vanhecke/celmex/3.0.0

Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/vanhecke/celmex is gone (deleted or private); Software Heritage not asked yet (this run's --swh-calls were used up); no fork with the same repo name found; no cached copy. Use another version.

Details

Cortex.Api.Risk

Cortex identity-threat risk scoring for users and endpoints.

= Low
| Med
| High

Cortex risk-level bucket — closed enum per the spec.

  • Low — wire value "LOW"
  • Med — wire value "MED" (note: not "MEDIUM")
  • High — wire value "HIGH"
type alias RiskScoreResponse =
{ type_ : Maybe String
, id : Maybe String
, score : Maybe Int
, normRiskScore : Maybe Int
, riskLevel : Maybe RiskLevel
, reasons : List Reason
, email : Maybe String
}

Risk-score record for a single user or endpoint, returned by getRiskScore.

type alias RiskyEntity =
{ type_ : Maybe String
, id : Maybe String
, score : Maybe Int
, normRiskScore : Maybe Int
, riskLevel : Maybe RiskLevel
, reasons : List Reason
, email : Maybe String
}

One risky-user / risky-host entry returned by listRiskyUsers / listRiskyHosts. Shape matches RiskScoreResponse — email is populated for user entries only.

type alias Reason =
{ dateCreated : Maybe String
, description : Maybe String
, severity : Maybe String
, status : Maybe String
, points : Maybe Int
}

One reason contributing to a risk score. Note dateCreated decodes from the spec's "date created" (with a space).

getRiskScore : { id : String } -> Request RiskScoreResponse

POST /public_api/v1/get_risk_score

Get the risk score for a single user or endpoint. The API requires id (user samAccount in netBIOS/samAccount form, or a Cortex agent ID); pass it via the record argument.

listRiskyHosts : Request (List RiskyEntity)

POST /public_api/v1/get_risky_hosts

Returns the highest-risk endpoints on the tenant.

listRiskyUsers : Request (List RiskyEntity)

POST /public_api/v1/get_risky_users

Returns the highest-risk users on the tenant.