DevicePostureRuleInput

data class DevicePostureRuleInput(val activeThreats: Int? = null, val certificateId: String? = null, val checkDisks: List<String>? = null, val checkPrivateKey: Boolean? = null, val cn: String? = null, val complianceStatus: String? = null, val connectionId: String? = null, val countOperator: String? = null, val domain: String? = null, val eidLastSeen: String? = null, val enabled: Boolean? = null, val exists: Boolean? = null, val extendedKeyUsages: List<String>? = null, val id: String? = null, val infected: Boolean? = null, val isActive: Boolean? = null, val issueCount: String? = null, val lastSeen: String? = null, val locations: List<DevicePostureRuleInputLocation>? = null, val networkStatus: String? = null, val operationalState: String? = null, val operator: String? = null, val os: String? = null, val osDistroName: String? = null, val osDistroRevision: String? = null, val osVersionExtra: String? = null, val overall: String? = null, val path: String? = null, val requireAll: Boolean? = null, val riskLevel: String? = null, val running: Boolean? = null, val score: Int? = null, val sensorConfig: String? = null, val sha256: String? = null, val state: String? = null, val thumbprint: String? = null, val totalScore: Int? = null, val version: String? = null, val versionOperator: String? = null)

Constructors

Link copied to clipboard
constructor(activeThreats: Int? = null, certificateId: String? = null, checkDisks: List<String>? = null, checkPrivateKey: Boolean? = null, cn: String? = null, complianceStatus: String? = null, connectionId: String? = null, countOperator: String? = null, domain: String? = null, eidLastSeen: String? = null, enabled: Boolean? = null, exists: Boolean? = null, extendedKeyUsages: List<String>? = null, id: String? = null, infected: Boolean? = null, isActive: Boolean? = null, issueCount: String? = null, lastSeen: String? = null, locations: List<DevicePostureRuleInputLocation>? = null, networkStatus: String? = null, operationalState: String? = null, operator: String? = null, os: String? = null, osDistroName: String? = null, osDistroRevision: String? = null, osVersionExtra: String? = null, overall: String? = null, path: String? = null, requireAll: Boolean? = null, riskLevel: String? = null, running: Boolean? = null, score: Int? = null, sensorConfig: String? = null, sha256: String? = null, state: String? = null, thumbprint: String? = null, totalScore: Int? = null, version: String? = null, versionOperator: String? = null)

Types

Link copied to clipboard
object Companion

Properties

Link copied to clipboard
val activeThreats: Int? = null

The number of active threats from SentinelOne.

Link copied to clipboard
val certificateId: String? = null

The UUID of a Cloudflare managed certificate.

Link copied to clipboard
val checkDisks: List<String>? = null

Specific volume(s) to check for encryption.

Link copied to clipboard

Confirm the certificate was not imported from another device.

Link copied to clipboard
val cn: String? = null

The common name for a certificate.

Link copied to clipboard

The workspace one or intune device compliance status. compliant and noncompliant are values supported by both providers. unknown, conflict, error, ingraceperiod values are only supported by intune. Available values: compliant, noncompliant, unknown, conflict, error, ingraceperiod.

Link copied to clipboard
val connectionId: String? = null

The workspace one or intune connection id.

Link copied to clipboard
val countOperator: String? = null

The count comparison operator for kolide. Available values: >, >=, <, <=, ==.

Link copied to clipboard
val domain: String? = null

The domain that the client must join.

Link copied to clipboard
val eidLastSeen: String? = null

The time a device last seen in Tanium. Must be in the format 1h or 30m. Valid units are d, h and m.

Link copied to clipboard
val enabled: Boolean? = null

True if the firewall must be enabled.

Link copied to clipboard
val exists: Boolean? = null

Checks if the file should exist.

Link copied to clipboard

List of values indicating purposes for which the certificate public key can be used. Available values: clientAuth, emailProtection.

Link copied to clipboard
val id: String? = null

The Teams List id. Required for serial_number and unique_client_id rule types.

Link copied to clipboard
val infected: Boolean? = null

True if SentinelOne device is infected.

Link copied to clipboard
val isActive: Boolean? = null

True if SentinelOne device is active.

Link copied to clipboard
val issueCount: String? = null

The number of issues for kolide.

Link copied to clipboard
val lastSeen: String? = null

The duration of time that the host was last seen from Crowdstrike. Must be in the format 1h or 30m. Valid units are d, h and m.

Link copied to clipboard

List of operating system locations to check for a client certificate..

Link copied to clipboard
val networkStatus: String? = null

The network status from SentinelOne. Available values: connected, disconnected, disconnecting, connecting.

Link copied to clipboard

The current operational state of a SentinelOne Agent. Available values: na, partially_disabled, auto_fully_disabled, fully_disabled, auto_partially_disabled, disabled_error, db_corruption.

Link copied to clipboard
val operator: String? = null

The version comparison operator. Available values: >, >=, <, <=, ==.

Link copied to clipboard
val os: String? = null

OS signal score from Crowdstrike. Value must be between 1 and 100.

Link copied to clipboard
val osDistroName: String? = null

The operating system excluding version information.

Link copied to clipboard

The operating system version excluding OS name information or release name.

Link copied to clipboard
val osVersionExtra: String? = null

Extra version value following the operating system semantic version.

Link copied to clipboard
val overall: String? = null

Overall ZTA score from Crowdstrike. Value must be between 1 and 100.

Link copied to clipboard
val path: String? = null

The path to the file.

Link copied to clipboard
val requireAll: Boolean? = null

True if all drives must be encrypted.

Link copied to clipboard
val riskLevel: String? = null

The risk level from Tanium. Available values: low, medium, high, critical.

Link copied to clipboard
val running: Boolean? = null

Checks if the application should be running.

Link copied to clipboard
val score: Int? = null

A value between 0-100 assigned to devices set by the 3rd party posture provider for custom device posture integrations.

Link copied to clipboard
val sensorConfig: String? = null

Sensor signal score from Crowdstrike. Value must be between 1 and 100.

Link copied to clipboard
val sha256: String? = null

The sha256 hash of the file.

Link copied to clipboard
val state: String? = null

The host’s current online status from Crowdstrike. Available values: online, offline, unknown.

Link copied to clipboard
val thumbprint: String? = null

The thumbprint of the file certificate.

Link copied to clipboard
val totalScore: Int? = null

The total score from Tanium.

Link copied to clipboard
val version: String? = null

The operating system semantic version.

Link copied to clipboard
val versionOperator: String? = null

The version comparison operator for Crowdstrike. Available values: >, >=, <, <=, ==.