Go API Client

CopyClient generates a copy of the provider Lacework API Go client Example of basic usage client, err := api.NewClient("demo") if err == nil { client.Integrations.List() } clientCopy, err := api.CopyClient(client, api.WithOrgAccess()) if err == nil { clientCopy.Integrations.List() }.

DatadogService returns the datadogService type for the corresponding string input.

DatadogSite returns the datadogSite type for the corresponding string input.

FindAlertChannelType looks up inside the list of available alert channel types the matching type from the provided string, if none, returns NoneAlertChannelType.

FindCloudAccountType looks up inside the list of available cloud account types the matching type from the provided string, if none, returns NoneCloudAccount.

FindContainerRegistryType looks up inside the list of available container registry types the matching type from the provided string, if none, returns NoneContainerRegistry.

FindIntegrationType looks up inside the list of available integration types the matching type from the provided string, if none, returns NoneIntegration.

FindResourceGroupType looks up inside the list of available resource group types the matching type from the provided string, if none, returns NoneResourceGroup.

NewAlertChannel returns an instance of the AlertChannelRaw struct with the provided Alert Channel integration type, name and raw data as an interface{}.

NewAlertProfile returns an instance of the AlertProfileConfig struct Basic usage: Initialize a new AlertProfileConfig struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } alertProfile := api.NewAlertProfile( "CUSTOM_PROFILE_NAME", "LW_HE_FILES_DEFAULT_PROFILE" []api.AlertTemplate{{ ..

NewAlertRule returns an instance of the AlertRule struct Basic usage: Initialize a new AlertRule struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } alertRule := api.NewAlertRule( "Foo", api.AlertRuleConfig{ Description: "My Alert Rule" Severities: api.AlertRuleSeverities{api.AlertRuleSeverityHigh, Channels: []string{"TECHALLY_000000000000AAAAAAAAAAAAAAAAAAAA"}, ResourceGroups: []string{"TECHALLY_111111111111AAAAAAAAAAAAAAAAAAAA"} }, }, ) client.V2.AlertRules.Create(alertRule) .

NewAwsCfgIntegration returns an instance of AwsIntegration of type AWS_CFG.

NewAwsCloudTrailIntegration returns an instance of AwsIntegration of type AWS_CT_SQS.

NewAwsCloudWatchAlertChannel returns an instance of AwsCloudWatchAlertChannel with the provided name and data.

NewAwsIntegration returns an instance of AwsIntegration with the provided integration type, name and data.

NewAwsS3AlertChannel returns an instance of AwsS3AlertChannel with the provided name and data.

NewAzureActivityLogIntegration returns an instance of AzureIntegration of type AZURE_AL_SEQ.

NewAzureCfgIntegration returns an instance of AzureIntegration of type AZURE_CFG.

NewAzureIntegration returns an instance of AzureIntegration with the provided integration type, name and data.

NewCiscoWebexAlertChannel returns an instance of CiscoWebexAlertChannel with the provided name and data.

New generates a new Lacework API client Example of basic usage lacework, err := api.NewClient("demo") if err == nil { lacework.Integrations.List() }.

NewCloudAccount returns an instance of the CloudAccountRaw struct with the provided Cloud Account integration type, name and raw data as an interface{}.

NewContainerRegIntegration returns an instance of ContainerRegIntegration with the provided name and data.

NewContainerRegistry returns an instance of the ContainerRegistryRaw struct with the provided Container Registry integration type, name and raw data as an interface{}.

NewDatadogAlertChannel returns an instance of DatadogAlertChannel with the provided name and data.

NewGcpAuditLogIntegration returns an instance of GcpIntegration of type GCP_AT_SES.

NewGcpCfgIntegration returns an instance of GcpIntegration of type GCP_CFG.

NewGcpIntegration returns an instance of GcpIntegration with the provided integration type, name and data.

NewGcpPubSubAlertChannel returns an instance of GcpPubSubAlertChannel with the provided name and data.

NewJiraAlertChannel returns an instance of JiraAlertChannel with the provided name and data.

NewJiraCloudAlertChannel returns a JiraAlertChannel instance preconfigured as a JIRA_CLOUD type.

NewJiraServerAlertChannel returns a JiraAlertChannel instance preconfigured as a JIRA_SERVER type.

NewMicrosoftTeamsAlertChannel returns an instance of MicrosoftTeamsAlertChannel with the provided name and data.

NewNewRelicAlertChannel returns an instance of NewRelicAlertChannel with the provided name and data.

NewPagerDutyAlertChannel returns an instance of PagerDutyAlertChannel with the provided name and data.

NewQRadarAlertChannel returns an instance of QRadarAlertChannel with the provided name and data.

NewReportRule returns an instance of the ReportRule struct Basic usage: Initialize a new ReportRule struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } reportRule := api.NewReportRule( "Foo", api.ReportRuleConfig{ Description: "My Report Rule" Severities: api.ReportRuleSeverities{api.ReportRuleSeverityHigh, EmailAlertChannels: []string{"TECHALLY_000000000000AAAAAAAAAAAAAAAAAAAA"}, ResourceGroups: []string{"TECHALLY_111111111111AAAAAAAAAAAAAAAAAAAA"} ReportNotificationTypes: api.WeeklyEventsReportRuleNotifications{TrendReport: true}, }, }, ) client.V2.ReportRules.Create(reportRule) .

NewResourceGroup returns an instance of the ResourceGroupData struct with the provided ResourceGroup type, name and the props field as an interface{}.

NewServiceNowAlertChannel returns an instance of ServiceNowAlertChannel with the provided name and data.

NewSlackAlertChannel returns an instance of SlackAlertChannel with the provided name and data.

NewSplunkAlertChannel returns an instance of SplunkAlertChannel with the provided name and data.

NewTeamMember returns an instance of the Team Member struct Basic usage: Initialize a new TeamMember struct and then use the new instance to perform CRUD operations.

NewTeamMemberOrg returns an instance of the team member org struct Basic usage: Initialize a new TeamMemberOrg struct and then use the new instance to perform CRUD operations.

NewVictorOpsAlertChannel returns an instance of VictorOpsAlertChannel with the provided name and data.

NewVulnerabilityException returns an instance of the VulnerabilityException struct Basic usage: Initialize a new VulnerabilityException struct, then use the new instance to do CRUD operations client, err := api.NewClient("account") if err != nil { return err } exception := api.VulnerabilityExceptionConfig{ Type: api.VulnerabilityExceptionTypeHost, Description: "This is a vuln exception", ExceptionReason: api.VulnerabilityExceptionReasonCompensatingControls, Severities: api.VulnerabilityExceptionSeverities{api.VulnerabilityExceptionSeverityCritical}, Fixable: true, ResourceScope: api.VulnerabilityExceptionContainerResourceScope{ ImageID: []string{""}, ImageTag: []string{""}, Registry: []string{""}, Repository: []string{""}, Namespace: []string{""}, }, ExpiryTime: time.Now().AddDate(0, 1, 0), } vulnerabilityException := api.NewVulnerabilityException("vulnerabilityException", exception) client.V2.VulnerabilityExceptions.Create(vulnerabilityException) .

NewWebhookAlertChannel returns an instance of WebhookAlertChannel with the provided name and data.

QRadarComm returns the qradarComm type for the corresponding string input.

VictorOpsService returns the datadogService type for the corresponding string input.

VictorOpsSite returns the datadogSite type for the corresponding string input.

WithApiKeys sets the key_id and secret used to generate API access tokens.

WithApiV2 configures the client to use the API version 2 (/api/v2) for common API endpoints.

WithExpirationTime configures the token expiration time.

WithHeader configures a HTTP Header to pass to every request.

WithLifecycleCallbacks will configure the lifecycle callback functions.

WithLogFile configures the client to write messages to the provided file.

WithLogLevel sets the log level of the client, available: info or debug.

WithLogLevelAndFile sets the log level of the client and writes the log messages to the provided file.

WithLogLevelAndWriter sets the log level of the client and writes the log messages to the provided io.Writer.

WithLogWriter configures the client to log messages to the provided io.Writer.

WithOrgAccess sets the Org-Access Header to access the organization level data sets.

WithSubaccount sets a subaccount into an API client.

WithTimeout changes the default client timeout.

WithToken sets the token used to authenticate the API requests.

WithTokenAndExpiration sets the token used to authenticate the API requests and additionally configures the expiration of the token.

WithTokenFromKeys sets the API access keys and triggers a new token generation NOTE: Order matters when using this option, use it at the end of a NewClient() func.

WithURL sets the base URL, this options is only available for test purposes.

Info and above (which is All of them).

AWS Config integration type.

AWS CloudTrail integration type.

AWS CloudWatch integration type.

AWS Gov Cloud Config integration type.

AWS GovCloud CloudTrail integration type.

AWS S3 channel integration type.

Azure Activity Log integration type.

Azure Config integration type.

Cisco Webex integration type.

Container registry integration type.

Critical only.

Datadog channel integration type.

The list of valid inputs for DatadogService field.

The list of valid inputs for DatadogSite field.

Email integration type.

GCP Audit Log integration type.

GCP Config integration type.

Organization level integration with GCP.

Project level integration with GCP.

GCP Pub Sub alert channel integration type.

High and above.

Jira integration type.

Low and above.

requires Org Access account client.WithOrgAccess().

Medium and above.

Microsoft Teams channel integration type.

New Relic Insights alert channel integration type.

NoneAlertChannelType type that defines a non-existing Alert Channel integration.

type that defines a non-existing Cloud Account integration.

type that defines a non-existing Container Registry integration.

type that defines a non-existing integration.

type that defines a non-existing registry.

type that defines a non-existing Resource Group.

Pager Duty integration type.

QRadar channel integration type.

The list of valid inputs for QRadar Communication Type field.

Sevice Now alert channel integration type.

Slack channel integration type.

Splunk channel integration type.

Version is the semver coming from the VERSION file.

VictorOps channel integration type.

Webhook channel integration type.

AlertChannelTypes is the list of available Alert Channel integration types.

AlertLevels is the list of available alert levels.

Enable all Aws report rules.

Enable all Azure report rules.

Enable all Daily report rules.

Enable all Gcp report rules.

Enable all report rules.

Enable all Weekly report rules.

AwsEcrAuthTypes is the list of available ECR auth types.

Wildcard values for selecting all aws accounts.

Wildcard values for selecting all azure subscriptions.

CloudAccountTypes is the list of available Cloud Account integration types.

ContainerRegistryTypes is the list of available Container Registry integration types.

Wildcard values for selecting all labels/tags.

Wildcard values for selecting all labels/tags.

EntityTypes is the list of available entity types.

Wildcard values for selecting all gcp projects.

IntegrationTypes is the list of available integration types.

Wildcard values for selecting all lacework accounts.

Wildcard values for selecting all machine tags.

RegistryTypes is the list of available registry types.

ResourceGroupTypes is the list of available Resource Group types.

ValidComplianceStatus is a list of all valid compliance status.

ValidEventSeverities is a list of all valid event severities.

ValidPolicySeverities is a list of all valid policy severities.

ValidVulnSeverities is a list of all valid severities in a vulnerability report.

AccountService is a service that interacts with Account related endpoints from the Lacework Server.

AgentAccessTokensService is the service that interacts with the AgentAccessTokens schema from the Lacework APIv2 Server.

AgentInfoService is the service that interacts with the AgentInfo schema from the Lacework APIv2 Server.

AgentsService is a service that interacts with the Agent Access Tokens endpoints from the Lacework Server.

AlertChannelsService is the service that interacts with the AlertChannels schema from the Lacework APIv2 Server.

AlertRulesService is the service that interacts with the AlertRules schema from the Lacework APIv2 Server.

AwsRecommendationsV1 is a service that interacts with the V1 Recommendations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

AzureRecommendationsV1 is a service that interacts with the V1 Recommendations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

CloudAccountsService is the service that interacts with the CloudAccounts schema from the Lacework APIv2 Server.

ComplianceService is a service that interacts with the compliance endpoints from the Lacework Server.

ContainerRegistriesService is the service that interacts with the ContainerRegistries schema from the Lacework APIv2 Server.

Workaround for props being returned as a json string.

ContainerVulnerabilityService is a service that interacts with the vulnerabilities endpoints for the container space from the Lacework Server.

DataExportRulesService is a service that interacts with the DataExportRule endpoints from the Lacework Server.

DatasourcesService is a service that interacts with the Datasources endpoints from the Lacework Server.

EventsService is a service that interacts with the Events endpoints from the Lacework Server.

GcpCredentials is already defined in api/integrations_gcp.go:163 so we need to add a "V2" at the end to make it clear that this is the Google Credentials struct for API v2.

GcpRecommendationsV1 is a service that interacts with the V1 Recommendations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

GcpCredentials is already defined in api/integrations_gcp.go:163 so we need to add a "V2" at the end to make it clear that this is the Google Credentials struct for API v2.

HostVulnerabilityService is a service that interacts with the vulnerabilities endpoints for the host space from the Lacework Server.

IntegrationsService is a service that interacts with the integrations endpoints from the Lacework Server.

Workaround for props being returned as a json string.

Workaround for props being returned as a json string.

PackageManifest is the representation of a package manifest that the Lacework API server expects when executing a scan { "os_pkg_info_list": [ { "os":"Ubuntu", "os_ver":"18.04", "pkg": "openssl", "pkg_ver": "1.1.1-1ubuntu2.1~18.04.6" } ] }.

PolicyService is a service that interacts with the Custom Policies endpoints from the Lacework Server.

QueryService is a service that interacts with the Queries endpoints from the Lacework Server.

RecommendationsServiceV1 is a service that interacts with the V1 Recommendations endpoints from the Lacework Server.

ReportRulesService is the service that interacts with the ReportRules schema from the Lacework APIv2 Server.

ReportsService is a service that interacts with the Reports endpoints from the Lacework APIv2 Server.

ResourceGroupsService is the service that interacts with the ResourceGroups schema from the Lacework APIv2 Server.

SchemasService is the service that retrieves schemas for v2.

SearchFilter is the representation of an advanced search payload for retrieving information out of the Lacework APIv2 Server An advanced example of a SearchFilter to search for an Agent Access Token that matches the provider token alias and return only the token found: SearchFilter{ Filters: []Filter{ Filter{ Field: "tokenAlias", Expression: "eq", Value: "k8s-deployment, }, }, Returns: []string{"accessToken"}, }.

TeamMember is for a standalone team member without org access.

TeamMemberOrg is for an organizational team member.

APIv2.

APIv1.

In order to properly PATCH we need to omit items that aren't specified.

UserProfileService is the service that interacts with the UserProfile schema from the Lacework APIv2 Server.

V2Endpoints groups all APIv2 endpoints available, they are grouped by schema which matches with our service architecture.

VulnerabilitiesService is a service that interacts with the vulnerabilities endpoints from the Lacework Server.

VulnerabilityExceptionsService is the service that interacts with the VulnerabilityExceptions schema from the Lacework APIv2 Server.

AlertChannel is an interface that helps us implement a few functions that any Alert Channel might use, there are some cases, like during Update, where we need to get the ID of the Alert Channel and its type, this will allow users to pass any Alert Channel that implements these methods.

CloudAccount is an interface that helps us implement a few functions that any Cloud Account might use, there are some cases, like during Update, where we need to get the ID of the Cloud Account and its type, this will allow users to pass any Cloud Account that implements these methods.

ContainerRegistry is an interface that helps us implement a few functions that any Container Registry might use, there are some cases, like during Update, where we need to get the ID of the Container Registry and its type, this will allow users to pass any Container Registry that implements these methods.

Pageable is the interface that structs should implement to become pageable and be able to use the client.NextPage() function.

V2RawType is the interface that should be implemented when a struct is a response that contains v2CommonIntegrationData.

VulnerabilityAssessment is used to provide common functions that are required by host or container vulnerability assessments, this is used to treat them both as equal.

Enum for Alert Severity Levels.