list[BlocklistSubscriberEntity] | List of subscribers to the blocklist. Only subscribers belonging to your organization are returned || +| categories | list[BlocklistCategory] | List of categories for the blocklist || # **BlocklistIncludeFilters** ## Enum: @@ -135,12 +148,13 @@ id, created_at, updated_at, name, label, description, references, is_private, ta | tags | list[str] | Classification tags || | pricing_tier | str | None || | source | str | None || -| stats | object | None || +| stats | BlocklistStats | None || | from_cti_query | Optional[str] | CTI query from which the blocklist was created || | since | Optional[str] | Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days || | shared_with | list[Share] | List of organizations shared with || | organization_id | Optional[str] | Blocklists owner's organization id || | subscribers | list[BlocklistSubscriberEntity] | List of subscribers to the blocklist. Only subscribers belonging to your organization are returned || +| categories | list[BlocklistCategory] | List of categories for the blocklist || # **BlocklistSearchRequest** ## Properties @@ -155,6 +169,7 @@ id, created_at, updated_at, name, label, description, references, is_private, ta | behaviors | list[str] | Behaviors || | min_ips | int | Minimum number of IPs || | sources | list[BlocklistSources] | Sources || +| categories | list[str] | Categories || | is_private | Optional[bool] | Private blocklist || | is_subscribed | Optional[bool] | Subscribed blocklist (None: all) || @@ -174,8 +189,8 @@ CROWDSEC, THIRD_PARTY, CUSTOM ## Properties | Property | Type | Description | Example | |----------|------|-------------|---------| -| content_stats | object | None || -| usage_stats | Optional[object] | None || +| content_stats | BlocklistContentStats | None || +| usage_stats | Optional[BlocklistUsageStats] | None || | addition_2days | int | None || | addition_month | int | None || | suppression_2days | int | None || @@ -252,6 +267,7 @@ updated, errors | engines_subscribed_through_org | int | None || | engines_subscribed_through_tag | int | None || | total_subscribed_engines | int | None || +| total_subscribed_organizations | int | None || | updated_at | str | None || # **Body_uploadBlocklistContent** @@ -326,10 +342,6 @@ name, label, description, references, total_ips | references | list[str] | None || | total_ips | int | None || -# **EntityType** -## Enum: -ORG, TAG, ENGINE, FIREWALL_INTEGRATION, REMEDIATION_COMPONENT_INTEGRATION - # **HTTPValidationError** ## Properties | Property | Type | Description | Example | @@ -374,8 +386,9 @@ id, name, organization_id, created_at, updated_at, entity_type, output_format, b | last_pull | str | Last time the integration pulled blocklists || | blocklists | list[BlocklistSubscription] | Blocklists that are subscribed by the integration || | endpoint | str | Url that should be used by the firewall or the remediation component to fetch the integration's content || -| stats | object | None || -| credentials | Union[object, object] | Credentials that were generated for the integration || +| stats | Stats | None || +| tags | list[str] | Tags associated with the integration || +| credentials | Union[ApiKeyCredentials, BasicAuthCredentials] | Credentials that were generated for the integration || # **IntegrationGetResponse** ## Required: @@ -394,7 +407,8 @@ id, name, organization_id, created_at, updated_at, entity_type, output_format, b | last_pull | str | Last time the integration pulled blocklists || | blocklists | list[BlocklistSubscription] | Blocklists that are subscribed by the integration || | endpoint | str | Url that should be used by the firewall or the remediation component to fetch the integration's content || -| stats | object | None || +| stats | Stats | None || +| tags | list[str] | Tags associated with the integration || # **IntegrationType** ## Enum: @@ -426,8 +440,9 @@ id, name, organization_id, created_at, updated_at, entity_type, output_format, b | last_pull | str | Last time the integration pulled blocklists || | blocklists | list[BlocklistSubscription] | Blocklists that are subscribed by the integration || | endpoint | str | Url that should be used by the firewall or the remediation component to fetch the integration's content || -| stats | object | None || -| credentials | Optional[object, object] | Credentials for the integration || +| stats | Stats | None || +| tags | list[str] | Tags associated with the integration || +| credentials | Optional[ApiKeyCredentials, BasicAuthCredentials] | Credentials for the integration || # **Links** ## Required: @@ -456,7 +471,7 @@ items, total, page, size, links | page | Optional[int] | None || | size | Optional[int] | None || | pages | Optional[int] | None || -| links | object | None || +| links | Links | None || # **Page_IntegrationGetResponse_** ## Required: @@ -469,7 +484,7 @@ items, total, page, size, links | page | Optional[int] | None || | size | Optional[int] | None || | pages | Optional[int] | None || -| links | object | None || +| links | Links | None || # **PaginatedBlocklistResponse** ## Required: @@ -508,6 +523,10 @@ count |----------|------|-------------|---------| | count | int | Number of total blocklists items the integration will pull || +# **SubscriberEntityType** +## Enum: +ORG, TAG, ENGINE, FIREWALL_INTEGRATION, REMEDIATION_COMPONENT_INTEGRATION + # **ValidationError** ## Required: loc, msg, type @@ -518,10 +537,118 @@ loc, msg, type | msg | str | None || | type | str | None || -# **HubItem** +# **AppsecConfigIndex** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| content | Optional[str] | The YAML content of the item, in plaintext. || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| path | Optional[str] | Relative path to the item's YAML content || +| references | Optional[list[str]] | List of references to external resources || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || -# **HubType** -## Enum: -PARSERS, POSTOVERFLOWS, SCENARIOS, COLLECTIONS, CONTEXTS, APPSEC-CONFIGS, APPSEC-RULES +# **AppsecRuleIndex** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| content | Optional[str] | The YAML content of the item, in plaintext. || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| path | Optional[str] | Relative path to the item's YAML content || +| references | Optional[list[str]] | List of references to external resources || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || + +# **CollectionIndex** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| appsec-configs | Optional[list[str]] | List of appsec-configs || +| appsec-rules | Optional[list[str]] | List of appsec-rules || +| collections | Optional[list[str]] | List of collections || +| content | Optional[str] | The YAML content of the item, in plaintext. || +| contexts | Optional[list[str]] | List of contexts || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| parsers | Optional[list[str]] | List of parsers || +| path | Optional[str] | Relative path to the item's YAML content || +| postoverflows | Optional[list[str]] | List of postoverflows || +| references | Optional[list[str]] | List of references to external resources || +| scenarios | Optional[list[str]] | List of scenarios || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || -# **Index** \ No newline at end of file +# **ContextIndex** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| content | Optional[str] | The YAML content of the item, in plaintext. || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| path | Optional[str] | Relative path to the item's YAML content || +| references | Optional[list[str]] | List of references to external resources || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || + +# **Index** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| appsec-configs | Appsec-Configs | None || +| appsec-rules | Appsec-Rules | None || +| collections | Collections | None || +| contexts | Contexts | None || +| parsers | Parsers | None || +| postoverflows | Postoverflows | None || +| scenarios | Scenarios | None || + +# **ParserIndex** +## Required: +stage +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| content | Optional[str] | The YAML content of the item, in plaintext. || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| path | Optional[str] | Relative path to the item's YAML content || +| references | Optional[list[str]] | List of references to external resources || +| stage | str | The stage of the parser || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || + +# **PostoverflowIndex** +## Required: +stage +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| content | Optional[str] | The YAML content of the item, in plaintext. || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| path | Optional[str] | Relative path to the item's YAML content || +| references | Optional[list[str]] | List of references to external resources || +| stage | str | The stage of the postoverflow || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || + +# **ScenarioIndex** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| content | Optional[str] | The YAML content of the item, in plaintext. || +| description | Optional[str] | A short, plaintext description of the item || +| labels | Optional[object] | Classification labels for the item || +| path | Optional[str] | Relative path to the item's YAML content || +| references | Optional[list[str]] | List of references to external resources || +| version | Optional[str] | Current version of the collection || +| versions | Optional[object] | A dictionary where each key is a version number (e.g., '0.1', '0.2') || + +# **VersionDetail** +## Properties +| Property | Type | Description | Example | +|----------|------|-------------|---------| +| deprecated | Optional[bool] | Indicates whether this version is deprecated. || +| digest | str | The SHA256 digest of the versioned file. || \ No newline at end of file diff --git a/doc/README.md b/doc/README.md index bbb9d7c..8a3bfda 100644 --- a/doc/README.md +++ b/doc/README.md @@ -27,6 +27,8 @@ You can find a Quickstart about this SDK, following this [documentation](https:/ [BlocklistAddIPsRequest](./Models.md#blocklistaddipsrequest) +[BlocklistCategory](./Models.md#blocklistcategory) + [BlocklistContentStats](./Models.md#blocklistcontentstats) [BlocklistCreateRequest](./Models.md#blocklistcreaterequest) @@ -77,8 +79,6 @@ You can find a Quickstart about this SDK, following this [documentation](https:/ [CtiScenario](./Models.md#ctiscenario) -[EntityType](./Models.md#entitytype) - [HTTPValidationError](./Models.md#httpvalidationerror) [InfoResponse](./Models.md#inforesponse) @@ -113,10 +113,24 @@ You can find a Quickstart about this SDK, following this [documentation](https:/ [Stats](./Models.md#stats) +[SubscriberEntityType](./Models.md#subscriberentitytype) + [ValidationError](./Models.md#validationerror) -[HubItem](./Models.md#hubitem) +[AppsecConfigIndex](./Models.md#appsecconfigindex) + +[AppsecRuleIndex](./Models.md#appsecruleindex) + +[CollectionIndex](./Models.md#collectionindex) + +[ContextIndex](./Models.md#contextindex) + +[Index](./Models.md#index) + +[ParserIndex](./Models.md#parserindex) + +[PostoverflowIndex](./Models.md#postoverflowindex) -[HubType](./Models.md#hubtype) +[ScenarioIndex](./Models.md#scenarioindex) -[Index](./Models.md#index) \ No newline at end of file +[VersionDetail](./Models.md#versiondetail) \ No newline at end of file diff --git a/openapi.json b/openapi.json index f109d02..597a7a9 100644 --- a/openapi.json +++ b/openapi.json @@ -1 +1 @@ -{"openapi": "3.1.0", "info": {"title": "Service API", "description": "This is the API to manage Crowdsec services", "contact": {"name": "CrowdSec", "url": "https://crowdsec.net/", "email": "info@crowdsec.net"}, "version": "1.30.1"}, "paths": {"/blocklists": {"post": {"tags": ["Blocklists"], "summary": "Create Blocklist", "description": "Create a new blocklist owned by your organization. The name must be unique within your organization. The list will only be visible to your organization and organizations you shared the blocklist with. This operation is submitted to quotas", "operationId": "createBlocklist", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistCreateResponse"}}}}, "409": {"description": "Blocklist already exists"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklists", "description": "Get multiple blocklists. Only blocklists owned by your organization, shared with your organization or public blocklists are returned. Filters and pagination are available as query parameters.", "operationId": "getBlocklists", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "page_size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 1000, "description": "Page size", "default": 100, "title": "Page Size"}, "description": "Page size"}, {"name": "subscribed_only", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Fetch only blocklists subscribed by your organization, engines or tags", "default": false, "title": "Subscribed Only"}, "description": "Fetch only blocklists subscribed by your organization, engines or tags"}, {"name": "exclude_subscribed", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Exclude subscribed blocklists", "default": false, "title": "Exclude Subscribed"}, "description": "Exclude subscribed blocklists"}, {"name": "include_filter", "in": "query", "required": false, "schema": {"type": "array", "items": {"$ref": "#/components/schemas/BlocklistIncludeFilters"}, "description": "Include blocklists with the specified filters", "default": ["private", "shared"], "title": "Include Filter"}, "description": "Include blocklists with the specified filters"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_BlocklistResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/search": {"post": {"tags": ["Blocklists"], "summary": "Search Blocklists", "description": "Search blocklists", "operationId": "searchBlocklist", "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSearchRequest"}}}, "required": true}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PaginatedBlocklistResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}": {"get": {"tags": ["Blocklists"], "summary": "Get Blocklist", "description": "Get the details of a blocklist by ID. The content of the blocklist is not returned.", "operationId": "getBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistGetResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Blocklists"], "summary": "Update Blocklist", "description": "Update a blocklist's details by ID. It is not possible to update the blocklist content using this operation.", "operationId": "updateBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistResponse"}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Blocklists"], "summary": "Delete Blocklist", "description": "Delete a blocklist by ID. If the blocklist is shared with other organizations or it has subscriptions, the operation will fail. If you want to force delete the blocklist, you can use the force query parameter, so the blocklists will be unshared / unsubscribed.", "operationId": "deleteBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "force", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Force delete the blocklist if it is shared or subscribed", "default": false, "title": "Force"}, "description": "Force delete the blocklist if it is shared or subscribed"}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/upload": {"post": {"tags": ["Blocklists"], "summary": "Upload Blocklist Content", "description": "Upload a blocklist. The file must be in txt format with one IP per line. This operation will overwrite the existing blocklist content.", "operationId": "uploadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "expiration", "in": "query", "required": false, "schema": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "description": "Blocklist expiration", "title": "Expiration"}, "description": "Blocklist expiration", "example": "2024-09-23T13:03:25.298682+00:00"}, {"name": "ignore_invalid_ips", "in": "query", "required": false, "schema": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "description": "Ignore invalid IPs", "default": false, "title": "Ignore Invalid Ips"}, "description": "Ignore invalid IPs"}], "requestBody": {"required": true, "content": {"multipart/form-data": {"schema": {"$ref": "#/components/schemas/Body_uploadBlocklistContent"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "400": {"description": "Invalid IP in blocklist file content"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips": {"post": {"tags": ["Blocklists"], "summary": "Add Ips To Blocklist", "description": "Add IPs to a blocklist. If an IP is already in the blocklist, its expiration will be updated with the new expiration.", "operationId": "addIpsToBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistAddIPsRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "412": {"description": "Payload too large for one operation, limit is 20000 IPs per request"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips/delete": {"post": {"tags": ["Blocklists"], "summary": "Delete Ips From Blocklist", "description": "Delete IPs from a blocklist", "operationId": "deleteIpsFromBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistDeleteIPsRequest"}}}}, "responses": {"204": {"description": "Successful Response"}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/download": {"get": {"tags": ["Blocklists"], "summary": "Download Blocklist Content", "description": "Download blocklist content as a list of ips as plain text separated by new lines. The response will include the ETag header for cache control. If_Modified_Since and If_None_Match cache control headers are supported for conditional requests.", "operationId": "downloadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "if-modified-since", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_Modified_Since cache control header", "title": "If-Modified-Since"}, "description": "If_Modified_Since cache control header"}, {"name": "if-none-match", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_None_Match cache control header", "title": "If-None-Match"}, "description": "If_None_Match cache control header"}], "responses": {"200": {"description": "Successful Response", "content": {"text/plain": {"schema": {"type": "string"}}}}, "404": {"description": "Blocklist not found"}, "204": {"description": "Blocklist is empty"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers": {"post": {"tags": ["Blocklists"], "summary": "Subscribe Blocklist", "description": "Subscribe to a blocklist with a remediation type. If the entity type is the full organization or a Tag, all the engines belonging to the organization or the Tag will be subscribed and new engines that will join the organization or the Tag will also be automatically subscribed. If the subscription has been done on an organization or Tag you cannot unsubscribe individual engines. In case of errors for some subscribers, the operation will still succeed for the entities that were successfully subscribed and you'll have the list of errors in the operation's result. This operation is submitted to quotas.", "operationId": "subscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklist Subscribers", "description": "Get blocklist subscribers within your organization.", "operationId": "getBlocklistSubscribers", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscribersResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers/{entity_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unsubscribe Blocklist", "description": "Unsubscribe from a blocklist. You cannot unsubscribe individual engines if the subscription has been done on an organization or Tag.", "operationId": "unsubscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "entity_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Entity Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares": {"post": {"tags": ["Blocklists"], "summary": "Share Blocklist", "description": "Share a blocklist with other organizations given their IDs. The blocklist must be owned by your organization. You can give read-only access or read-write access to the blocklist. Sharing a blocklist will not automatically subscribe the shared organizations to the blocklist.", "operationId": "shareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistShareRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares/{unshare_organization_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unshare Blocklist", "description": "Unshare a blocklist with other organizations. If the blocklist is subscribed by the organization, the operation will fail.Use force query parameter to unshare a blocklist even if subscriptions exists.", "operationId": "unshareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "unshare_organization_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Unshare Organization Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations": {"post": {"tags": ["Integrations"], "summary": "Create Integration", "description": "Create an integration to a firewall or remediation component, owned by your organization. The name should be unique within the organization. This operation is submitted to quotas.", "operationId": "createIntegration", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integrations", "description": "Get integrations owned by your organization", "operationId": "getIntegrations", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_IntegrationGetResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}": {"get": {"tags": ["Integrations"], "summary": "Get Integration", "description": "Get an integration by ID", "operationId": "getIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationGetResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Integrations"], "summary": "Update Integration", "description": "Update the integration details", "operationId": "updateIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Integrations"], "summary": "Delete Integration", "description": "Delete the integration by ID", "operationId": "deleteIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"204": {"description": "Successful Response"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/content": {"head": {"tags": ["Integrations"], "summary": "Head Integration Content", "description": "Check if the integration has content", "operationId": "headIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integration Content", "description": "Get the ips associated to the integration in plain text format. The content can be paginated to accomodate limits in firewalls.", "operationId": "getIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number to return", "default": 1, "title": "Page"}, "description": "Page number to return"}, {"name": "page_size", "in": "query", "required": false, "schema": {"anyOf": [{"type": "integer", "minimum": 10000}, {"type": "null"}], "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000", "title": "Page Size"}, "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/v1/decisions/stream": {"get": {"tags": ["Integrations"], "summary": "Get Integration Content Stream", "description": "Get the ips associated to the integration in a format compatible with a remediation component. As for the remediation components, you can fetch the full content with startup=true or only the changes since the last pull", "operationId": "getIntegrationContentStream", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "startup", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull.", "default": false, "title": "Startup"}, "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull."}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/info": {"get": {"tags": ["Info"], "summary": "Get Me Info", "description": "Get the current user and organization informations", "operationId": "getInfo", "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/InfoResponse"}}}}}}}, "/hub/index/{tenant}/{branch}/.index.json": {"get": {"description": "Get a (minimized) index file for 'cscli hub update'. May or may not include unused fields\n(content, long descriptions, labels...) or redundant ones (author, name).", "operationId": "getIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get a minimized index file (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for the index file without the full content. \nIt is useful for validating cache, checking resource freshness, and managing client-side \ncache expiration policies. No body content is returned.", "operationId": "headIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for the index file", "tags": ["Hub"]}}, "/hub/index/{tenant}/{branch}/{item_path}": {"get": {"description": "Get an item's content from its path. This is usually a YAML file.", "operationId": "getItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "404": {"description": "No content field"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get an item's content (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for an item's content. It is useful for validating \ncache, checking resource freshness, and managing client-side cache expiration policies. No body \ncontent is returned.", "operationId": "headItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for an item's content", "tags": ["Hub"]}}}, "components": {"schemas": {"ApiKeyCredentials": {"properties": {"api_key": {"type": "string", "title": "Api Key", "description": "API key for the integration"}}, "type": "object", "required": ["api_key"], "title": "ApiKeyCredentials"}, "BasicAuthCredentials": {"properties": {"username": {"type": "string", "title": "Username", "description": "Basic auth username for the integration"}, "password": {"type": "string", "title": "Password", "description": "Basic auth password for the integration"}}, "type": "object", "required": ["username", "password"], "title": "BasicAuthCredentials"}, "BlocklistAddIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}, "expiration": {"type": "string", "format": "date-time", "title": "Expiration", "description": "Expiration date"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistAddIPsRequest"}, "BlocklistContentStats": {"properties": {"total_seen": {"type": "integer", "title": "Total Seen", "default": 0}, "total_fire": {"type": "integer", "title": "Total Fire", "default": 0}, "total_seen_1m": {"type": "integer", "title": "Total Seen 1M", "default": 0}, "total_in_other_lists": {"type": "integer", "title": "Total In Other Lists", "default": 0}, "total_false_positive": {"type": "integer", "title": "Total False Positive", "default": 0}, "false_positive_removed_by_crowdsec": {"type": "integer", "title": "False Positive Removed By Crowdsec", "default": 0}, "most_present_behaviors": {"items": {"$ref": "#/components/schemas/CtiBehavior"}, "type": "array", "title": "Most Present Behaviors", "default": []}, "most_present_categories": {"items": {"$ref": "#/components/schemas/CtiCategory"}, "type": "array", "title": "Most Present Categories", "default": []}, "most_present_scenarios": {"items": {"$ref": "#/components/schemas/CtiScenario"}, "type": "array", "title": "Most Present Scenarios", "default": []}, "top_as": {"items": {"$ref": "#/components/schemas/CtiAs"}, "type": "array", "title": "Top As", "default": []}, "top_attacking_countries": {"items": {"$ref": "#/components/schemas/CtiCountry"}, "type": "array", "title": "Top Attacking Countries", "default": []}, "top_ips": {"items": {"$ref": "#/components/schemas/CtiIp"}, "type": "array", "title": "Top Ips", "default": []}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistContentStats"}, "BlocklistCreateRequest": {"properties": {"name": {"type": "string", "maxLength": 200, "minLength": 1, "title": "Name", "description": "Blocklist name, must be unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name (Default: name)"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Useful references on the list's origins", "default": []}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags", "default": []}, "from_cti_query": {"type": "string", "title": "From Cti Query", "description": "CTI query (doc link available soon)"}, "since": {"type": "string", "title": "Since", "description": "Since duration for the CTI query (5m, 2h, 7d). Max is 30 days"}}, "additionalProperties": false, "type": "object", "required": ["name", "description"], "title": "BlocklistCreateRequest"}, "BlocklistCreateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags"}, "pricing_tier": {"allOf": [{"$ref": "#/components/schemas/PricingTiers"}], "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"allOf": [{"$ref": "#/components/schemas/BlocklistSources"}], "description": "Blocklist source"}, "stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistStats"}], "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with"}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned"}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "label", "description", "references", "is_private", "tags", "pricing_tier", "source", "stats", "from_cti_query", "since", "shared_with", "organization_id", "subscribers"], "title": "BlocklistCreateResponse"}, "BlocklistDeleteIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistDeleteIPsRequest"}, "BlocklistGetResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags"}, "pricing_tier": {"allOf": [{"$ref": "#/components/schemas/PricingTiers"}], "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"allOf": [{"$ref": "#/components/schemas/BlocklistSources"}], "description": "Blocklist source"}, "stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistStats"}], "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with"}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned"}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "label", "description", "references", "is_private", "tags", "pricing_tier", "source", "stats", "from_cti_query", "since", "shared_with", "organization_id", "subscribers"], "title": "BlocklistGetResponse"}, "BlocklistIncludeFilters": {"type": "string", "enum": ["public", "private", "shared", "all"], "title": "BlocklistIncludeFilters"}, "BlocklistResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags"}, "pricing_tier": {"allOf": [{"$ref": "#/components/schemas/PricingTiers"}], "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"allOf": [{"$ref": "#/components/schemas/BlocklistSources"}], "description": "Blocklist source"}, "stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistStats"}], "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with"}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned"}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "label", "description", "references", "is_private", "tags", "pricing_tier", "source", "stats", "from_cti_query", "since", "shared_with", "organization_id", "subscribers"], "title": "BlocklistResponse"}, "BlocklistSearchRequest": {"properties": {"page": {"type": "integer", "minimum": 1.0, "title": "Page", "description": "Page number", "default": 1}, "page_size": {"type": "integer", "maximum": 1000.0, "title": "Page Size", "description": "Page size", "default": 100}, "pricing_tiers": {"items": {"$ref": "#/components/schemas/PricingTiers"}, "type": "array", "title": "Pricing Tiers", "description": "Pricing tiers", "default": []}, "query": {"type": "string", "title": "Query", "description": "Search query", "default": ""}, "targeted_countries": {"items": {"type": "string"}, "type": "array", "title": "Targeted Countries", "description": "Targeted countries", "default": []}, "classifications": {"items": {"type": "string"}, "type": "array", "title": "Classifications", "description": "Classifications", "default": []}, "behaviors": {"items": {"type": "string"}, "type": "array", "title": "Behaviors", "description": "Behaviors", "default": []}, "min_ips": {"type": "integer", "minimum": 0.0, "title": "Min Ips", "description": "Minimum number of IPs", "default": 0}, "sources": {"items": {"$ref": "#/components/schemas/BlocklistSources"}, "type": "array", "title": "Sources", "description": "Sources", "default": []}, "is_private": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Private", "description": "Private blocklist"}, "is_subscribed": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Subscribed", "description": "Subscribed blocklist (None: all)"}}, "additionalProperties": false, "type": "object", "title": "BlocklistSearchRequest"}, "BlocklistShareRequest": {"properties": {"organizations": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Organizations", "description": "List of organizations to share the blocklist"}}, "additionalProperties": false, "type": "object", "required": ["organizations"], "title": "BlocklistShareRequest"}, "BlocklistSources": {"type": "string", "enum": ["crowdsec", "third_party", "custom"], "title": "BlocklistSources"}, "BlocklistStats": {"properties": {"content_stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistContentStats"}], "default": {"total_seen": 0, "total_fire": 0, "total_seen_1m": 0, "total_in_other_lists": 0, "total_false_positive": 0, "false_positive_removed_by_crowdsec": 0, "most_present_behaviors": [], "most_present_categories": [], "most_present_scenarios": [], "top_as": [], "top_attacking_countries": [], "top_ips": []}}, "usage_stats": {"anyOf": [{"$ref": "#/components/schemas/BlocklistUsageStats"}, {"type": "null"}], "default": {"engines_subscribed_directly": 0, "engines_subscribed_through_org": 0, "engines_subscribed_through_tag": 0, "total_subscribed_engines": 0}}, "addition_2days": {"type": "integer", "title": "Addition 2Days", "default": 0}, "addition_month": {"type": "integer", "title": "Addition Month", "default": 0}, "suppression_2days": {"type": "integer", "title": "Suppression 2Days", "default": 0}, "suppression_month": {"type": "integer", "title": "Suppression Month", "default": 0}, "change_2days_percentage": {"type": "number", "title": "Change 2Days Percentage", "default": 0.0}, "change_month_percentage": {"type": "number", "title": "Change Month Percentage", "default": 0.0}, "count": {"type": "integer", "title": "Count", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistStats"}, "BlocklistSubscriberEntity": {"properties": {"id": {"type": "string", "title": "Id", "description": "Subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/EntityType"}, "remediation": {"type": "string", "title": "Remediation", "description": "Remediation"}}, "type": "object", "required": ["id", "entity_type", "remediation"], "title": "BlocklistSubscriberEntity"}, "BlocklistSubscribersResponse": {"properties": {"subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers"}}, "type": "object", "required": ["subscribers"], "title": "BlocklistSubscribersResponse"}, "BlocklistSubscription": {"properties": {"id": {"type": "string", "title": "Id"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation"}, "name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}}, "type": "object", "required": ["id", "name", "label"], "title": "BlocklistSubscription"}, "BlocklistSubscriptionRequest": {"properties": {"ids": {"items": {"type": "string"}, "type": "array", "title": "Ids", "description": "List of subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/EntityType"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation", "description": "Remediation"}}, "additionalProperties": false, "type": "object", "required": ["entity_type"], "title": "BlocklistSubscriptionRequest"}, "BlocklistSubscriptionResponse": {"properties": {"updated": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "title": "Updated", "description": "List of updated blocklist ids", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "errors": {"anyOf": [{"items": {"additionalProperties": {"type": "string"}, "type": "object"}, "type": "array"}, {"type": "null"}], "title": "Errors", "description": "List of errors if any", "examples": [{"5f9d88b9e5c4f5b9a3d3e8b1": "error message"}]}}, "type": "object", "required": ["updated", "errors"], "title": "BlocklistSubscriptionResponse"}, "BlocklistUpdateRequest": {"properties": {"label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Blocklist tags"}, "from_cti_query": {"type": "string", "title": "From Cti Query", "description": "CTI query (doc link available soon)"}, "since": {"type": "string", "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}}, "additionalProperties": false, "type": "object", "title": "BlocklistUpdateRequest"}, "BlocklistUsageStats": {"properties": {"engines_subscribed_directly": {"type": "integer", "title": "Engines Subscribed Directly", "default": 0}, "engines_subscribed_through_org": {"type": "integer", "title": "Engines Subscribed Through Org", "default": 0}, "engines_subscribed_through_tag": {"type": "integer", "title": "Engines Subscribed Through Tag", "default": 0}, "total_subscribed_engines": {"type": "integer", "title": "Total Subscribed Engines", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistUsageStats"}, "Body_uploadBlocklistContent": {"properties": {"file": {"type": "string", "format": "binary", "title": "File", "description": "Blocklist file in txt format"}}, "type": "object", "required": ["file"], "title": "Body_uploadBlocklistContent"}, "CtiAs": {"properties": {"as_num": {"type": "string", "title": "As Num"}, "as_name": {"type": "string", "title": "As Name"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["as_num", "as_name", "total_ips"], "title": "CtiAs"}, "CtiBehavior": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiBehavior"}, "CtiCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "total_ips"], "title": "CtiCategory"}, "CtiCountry": {"properties": {"country_short": {"type": "string", "title": "Country Short"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["country_short", "total_ips"], "title": "CtiCountry"}, "CtiIp": {"properties": {"ip": {"type": "string", "title": "Ip"}, "total_signals_1m": {"type": "integer", "title": "Total Signals 1M"}, "reputation": {"type": "string", "title": "Reputation", "default": "unknown"}}, "additionalProperties": true, "type": "object", "required": ["ip", "total_signals_1m"], "title": "CtiIp"}, "CtiScenario": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiScenario"}, "EntityType": {"type": "string", "enum": ["org", "tag", "engine", "firewall_integration", "remediation_component_integration"], "title": "EntityType"}, "HTTPValidationError": {"properties": {"detail": {"items": {"$ref": "#/components/schemas/ValidationError"}, "title": "Detail", "type": "array"}}, "title": "HTTPValidationError", "type": "object"}, "InfoResponse": {"properties": {"organization_id": {"type": "string", "title": "Organization Id", "description": "The organization ID"}, "subscription_type": {"type": "string", "title": "Subscription Type", "description": "The organization subscription type"}, "api_key_name": {"type": "string", "title": "Api Key Name", "description": "The API key name that is used"}}, "type": "object", "required": ["organization_id", "subscription_type", "api_key_name"], "title": "InfoResponse"}, "IntegrationCreateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "Name of the integration"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the integration"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}}, "additionalProperties": false, "type": "object", "required": ["name", "entity_type", "output_format"], "title": "IntegrationCreateRequest"}, "IntegrationCreateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}, "last_pull": {"type": "string", "format": "date-time", "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"allOf": [{"$ref": "#/components/schemas/Stats"}], "description": "Stats of the integration", "default": {"count": 0}}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}], "title": "Credentials", "description": "Credentials that were generated for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint", "credentials"], "title": "IntegrationCreateResponse"}, "IntegrationGetResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}, "last_pull": {"type": "string", "format": "date-time", "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"allOf": [{"$ref": "#/components/schemas/Stats"}], "description": "Stats of the integration", "default": {"count": 0}}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationGetResponse"}, "IntegrationType": {"type": "string", "enum": ["firewall_integration", "remediation_component_integration"], "title": "IntegrationType"}, "IntegrationUpdateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "New name"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "New description"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "New output format"}, "regenerate_credentials": {"type": "boolean", "title": "Regenerate Credentials", "description": "Regenerate credentials for the integration"}}, "additionalProperties": false, "type": "object", "title": "IntegrationUpdateRequest"}, "IntegrationUpdateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}, "last_pull": {"type": "string", "format": "date-time", "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"allOf": [{"$ref": "#/components/schemas/Stats"}], "description": "Stats of the integration", "default": {"count": 0}}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}, {"type": "null"}], "title": "Credentials", "description": "Credentials for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationUpdateResponse"}, "Links": {"properties": {"first": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "First", "examples": ["/api/v1/users?limit=1&offset1"]}, "last": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Last", "examples": ["/api/v1/users?limit=1&offset1"]}, "self": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Self", "examples": ["/api/v1/users?limit=1&offset1"]}, "next": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Next", "examples": ["/api/v1/users?limit=1&offset1"]}, "prev": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Prev", "examples": ["/api/v1/users?limit=1&offset1"]}}, "type": "object", "required": ["first", "last", "self", "next", "prev"], "title": "Links"}, "OutputFormat": {"type": "string", "enum": ["plain_text", "f5", "remediation_component", "fortigate", "paloalto", "checkpoint", "cisco"], "title": "OutputFormat"}, "Page_BlocklistResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/BlocklistResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[BlocklistResponse]"}, "Page_IntegrationGetResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/IntegrationGetResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[IntegrationGetResponse]"}, "PaginatedBlocklistResponse": {"properties": {"items": {"items": {"$ref": "#/components/schemas/BlocklistResponse"}, "type": "array", "title": "Items", "description": "List of blocklists"}, "page": {"type": "integer", "title": "Page", "description": "Page number"}, "total": {"type": "integer", "title": "Total", "description": "Total number of blocklists"}, "size": {"type": "integer", "title": "Size", "description": "Page size"}, "pages": {"type": "integer", "title": "Pages", "description": "Total number of pages"}}, "type": "object", "required": ["items", "page", "total", "size", "pages"], "title": "PaginatedBlocklistResponse"}, "Permission": {"type": "string", "enum": ["read", "write"], "title": "Permission"}, "PricingTiers": {"type": "string", "enum": ["free", "premium", "platinum"], "title": "PricingTiers"}, "Share": {"properties": {"organization_id": {"type": "string", "title": "Organization Id"}, "permission": {"$ref": "#/components/schemas/Permission"}}, "type": "object", "required": ["organization_id", "permission"], "title": "Share"}, "Stats": {"properties": {"count": {"type": "integer", "title": "Count", "description": "Number of total blocklists items the integration will pull"}}, "type": "object", "required": ["count"], "title": "Stats"}, "ValidationError": {"properties": {"loc": {"items": {"anyOf": [{"type": "string"}, {"type": "integer"}]}, "title": "Location", "type": "array"}, "msg": {"title": "Message", "type": "string"}, "type": {"title": "Error Type", "type": "string"}}, "required": ["loc", "msg", "type"], "title": "ValidationError", "type": "object"}, "HubItem": {"title": "HubItem", "type": "object"}, "HubType": {"enum": ["parsers", "postoverflows", "scenarios", "collections", "contexts", "appsec-configs", "appsec-rules"], "title": "HubType", "type": "string"}, "Index": {"additionalProperties": {"additionalProperties": {"$ref": "#/components/schemas/HubItem"}, "type": "object"}, "title": "Index", "type": "object"}}, "securitySchemes": {"ApiKeyAuth": {"type": "apiKey", "in": "header", "name": "x-api-key", "description": "If integration key is provided, can also work to get integration content"}, "BasicAuth": {"type": "http", "scheme": "basic", "description": "Basic Auth for integration content endpoint only"}}}, "security": [{"ApiKeyAuth": []}, {"BasicAuth": []}], "servers": [{"url": "https://admin.api.crowdsec.net/v1/", "description": "Production server"}]} \ No newline at end of file +{"openapi": "3.1.0", "info": {"title": "Service API", "description": "This is the API to manage Crowdsec services", "contact": {"name": "CrowdSec", "url": "https://crowdsec.net/", "email": "info@crowdsec.net"}, "version": "1.43.1"}, "paths": {"/blocklists": {"post": {"tags": ["Blocklists"], "summary": "Create Blocklist", "description": "Create a new blocklist owned by your organization. The name must be unique within your organization. The list will only be visible to your organization and organizations you shared the blocklist with. This operation is submitted to quotas", "operationId": "createBlocklist", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistCreateResponse"}}}}, "409": {"description": "Blocklist already exists"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklists", "description": "Get multiple blocklists. Only blocklists owned by your organization, shared with your organization or public blocklists are returned. Filters and pagination are available as query parameters.", "operationId": "getBlocklists", "parameters": [{"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "page_size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 1000, "description": "Page size", "default": 100, "title": "Page Size"}, "description": "Page size"}, {"name": "subscribed_only", "in": "query", "required": false, "schema": {"type": "boolean", "description": "only subscribed blocklists", "default": false, "title": "Subscribed Only"}, "description": "only subscribed blocklists"}, {"name": "exclude_subscribed", "in": "query", "required": false, "schema": {"type": "boolean", "description": "exclude subscribed blocklists", "default": false, "title": "Exclude Subscribed"}, "description": "exclude subscribed blocklists"}, {"name": "include_filter", "in": "query", "required": false, "schema": {"type": "array", "items": {"$ref": "#/components/schemas/BlocklistIncludeFilters"}, "description": "Include blocklists with the specified filters", "default": ["private", "shared"], "title": "Include Filter"}, "description": "Include blocklists with the specified filters"}, {"name": "category", "in": "query", "required": false, "schema": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}], "description": "Filter by category", "title": "Category"}, "description": "Filter by category"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_BlocklistResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/search": {"post": {"tags": ["Blocklists"], "summary": "Search Blocklists", "description": "Search blocklists", "operationId": "searchBlocklist", "requestBody": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSearchRequest"}}}, "required": true}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/PaginatedBlocklistResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}": {"get": {"tags": ["Blocklists"], "summary": "Get Blocklist", "description": "Get the details of a blocklist by ID. The content of the blocklist is not returned.", "operationId": "getBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistGetResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Blocklists"], "summary": "Update Blocklist", "description": "Update a blocklist's details by ID. It is not possible to update the blocklist content using this operation.", "operationId": "updateBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistResponse"}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Blocklists"], "summary": "Delete Blocklist", "description": "Delete a blocklist by ID. If the blocklist is shared with other organizations or it has subscriptions, the operation will fail. If you want to force delete the blocklist, you can use the force query parameter, so the blocklists will be unshared / unsubscribed.", "operationId": "deleteBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "force", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Force delete the blocklist if it is shared or subscribed", "default": false, "title": "Force"}, "description": "Force delete the blocklist if it is shared or subscribed"}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/upload": {"post": {"tags": ["Blocklists"], "summary": "Upload Blocklist Content", "description": "Upload a blocklist. The file must be in txt format with one IP per line. This operation will overwrite the existing blocklist content.", "operationId": "uploadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "expiration", "in": "query", "required": false, "schema": {"anyOf": [{"type": "string", "format": "date-time"}, {"type": "null"}], "description": "Blocklist expiration", "examples": "2024-11-18T16:31:37.285809+00:00", "title": "Expiration"}, "description": "Blocklist expiration"}, {"name": "ignore_invalid_ips", "in": "query", "required": false, "schema": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "description": "Ignore invalid IPs", "default": false, "title": "Ignore Invalid Ips"}, "description": "Ignore invalid IPs"}], "requestBody": {"required": true, "content": {"multipart/form-data": {"schema": {"$ref": "#/components/schemas/Body_uploadBlocklistContent"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "400": {"description": "Invalid IP in blocklist file content"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips": {"post": {"tags": ["Blocklists"], "summary": "Add Ips To Blocklist", "description": "Add IPs to a blocklist. If an IP is already in the blocklist, its expiration will be updated with the new expiration.", "operationId": "addIpsToBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistAddIPsRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "412": {"description": "Payload too large for one operation, limit is 20000 IPs per request"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/ips/delete": {"post": {"tags": ["Blocklists"], "summary": "Delete Ips From Blocklist", "description": "Delete IPs from a blocklist", "operationId": "deleteIpsFromBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistDeleteIPsRequest"}}}}, "responses": {"204": {"description": "Successful Response"}, "403": {"description": "Blocklist is read-only"}, "404": {"description": "Blocklist not found"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/download": {"get": {"tags": ["Blocklists"], "summary": "Download Blocklist Content", "description": "Download blocklist content as a list of ips as plain text separated by new lines. The response will include the ETag header for cache control. If_Modified_Since and If_None_Match cache control headers are supported for conditional requests.", "operationId": "downloadBlocklistContent", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "if-modified-since", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_Modified_Since cache control header", "title": "If-Modified-Since"}, "description": "If_Modified_Since cache control header"}, {"name": "if-none-match", "in": "header", "required": false, "schema": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "If_None_Match cache control header", "title": "If-None-Match"}, "description": "If_None_Match cache control header"}], "responses": {"200": {"description": "Successful Response", "content": {"text/plain": {"schema": {"type": "string"}}}}, "404": {"description": "Blocklist not found"}, "204": {"description": "Blocklist is empty"}, "500": {"description": "Internal server error"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers": {"post": {"tags": ["Blocklists"], "summary": "Subscribe Blocklist", "description": "Subscribe to a blocklist with a remediation type. If the entity type is the full organization or a Tag, all the engines belonging to the organization or the Tag will be subscribed and new engines that will join the organization or the Tag will also be automatically subscribed. If the subscription has been done on an organization or Tag you cannot unsubscribe individual engines. In case of errors for some subscribers, the operation will still succeed for the entities that were successfully subscribed and you'll have the list of errors in the operation's result. This operation is submitted to quotas.", "operationId": "subscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscriptionResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Blocklists"], "summary": "Get Blocklist Subscribers", "description": "Get blocklist subscribers within your organization.", "operationId": "getBlocklistSubscribers", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistSubscribersResponse"}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/subscribers/{entity_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unsubscribe Blocklist", "description": "Unsubscribe from a blocklist. You cannot unsubscribe individual engines if the subscription has been done on an organization or Tag.", "operationId": "unsubscribeBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "entity_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Entity Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares": {"post": {"tags": ["Blocklists"], "summary": "Share Blocklist", "description": "Share a blocklist with other organizations given their IDs. The blocklist must be owned by your organization. You can give read-only access or read-write access to the blocklist. Sharing a blocklist will not automatically subscribe the shared organizations to the blocklist.", "operationId": "shareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/BlocklistShareRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/blocklists/{blocklist_id}/shares/{unshare_organization_id}": {"delete": {"tags": ["Blocklists"], "summary": "Unshare Blocklist", "description": "Unshare a blocklist with other organizations. If the blocklist is subscribed by the organization, the operation will fail.Use force query parameter to unshare a blocklist even if subscriptions exists.", "operationId": "unshareBlocklist", "parameters": [{"name": "blocklist_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Blocklist Id"}}, {"name": "unshare_organization_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Unshare Organization Id"}}], "responses": {"204": {"description": "Successful Response"}, "404": {"description": "Blocklist not found"}, "409": {"description": "Blocklist is not private"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations": {"post": {"tags": ["Integrations"], "summary": "Create Integration", "description": "Create an integration to a firewall or remediation component, owned by your organization. The name should be unique within the organization. This operation is submitted to quotas.", "operationId": "createIntegration", "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateRequest"}}}}, "responses": {"201": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationCreateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integrations", "description": "Get integrations owned by your organization", "operationId": "getIntegrations", "parameters": [{"name": "tag", "in": "query", "required": false, "schema": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}], "description": "List of tags associated with the integrations (any of)", "title": "Tag"}, "description": "List of tags associated with the integrations (any of)"}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number", "default": 1, "title": "Page"}, "description": "Page number"}, {"name": "size", "in": "query", "required": false, "schema": {"type": "integer", "maximum": 100, "minimum": 1, "description": "Page size", "default": 50, "title": "Size"}, "description": "Page size"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/Page_IntegrationGetResponse_"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}": {"get": {"tags": ["Integrations"], "summary": "Get Integration", "description": "Get an integration by ID", "operationId": "getIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationGetResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "patch": {"tags": ["Integrations"], "summary": "Update Integration", "description": "Update the integration details", "operationId": "updateIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "requestBody": {"required": true, "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateRequest"}}}}, "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/IntegrationUpdateResponse"}}}}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "delete": {"tags": ["Integrations"], "summary": "Delete Integration", "description": "Delete the integration by ID", "operationId": "deleteIntegration", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "title": "Integration Id"}}], "responses": {"204": {"description": "Successful Response"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/content": {"head": {"tags": ["Integrations"], "summary": "Head Integration Content", "description": "Check if the integration has content", "operationId": "headIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}, "get": {"tags": ["Integrations"], "summary": "Get Integration Content", "description": "Get the ips associated to the integration in plain text format. The content can be paginated to accomodate limits in firewalls.", "operationId": "getIntegrationContent", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "page", "in": "query", "required": false, "schema": {"type": "integer", "minimum": 1, "description": "Page number to return", "default": 1, "title": "Page"}, "description": "Page number to return"}, {"name": "page_size", "in": "query", "required": false, "schema": {"anyOf": [{"type": "integer", "minimum": 10000}, {"type": "null"}], "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000", "title": "Page Size"}, "description": "Maximum number of items to return, 0 means no limit (default), should be greater than 10000"}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/integrations/{integration_id}/v1/decisions/stream": {"get": {"tags": ["Integrations"], "summary": "Get Integration Content Stream", "description": "Get the ips associated to the integration in a format compatible with a remediation component. As for the remediation components, you can fetch the full content with startup=true or only the changes since the last pull", "operationId": "getIntegrationContentStream", "parameters": [{"name": "integration_id", "in": "path", "required": true, "schema": {"type": "string", "format": "ObjectId", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"], "title": "Integration Id"}}, {"name": "startup", "in": "query", "required": false, "schema": {"type": "boolean", "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull.", "default": false, "title": "Startup"}, "description": "Set to true if it's the first run to fetch all the content, otherwise only changes since the last pull."}], "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {}}}}, "404": {"description": "Integration not found"}, "204": {"description": "Integration has no subscribed blocklists or no content available"}, "422": {"description": "Validation Error", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}}}}}, "/info": {"get": {"tags": ["Info"], "summary": "Get Me Info", "description": "Get the current user and organization informations", "operationId": "getInfo", "responses": {"200": {"description": "Successful Response", "content": {"application/json": {"schema": {"$ref": "#/components/schemas/InfoResponse"}}}}}}}, "/hub/index/{tenant}/{branch}/.index.json": {"get": {"description": "Get a (minimized) index file for 'cscli hub update'. May or may not include unused fields\n(content, long descriptions, labels...) or redundant ones (author, name).", "operationId": "getIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get a minimized index file (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for the index file without the full content.\nIt is useful for validating cache, checking resource freshness, and managing client-side\ncache expiration policies. No body content is returned.", "operationId": "headIndex", "parameters": [{"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}, {"description": "Include content in the index", "in": "query", "name": "with_content", "required": false, "schema": {"default": false, "description": "Include content in the index", "title": "With Content", "type": "boolean"}}], "responses": {"200": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Index"}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for the index file", "tags": ["Hub"]}}, "/hub/index/{tenant}/{branch}/{item_path}": {"get": {"description": "Get an item's content from its path. This is usually a YAML file.", "operationId": "getItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "404": {"description": "No content field"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Get an item's content (crowdsec only)", "tags": ["Hub"]}, "head": {"description": "This endpoint returns cache-related headers for an item's content. It is useful for validating\ncache, checking resource freshness, and managing client-side cache expiration policies. No body\ncontent is returned.", "operationId": "headItemContent", "parameters": [{"in": "path", "name": "item_path", "required": true, "schema": {"title": "Item Path", "type": "string"}}, {"in": "path", "name": "branch", "required": true, "schema": {"title": "Branch", "type": "string"}}, {"in": "path", "name": "tenant", "required": true, "schema": {"title": "Tenant", "type": "string"}}], "responses": {"200": {"content": {"application/json": {"schema": {}}}, "description": "Successful Response"}, "422": {"content": {"application/json": {"schema": {"$ref": "#/components/schemas/HTTPValidationError"}}}, "description": "Validation Error"}}, "summary": "Check cache control headers for an item's content", "tags": ["Hub"]}}}, "components": {"schemas": {"ApiKeyCredentials": {"properties": {"api_key": {"type": "string", "title": "Api Key", "description": "API key for the integration"}}, "type": "object", "required": ["api_key"], "title": "ApiKeyCredentials"}, "BasicAuthCredentials": {"properties": {"username": {"type": "string", "title": "Username", "description": "Basic auth username for the integration"}, "password": {"type": "string", "title": "Password", "description": "Basic auth password for the integration"}}, "type": "object", "required": ["username", "password"], "title": "BasicAuthCredentials"}, "BlocklistAddIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}, "expiration": {"type": "string", "format": "date-time", "title": "Expiration", "description": "Expiration date"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistAddIPsRequest"}, "BlocklistCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "priority": {"type": "integer", "title": "Priority"}}, "type": "object", "required": ["name", "label", "description", "priority"], "title": "BlocklistCategory"}, "BlocklistContentStats": {"properties": {"total_seen": {"type": "integer", "title": "Total Seen", "default": 0}, "total_fire": {"type": "integer", "title": "Total Fire", "default": 0}, "total_seen_1m": {"type": "integer", "title": "Total Seen 1M", "default": 0}, "total_in_other_lists": {"type": "integer", "title": "Total In Other Lists", "default": 0}, "total_false_positive": {"type": "integer", "title": "Total False Positive", "default": 0}, "false_positive_removed_by_crowdsec": {"type": "integer", "title": "False Positive Removed By Crowdsec", "default": 0}, "most_present_behaviors": {"items": {"$ref": "#/components/schemas/CtiBehavior"}, "type": "array", "title": "Most Present Behaviors", "default": []}, "most_present_categories": {"items": {"$ref": "#/components/schemas/CtiCategory"}, "type": "array", "title": "Most Present Categories", "default": []}, "most_present_scenarios": {"items": {"$ref": "#/components/schemas/CtiScenario"}, "type": "array", "title": "Most Present Scenarios", "default": []}, "top_as": {"items": {"$ref": "#/components/schemas/CtiAs"}, "type": "array", "title": "Top As", "default": []}, "top_attacking_countries": {"items": {"$ref": "#/components/schemas/CtiCountry"}, "type": "array", "title": "Top Attacking Countries", "default": []}, "top_ips": {"items": {"$ref": "#/components/schemas/CtiIp"}, "type": "array", "title": "Top Ips", "default": []}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistContentStats"}, "BlocklistCreateRequest": {"properties": {"name": {"type": "string", "maxLength": 200, "minLength": 1, "title": "Name", "description": "Blocklist name, must be unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name (Default: name)"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Useful references on the list's origins", "default": []}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags", "default": []}, "from_cti_query": {"type": "string", "title": "From Cti Query", "description": "CTI query (doc link available soon)"}, "since": {"type": "string", "title": "Since", "description": "Since duration for the CTI query (5m, 2h, 7d). Max is 30 days"}}, "additionalProperties": false, "type": "object", "required": ["name", "description"], "title": "BlocklistCreateRequest"}, "BlocklistCreateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags"}, "pricing_tier": {"allOf": [{"$ref": "#/components/schemas/PricingTiers"}], "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"allOf": [{"$ref": "#/components/schemas/BlocklistSources"}], "description": "Blocklist source"}, "stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistStats"}], "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with"}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned"}, "categories": {"items": {"$ref": "#/components/schemas/BlocklistCategory"}, "type": "array", "title": "Categories", "description": "List of categories for the blocklist", "default": []}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "label", "description", "references", "is_private", "tags", "pricing_tier", "source", "stats", "from_cti_query", "since", "shared_with", "organization_id", "subscribers"], "title": "BlocklistCreateResponse"}, "BlocklistDeleteIPsRequest": {"properties": {"ips": {"items": {"type": "string"}, "type": "array", "title": "Ips", "description": "List of IPs or networks"}}, "additionalProperties": false, "type": "object", "required": ["ips"], "title": "BlocklistDeleteIPsRequest"}, "BlocklistGetResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags"}, "pricing_tier": {"allOf": [{"$ref": "#/components/schemas/PricingTiers"}], "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"allOf": [{"$ref": "#/components/schemas/BlocklistSources"}], "description": "Blocklist source"}, "stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistStats"}], "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with"}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned"}, "categories": {"items": {"$ref": "#/components/schemas/BlocklistCategory"}, "type": "array", "title": "Categories", "description": "List of categories for the blocklist", "default": []}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "label", "description", "references", "is_private", "tags", "pricing_tier", "source", "stats", "from_cti_query", "since", "shared_with", "organization_id", "subscribers"], "title": "BlocklistGetResponse"}, "BlocklistIncludeFilters": {"type": "string", "enum": ["public", "private", "shared", "all"], "title": "BlocklistIncludeFilters"}, "BlocklistResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "Blocklist id"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Blocklist creation date"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Blocklist update date"}, "name": {"type": "string", "title": "Name", "description": "Blocklist name, unique within the organization"}, "label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "is_private": {"type": "boolean", "title": "Is Private", "description": "Private blocklist if True or public if False"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Classification tags"}, "pricing_tier": {"allOf": [{"$ref": "#/components/schemas/PricingTiers"}], "description": "Pricing tier for Crowdsec blocklists only"}, "source": {"allOf": [{"$ref": "#/components/schemas/BlocklistSources"}], "description": "Blocklist source"}, "stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistStats"}], "description": "Blocklist stats"}, "from_cti_query": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "From Cti Query", "description": "CTI query from which the blocklist was created"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}, "shared_with": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Shared With", "description": "List of organizations shared with"}, "organization_id": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Organization Id", "description": "Blocklists owner's organization id"}, "subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers to the blocklist. Only subscribers belonging to your organization are returned"}, "categories": {"items": {"$ref": "#/components/schemas/BlocklistCategory"}, "type": "array", "title": "Categories", "description": "List of categories for the blocklist", "default": []}}, "type": "object", "required": ["id", "created_at", "updated_at", "name", "label", "description", "references", "is_private", "tags", "pricing_tier", "source", "stats", "from_cti_query", "since", "shared_with", "organization_id", "subscribers"], "title": "BlocklistResponse"}, "BlocklistSearchRequest": {"properties": {"page": {"type": "integer", "minimum": 1.0, "title": "Page", "description": "Page number", "default": 1}, "page_size": {"type": "integer", "maximum": 1000.0, "title": "Page Size", "description": "Page size", "default": 100}, "pricing_tiers": {"items": {"$ref": "#/components/schemas/PricingTiers"}, "type": "array", "title": "Pricing Tiers", "description": "Pricing tiers", "default": []}, "query": {"type": "string", "title": "Query", "description": "Search query", "default": ""}, "targeted_countries": {"items": {"type": "string"}, "type": "array", "title": "Targeted Countries", "description": "Targeted countries", "default": []}, "classifications": {"items": {"type": "string"}, "type": "array", "title": "Classifications", "description": "Classifications", "default": []}, "behaviors": {"items": {"type": "string"}, "type": "array", "title": "Behaviors", "description": "Behaviors", "default": []}, "min_ips": {"type": "integer", "minimum": 0.0, "title": "Min Ips", "description": "Minimum number of IPs", "default": 0}, "sources": {"items": {"$ref": "#/components/schemas/BlocklistSources"}, "type": "array", "title": "Sources", "description": "Sources", "default": []}, "categories": {"items": {"type": "string"}, "type": "array", "title": "Categories", "description": "Categories", "default": []}, "is_private": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Private", "description": "Private blocklist"}, "is_subscribed": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "title": "Is Subscribed", "description": "Subscribed blocklist (None: all)"}}, "additionalProperties": false, "type": "object", "title": "BlocklistSearchRequest"}, "BlocklistShareRequest": {"properties": {"organizations": {"items": {"$ref": "#/components/schemas/Share"}, "type": "array", "title": "Organizations", "description": "List of organizations to share the blocklist"}}, "additionalProperties": false, "type": "object", "required": ["organizations"], "title": "BlocklistShareRequest"}, "BlocklistSources": {"type": "string", "enum": ["crowdsec", "third_party", "custom"], "title": "BlocklistSources"}, "BlocklistStats": {"properties": {"content_stats": {"allOf": [{"$ref": "#/components/schemas/BlocklistContentStats"}], "default": {"total_seen": 0, "total_fire": 0, "total_seen_1m": 0, "total_in_other_lists": 0, "total_false_positive": 0, "false_positive_removed_by_crowdsec": 0, "most_present_behaviors": [], "most_present_categories": [], "most_present_scenarios": [], "top_as": [], "top_attacking_countries": [], "top_ips": []}}, "usage_stats": {"anyOf": [{"$ref": "#/components/schemas/BlocklistUsageStats"}, {"type": "null"}], "default": {"engines_subscribed_directly": 0, "engines_subscribed_through_org": 0, "engines_subscribed_through_tag": 0, "total_subscribed_engines": 0, "total_subscribed_organizations": 0}}, "addition_2days": {"type": "integer", "title": "Addition 2Days", "default": 0}, "addition_month": {"type": "integer", "title": "Addition Month", "default": 0}, "suppression_2days": {"type": "integer", "title": "Suppression 2Days", "default": 0}, "suppression_month": {"type": "integer", "title": "Suppression Month", "default": 0}, "change_2days_percentage": {"type": "number", "title": "Change 2Days Percentage", "default": 0.0}, "change_month_percentage": {"type": "number", "title": "Change Month Percentage", "default": 0.0}, "count": {"type": "integer", "title": "Count", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistStats"}, "BlocklistSubscriberEntity": {"properties": {"id": {"type": "string", "title": "Id", "description": "Subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}, "remediation": {"type": "string", "title": "Remediation", "description": "Remediation"}}, "type": "object", "required": ["id", "entity_type", "remediation"], "title": "BlocklistSubscriberEntity"}, "BlocklistSubscribersResponse": {"properties": {"subscribers": {"items": {"$ref": "#/components/schemas/BlocklistSubscriberEntity"}, "type": "array", "title": "Subscribers", "description": "List of subscribers"}}, "type": "object", "required": ["subscribers"], "title": "BlocklistSubscribersResponse"}, "BlocklistSubscription": {"properties": {"id": {"type": "string", "title": "Id"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation"}, "name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}}, "type": "object", "required": ["id", "name", "label"], "title": "BlocklistSubscription"}, "BlocklistSubscriptionRequest": {"properties": {"ids": {"items": {"type": "string"}, "type": "array", "title": "Ids", "description": "List of subscriber entity id"}, "entity_type": {"$ref": "#/components/schemas/SubscriberEntityType"}, "remediation": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Remediation", "description": "Remediation"}}, "additionalProperties": false, "type": "object", "required": ["entity_type"], "title": "BlocklistSubscriptionRequest"}, "BlocklistSubscriptionResponse": {"properties": {"updated": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "title": "Updated", "description": "List of updated blocklist ids", "examples": ["5f9d88b9e5c4f5b9a3d3e8b1"]}, "errors": {"anyOf": [{"items": {"additionalProperties": {"type": "string"}, "type": "object"}, "type": "array"}, {"type": "null"}], "title": "Errors", "description": "List of errors if any", "examples": [{"5f9d88b9e5c4f5b9a3d3e8b1": "error message"}]}}, "type": "object", "required": ["updated", "errors"], "title": "BlocklistSubscriptionResponse"}, "BlocklistUpdateRequest": {"properties": {"label": {"type": "string", "title": "Label", "description": "Blocklist human readable name"}, "description": {"type": "string", "title": "Description", "description": "Blocklist description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References", "description": "Blocklist references"}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Blocklist tags"}, "from_cti_query": {"type": "string", "title": "From Cti Query", "description": "CTI query (doc link available soon)"}, "since": {"type": "string", "title": "Since", "description": "Since duration for the CTI query (eg. 5m, 2h, 7d). Max is 30 days"}}, "additionalProperties": false, "type": "object", "title": "BlocklistUpdateRequest"}, "BlocklistUsageStats": {"properties": {"engines_subscribed_directly": {"type": "integer", "title": "Engines Subscribed Directly", "default": 0}, "engines_subscribed_through_org": {"type": "integer", "title": "Engines Subscribed Through Org", "default": 0}, "engines_subscribed_through_tag": {"type": "integer", "title": "Engines Subscribed Through Tag", "default": 0}, "total_subscribed_engines": {"type": "integer", "title": "Total Subscribed Engines", "default": 0}, "total_subscribed_organizations": {"type": "integer", "title": "Total Subscribed Organizations", "default": 0}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At"}}, "additionalProperties": true, "type": "object", "title": "BlocklistUsageStats"}, "Body_uploadBlocklistContent": {"properties": {"file": {"type": "string", "format": "binary", "title": "File", "description": "Blocklist file in txt format"}}, "type": "object", "required": ["file"], "title": "Body_uploadBlocklistContent"}, "CtiAs": {"properties": {"as_num": {"type": "string", "title": "As Num"}, "as_name": {"type": "string", "title": "As Name"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["as_num", "as_name", "total_ips"], "title": "CtiAs"}, "CtiBehavior": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiBehavior"}, "CtiCategory": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "total_ips"], "title": "CtiCategory"}, "CtiCountry": {"properties": {"country_short": {"type": "string", "title": "Country Short"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["country_short", "total_ips"], "title": "CtiCountry"}, "CtiIp": {"properties": {"ip": {"type": "string", "title": "Ip"}, "total_signals_1m": {"type": "integer", "title": "Total Signals 1M"}, "reputation": {"type": "string", "title": "Reputation", "default": "unknown"}}, "additionalProperties": true, "type": "object", "required": ["ip", "total_signals_1m"], "title": "CtiIp"}, "CtiScenario": {"properties": {"name": {"type": "string", "title": "Name"}, "label": {"type": "string", "title": "Label"}, "description": {"type": "string", "title": "Description"}, "references": {"items": {"type": "string"}, "type": "array", "title": "References"}, "total_ips": {"type": "integer", "title": "Total Ips"}}, "additionalProperties": true, "type": "object", "required": ["name", "label", "description", "references", "total_ips"], "title": "CtiScenario"}, "HTTPValidationError": {"properties": {"detail": {"items": {"$ref": "#/components/schemas/ValidationError"}, "title": "Detail", "type": "array"}}, "title": "HTTPValidationError", "type": "object"}, "InfoResponse": {"properties": {"organization_id": {"type": "string", "title": "Organization Id", "description": "The organization ID"}, "subscription_type": {"type": "string", "title": "Subscription Type", "description": "The organization subscription type"}, "api_key_name": {"type": "string", "title": "Api Key Name", "description": "The API key name that is used"}}, "type": "object", "required": ["organization_id", "subscription_type", "api_key_name"], "title": "InfoResponse"}, "IntegrationCreateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "Name of the integration"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "Description of the integration"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}}, "additionalProperties": false, "type": "object", "required": ["name", "entity_type", "output_format"], "title": "IntegrationCreateRequest"}, "IntegrationCreateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}, "last_pull": {"type": "string", "format": "date-time", "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"allOf": [{"$ref": "#/components/schemas/Stats"}], "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}], "title": "Credentials", "description": "Credentials that were generated for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint", "credentials"], "title": "IntegrationCreateResponse"}, "IntegrationGetResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}, "last_pull": {"type": "string", "format": "date-time", "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"allOf": [{"$ref": "#/components/schemas/Stats"}], "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationGetResponse"}, "IntegrationType": {"type": "string", "enum": ["firewall_integration", "remediation_component_integration"], "title": "IntegrationType"}, "IntegrationUpdateRequest": {"properties": {"name": {"type": "string", "minLength": 1, "title": "Name", "description": "New name"}, "description": {"type": "string", "minLength": 1, "title": "Description", "description": "New description"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "New output format"}, "regenerate_credentials": {"type": "boolean", "title": "Regenerate Credentials", "description": "Regenerate credentials for the integration"}}, "additionalProperties": false, "type": "object", "title": "IntegrationUpdateRequest"}, "IntegrationUpdateResponse": {"properties": {"id": {"type": "string", "title": "Id", "description": "ID of the integration"}, "name": {"type": "string", "title": "Name", "description": "Name of the integration. Should be unique within the organization"}, "organization_id": {"type": "string", "title": "Organization Id", "description": "ID of the owner organization"}, "description": {"type": "string", "title": "Description", "description": "Description of the integration"}, "created_at": {"type": "string", "format": "date-time", "title": "Created At", "description": "Time the integration was created"}, "updated_at": {"type": "string", "format": "date-time", "title": "Updated At", "description": "Last time the integration was updated"}, "entity_type": {"allOf": [{"$ref": "#/components/schemas/IntegrationType"}], "description": "Type of the integration"}, "output_format": {"allOf": [{"$ref": "#/components/schemas/OutputFormat"}], "description": "Output format of the integration"}, "last_pull": {"type": "string", "format": "date-time", "title": "Last Pull", "description": "Last time the integration pulled blocklists"}, "blocklists": {"items": {"$ref": "#/components/schemas/BlocklistSubscription"}, "type": "array", "title": "Blocklists", "description": "Blocklists that are subscribed by the integration"}, "endpoint": {"type": "string", "maxLength": 2083, "minLength": 1, "format": "uri", "title": "Endpoint", "description": "Url that should be used by the firewall or the remediation component to fetch the integration's content"}, "stats": {"allOf": [{"$ref": "#/components/schemas/Stats"}], "description": "Stats of the integration", "default": {"count": 0}}, "tags": {"items": {"type": "string"}, "type": "array", "title": "Tags", "description": "Tags associated with the integration", "default": []}, "credentials": {"anyOf": [{"$ref": "#/components/schemas/ApiKeyCredentials"}, {"$ref": "#/components/schemas/BasicAuthCredentials"}, {"type": "null"}], "title": "Credentials", "description": "Credentials for the integration"}}, "type": "object", "required": ["id", "name", "organization_id", "created_at", "updated_at", "entity_type", "output_format", "blocklists", "endpoint"], "title": "IntegrationUpdateResponse"}, "Links": {"properties": {"first": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "First", "examples": ["/api/v1/users?limit=1&offset1"]}, "last": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Last", "examples": ["/api/v1/users?limit=1&offset1"]}, "self": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Self", "examples": ["/api/v1/users?limit=1&offset1"]}, "next": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Next", "examples": ["/api/v1/users?limit=1&offset1"]}, "prev": {"anyOf": [{"type": "string"}, {"type": "null"}], "title": "Prev", "examples": ["/api/v1/users?limit=1&offset1"]}}, "type": "object", "required": ["first", "last", "self", "next", "prev"], "title": "Links"}, "OutputFormat": {"type": "string", "enum": ["plain_text", "f5", "remediation_component", "fortigate", "paloalto", "checkpoint", "cisco"], "title": "OutputFormat"}, "Page_BlocklistResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/BlocklistResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[BlocklistResponse]"}, "Page_IntegrationGetResponse_": {"properties": {"items": {"items": {"$ref": "#/components/schemas/IntegrationGetResponse"}, "type": "array", "title": "Items"}, "total": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Total"}, "page": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Page"}, "size": {"anyOf": [{"type": "integer", "minimum": 1.0}, {"type": "null"}], "title": "Size"}, "pages": {"anyOf": [{"type": "integer", "minimum": 0.0}, {"type": "null"}], "title": "Pages"}, "links": {"$ref": "#/components/schemas/Links"}}, "type": "object", "required": ["items", "total", "page", "size", "links"], "title": "Page[IntegrationGetResponse]"}, "PaginatedBlocklistResponse": {"properties": {"items": {"items": {"$ref": "#/components/schemas/BlocklistResponse"}, "type": "array", "title": "Items", "description": "List of blocklists"}, "page": {"type": "integer", "title": "Page", "description": "Page number"}, "total": {"type": "integer", "title": "Total", "description": "Total number of blocklists"}, "size": {"type": "integer", "title": "Size", "description": "Page size"}, "pages": {"type": "integer", "title": "Pages", "description": "Total number of pages"}}, "type": "object", "required": ["items", "page", "total", "size", "pages"], "title": "PaginatedBlocklistResponse"}, "Permission": {"type": "string", "enum": ["read", "write"], "title": "Permission"}, "PricingTiers": {"type": "string", "enum": ["free", "premium", "platinum"], "title": "PricingTiers"}, "Share": {"properties": {"organization_id": {"type": "string", "title": "Organization Id"}, "permission": {"$ref": "#/components/schemas/Permission"}}, "type": "object", "required": ["organization_id", "permission"], "title": "Share"}, "Stats": {"properties": {"count": {"type": "integer", "title": "Count", "description": "Number of total blocklists items the integration will pull"}}, "type": "object", "required": ["count"], "title": "Stats"}, "SubscriberEntityType": {"type": "string", "enum": ["org", "tag", "engine", "firewall_integration", "remediation_component_integration"], "title": "SubscriberEntityType"}, "ValidationError": {"properties": {"loc": {"items": {"anyOf": [{"type": "string"}, {"type": "integer"}]}, "title": "Location", "type": "array"}, "msg": {"title": "Message", "type": "string"}, "type": {"title": "Error Type", "type": "string"}}, "required": ["loc", "msg", "type"], "title": "ValidationError", "type": "object"}, "AppsecConfigIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "AppsecConfigIndex", "type": "object"}, "AppsecRuleIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "AppsecRuleIndex", "type": "object"}, "CollectionIndex": {"properties": {"appsec-configs": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of appsec-configs", "title": "Appsec-Configs"}, "appsec-rules": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of appsec-rules", "title": "Appsec-Rules"}, "collections": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of collections", "title": "Collections"}, "content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "contexts": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of contexts", "title": "Contexts"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "parsers": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of parsers", "title": "Parsers"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "postoverflows": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of postoverflows", "title": "Postoverflows"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "scenarios": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of scenarios", "title": "Scenarios"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "CollectionIndex", "type": "object"}, "ContextIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "ContextIndex", "type": "object"}, "Index": {"description": "Index document served to crowdsec/cscli.", "properties": {"appsec-configs": {"additionalProperties": {"$ref": "#/components/schemas/AppsecConfigIndex"}, "title": "Appsec-Configs", "type": "object"}, "appsec-rules": {"additionalProperties": {"$ref": "#/components/schemas/AppsecRuleIndex"}, "title": "Appsec-Rules", "type": "object"}, "collections": {"additionalProperties": {"$ref": "#/components/schemas/CollectionIndex"}, "title": "Collections", "type": "object"}, "contexts": {"additionalProperties": {"$ref": "#/components/schemas/ContextIndex"}, "title": "Contexts", "type": "object"}, "parsers": {"additionalProperties": {"$ref": "#/components/schemas/ParserIndex"}, "title": "Parsers", "type": "object"}, "postoverflows": {"additionalProperties": {"$ref": "#/components/schemas/PostoverflowIndex"}, "title": "Postoverflows", "type": "object"}, "scenarios": {"additionalProperties": {"$ref": "#/components/schemas/ScenarioIndex"}, "title": "Scenarios", "type": "object"}}, "title": "Index", "type": "object"}, "ParserIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "stage": {"description": "The stage of the parser", "title": "Stage", "type": "string"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "required": ["stage"], "title": "ParserIndex", "type": "object"}, "PostoverflowIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "stage": {"description": "The stage of the postoverflow", "title": "Stage", "type": "string"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "required": ["stage"], "title": "PostoverflowIndex", "type": "object"}, "ScenarioIndex": {"properties": {"content": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "The YAML content of the item, in plaintext.", "examples": ["type: leaky\n#debug: true\nname: crowdsecurity/vsftpd-bf\ndescription: \"Detect FTP bruteforce (vsftpd)\"\nfilter: evt.Meta.log_type == 'ftp_failed_auth'\nleakspeed: \"10s\"\ncapacity: 5\ngroupby: evt.Meta.source_ip\nblackhole: 5m\nlabels:\n confidence: 3\n spoofable: 0\n classification:\n - attack.T1110\n behavior: \"ftp:bruteforce\"\n label: \"VSFTPD Bruteforce\"\n remediation: true\n service: vsftpd"], "title": "Content"}, "description": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "A short, plaintext description of the item", "title": "Description"}, "labels": {"anyOf": [{"additionalProperties": {"anyOf": [{"type": "string"}, {"items": {"type": "string"}, "type": "array"}, {"type": "integer"}]}, "type": "object"}, {"type": "null"}], "description": "Classification labels for the item", "examples": [{"behavior": "ftp:bruteforce", "classification": ["attack.T1110"], "confidence": 3, "label": "VSFTPD Bruteforce", "remediation": true, "service": "vsftpd", "spoofable": 0}], "title": "Labels"}, "path": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Relative path to the item's YAML content", "examples": ["scenarios/crowdsecurity/vsftpd-bf.yaml"], "title": "Path"}, "references": {"anyOf": [{"items": {"type": "string"}, "type": "array"}, {"type": "null"}], "description": "List of references to external resources", "title": "References"}, "version": {"anyOf": [{"type": "string"}, {"type": "null"}], "description": "Current version of the collection", "examples": ["0.2"], "title": "Version"}, "versions": {"anyOf": [{"additionalProperties": {"$ref": "#/components/schemas/VersionDetail"}, "type": "object"}, {"type": "null"}], "description": "A dictionary where each key is a version number (e.g., '0.1', '0.2')", "examples": [{"0.1": {"deprecated": false, "digest": "3591247988014705cf3a7e42388f0c87f9b86d3141268d996c5820ceab6364e1"}, "0.2": {"deprecated": false, "digest": "d1ddf4797250c1899a93ce634e6366e5deaaaf7508135056d17e9b09998ddf91"}}], "title": "Versions"}}, "title": "ScenarioIndex", "type": "object"}, "VersionDetail": {"properties": {"deprecated": {"anyOf": [{"type": "boolean"}, {"type": "null"}], "default": false, "description": "Indicates whether this version is deprecated.", "title": "Deprecated"}, "digest": {"description": "The SHA256 digest of the versioned file.", "examples": ["Detect FTP bruteforce (vsftpd)"], "title": "Digest", "type": "string"}}, "title": "VersionDetail", "type": "object"}}, "securitySchemes": {"ApiKeyAuth": {"type": "apiKey", "in": "header", "name": "x-api-key", "description": "If integration key is provided, can also work to get integration content"}, "BasicAuth": {"type": "http", "scheme": "basic", "description": "Basic Auth for integration content endpoint only"}}}, "security": [{"ApiKeyAuth": []}, {"BasicAuth": []}], "servers": [{"url": "https://admin.api.crowdsec.net/v1/", "description": "Production server"}]} \ No newline at end of file diff --git a/pyproject.toml b/pyproject.toml index 65f419e..154d764 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "crowdsec_service_api" -version = "1.30.1" +version = "1.43.1" license = { text = "MIT" } authors = [ { name="crowdsec", email="info@crowdsec.net" }