# AUTOGENERATED DO NOT EDIT
# Autogenerated using the pat_regex_generator dev tool

from schema import Regex

LOG_TYPE_REGEX = Regex(
    r"^("
    r"AWS\.ALB|"
    r"AWS\.AuroraMySQLAudit|"
    r"AWS\.BedrockModelInvocation|"
    r"AWS\.CloudFrontAccess|"
    r"AWS\.CloudTrail|"
    r"AWS\.CloudTrailDigest|"
    r"AWS\.CloudTrailInsight|"
    r"AWS\.CloudWatchEvents|"
    r"AWS\.Config|"
    r"AWS\.GuardDuty|"
    r"AWS\.NLB|"
    r"AWS\.S3ServerAccess|"
    r"AWS\.SecurityFindingFormat|"
    r"AWS\.TransitGatewayFlow|"
    r"AWS\.VPCDns|"
    r"AWS\.VPCFlow|"
    r"AWS\.WAFWebACL|"
    r"AlphaSOC\.Alert|"
    r"Amazon\.EKS\.Audit|"
    r"Amazon\.EKS\.Authenticator|"
    r"Anomali\.Indicator|"
    r"Apache\.AccessCombined|"
    r"Apache\.AccessCommon|"
    r"AppOmni\.Alerts|"
    r"AppOmni\.Events|"
    r"AppOmni\.Policy|"
    r"Asana\.Audit|"
    r"Atlassian\.Audit|"
    r"Auth0\.Events|"
    r"Axonius\.Activity|"
    r"Azure\.Audit|"
    r"Azure\.DefenderAlerts|"
    r"Azure\.MonitorActivity|"
    r"Bitwarden\.Events|"
    r"Box\.Event|"
    r"CarbonBlack\.AlertV2|"
    r"CarbonBlack\.Audit|"
    r"CarbonBlack\.EndpointEvent|"
    r"CarbonBlack\.WatchlistHit|"
    r"CiscoUmbrella\.AdminAudit|"
    r"CiscoUmbrella\.CloudFirewall|"
    r"CiscoUmbrella\.DNS|"
    r"CiscoUmbrella\.IP|"
    r"CiscoUmbrella\.Proxy|"
    r"Cloudflare\.Audit|"
    r"Cloudflare\.Firewall|"
    r"Cloudflare\.HttpRequest|"
    r"Cloudflare\.Spectrum|"
    r"Cloudflare\.ZeroTrust\.RData|"
    r"Crowdstrike\.AIDMaster|"
    r"Crowdstrike\.ActivityAudit|"
    r"Crowdstrike\.AppInfo|"
    r"Crowdstrike\.CriticalFile|"
    r"Crowdstrike\.DNSRequest|"
    r"Crowdstrike\.DetectionSummary|"
    r"Crowdstrike\.EventStreams|"
    r"Crowdstrike\.FDREvent|"
    r"Crowdstrike\.GroupIdentity|"
    r"Crowdstrike\.ManagedAssets|"
    r"Crowdstrike\.NetworkConnect|"
    r"Crowdstrike\.NetworkListen|"
    r"Crowdstrike\.NotManagedAssets|"
    r"Crowdstrike\.ProcessRollup2|"
    r"Crowdstrike\.ProcessRollup2Stats|"
    r"Crowdstrike\.SyntheticProcessRollup2|"
    r"Crowdstrike\.Unknown|"
    r"Crowdstrike\.UserIdentity|"
    r"Crowdstrike\.UserInfo|"
    r"Crowdstrike\.UserLogonLogoff|"
    r"Docker\.Events|"
    r"Docusign\.Connect|"
    r"Dropbox\.TeamEvent|"
    r"Duo\.Administrator|"
    r"Duo\.Authentication|"
    r"Duo\.OfflineEnrollment|"
    r"Duo\.Telephony|"
    r"Envoy\.Access|"
    r"Fastly\.Access|"
    r"Fluentd\.Syslog3164|"
    r"Fluentd\.Syslog5424|"
    r"GCP\.AccessTransparency|"
    r"GCP\.AuditLog|"
    r"GCP\.DNS|"
    r"GCP\.Firewall|"
    r"GCP\.HTTPLoadBalancer|"
    r"GSuite\.ActivityEvent|"
    r"GSuite\.DirectoryUsers|"
    r"GSuite\.Reports|"
    r"GitHub\.Audit|"
    r"GitHub\.Webhook|"
    r"GitLab\.API|"
    r"GitLab\.Audit|"
    r"GitLab\.Exceptions|"
    r"GitLab\.Git|"
    r"GitLab\.Integrations|"
    r"GitLab\.Production|"
    r"Gravitational\.TeleportAudit|"
    r"GreyNoise\.API\.Noise|"
    r"GreyNoise\.API\.V3|"
    r"GreyNoise\.Noise|"
    r"GreyNoise\.RIOT|"
    r"Heroku\.Runtime|"
    r"IPInfo\.ASNCIDR|"
    r"IPInfo\.ASNRanges|"
    r"IPInfo\.LocationCIDR|"
    r"IPInfo\.LocationRanges|"
    r"IPInfo\.PrivacyCIDR|"
    r"IPInfo\.PrivacyRanges|"
    r"Iru\.Audit|"
    r"Jamfpro\.ComplianceReporter|"
    r"Jamfpro\.Login|"
    r"Juniper\.Access|"
    r"Juniper\.Audit|"
    r"Juniper\.Firewall|"
    r"Juniper\.MWS|"
    r"Juniper\.Postgres|"
    r"Juniper\.Security|"
    r"Kandji\.Endpoint|"
    r"Lacework\.AgentManagement|"
    r"Lacework\.AlertDetails|"
    r"Lacework\.AllFiles|"
    r"Lacework\.Applications|"
    r"Lacework\.ChangeFiles|"
    r"Lacework\.CloudCompliance|"
    r"Lacework\.CloudConfiguration|"
    r"Lacework\.Cmdline|"
    r"Lacework\.Connections|"
    r"Lacework\.ContainerSummary|"
    r"Lacework\.ContainerVulnDetails|"
    r"Lacework\.DNSQuery|"
    r"Lacework\.Events|"
    r"Lacework\.HostVulnDetails|"
    r"Lacework\.Image|"
    r"Lacework\.Interfaces|"
    r"Lacework\.InternalIPA|"
    r"Lacework\.MachineDetails|"
    r"Lacework\.MachineSummary|"
    r"Lacework\.NewHashes|"
    r"Lacework\.Package|"
    r"Lacework\.PodSummary|"
    r"Lacework\.ProcessSummary|"
    r"Lacework\.UserDetails|"
    r"Lacework\.UserLogin|"
    r"Linux\.Auditd|"
    r"MISP\.WarningListsCIDR|"
    r"Material\.NewCaseCreated|"
    r"Microsoft365\.Audit\.AzureActiveDirectory|"
    r"Microsoft365\.Audit\.Exchange|"
    r"Microsoft365\.Audit\.General|"
    r"Microsoft365\.Audit\.SharePoint|"
    r"Microsoft365\.DLP\.All|"
    r"MicrosoftDefenderXDR\.AdvancedHunting|"
    r"MicrosoftGraph\.SecurityAlert|"
    r"MicrosoftIntune\.AuditLogs|"
    r"MicrosoftIntune\.DeviceComplianceOrg|"
    r"MicrosoftIntune\.Devices|"
    r"MicrosoftIntune\.OperationalLogs|"
    r"MicrosoftIntune\.Windows365AuditLogs|"
    r"MongoDB\.OrganizationEvent|"
    r"MongoDB\.ProjectEvent|"
    r"Netskope\.Audit|"
    r"Nginx\.Access|"
    r"Nginx\.Error|"
    r"Notion\.AuditLogs|"
    r"OCSF\.AccountChange|"
    r"OCSF\.ApiActivity|"
    r"OCSF\.ApplicationLifecycle|"
    r"OCSF\.Authentication|"
    r"OCSF\.AuthorizeSession|"
    r"OCSF\.BaseEvent|"
    r"OCSF\.ComplianceFinding|"
    r"OCSF\.ConfigState|"
    r"OCSF\.DatastoreActivity|"
    r"OCSF\.DetectionFinding|"
    r"OCSF\.DeviceConfigStateChange|"
    r"OCSF\.DhcpActivity|"
    r"OCSF\.DnsActivity|"
    r"OCSF\.EmailActivity|"
    r"OCSF\.EmailFileActivity|"
    r"OCSF\.EmailUrlActivity|"
    r"OCSF\.EntityManagement|"
    r"OCSF\.FileActivity|"
    r"OCSF\.FileHosting|"
    r"OCSF\.FtpActivity|"
    r"OCSF\.GroupManagement|"
    r"OCSF\.HttpActivity|"
    r"OCSF\.IncidentFinding|"
    r"OCSF\.InventoryInfo|"
    r"OCSF\.KernelActivity|"
    r"OCSF\.KernelExtension|"
    r"OCSF\.MemoryActivity|"
    r"OCSF\.ModuleActivity|"
    r"OCSF\.NetworkActivity|"
    r"OCSF\.NetworkFileActivity|"
    r"OCSF\.NtpActivity|"
    r"OCSF\.PatchState|"
    r"OCSF\.ProcessActivity|"
    r"OCSF\.RdpActivity|"
    r"OCSF\.ScanActivity|"
    r"OCSF\.ScheduledJobActivity|"
    r"OCSF\.SecurityFinding|"
    r"OCSF\.SmbActivity|"
    r"OCSF\.SshActivity|"
    r"OCSF\.UserAccess|"
    r"OCSF\.UserInventory|"
    r"OCSF\.VulnerabilityFinding|"
    r"OCSF\.WebResourceAccessActivity|"
    r"OCSF\.WebResourcesActivity|"
    r"OCSF\.WinPrefetchInfo|"
    r"OCSF\.WinRegistryKeyActivity|"
    r"OCSF\.WinRegistryKeyInfo|"
    r"OCSF\.WinRegistryValueActivity|"
    r"OCSF\.WinRegistryValueInfo|"
    r"OCSF\.WinResourceActivity|"
    r"OCSF\.WinprefetchInfo|"
    r"OCSF\.WinregistryKeyActivity|"
    r"OCSF\.WinregistryKeyInfo|"
    r"OCSF\.WinregistryValueActivity|"
    r"OCSF\.WinregistryValueInfo|"
    r"OCSF\.WinresourceActivity|"
    r"OSSEC\.EventInfo|"
    r"OTX\.Pulses|"
    r"Okta\.Devices|"
    r"Okta\.SystemLog|"
    r"Okta\.Users|"
    r"OneLogin\.Events|"
    r"OnePassword\.AuditEvent|"
    r"OnePassword\.ItemUsage|"
    r"OnePassword\.SignInAttempt|"
    r"OpenAI\.Audit|"
    r"Orca\.Alert|"
    r"Orca\.AlertEvent|"
    r"Osquery\.Batch|"
    r"Osquery\.Differential|"
    r"Osquery\.Snapshot|"
    r"Osquery\.Status|"
    r"Panther\.Audit|"
    r"Proofpoint\.Event|"
    r"PushSecurity\.Activity|"
    r"PushSecurity\.Controls|"
    r"PushSecurity\.Entities|"
    r"Rapid7\.AuditLog|"
    r"Salesforce\.Login|"
    r"Salesforce\.LoginAs|"
    r"Salesforce\.Logout|"
    r"Salesforce\.RealtimeEvent|"
    r"Salesforce\.URI|"
    r"SentinelOne\.Activity|"
    r"SentinelOne\.DeepVisibility|"
    r"SentinelOne\.DeepVisibilityV2|"
    r"Slack\.AccessLogs|"
    r"Slack\.AuditLogs|"
    r"Slack\.IntegrationLogs|"
    r"Snowflake\.AccessHistory|"
    r"Snowflake\.DataTransferHistory|"
    r"Snowflake\.GrantsToRoles|"
    r"Snowflake\.GrantsToUsers|"
    r"Snowflake\.LoginHistory|"
    r"Snowflake\.NetworkPolicies|"
    r"Snowflake\.QueryHistory|"
    r"Snowflake\.Roles|"
    r"Snowflake\.Sessions|"
    r"Snowflake\.Stages|"
    r"Snowflake\.Users|"
    r"Snyk\.GroupAudit|"
    r"Snyk\.OrgAudit|"
    r"Sophos\.Central|"
    r"Sublime\.Audit|"
    r"Sublime\.MDM|"
    r"Sublime\.MessageEvent|"
    r"Suricata\.Alert|"
    r"Suricata\.Anomaly|"
    r"Suricata\.DHCP|"
    r"Suricata\.DNS|"
    r"Suricata\.FileInfo|"
    r"Suricata\.Flow|"
    r"Suricata\.HTTP|"
    r"Suricata\.SSH|"
    r"Suricata\.TLS|"
    r"Sysdig\.Audit|"
    r"Syslog\.RFC3164|"
    r"Syslog\.RFC5424|"
    r"Tailscale\.Audit|"
    r"Tailscale\.Network|"
    r"Tenable\.Vulnerability|"
    r"ThinkstCanary\.Alert|"
    r"Tines\.Audit|"
    r"Tor\.ExitNode|"
    r"Tracebit\.Alert|"
    r"Tracebit\.HealthCheck|"
    r"TrailDiscover\.CloudTrail|"
    r"Upwind\.Detections|"
    r"Vercel\.Audit|"
    r"Windows\.EventLogs|"
    r"Wiz\.Audit|"
    r"Wiz\.Detections|"
    r"Wiz\.Issues|"
    r"Wiz\.IssuesWebhook|"
    r"Wiz\.Threats|"
    r"Wiz\.VulnerabilityFinding|"
    r"Workday\.Activity|"
    r"Workday\.SignOnAttempt|"
    r"Zeek\.CaptureLoss|"
    r"Zeek\.Conn|"
    r"Zeek\.DHCP|"
    r"Zeek\.DNS|"
    r"Zeek\.DPD|"
    r"Zeek\.Files|"
    r"Zeek\.HTTP|"
    r"Zeek\.KnownHosts|"
    r"Zeek\.KnownServices|"
    r"Zeek\.NTP|"
    r"Zeek\.Notice|"
    r"Zeek\.OCSP|"
    r"Zeek\.Reporter|"
    r"Zeek\.SIP|"
    r"Zeek\.Software|"
    r"Zeek\.Ssh|"
    r"Zeek\.Ssl|"
    r"Zeek\.Stats|"
    r"Zeek\.Telemetry|"
    r"Zeek\.Tunnel|"
    r"Zeek\.Weird|"
    r"Zeek\.X509|"
    r"Zendesk\.Audit|"
    r"Zoom\.Activity|"
    r"Zoom\.Operation|"
    r"Zscaler\.ZIA\.AdminAuditLog|"
    r"Zscaler\.ZIA\.DNSLog|"
    r"Zscaler\.ZIA\.FWLog|"
    r"Zscaler\.ZIA\.WebLog|"
    r"Zscaler\.ZPA\.AppConnectorMetrics|"
    r"Zscaler\.ZPA\.AppConnectorStatus|"
    r"Zscaler\.ZPA\.AuditLog|"
    r"Zscaler\.ZPA\.UserActivity|"
    r"Zscaler\.ZPA\.UserStatus|"
    r"Custom\.([A-Z][A-Za-z0-9]*)(\.[A-Z][A-Za-z0-9]*){0,5}"
    r")$"
)

RESOURCE_TYPE_REGEX = Regex(
    r"^("
    r"AWS\.ACM\.Certificate|"
    r"AWS\.CloudFormation\.Stack|"
    r"AWS\.CloudTrail|"
    r"AWS\.CloudTrail\.Meta|"
    r"AWS\.CloudWatch\.LogGroup|"
    r"AWS\.Config\.Recorder|"
    r"AWS\.Config\.Recorder\.Meta|"
    r"AWS\.DynamoDB\.Table|"
    r"AWS\.EC2\.AMI|"
    r"AWS\.EC2\.Instance|"
    r"AWS\.EC2\.NetworkACL|"
    r"AWS\.EC2\.SecurityGroup|"
    r"AWS\.EC2\.VPC|"
    r"AWS\.EC2\.Volume|"
    r"AWS\.ECS\.Cluster|"
    r"AWS\.EKS\.Cluster|"
    r"AWS\.ELBV2\.ApplicationLoadBalancer|"
    r"AWS\.GuardDuty\.Detector|"
    r"AWS\.GuardDuty\.Detector\.Meta|"
    r"AWS\.IAM\.Group|"
    r"AWS\.IAM\.Policy|"
    r"AWS\.IAM\.Role|"
    r"AWS\.IAM\.RootUser|"
    r"AWS\.IAM\.User|"
    r"AWS\.KMS\.Key|"
    r"AWS\.Lambda\.Function|"
    r"AWS\.PasswordPolicy|"
    r"AWS\.RDS\.Instance|"
    r"AWS\.Redshift\.Cluster|"
    r"AWS\.Route53\.HostedZone|"
    r"AWS\.Route53Domains|"
    r"AWS\.S3\.Bucket|"
    r"AWS\.WAF\.Regional\.WebACL|"
    r"AWS\.WAF\.WebACL|"
    r")$"
)
