# This file was auto-generated by Fern from our API Definition.

from ......core.unchecked_base_model import UncheckedBaseModel
import typing
from .actor import Actor
import pydantic
from .api import Api
from .network_connection_info import NetworkConnectionInfo
from .container import Container
from .database import Database
from .databucket import Databucket
from .device import Device
from .network_endpoint import NetworkEndpoint
from .email import Email
from .file import File
from .http_request import HttpRequest
from .http_response import HttpResponse
from .ja_4_fingerprint import Ja4Fingerprint
from .job import Job
from .process import Process
from .dns_query import DnsQuery
from .resource_details import ResourceDetails
from .script import Script
from .tls import Tls
from .url import Url
from .user import User
from .evidences_verdict_id import EvidencesVerdictId
from ......core.pydantic_utilities import IS_PYDANTIC_V2


class Evidences(UncheckedBaseModel):
    """
    A collection of evidence artifacts associated to the activity/activities that triggered a security detection.
    """

    actor: typing.Optional[Actor] = pydantic.Field(default=None)
    """
    Describes details about the user/role/process that was the source of the activity that triggered the detection.
    """

    api: typing.Optional[Api] = pydantic.Field(default=None)
    """
    Describes details about the API call associated to the activity that triggered the detection.
    """

    connection_info: typing.Optional[NetworkConnectionInfo] = pydantic.Field(
        default=None
    )
    """
    Describes details about the network connection associated to the activity that triggered the detection.
    """

    container: typing.Optional[Container] = pydantic.Field(default=None)
    """
    Describes details about the container associated to the activity that triggered the detection.
    """

    data: typing.Optional[typing.Optional[typing.Any]] = pydantic.Field(default=None)
    """
    Additional evidence data that is not accounted for in the specific evidence attributes.<code> Use only when absolutely necessary.</code>
    """

    database: typing.Optional[Database] = pydantic.Field(default=None)
    """
    Describes details about the database associated to the activity that triggered the detection.
    """

    databucket: typing.Optional[Databucket] = pydantic.Field(default=None)
    """
    Describes details about the databucket associated to the activity that triggered the detection.
    """

    device: typing.Optional[Device] = pydantic.Field(default=None)
    """
    An addressable device, computer system or host associated to the activity that triggered the detection.
    """

    dst_endpoint: typing.Optional[NetworkEndpoint] = pydantic.Field(default=None)
    """
    Describes details about the destination of the network activity that triggered the detection.
    """

    email: typing.Optional[Email] = pydantic.Field(default=None)
    """
    The email object associated to the activity that triggered the detection.
    """

    file: typing.Optional[File] = pydantic.Field(default=None)
    """
    Describes details about the file associated to the activity that triggered the detection.
    """

    http_request: typing.Optional[HttpRequest] = pydantic.Field(default=None)
    """
    Describes details about the http request associated to the activity that triggered the detection.
    """

    http_response: typing.Optional[HttpResponse] = pydantic.Field(default=None)
    """
    Describes details about the http response associated to the activity that triggered the detection.
    """

    ja_4_fingerprint_list: typing.Optional[typing.List[Ja4Fingerprint]] = (
        pydantic.Field(alias="ja4_fingerprint_list", default=None)
    )
    """
    Describes details about the JA4+ fingerprints that triggered the detection.
    """

    job: typing.Optional[Job] = pydantic.Field(default=None)
    """
    Describes details about the scheduled job that was associated with the activity that triggered the detection.
    """

    name: typing.Optional[str] = pydantic.Field(default=None)
    """
    The naming convention or type identifier of the evidence associated with the security detection. For example, the <code>@odata.type</code> from Microsoft Graph Alerts V2 or <code>display_name</code> from CrowdStrike Falcon Incident Behaviors.
    """

    process: typing.Optional[Process] = pydantic.Field(default=None)
    """
    Describes details about the process associated to the activity that triggered the detection.
    """

    query: typing.Optional[DnsQuery] = pydantic.Field(default=None)
    """
    Describes details about the DNS query associated to the activity that triggered the detection.
    """

    resources: typing.Optional[typing.List[ResourceDetails]] = pydantic.Field(
        default=None
    )
    """
    Describes details about the cloud resources directly related to activity that triggered the detection. For resources impacted by the detection, use <code>Affected Resources</code> at the top-level of the finding.
    """

    script: typing.Optional[Script] = pydantic.Field(default=None)
    """
    Describes details about the script that was associated with the activity that triggered the detection.
    """

    src_endpoint: typing.Optional[NetworkEndpoint] = pydantic.Field(default=None)
    """
    Describes details about the source of the network activity that triggered the detection.
    """

    tls: typing.Optional[Tls] = pydantic.Field(default=None)
    """
    Describes details about the Transport Layer Security (TLS) activity that triggered the detection.
    """

    uid: typing.Optional[str] = pydantic.Field(default=None)
    """
    The unique identifier of the evidence associated with the security detection. For example, the <code>activity_id</code> from CrowdStrike Falcon Alerts or <code>behavior_id</code> from CrowdStrike Falcon Incident Behaviors.
    """

    url: typing.Optional[Url] = pydantic.Field(default=None)
    """
    The URL object that pertains to the event or object associated to the activity that triggered the detection.
    """

    user: typing.Optional[User] = pydantic.Field(default=None)
    """
    Describes details about the user that was the target or somehow else associated with the activity that triggered the detection.
    """

    verdict: typing.Optional[str] = pydantic.Field(default=None)
    """
    The normalized verdict of the evidence associated with the security detection.
    """

    verdict_id: typing.Optional[EvidencesVerdictId] = pydantic.Field(default=None)
    """
    The normalized verdict (or status) ID of the evidence associated with the security detection. For example, Microsoft Graph Security Alerts contain a <code>verdict</code> enumeration for each type of <code>evidence</code> associated with the Alert. This is typically set by an automated investigation process or an analyst/investigator assigned to the finding.
    """

    if IS_PYDANTIC_V2:
        model_config: typing.ClassVar[pydantic.ConfigDict] = pydantic.ConfigDict(
            extra="allow"
        )  # type: ignore # Pydantic v2
    else:

        class Config:
            smart_union = True
            extra = pydantic.Extra.allow
