<?php

declare(strict_types=1);

/**
 * SPDX-License-Identifier: Apache-2.0
 *
 * The OpenSearch Contributors require contributions made to
 * this file be licensed under the Apache-2.0 license or a
 * compatible open source license.
 *
 * Modifications Copyright OpenSearch Contributors. See
 * GitHub history for details.
 */

namespace OpenSearch\Namespaces;

use OpenSearch\Endpoints\SecurityAnalytics\GetAlerts;
use OpenSearch\Endpoints\SecurityAnalytics\GetFindings;
use OpenSearch\Endpoints\SecurityAnalytics\SearchFindingCorrelations;

/**
 * Class SecurityAnalyticsNamespace
 *
 * NOTE: This file is autogenerated using util/GenerateEndpoints.php
 */
class SecurityAnalyticsNamespace extends AbstractNamespace
{
    /**
     * Retrieve alerts related to a specific detector type or detector ID.
     *
     * @param array{alertState?: mixed, detectorType?: string, detector_id?: string, endTime?: int, missing?: string, searchString?: string, severityLevel?: mixed, size?: int, sortOrder?: mixed, sortString?: string, startIndex?: int, startTime?: int, pretty?: bool, human?: bool, error_trace?: bool, source?: string, filter_path?: mixed} $params
     * - alertState: Used to filter by alert state. Optional. (Options: ACKNOWLEDGED, ACTIVE, COMPLETED, DELETED, ERROR)
     * - detectorType: The type of detector used to fetch alerts. Optional when `detector_id` is specified. Otherwise required.
     * - detector_id: The ID of the detector used to fetch alerts. Optional when `detectorType` is specified. Otherwise required.
     * - endTime: The end timestamp (in ms) of the time window in which you want to retrieve alerts. Optional.
     * - missing: Used to sort by whether the field `missing` exists or not in the documents associated with the alert. Optional.
     * - searchString: The alert attribute you want returned in the search. Optional.
     * - severityLevel: Used to filter by alert severity level. Optional. (Options: 1, 2, 3, 4, 5, ALL)
     * - size: The maximum number of results returned in the response. Optional. (Default: 20)
     * - sortOrder: The order used to sort the list of findings. Possible values are `asc` or `desc`. Optional. (Options: asc, desc)
     * - sortString: The string used by Security Analytics to sort the alerts. Optional. (Default: start_time)
     * - startIndex: The pagination index. Optional. (Default: 0)
     * - startTime: The beginning timestamp (in ms) of the time window in which you want to retrieve alerts. Optional.
     * - pretty: Whether to pretty-format the returned JSON response. (Default: false)
     * - human: Whether to return human-readable values for statistics. (Default: false)
     * - error_trace: Whether to include the stack trace of returned errors. (Default: false)
     * - source: The URL-encoded request definition. Useful for libraries that do not accept a request body for non-POST requests.
     * - filter_path: A comma-separated list of filters used to filter the response. Use wildcards to match any field or part of a field's name. To exclude fields, use `-`.
     * @return array
     */
    public function getAlerts(array $params = [])
    {

        $endpoint = $this->endpointFactory->getEndpoint(GetAlerts::class);
        $endpoint->setParams($params);

        return $this->performRequest($endpoint);
    }

    /**
     * Retrieve findings related to a specific detector type or detector ID.
     *
     * @param array{detectionType?: mixed, detectorType?: string, detector_id?: string, endTime?: string, findingIds?: string, missing?: string, searchString?: string, severity?: mixed, size?: int, sortOrder?: mixed, sortString?: string, startIndex?: int, startTime?: int, pretty?: bool, human?: bool, error_trace?: bool, source?: string, filter_path?: mixed} $params
     * - detectionType: The detection type that dictates the retrieval type for the findings. When the detection type is `threat`, it fetches threat intelligence feeds. When the detection type is `rule`, findings are fetched based on the detector’s rule. Optional. (Options: rule, threat)
     * - detectorType: The type of detector used to fetch alerts. Optional when the `detector_id` is specified. Otherwise required.
     * - detector_id: The ID of the detector used to fetch alerts. Optional when the `detectorType` is specified. Otherwise required.
     * - endTime: The end timestamp (in ms) of the time window in which you want to retrieve findings. Optional.
     * - findingIds: The comma-separated id list of findings for which you want retrieve details. Optional.
     * - missing: Used to sort by whether the field `missing` exists or not in the documents associated with the finding. Optional.
     * - searchString: The finding attribute you want returned in the search. To search in a specific index, specify the index name in the request path. For example, to search findings in the indexABC index, use `searchString=indexABC’. Optional.
     * - severity: The rule severity for which retrieve findings. Severity can be `critical`, `high`, `medium`, or `low`. Optional. (Options: critical, high, low, medium)
     * - size: The maximum number of results returned in the response. Optional. (Default: 20)
     * - sortOrder: The order used to sort the list of findings. Possible values are `asc` or `desc`. Optional. (Options: asc, desc)
     * - sortString: The string used by the Alerting plugin to sort the findings. Optional. (Default: timestamp)
     * - startIndex: The pagination index. Optional. (Default: 0)
     * - startTime: The beginning timestamp (in ms) of the time window in which you want to retrieve findings. Optional.
     * - pretty: Whether to pretty-format the returned JSON response. (Default: false)
     * - human: Whether to return human-readable values for statistics. (Default: false)
     * - error_trace: Whether to include the stack trace of returned errors. (Default: false)
     * - source: The URL-encoded request definition. Useful for libraries that do not accept a request body for non-POST requests.
     * - filter_path: A comma-separated list of filters used to filter the response. Use wildcards to match any field or part of a field's name. To exclude fields, use `-`.
     * @return array
     */
    public function getFindings(array $params = [])
    {

        $endpoint = $this->endpointFactory->getEndpoint(GetFindings::class);
        $endpoint->setParams($params);

        return $this->performRequest($endpoint);
    }

    /**
     * List correlations for a finding.
     *
     * @param array{detector_type?: string, finding?: string, nearby_findings?: int, time_window?: int, pretty?: bool, human?: bool, error_trace?: bool, source?: string, filter_path?: mixed} $params
     * - detector_type: The log type of findings you want to correlate with the specified finding. Required.
     * - finding: The finding ID for which you want to find other findings that are correlated. Required.
     * - nearby_findings: The number of nearby findings you want to return. Optional. (Default: 10)
     * - time_window: The time window (in ms) in which all of the correlations must have occurred together. Optional. (Default: 300000)
     * - pretty: Whether to pretty-format the returned JSON response. (Default: false)
     * - human: Whether to return human-readable values for statistics. (Default: false)
     * - error_trace: Whether to include the stack trace of returned errors. (Default: false)
     * - source: The URL-encoded request definition. Useful for libraries that do not accept a request body for non-POST requests.
     * - filter_path: A comma-separated list of filters used to filter the response. Use wildcards to match any field or part of a field's name. To exclude fields, use `-`.
     * @return array
     */
    public function searchFindingCorrelations(array $params = [])
    {

        $endpoint = $this->endpointFactory->getEndpoint(SearchFindingCorrelations::class);
        $endpoint->setParams($params);

        return $this->performRequest($endpoint);
    }

}