from enum import IntEnum


class SeverityID(IntEnum):
    """
    The normalized identifier of the event/finding severity.

    The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.

    0 Unknown: The event/finding severity is unknown.
    1 Informational: Informational message. No action required.
    2 Low: The user decides if action is needed.
    3 Medium: Action is required but the situation is not serious at this time.
    4 High: Action is required immediately.
    5 Critical: Action is required immediately and the scope is broad.
    6 Fatal: An error occurred but it is too late to take remedial action.
    99 Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.
    """

    Unknown: int = 0
    Informational: int = 1
    Low: int = 2
    Medium: int = 3
    High: int = 4
    Critical: int = 5
    Fatal: int = 6
    Other: int = 99


class CategoryUID(IntEnum):
    """
    The category unique identifier of the event.

    2 Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.
    """
    SystemActivity = 1
    Findings = 2
    Discovery = 5


class ClassUID(IntEnum):
    """
    The unique identifier of a class. A Class describes the attributes available in an event.

    2004 DetectionFinding: A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the security_control profile should be applied and its attacks information should be duplicated into the finding_info object.
    """
    EventLogActivity: int = 1008
    VulnerabilityFinding: int = 2002
    DetectionFinding: int = 2004
    SoftwareInventoryInfo = 5020


class ConfidenceID(IntEnum):
    """
    The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence
    means that the finding scope is wide and may create finding reports that may not be malicious in nature.
    """
    Unknown = 0
    Low = 1
    Medium = 2
    High = 3
    Other = 99


class StatusID(IntEnum):
    """
    The normalized identifier of the event status.
    0	Unknown The status is unknown.
    1	Success
    2	Failure
    99	Other The event status is not mapped. See the status attribute, which contains a data source specific value.
    """
    Unknown = 0
    Success = 1
    Failure = 2
    Other = 99
