API Client

CopyClient generates a copy of the provider Lacework API Go client Example of basic usage client, err := api.NewClient("demo") if err == nil { client.Integrations.List() } clientCopy, err := api.CopyClient(client, api.WithOrgAccess()) if err == nil { clientCopy.Integrations.List() }.

DatadogService returns the datadogService type for the corresponding string input.

DatadogSite returns the datadogSite type for the corresponding string input.

FindAlertChannelType looks up inside the list of available alert channel types the matching type from the provided string, if none, returns NoneAlertChannelType.

FindCloudAccountType looks up inside the list of available cloud account types the matching type from the provided string, if none, returns NoneCloudAccount.

FindContainerRegistryType looks up inside the list of available container registry types the matching type from the provided string, if none, returns NoneContainerRegistry.

FindResourceGroupType looks up inside the list of available resource group types the matching type from the provided string, if none, returns NoneResourceGroup.

NewAlertChannel returns an instance of the AlertChannelRaw struct with the provided Alert Channel integration type, name and raw data as an interface{}.

NewAlertProfile returns an instance of the AlertProfileConfig struct Basic usage: Initialize a new AlertProfileConfig struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } alertProfile := api.NewAlertProfile( "CUSTOM_PROFILE_NAME", "LW_HE_FILES_DEFAULT_PROFILE" []api.AlertTemplate{{ ..

NewAlertRule returns an instance of the AlertRule struct Basic usage: Initialize a new AlertRule struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } alertRule := api.NewAlertRule( "Foo", api.AlertRuleConfig{ Description: "My Alert Rule" Severities: api.AlertRuleSeverities{api.AlertRuleSeverityHigh, Channels: []string{"TECHALLY_000000000000AAAAAAAAAAAAAAAAAAAA"}, ResourceGroups: []string{"TECHALLY_111111111111AAAAAAAAAAAAAAAAAAAA"} }, }, ) client.V2.AlertRules.Create(alertRule).

New generates a new Lacework API client Example of basic usage lacework, err := api.NewClient("demo") if err == nil { lacework.Integrations.List() }.

NewCloudAccount returns an instance of the CloudAccountRaw struct with the provided Cloud Account integration type, name and raw data as an interface{}.

NewContainerRegistry returns an instance of the ContainerRegistryRaw struct with the provided Container Registry integration type, name and raw data as an interface{}.

NewReportDefinition creates a new report definition for Create function.

NewReportDefinitionUpdate creates a new report definition for Update function.

NewReportRule returns an instance of the ReportRule struct Basic usage: Initialize a new ReportRule struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } reportRule := api.NewReportRule( "Foo", api.ReportRuleConfig{ Description: "My Report Rule" Severities: api.ReportRuleSeverities{api.ReportRuleSeverityHigh, EmailAlertChannels: []string{"TECHALLY_000000000000AAAAAAAAAAAAAAAAAAAA"}, ResourceGroups: []string{"TECHALLY_111111111111AAAAAAAAAAAAAAAAAAAA"} ReportNotificationTypes: api.WeeklyEventsReportRuleNotifications{TrendReport: true}, }, }, ) client.V2.ReportRules.Create(reportRule).

NewResourceGroup returns an instance of the ResourceGroupData struct with the provided ResourceGroup type, name and the props field as an interface{}.

NewResourceGroupWithQuery Only available with RGv2 beta.

NewTeamMember returns an instance of the Team Member struct Basic usage: Initialize a new TeamMember struct and then use the new instance to perform CRUD operations.

NewTeamMemberOrg returns an instance of the team member org struct Basic usage: Initialize a new TeamMemberOrg struct and then use the new instance to perform CRUD operations.

NewVulnerabilityException returns an instance of the VulnerabilityException struct Basic usage: Initialize a new VulnerabilityException struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } exception := api.VulnerabilityExceptionConfig{ Type: api.VulnerabilityExceptionTypeHost, Description: "This is a vuln exception", ExceptionReason: api.VulnerabilityExceptionReasonCompensatingControls, Severities: api.VulnerabilityExceptionSeverities{api.VulnerabilityExceptionSeverityCritical}, Fixable: true, ResourceScope: api.VulnerabilityExceptionContainerResourceScope{ ImageID: []string{""}, ImageTag: []string{""}, Registry: []string{""}, Repository: []string{""}, Namespace: []string{""}, }, ExpiryTime: time.Now().AddDate(0, 1, 0), } vulnerabilityException := api.NewVulnerabilityException("vulnerabilityException", exception) client.V2.VulnerabilityExceptions.Create(vulnerabilityException).

QRadarComm returns the qradarComm type for the corresponding string input.

WindowedSearchFirst performs a new search of a specific time frame size, until response data is found or the max searchable days is reached.

WithApiKeys sets the key_id and secret used to generate API access tokens.

WithApiV2 configures the client to use the API version 2 (/api/v2) for common API endpoints (no-op) DEPRECATED.

WithExpirationTime configures the token expiration time.

WithHeader configures a HTTP Header to pass to every request.

WithLifecycleCallbacks will configure the lifecycle callback functions.

WithLogFile configures the client to write messages to the provided file.

WithLogLevel sets the log level of the client, available: info, debug, or error.

WithLogLevelAndFile sets the log level of the client and writes the log messages to the provided file.

WithLogLevelAndWriter sets the log level of the client and writes the log messages to the provided io.Writer.

WithLogWriter configures the client to log messages to the provided io.Writer.

WithOrgAccess sets the Org-Access Header to access the organization level data sets.

WithRetries sets the retrying policy for API requests.

WithSubaccount sets a subaccount into an API client.

WithTimeout changes the default client timeout.

WithToken sets the token used to authenticate the API requests.

WithTokenAndExpiration sets the token used to authenticate the API requests and additionally configures the expiration of the token.

WithTokenFromKeys sets the API access keys and triggers a new token generation NOTE: Order matters when using this option, use it at the end of a NewClient() func.

WithTransport changes the default transport to increase TLSHandshakeTimeout.

WithURL sets the base URL, this options is only available for test purposes.

The list of valid inputs for DatadogService field.

The list of valid inputs for DatadogSite field.

Organization level integration with GCP.

Project level integration with GCP.

requires Org Access account client.WithOrgAccess().

NoneAlertChannelType type that defines a non-existing Alert Channel integration.

type that defines a non-existing Cloud Account integration.

type that defines a non-existing Container Registry integration.

type that defines a non-existing Resource Group.

The list of valid inputs for QRadar Communication Type field.

V2ApiMaxSearchHistoryDays defines the maximum number of days in the past api v2 allows to be searched.

V2ApiMaxSearchWindowDays defines the maximum number of days in a single request api v2 allows to be searched.

Version is the semver coming from the VERSION file.

AlertChannelTypes is the list of available Alert Channel integration types.

AlertCloseReasons is the list of available Alert closure reasons.

Valid inputs for AlertRule Categories property.

Valid inputs for AlertRule Source property.

Valid inputs for AlertRule SubCategories property.

Enable all Aws report rules.

Enable all Azure report rules.

Enable all Daily report rules.

Enable all Gcp report rules.

Enable all report rules.

Enable all Weekly report rules.

AwsEcrAuthTypes is the list of available ECR auth types.

Wildcard values for selecting all aws accounts.

go:embed _templates/resource_groups/aws.json.

Wildcard values for selecting all azure subscriptions.

go:embed _templates/resource_groups/azure.json.

CloudAccountTypes is the list of available Cloud Account integration types.

ContainerRegistryTypes is the list of available Container Registry integration types.

Wildcard values for selecting all labels/tags.

Wildcard values for selecting all labels/tags.

go:embed _templates/resource_groups/container.json.

EntityTypes is the list of available entity types.

Wildcard values for selecting all gcp projects.

go:embed _templates/resource_groups/gcp.json.

Wildcard values for selecting all lacework accounts.

query templates.

Wildcard values for selecting all machine tags.

go:embed _templates/resource_groups/machine.json.

query templates.

go:embed _templates/resource_groups/oci.json.

ResourceGroupTypes is the list of available Resource Group types.

ValidAlertSeverities is a list of all valid alert severities.

ValidAlertStatuses is a list of all valid alert statuses.

ValidComplianceStatus is a list of all valid compliance status.

ValidPolicySeverities is a list of all valid policy severities.

AgentAccessTokensService is the service that interacts with the AgentAccessTokens schema from the Lacework APIv2 Server.

AgentInfoService is the service that interacts with the AgentInfo schema from the Lacework APIv2 Server.

AlertChannelsService is the service that interacts with the AlertChannels schema from the Lacework APIv2 Server.

AlertRulesService is the service that interacts with the AlertRules schema from the Lacework APIv2 Server.

AlertsService is a service that interacts with the Alerts endpoints from the Lacework Server.

AwsRecommendationsV2 is a service that interacts with the V2 Recommendations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

AwsSuppressionsV2 is a service that interacts with the V2 Suppressions endpoints from the Lacework Server.

AzureRecommendationsV2 is a service that interacts with the V2 Recommendations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

AzureSuppressionsV2 is a service that interacts with the V2 Suppressions endpoints from the Lacework Server.

CloudAccountsService is the service that interacts with the CloudAccounts schema from the Lacework APIv2 Server.

ContainerRegistriesService is the service that interacts with the ContainerRegistries schema from the Lacework APIv2 Server.

Workaround for props being returned as a json string.

DataExportRulesService is a service that interacts with the DataExportRule endpoints from the Lacework Server.

DatasourcesService is a service that interacts with the Datasources endpoints from the Lacework Server.

GcpCredentials is already defined in api/integrations_gcp.go:163 so we need to add a "V2" at the end to make it clear that this is the Google Credentials struct for API v2.

GcpRecommendationsV2 is a service that interacts with the V2 Recommendations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

GcpSuppressionsV2 is a service that interacts with the V2 Suppressions endpoints from the Lacework Server.

GcpCredentials is already defined in api/integrations_gcp.go:163 so we need to add a "V2" at the end to make it clear that this is the Google Credentials struct for API v2.

Honeyvent defines what a Honeycomb event looks like for the Lacework CLI.

Workaround for props being returned as a json string.

Workaround for props being returned as a json string.

MetricsService is a service that sends events to Lacework APIv2 Server metrics endpoint.

OrganizationInfoService is the service that interacts with the OrganizationInfo schema from the Lacework APIv2 Server.

PolicyService is a service that interacts with the Custom Policies endpoints from the Lacework Server.

QueryService is a service that interacts with the Queries endpoints from the Lacework Server.

RecommendationsServiceV2 is a service that interacts with the V2 Recommendations endpoints from the Lacework Server.

ReportDefinitionsService is a service that interacts with the ReportDefinitions endpoints from the Lacework APIv2 Server.

ReportDefinitionUpdate represents fields allowed for update request.

ReportDistributionsService is a service that interacts with the ReportDistributions endpoints from the Lacework APIv2 Server.

ReportRulesService is the service that interacts with the ReportRules schema from the Lacework APIv2 Server.

ReportsService is a service that interacts with the Reports endpoints from the Lacework APIv2 Server.

ResourceGroupsService is the service that interacts with the ResourceGroups schema from the Lacework APIv2 Server.

SchemasService is the service that retrieves schemas for v2.

SearchFilter is the representation of an advanced search payload for retrieving information out of the Lacework APIv2 Server An advanced example of a SearchFilter to search for an Agent Access Token that matches the provider token alias and return only the token found: SearchFilter{ Filters: []Filter{ Filter{ Field: "tokenAlias", Expression: "eq", Value: "k8s-deployment, }, }, Returns: []string{"accessToken"}, }.

SuppressionsServiceV2 is a service that interacts with the V2 Suppressions endpoints from the Lacework Server.

TeamMember is for a standalone team member without org access.

TeamMemberOrg is for an organizational team member.

APIv2.

In order to properly PATCH we need to omit items that aren't specified.

UserProfileService is the service that interacts with the UserProfile schema from the Lacework APIv2 Server.

V2Endpoints groups all APIv2 endpoints available, they are grouped by schema which matches with our service architecture.

VulnerabilityExceptionsService is the service that interacts with the VulnerabilityExceptions schema from the Lacework APIv2 Server.

AlertChannel is an interface that helps us implement a few functions that any Alert Channel might use, there are some cases, like during Update, where we need to get the ID of the Alert Channel and its type, this will allow users to pass any Alert Channel that implements these methods.

CloudAccount is an interface that helps us implement a few functions that any Cloud Account might use, there are some cases, like during Update, where we need to get the ID of the Cloud Account and its type, this will allow users to pass any Cloud Account that implements these methods.

ContainerRegistry is an interface that helps us implement a few functions that any Container Registry might use, there are some cases, like during Update, where we need to get the ID of the Container Registry and its type, this will allow users to pass any Container Registry that implements these methods.

Pageable is the interface that structs should implement to become pageable and be able to use the client.NextPage() function.

V2RawType is the interface that should be implemented when a struct is a response that contains v2CommonIntegrationData.

VulnerabilityAssessment is used to provide common functions that are required by host or container vulnerability assessments, this is used to treat them both as equal.

@dhazekamp: is this the same structure as v2/Events? @dhazekamp: is this structure consistent across alerts (types).