thorlog

type AclAccess byte

type AclEntries []AclEntry

type AclEntry struct {
	Group  string    `json:"group"`  // FIXME: Could include information like the original SID
	Access AclAccess `json:"access"` // FIXME: Could include the full original byte mask
}

type AmcacheEntry struct {
	jsonlog.ObjectHeader

	File     *File     `json:"file" textlog:"file,expand"`
	SHA1     string    `json:"sha1" textlog:"sha1"`
	Size     int64     `json:"size" textlog:"size"`
	Desc     string    `json:"desc" textlog:"desc"`
	FirstRun time.Time `json:"first_run" textlog:"first_run"`
	Created  time.Time `json:"created" textlog:"created"`
	Product  string    `json:"product" textlog:"product"`
	Company  string    `json:"company" textlog:"company"`
}

type AnalysisResult struct {
	Exe         string    `json:"exe"`
	Date        time.Time `json:"date"`
	AppPath     string    `json:"app_path"`
	Error       string    `json:"error"`
	FaultModule string    `json:"fault_in_module"`
}

type AntiVirusExclude struct {
	LogObjectHeader

	Type      string `json:"exclusion_type" textlog:"type"`
	Exclusion string `json:"exclusion" textlog:"exclusion"`
}

type AntiVirusProduct struct {
	LogObjectHeader

	Name            string `json:"name" textlog:"name"`
	Status          string `json:"status" textlog:"status"`
	SignatureStatus string `json:"signature_status" textlog:"signature_status"`
	Path            string `json:"path" textlog:"path"`
}

type ArrowStringList []string

type AtJob struct {
	jsonlog.ObjectHeader

	Command   string `json:"command" textlog:"command"`
	Start     string `json:"start" textlog:"start"`
	User      string `json:"user" textlog:"user"`
	RunLevel  string `json:"run_level" textlog:"runlevel"`
	LogonType string `json:"logon_type" textlog:"logontype"`
	Image     *File  `json:"image" textlog:"image,expand"`
}

type AuditLogEntry struct {
	jsonlog.ObjectHeader

	Entry KeyValueList `json:"entry" textlog:"entry"`
}

type AuthorizedKeysEntry struct {
	jsonlog.ObjectHeader

	Type    string `json:"key_type" textlog:"type"`
	Key     string `json:"key" textlog:"key"`
	Comment string `json:"comment" textlog:"comment"`
	Line    string `json:"line" textlog:"line"`
}

type AutorunEntry struct {
	jsonlog.ObjectHeader

	Type         string `json:"autorun_type" textlog:"autorun_type"`
	Location     string `json:"location" textlog:"location"`
	Image        *File  `json:"image" textlog:",expand"`
	Arguments    string `json:"arguments" textlog:"arguments"`
	Entry        string `json:"entry" textlog:"entry"`
	LaunchString string `json:"launch_string" textlog:"launch_string"`

	OldMd5 string `json:"old_md5,omitempty" textlog:"md5_before,omitempty"`
}

type BeaconConfig struct {
	Type             string `json:"type" textlog:"type"`
	C2               string `json:"c2" textlog:"c2"`
	Port             string `json:"port" textlog:"port"`
	SpawnTo          string `json:"spawn_to" textlog:"spawnto"`
	InjectionProcess string `json:"injection_process" textlog:"injection_process"`
	Pipename         string `json:"pipe_name" textlog:"pipename"`
	UserAgent        string `json:"user_agent" textlog:"user_agent"`
	Proxy            string `json:"proxy" textlog:"proxy"`

	// FullConfig is the full configuration of the beacon.
	// For now, it is filled with strings only until we refactor the parsing module.
	FullConfig map[string]any `json:"full_config" textlog:"-"`

	// CipherParameters contains information about how the beacon is hidden in the file.
	CipherParameters CipherParameters `json:"cipher_parameters" textlog:"cipher_parameters,expand,omitempty"`
}

type CipherParameters struct {
	XafEncoded        bool       `json:"xaf_encoded" textlog:"xaf_encoded"`
	XafEncodingAnchor int64      `json:"xaf_encoding_anchor" textlog:"xaf_encoding_anchor,omitempty"`
	XorKey            byte       `json:"xor_key" textlog:"xor_key"`
	BeaconOffset      uint64     `json:"beacon_offset" textlog:"beacon_offset"`
	BeaconLength      uint64     `json:"beacon_length" textlog:"beacon_length"`
	BlockStart        FirstBytes `json:"block_start" textlog:"block_start"`
	PairwiseSwapped   bool       `json:"pairwise_swapped" textlog:"pairwise_swapped"`
}

type Context []ContextObject

type ContextObject struct {
	Object       ReportableObject `json:"object" textlog:",expand"`
	RelationType string           `json:"relation_type"` // RelationType is used to specify the type of relation, e.g. "derives from" or "related to"
	RelationName string           `json:"relation_name"` // RelationName is used to specify the name of the relation, e.g. "parent". It is optional.
	Unique       bool             `json:"unique"`        // Unique indicates whether the relation is unique, i.e. there can only be one object with this relation type / name in the context.
}

type CronJob struct {
	LogObjectHeader

	User     string `json:"user" textlog:"user"`
	Schedule string `json:"schedule" textlog:"schedule"`
	Command  string `json:"command" textlog:"command"`
}

type DeepDiveChunk struct {
	jsonlog.ObjectHeader

	ChunkOffset HexNumber   `json:"chunk_offset" textlog:"chunk_offset"`
	ChunkEnd    HexNumber   `json:"chunk_end" textlog:"chunk_end"`
	Content     *SparseData `json:"content" textlog:"content,expand"`

	// BeaconConfig contains information about a Cobalt Strike Beacon if the file contains one.
	BeaconConfig *BeaconConfig `json:"beacon_config,omitempty" textlog:"beacon,expand,omitempty"`
}

type DetectionAddEntry struct {
	jsonlog.ObjectHeader

	Time       time.Time    `json:"time" textlog:"time"`
	ThreatName string       `json:"threat_name" textlog:"threat_name"`
	Detected   KeyValueList `json:"detected" textlog:",expand"`
}

type DnsCacheEntry struct {
	LogObjectHeader
	Host string `json:"host" textlog:"entry"`
	IP   string `json:"ip" textlog:"ip"`
}

type DoublePulsarHandshake struct {
	LogObjectHeader

	Type string    `json:"handshake_type" textlog:"type"` // SMB or RDP
	Key  HexNumber `json:"key,omitempty" textlog:"key,omitempty"`
}

type EmbeddedObject struct {
	jsonlog.Object
}

type EmsDetectionEntry struct {
	jsonlog.ObjectHeader

	Time       time.Time `json:"time" textlog:"time"`
	ThreatName string    `json:"threat_name" textlog:"threat"`
	Pid        int       `json:"pid" textlog:"pid"`
}

type EndOfLifeReport struct {
	jsonlog.ObjectHeader

	Version   string    `json:"version" textlog:"version"`
	EndOfLife time.Time `json:"end_of_life" textlog:"end_time"`
}

type EnvironmentVariable struct {
	LogObjectHeader

	Variable string `json:"variable" textlog:"var"`
	Value    string `json:"value" textlog:"value"`
}

type EstimatedImpactEntry struct {
	jsonlog.ObjectHeader

	Time             time.Time `json:"time" textlog:"time"`
	ProcessImageName string    `json:"image" textlog:"image"`
	Pid              int       `json:"pid" textlog:"pid"`
	AccessedFile     string    `json:"file" textlog:"file"`
}

type Event = common.Event

type EventlogProcessStart struct {
	jsonlog.ObjectHeader
	Process    string      `json:"process" textlog:"process"`
	StartTimes []time.Time `json:"start_times" textlog:"-"`
	Count      int         `json:"-" textlog:"count"`
}

type ExecutionTimes []time.Time

type Existence string

type File struct {
	jsonlog.ObjectHeader

	// Path is the full path of the file (possibly including archives, e.g. /path/to/archive.zip/file.txt)
	Path string `json:"path" textlog:"file"`

	// Exists is a flag indicating whether the file exists or not. This is useful for files that are referenced elsewhere, but do not necessarily exist.
	Exists Existence `json:"exists" textlog:"exists,omitempty"`

	// Extension is the file extension of the file (e.g. .txt, .exe, etc.)
	Extension string `json:"extension" textlog:"extension,omitempty"`

	// FileMode is the type of the file (e.g. file, directory, symlink, etc.)
	FileMode FileModeType `json:"-" textlog:"-"`

	// MagicHeader is the magic header of the file (e.g. PE, ZIP, etc.)
	MagicHeader string `json:"magic_header" textlog:"type,omitempty"`

	// FileHashes contains the MD5, SHA1, and SHA256 hashes of the file, provided that the file is regular and could be read
	Hashes *FileHashes `json:"hashes,omitempty" textlog:",expand,omitempty"`

	// FirstBytes contains the first bytes of the file
	FirstBytes FirstBytes `json:"first_bytes,omitempty" textlog:"firstbytes,omitempty"`

	// Filetimes contains the file times of the file (e.g. created, modified, accessed, etc.)
	Filetimes *Filetimes `json:"file_times,omitempty" textlog:",expand,omitempty"`

	Size uint64 `json:"size" textlog:"size,omitempty"`

	// Permissions contains the permissions of the file. This can be either Unix or Windows permissions.
	Permissions Permissions `json:"permissions" textlog:",expand,omitempty"`

	// PeInfo contains information about the PE file, if the file is a PE file
	PeInfo *PeInfo `json:"pe_info,omitempty" textlog:",expand,omitempty"`

	// Target is only set for symlinks and contains the target path of the symlink
	Target string `json:"target,omitempty" textlog:"target,omitempty"`

	// UnpackSource is set for files that originate from another, unpacked file (possibly with multiple layers of unpacking)
	UnpackSource ArrowStringList `json:"unpack_source,omitempty" textlog:"unpack_source,omitempty" jsonschema:"nullable"`

	// LinkInfo contains information about the link, if the file is a windows link file (.lnk)
	LinkInfo *LinkInfo `json:"link_info,omitempty" textlog:",expand,omitempty"`

	// RecycleBinInfo contains information about the file if it was in the recycle bin
	RecycleBinInfo *RecycleBinIndexFile `json:"recycle_bin_info,omitempty" textlog:",expand,omitempty"`

	// WerInfo contains information about the file if it was a Windows Error Reporting crash report
	WerInfo *WerCrashReport `json:"wer_info,omitempty" textlog:",expand,omitempty"`

	// Content contains extracts from the content of the file, typically focusing on any matched patterns.
	Content *SparseData `json:"content,omitempty" textlog:"content,expand,omitempty"`

	// BeaconConfig contains information about a Cobalt Strike Beacon if the file contains one.
	BeaconConfig *BeaconConfig `json:"beacon_config,omitempty" textlog:"beacon,expand,omitempty"`

	// VirusTotalInfo contains information about the file from VirusTotal
	VirusTotalInfo *VirusTotalInformation `json:"virustotal,omitempty" textlog:"virustotal,expand,omitempty"`
}

type FileHashes struct {
	Md5    string `json:"md5" textlog:"md5"`
	Sha1   string `json:"sha1" textlog:"sha1"`
	Sha256 string `json:"sha256" textlog:"sha256"`
}

type FileModeType string

type Filetimes struct {
	Mtime time.Time  `json:"modified" textlog:"modified,with_millis"`
	Atime *time.Time `json:"accessed,omitempty" textlog:"accessed,omitempty,with_millis"`
	Ctime *time.Time `json:"changed,omitempty" textlog:"changed,omitempty,with_millis"`
	Btime *time.Time `json:"created,omitempty" textlog:"created,omitempty,with_millis"`

	// Timestamps that are not always available, but only set if timestomping is detected
	UsnChangeTime       *time.Time `json:"usn_change_time,omitempty" textlog:"usn_change_time,omitempty,with_millis"`
	MftFileNameModified *time.Time `json:"mft_file_name_modified,omitempty" textlog:"mft_file_name_modified,omitempty,with_millis"`
	MftFileNameAccessed *time.Time `json:"mft_file_name_accessed,omitempty" textlog:"mft_file_name_accessed,omitempty,with_millis"`
	MftFileNameChanged  *time.Time `json:"mft_file_name_changed,omitempty" textlog:"mft_file_name_changed,omitempty,with_millis"`
	MftFileNameCreated  *time.Time `json:"mft_file_name_created,omitempty" textlog:"mft_file_name_created,omitempty,with_millis"`
}

type Finding struct {
	jsonlog.ObjectHeader
	Meta         LogEventMetadata `json:"meta" textlog:",expand"`
	Text         string           `json:"message" textlog:"message"`
	Subject      ReportableObject `json:"subject" textlog:",expand"`
	Score        int64            `json:"score" textlog:"score"`
	Reasons      []Reason         `json:"reasons" textlog:",expand"`
	ReasonCount  int              `json:"reason_count,omitempty" textlog:"reasons_count,omitempty"`
	EventContext Context          `json:"context" textlog:",expand" jsonschema:"nullable"`
	Issues       []Issue          `json:"issues,omitempty" textlog:"-"`
	LogVersion   common.Version   `json:"log_version"`
}

type FirewallRule struct {
	jsonlog.ObjectHeader

	Path            string     `json:"path" textlog:"path"`
	LocalPorts      StringList `json:"local_ports" textlog:"lport" jsonschema:"nullable"`
	RemotePorts     StringList `json:"remote_ports" textlog:"rport" jsonschema:"nullable"`
	LocalAddresses  StringList `json:"local_ips" textlog:"lip" jsonschema:"nullable"`
	RemoteAddresses StringList `json:"remote_ips" textlog:"rip" jsonschema:"nullable"`
	Name            string     `json:"name" textlog:"name"`
	Allow           bool       `json:"allow" textlog:"allow"`
	Enabled         bool       `json:"enabled" textlog:"enabled"`
	Inbound         bool       `json:"inbound" textlog:"inbound"`
	Protocol        string     `json:"protocol" textlog:"protocol"`
}

type FirstBytes []byte

type GroupsXmlUser struct {
	jsonlog.ObjectHeader
	User     string `json:"user" textlog:"user"`
	Password string `json:"password" textlog:"password"`
}

type HexNumber uint64

type HostInfo struct {
	jsonlog.ObjectHeader

	Hostname    string          `json:"hostname" textlog:"hostname"`
	Domain      string          `json:"domain" textlog:"domain,omitempty"`
	Platform    PlatformInfo    `json:"platform" textlog:",expand"`
	Uptime      time.Duration   `json:"uptime" textlog:"uptime"`
	Cpus        int             `json:"cpu_count" textlog:"cpu_count"`
	Memory      uint64          `json:"memory" textlog:"memory"`
	Timezone    string          `json:"timezone" textlog:"timezone"`
	Language    string          `json:"language" textlog:"language"`
	Interfaces  []InterfaceInfo `json:"interfaces" textlog:",expand"`
	SystemType  SystemType      `json:"system_type" textlog:"system_type"`
	MountPoints []MountInfo     `json:"mount_points"`
}

type HostsFileEntry struct {
	LogObjectHeader
	Host string `json:"host" textlog:"host"`
	IP   string `json:"ip" textlog:"ip"`
}

type HotfixSummary struct {
	jsonlog.ObjectHeader
	LastHotfix time.Time `json:"last_hotfix" textlog:"last_hotfix"`
}

type HourDuration time.Duration

type InitdService struct {
	LogObjectHeader

	File *File `json:"file" textlog:"file,expand"`
}

type InterfaceInfo struct {
	Name        string `json:"name"`
	IpAddress   string `json:"ip_address" textlog:"ip_address"`
	Ipv6Address string `json:"ipv6_address,omitempty"`
	MacAddress  string `json:"mac_address,omitempty"`
}

type InvalidUnicodeString string

type Issue struct {
	// Affected is the path to the substructure that is related to the issue.
	// If the issue can't be related to a specific substructure, this may be null.
	Affected *jsonlog.Reference `json:"affected" textlog:"affected"`
	// Category is a human-readable description of the issue category.
	Category string `json:"category" textlog:"category"`
	// Description is a human-readable description of the issue.
	Description string `json:"description" textlog:"description"`
}

type JournaldEntry struct {
	jsonlog.ObjectHeader

	Time    time.Time    `json:"time" textlog:"time"`
	Details KeyValueList `json:"details" textlog:"entry"`
}

type JumplistEntry struct {
	jsonlog.ObjectHeader

	Path          string    `json:"path" textlog:"path"`
	Pinned        bool      `json:"pinned" textlog:"pinned"`
	LastAccess    time.Time `json:"last_access" textlog:"last_access"`
	AccessCount   int       `json:"access_count" textlog:"access_count"`
	NetbiosName   string    `json:"netbios_name" textlog:"netbios_name"`
	ObjectID      uuid.UUID `json:"object_id" textlog:"object_id"`
	VolumeID      uuid.UUID `json:"volume_id" textlog:"volume_id"`
	BirthVolumeID uuid.UUID `json:"birth_volume_id" textlog:"birth_volume_id"`
	EntryID       uint64    `json:"entry_id" textlog:"entry_id"`
	Checksum      uint64    `json:"checksum" textlog:"checksum"`
}

type KeyValue struct {
	Key   string
	Value string
}

type KeyValueList struct {
	KvList []KeyValue
}

type KnowledgeDBEntry struct {
	LogObjectHeader

	Entry      string        `json:"entry" textlog:"entry"`
	Created    time.Time     `json:"created" textlog:"created"`
	Started    time.Time     `json:"started" textlog:"started"`
	Duration   time.Duration `json:"duration" textlog:"duration"`
	PrimaryKey int64         `json:"primary_key" textlog:"primary_key"`
}

type LicenseInfo struct {
	Owner   string `json:"owner" textlog:"owner"`
	Type    string `json:"license_type" textlog:"type"`
	Starts  string `json:"starts" textlog:"starts"`
	Expires string `json:"expires" textlog:"expires"`
	Scanner string `json:"scanner" textlog:"scanner"`
	Hash    string `json:"hash" textlog:"hash"`
}

type LinkInfo struct {
	Target       string    `json:"target" textlog:"target"`
	Arguments    string    `json:"arguments" textlog:"arguments"`
	CommandLine  string    `json:"command_line" textlog:"command_line"`
	CreationTime time.Time `json:"created" textlog:"-"`
	WriteTime    time.Time `json:"modified" textlog:"-"`
	AccessTime   time.Time `json:"accessed" textlog:"-"`
}

type LinuxKernelModule struct {
	LogObjectHeader

	Name string `json:"name" textlog:"name"`
	Size int    `json:"size,omitempty" textlog:"size,omitempty"`

	// Whether this modules was compiled into the kernel
	IncludedInKernel bool `json:"included_in_kernel" textlog:"included_in_kernel"`

	Refcount   int          `json:"ref_count"`
	UsedBy     StringList   `json:"used_by"`
	Version    string       `json:"version"`
	Parameters KeyValueList `json:"parameters,omitempty" textlog:"parameters,omitempty"`

	File        *File      `json:"file" textlog:"file,expand,omitempty"`
	Description StringList `json:"description" textlog:"description"`
	Author      string     `json:"author" textlog:"author"`
}

type LogEventMetadata = common.LogEventMetadata

type LogLevel = common.LogLevel

type LogLine struct {
	jsonlog.ObjectHeader

	LineIndex uint64 `json:"line_index" textlog:"-"`
	Line      string `json:"line" textlog:"line"`
}

type LogObjectHeader = jsonlog.ObjectHeader

type LoggedInUser struct {
	LogObjectHeader

	User string `json:"user" textlog:"user"`

	Server       string `json:"server,omitempty" textlog:"server,omitempty"`
	Domain       string `json:"domain,omitempty" textlog:"domain,omitempty"`
	OtherDomains string `json:"other_domains,omitempty" textlog:"other_domains,omitempty"`
}

type LsaSession struct {
	LogObjectHeader

	LsaSession  string    `json:"lsa_session" textlog:"lsa_session"`
	User        string    `json:"user" textlog:"user"`
	AuthPackage string    `json:"auth_package" textlog:"auth_package"`
	Type        string    `json:"session_type" textlog:"type"`
	LogonTime   time.Time `json:"logon_time" textlog:"logon_time"`
	Domain      string    `json:"domain" textlog:"domain"`
	Server      string    `json:"server" textlog:"server"`
}

type MatchData struct {
	Data    []byte
	FullHex bool
}

type MatchString struct {
	Match      MatchData          `json:"data"`
	Context    *MatchData         `json:"context,omitempty"`
	Offset     *uint64            `json:"offset,omitempty"`
	Field      *jsonlog.Reference `json:"field,omitempty"`
	HideOffset bool               `json:"-"`
}

type MatchStrings []MatchString

type Message struct {
	jsonlog.ObjectHeader
	Meta       LogEventMetadata `json:"meta" textlog:",expand"`
	Text       string           `json:"message" textlog:"message"`
	Fields     MessageFields    `json:"fields" textlog:",expand" jsonschema:"nullable"`
	LogVersion common.Version   `json:"log_version"`
}

type MessageField struct {
	Key   string
	Value any
}

type MessageFields []MessageField

type MftFileEntry struct {
	jsonlog.ObjectHeader

	Path     string    `json:"path" textlog:"path"`
	Size     int64     `json:"size" textlog:"size"`
	Dir      bool      `json:"dir" textlog:"dir"`
	Modified time.Time `json:"modified" textlog:"modified"`
	Created  time.Time `json:"created" textlog:"created"`
	Accessed time.Time `json:"accessed" textlog:"accessed"`
	Changed  time.Time `json:"changed" textlog:"changed"`
	Filename string    `json:"filename" textlog:"filename"`
	Deleted  bool      `json:"deleted,omitempty" textlog:"deleted,omitempty"`
	Flags    *uint64   `json:"flags,omitempty" textlog:"flags,omitempty"`
}

type MountInfo struct {
	// FSType is the filesystem that is mounted, e.g. ext4, ntfs, etc.
	FSType string `json:"fs_type"`
	// Source is the OS description of the source of the mount.
	// This can differ greatly between OSes and filesystems.
	// For example, on Linux, for local partitions, this is the device path.
	Source string `json:"source"`
	// Target is the path where the filesystem is mounted.
	Target string `json:"target"`
	// Class is the class of the mount, e.g. local, network, removable, etc.
	// This determines how the mount is treated by THOR.
	// It is not innately part of the mount information, but is determined by THOR.
	Class string `json:"class"`
}

type MsOfficeConnectionCacheEntry struct {
	jsonlog.ObjectHeader
	Entry    string    `json:"entry" textlog:"entry"`
	Modified time.Time `json:"modified" textlog:"modified"`
	Key      string    `json:"key" textlog:"key"`
}

type NetworkConnectingThread struct {
	jsonlog.ObjectHeader

	ThreadId uint32   `json:"thread_id" textlog:"thread_id"`
	Process  *Process `json:"process" textlog:",expand"`

	CallbackInterval time.Duration      `json:"callback_interval" textlog:"callback_interval"`
	Connections      NetworkConnections `json:"connections" textlog:"connections"`
}

type NetworkConnection struct {
	Protocol string `json:"protocol"`
	Server   string `json:"server"`
}

type NetworkConnections []NetworkConnection

type NetworkSession struct {
	LogObjectHeader
	Client     string        `json:"client" textlog:"client"`
	Username   string        `json:"user_name" textlog:"username"`
	ClientType string        `json:"client_type" textlog:"client_type"`
	Active     time.Duration `json:"active" textlog:"active"`
	Idle       time.Duration `json:"idle" textlog:"idle"`
	NumOpens   int           `json:"num_opens" textlog:"num_opens"`
}

type NetworkShare struct {
	jsonlog.ObjectHeader
	Name        string     `json:"name" textlog:"share_name"`
	Path        string     `json:"path" textlog:"path"`
	Permissions AclEntries `json:"permissions" textlog:"share_perms,omitempty"`
}

type PSMacEntry struct {
	jsonlog.ObjectHeader

	Path    string `json:"path" textlog:"path"`
	Command string `json:"command" textlog:"command"`
}

type PeInfo struct {
	Company         string `json:"company" textlog:"company,omitempty"`
	FileDescription string `json:"description" textlog:"description,omitempty"`
	LegalCopyright  string `json:"legal_copyright" textlog:"legal_copyright,omitempty"`
	Product         string `json:"product" textlog:"product,omitempty"`
	OriginalName    string `json:"original_name" textlog:"original_name,omitempty"`
	InternalName    string `json:"internal_name" textlog:"internal_name,omitempty"`

	Signed     bool            `json:"signed" textlog:"signed"`
	Signatures []SignatureInfo `json:"signatures" textlog:",expand" jsonschema:"nullable"`

	Imphash           string    `json:"imphash" textlog:"imphash,omitempty"`
	RichHeaderHash    string    `json:"rich_header_hash"`
	CreationTimestamp time.Time `json:"creation_timestamp"`
}

type PeSieveReport struct {
	SuspiciousSections int `json:"suspicious_sections" textlog:"suspicious_sections"`
	Replaced           int `json:"replaced" textlog:"replaced"`
	HdrMod             int `json:"hdr_mod" textlog:"hdr_mod"`
	UnreachableFile    int `json:"unreachable_file" textlog:"unreachable_file"`
	Patched            int `json:"patched" textlog:"patched"`
	IatHooked          int `json:"iat_hooked" textlog:"iat_hooked"`
	Implanted          int `json:"implanted" textlog:"implanted"`
	Other              int `json:"other" textlog:"other"`
	Skipped            int `json:"skipped" textlog:"skipped"`
	Errors             int `json:"errors" textlog:"errors"`
}

type PermissionMask struct {
	User  RwxPermissions `json:"user"`
	Group RwxPermissions `json:"group"`
	World RwxPermissions `json:"world"`
}

type Permissions interface {
	jsonlog.Object

	String() string
	// contains filtered or unexported methods
}

type PlatformInfo interface {
	jsonlog.Object
	// contains filtered or unexported methods
}

type PlatformInfoLinux struct {
	jsonlog.ObjectHeader

	Name          string `json:"name" textlog:"name"`
	KernelName    string `json:"kernel_name" textlog:"kernel_name"`
	KernelVersion string `json:"kernel_version" textlog:"kernel_version"`
	Proc          string `json:"proc" textlog:"proc"`
	Arch          string `json:"arch" textlog:"arch"`
}

type PlatformInfoMacos struct {
	jsonlog.ObjectHeader

	Name          string `json:"name" textlog:"name"`
	Version       string `json:"version" textlog:"version"`
	KernelName    string `json:"kernel_name" textlog:"kernel_name"`
	KernelVersion string `json:"kernel_version" textlog:"kernel_version"`
	Proc          string `json:"proc" textlog:"proc"`
	Arch          string `json:"arch" textlog:"arch"`
}

type PlatformInfoWindows struct {
	jsonlog.ObjectHeader

	Name        string    `json:"name" textlog:"name"`
	Type        string    `json:"type" textlog:"type"`
	Version     string    `json:"version" textlog:"version"`
	Proc        string    `json:"proc" textlog:"proc"`
	Arch        string    `json:"arch" textlog:"arch"`
	InstalledOn time.Time `json:"installed_on" textlog:"installed_on"`
	BuildNumber string    `json:"build_number" textlog:"build_number"`
}

type PluginFinding struct {
	LogObjectHeader

	Plugin string `json:"plugin" textlog:"-"`

	LogDetails MessageFields `json:"details" textlog:",expand"`
}

type PluginString struct {
	jsonlog.ObjectHeader

	Plugin string `json:"plugin" textlog:"-"`

	String string `json:"string" textlog:"string"`
}

type PluginStructuredData struct {
	jsonlog.ObjectHeader

	Plugin string `json:"plugin" textlog:"-"`

	Data KeyValueList `json:"data" textlog:",inline"`
}

type PrefetchInfo struct {
	jsonlog.ObjectHeader
	Executable     *File          `json:"executable" textlog:"executable,expand"`
	ExecutionTimes ExecutionTimes `json:"execution_times" textlog:",expand"`
	ExecutionCount int            `json:"execution_count" textlog:"execution_count"`
	AccessedFiles  []string       `json:"accessed_files" textlog:"-"`
}

type Process struct {
	jsonlog.ObjectHeader

	Pid int32 `json:"pid" textlog:"pid"`

	Dead bool `json:"dead,omitempty" textlog:"dead,omitempty"`
	// Only filled if dead is false
	ProcessInfo `textlog:",expand,omitempty"`

	// BeaconConfig contains information about a Cobalt Strike Beacon if the process contains one.
	BeaconConfig *BeaconConfig `json:"beacon_config,omitempty" textlog:"beacon,expand,omitempty"`

	// PeSieveReport contains information from PE-Sieve about the process, if any exists.
	PeSieveReport *PeSieveReport `json:"pe_sieve,omitempty" textlog:"pe_sieve,expand,omitempty"`
}

type ProcessConnection struct {
	Fd uint32 `json:"-" textlog:"-"`
	// Status is the connection status, e.g. ESTABLISHED, LISTEN, etc.
	Status     string `json:"status" textlog:"-"`
	Ip         string `json:"ip" textlog:"ip"`
	Port       uint32 `json:"port" textlog:"port"`
	RemoteIp   string `json:"remote_ip,omitempty" textlog:"rip,omitempty"`
	RemotePort uint32 `json:"remote_port,omitempty" textlog:"rport,omitempty"`
	// Protocol is the layer 4 protocol used for the connection, e.g. TCP, UDP, etc.
	Protocol string `json:"protocol,omitempty" textlog:"protocol,omitempty"`
}

type ProcessConnectionObject struct {
	jsonlog.ObjectHeader
	ProcessConnection
}

type ProcessConnections struct {
	ListenPorts     ProcessListenPorts  `json:"listen_ports" textlog:"listen_ports,omitempty" jsonschema:"nullable"`
	Connections     []ProcessConnection `json:"connections" textlog:"-" jsonschema:"nullable"`
	ConnectionCount int                 `json:"-" textlog:"connection_count"`
}

type ProcessHandle struct {
	jsonlog.ObjectHeader

	Name   string `json:"name" textlog:"name"`
	Handle uint64 `json:"handle" textlog:"handle,omitempty"`
	Type   string `json:"type,omitempty" textlog:"type,omitempty"`
}

type ProcessInfo struct {
	Name    string `json:"name" textlog:"name"`
	Cmdline string `json:"command" textlog:"command"`
	User    string `json:"owner" textlog:"owner"`

	Image *File `json:"image" textlog:"image,expand"`

	ParentInfo struct {
		Pid         int32  `json:"pid" textlog:"ppid"`
		Exe         string `json:"exe" textlog:"parent"`
		CommandLine string `json:"command" textlog:"parent_command"`
	} `json:"parent_info,omitempty" textlog:",expand,omitempty"`

	ProcessTree StringList `json:"tree" textlog:"tree,omitempty" jsonschema:"nullable"`

	Created time.Time `json:"created" textlog:"created"`
	Session string    `json:"session" textlog:"session,omitempty"`

	ProcessConnections `textlog:",expand"`

	Sections Sections `json:"sections,omitempty" textlog:"-"`
}

type ProcessListenPorts []uint32

type ProfileFolder struct {
	LogObjectHeader

	User string `json:"user" textlog:"user"`

	Modified time.Time  `json:"modified" textlog:"modified,omitempty"`
	Created  *time.Time `json:"created,omitempty" textlog:"created,omitempty"`
}

type QuarantineEvent struct {
	jsonlog.ObjectHeader

	Id        string    `json:"id" textlog:"id"`
	Timestamp time.Time `json:"timestamp" textlog:"timestamp"`
	Name      string    `json:"name" textlog:"name"`
	Type      string    `json:"event_type" textlog:"type"`
	Url       string    `json:"url" textlog:"url,omitempty"`
}

type RawFirewallRule struct {
	jsonlog.ObjectHeader

	Rule string `json:"rule" textlog:"rule"`
}

type Reason struct {
	jsonlog.ObjectHeader

	Summary string `json:"summary" textlog:"reason"`

	Signature     `json:"signature" textlog:",inline"`
	StringMatches MatchStrings `json:"matched" textlog:"matched" jsonschema:"nullable"`
}

type RecycleBinIndexFile struct {
	Version          uint64    `json:"-" textlog:"-"`
	OriginalFilename string    `json:"original_file_name" textlog:"original_filename"`
	DeletionTime     time.Time `json:"deletion_time" textlog:"deletion_time"`
	OriginalFilesize uint64    `json:"original_file_size" textlog:"-"`
}

type RegisteredDebugger struct {
	jsonlog.ObjectHeader
	Executable string `json:"executable" textlog:"file"`
	Debugger   string `json:"debugger" textlog:"element"`
}

type RegistryKey struct {
	jsonlog.ObjectHeader
	Key             string    `json:"key" textlog:"key"`
	Modified        time.Time `json:"modified" textlog:"modified"`
	FormattedValues string    `json:"values" textlog:"values,omitincontext"`
}

type RegistryScheduledTask struct {
	jsonlog.ObjectHeader
	Guid        string    `json:"guid" textlog:"guid"`
	Path        string    `json:"path" textlog:"path"`
	Version     int       `json:"version" textlog:"version"`
	Created     time.Time `json:"created" textlog:"created"`
	LastRun     time.Time `json:"last_run" textlog:"last_run"`
	LastStopped time.Time `json:"last_stopped" textlog:"last_stopped"`
	Status      string    `json:"status" textlog:"status"`
	LastResult  string    `json:"last_result" textlog:"last_result"`
}

type RegistryValue struct {
	jsonlog.ObjectHeader

	Key         string    `json:"key" textlog:"key"`
	Modified    time.Time `json:"modified" textlog:"modified"`
	ParsedValue string    `json:"value" textlog:"value,omitincontext"`
	Size        uint64    `json:"size" textlog:"size"`
}

type ReportableObject interface {
	jsonlog.Object
	// contains filtered or unexported methods
}

type Rootkit struct {
	LogObjectHeader
}

type RwxPermissions struct {
	Readable   bool `json:"readable"`
	Writable   bool `json:"writable"`
	Executable bool `json:"executable"`
}

type SRUMResourceUsageEntry struct {
	jsonlog.ObjectHeader

	// TimeStamp is when the resource usage measurement was recorded by SRUM.
	// This represents the end time of the measurement period (typically hourly).
	TimeStamp time.Time `json:"timestamp" textlog:"timestamp"`

	// AppInfo contains the application path or executable name extracted from the
	// SruDbIdMapTable.IdBlob field. This identifies which application the resource
	// usage data belongs to (e.g., "C:\Windows\System32\notepad.exe").
	AppInfo string `json:"app_info" textlog:"app_info"`

	// UserSID is the Windows Security Identifier string parsed from the binary SID
	// stored in SruDbIdMapTable.IdBlob. This identifies which user account was
	// running the application (e.g., "S-1-5-21-...").
	UserSID string `json:"user_sid" textlog:"user_sid"`

	// UserName is the human-readable username resolved from the UserSID.
	// May be empty if the SID cannot be resolved to a username.
	UserName string `json:"user_name,omitempty" textlog:"user_name,omitempty"`

	// FaceTime is the total duration that the application was visible
	// to the user (in the foreground) during the measurement period. This indicates
	// actual user interaction time with the application.
	FaceTime time.Duration `json:"face_time" textlog:"face_time"`

	// ForegroundBytesRead is the total number of bytes read from disk/storage
	// while the application was in the foreground during the measurement period.
	ForegroundBytesRead uint64 `json:"foreground_bytes_read" textlog:"foreground_bytes_read"`

	// ForegroundBytesWritten is the total number of bytes written to disk/storage
	// while the application was in the foreground during the measurement period.
	ForegroundBytesWritten uint64 `json:"foreground_bytes_written" textlog:"foreground_bytes_written"`

	// ForegroundNumReadOperations is the count of discrete read I/O operations
	// performed while the application was in the foreground. This differs from
	// bytes read as it counts individual operations regardless of size.
	ForegroundNumReadOperations uint64 `json:"foreground_num_read_operations" textlog:"foreground_num_read_operations"`

	// ForegroundNumWriteOperations is the count of discrete write I/O operations
	// performed while the application was in the foreground. This differs from
	// bytes written as it counts individual operations regardless of size.
	ForegroundNumWriteOperations uint64 `json:"foreground_num_write_operations" textlog:"foreground_num_write_operations"`

	// BackgroundBytesRead is the total number of bytes read from disk/storage
	// while the application was running in the background during the measurement period.
	BackgroundBytesRead uint64 `json:"background_bytes_read" textlog:"background_bytes_read"`

	// BackgroundBytesWritten is the total number of bytes written to disk/storage
	// while the application was running in the background during the measurement period.
	BackgroundBytesWritten uint64 `json:"background_bytes_written" textlog:"background_bytes_written"`

	// BackgroundNumReadOperations is the count of discrete read I/O operations
	// performed while the application was running in the background. This differs
	// from bytes read as it counts individual operations regardless of size.
	BackgroundNumReadOperations uint64 `json:"background_num_read_operations" textlog:"background_num_read_operations"`

	// BackgroundNumWriteOperations is the count of discrete write I/O operations
	// performed while the application was running in the background. This differs
	// from bytes written as it counts individual operations regardless of size.
	BackgroundNumWriteOperations uint64 `json:"background_num_write_operations" textlog:"background_num_write_operations"`
}

type ScanInfo struct {
	jsonlog.ObjectHeader

	Versions  VersionInfo        `json:"versions" textlog:",expand"`
	Arguments SpaceSeparatedList `json:"arguments" textlog:"arguments"`
	ScanID    string             `json:"scan_id" textlog:"scan_id"`
	ThorDir   string             `json:"thor_dir" textlog:"thor_dir"`
	User      string             `json:"user" textlog:"user"`
	Elevated  bool               `json:"elevated" textlog:"elevated"`

	Outputs []ScannerOutput `json:"outputs"`

	ActiveModules  []string `json:"active_modules"`
	ActiveFeatures []string `json:"active_features"`

	License LicenseInfo `json:"license" textlog:"license,expand"`

	FpFilters []string `json:"fp_filters"`
}

type ScannerOutput struct {
	Kind   string `json:"kind"`
	Output string `json:"output"`
}

type ScheduledTask struct {
	LogObjectHeader

	Name    string    `json:"name" textlog:"name"`
	Path    string    `json:"path" textlog:"path"`
	Command string    `json:"command" textlog:"command"`
	Enabled bool      `json:"enabled" textlog:"enabled"`
	LastRun time.Time `json:"last_run,omitzero" textlog:"lastrun,omitempty"`
	NextRun time.Time `json:"next_run,omitzero" textlog:"nextrun,omitempty"`
}

type SdbEntry struct {
	jsonlog.ObjectHeader

	Entry KeyValueList `json:"entry" textlog:"entry"`
}

type SdnQueryEntry struct {
	jsonlog.ObjectHeader

	Time     time.Time `json:"time" textlog:"time"`
	Filepath string    `json:"file" textlog:"file"`
	Sha1     string    `json:"sha1" textlog:"sha1"`
	Sha256   string    `json:"sha256" textlog:"sha256"`
}

type Section struct {
	// Name of the section. For sections from loaded libraries, this is the library's file path.
	// For other memory ranges, this is OS specific and may be empty.
	Name string `json:"name"`
	// Address is the start address of the section in the process's virtual memory.
	Address uint64 `json:"address"`
	// Size is the size of the section in bytes.
	Size uint64 `json:"size" textlog:"size"`
	// Offset is the offset within the mapped file or library, if this section
	// corresponds to a file section. If this section does not correspond to a file,
	// this is empty.
	Offset uint64 `json:"offset,omitempty"`
	// SparseData contains a sparse representation of the section's data.
	// Only the interesting parts of the section are included, typically those that have been matched.
	SparseData *SparseData `json:"sparse_data,omitempty"`
	// Permissions of the section.
	Permissions RwxPermissions `json:"permissions"`
}

type Sections []Section

type ShellbagEntry struct {
	LogObjectHeader

	Path       string    `json:"path" textlog:"path"`
	Name       string    `json:"name" textlog:"name"`
	DateAccess time.Time `json:"date_access" textlog:"date_access"`
}

type ShimCache struct {
	jsonlog.ObjectHeader

	Entries          int `json:"entries" textlog:"entries"`
	LastKnownEntries int `json:"last_known_entries" textlog:"previous_entries,omitempty"`
}

type ShimCacheEntry struct {
	jsonlog.ObjectHeader

	Timestamp time.Time `json:"timestamp" textlog:"timestamp"`
	ExecFlag  *bool     `json:"exec_flag" textlog:"exec_flag,omitempty"`
	Path      string    `json:"path" textlog:"path"`
}

type Sigclass string

type Signature struct {
	Score           int64      `json:"score" textlog:"subscore"`
	Ref             StringList `json:"ref" textlog:"ref" jsonschema:"nullable"`
	Type            Sigtype    `json:"origin" textlog:"sigtype"`
	Class           Sigclass   `json:"kind" textlog:"sigclass"`
	Date            string     `json:"date,omitempty" textlog:"ruledate,omitempty"`
	Tags            StringList `json:"tags,omitempty" textlog:"tags,omitempty" jsonschema:"nullable"`
	Rulename        string     `json:"rule_name,omitempty" textlog:"rulename,omitempty"`
	LongDescription string     `json:"description,omitempty" textlog:"description,omitempty"`
	Author          string     `json:"author,omitempty" textlog:"author,omitempty"`
	RuleId          string     `json:"id,omitempty" textlog:"id"`
	FalsePositives  StringList `json:"false_positives,omitempty" textlog:"falsepositives,omitempty" jsonschema:"nullable"`
}

type SignatureInfo struct {
	CertificateName string `json:"certificate_name" textlog:"certificate_name,omitempty"`
	SignatureValid  bool   `json:"signature_valid" textlog:"signature_valid"`
}

type Sigtype int

type SpaceSeparatedList []string

type SparseData struct {
	jsonlog.ObjectHeader
	// Elements is a list of sparse data elements that contain the actual data.
	// Each element has an offset within the block and the data that is present at that offset.
	// Elements are ordered by their offset, and are guaranteed to be non-overlapping.
	Elements []SparseDataElement `json:"elements" jsonschema:"nullable"`
	// Length is the length of the block where the sparse elements reside in.
	// In other words, all Elements are within an address range of [0, Length).
	Length int64 `json:"length"`
}

type SparseDataElement struct {
	Offset uint64               `json:"offset"`
	Data   InvalidUnicodeString `json:"data"`
}

type StringList []string

type SystemType string

type SystemdService struct {
	LogObjectHeader

	Command    string `json:"command" textlog:"command"`
	RunAsUser  string `json:"run_as_user" textlog:"run_as_user"`
	RunAsGroup string `json:"run_as_group" textlog:"run_as_group"`

	Unit  *File `json:"unit" textlog:"unit,expand"`
	Image *File `json:"image" textlog:"image,expand"`
}

type TeamViewerPassword struct {
	jsonlog.ObjectHeader
	Password string `json:"password" textlog:"password"`
	Name     string `json:"name" textlog:"name"`
}

type Thread struct {
	jsonlog.ObjectHeader
	ThreadId uint32     `json:"id"`
	Stack    StringList `json:"stack" jsonschema:"nullable"`
}

type TomcatUser struct {
	jsonlog.ObjectHeader
	User string `json:"user" textlog:"user"`
}

type UALEntry struct {
	jsonlog.ObjectHeader

	// AuthenticatedUserName is the user name on the client that accompanies the UAL
	// entries from installed roles and products, if applicable.
	AuthenticatedUserName string `json:"authenticated_user_name" textlog:"authenticated_user_name"`
	// Address is the IP address of a client device that is used to access a role or
	// service.
	Address string `json:"address" textlog:"address"`
	// TotalAccesses is the number of times a particular user accessed a role or service.
	TotalAccesses uint32 `json:"total_accesses" textlog:"total_accesses"`
	// RoleGuid is the UAL assigned or registered GUID that represents the server role or
	// installed product.
	RoleGuid uuid.UUID `json:"role_guid" textlog:"role_guid"`
	// RoleName is the name of the role, component, or subproduct that is providing UAL
	// data.
	RoleName string `json:"role_name,omitempty" textlog:"role_name,omitempty"`
	// ProductName is the name of the software parent product, such as Windows, that is
	// providing UAL data. The value can be a GUID or a human-readable string.
	ProductName string `json:"product_name,omitempty" textlog:"product_name,omitempty"`
	// TenantId is a unique GUID for a tenant client of an installed role or product that
	// accompanies the UAL data, if applicable.
	TenantId uuid.UUID `json:"tenant_id" textlog:"tenant_id"`
	// InsertDate is the date and time when an IP address was first used to access a role
	// or service.
	InsertDate time.Time `json:"insert_date" textlog:"insert_date"`
	// LastAccess is the date and time when an IP address was last used to access a role
	// or service.
	LastAccess time.Time `json:"last_access" textlog:"last_access"`
	// ClientName. Usually unset.
	ClientName string `json:"client_name,omitempty" textlog:"client_name,omitempty"`
	// AccessesByDay is a map of the number of accesses per day of the year.
	AccessesByDay map[int]uint16 `json:"accesses_by_day" textlog:"-"`
}

type UnixPermissions struct {
	LogObjectHeader

	Owner string         `json:"owner" textlog:"owner"` // FIXME: Could explicitly include name / UID
	Group string         `json:"group" textlog:"group"` // FIXME: Could explicitly include name / GID
	Mask  PermissionMask `json:"permissions" textlog:"permissions"`
}

type UnixUser struct {
	LogObjectHeader

	Name        string   `json:"name" textlog:"name"`
	Uid         string   `json:"uid" textlog:"userid"`
	Gid         string   `json:"gid" textlog:"groupid"`
	FullName    string   `json:"full_name" textlog:"full_name"`
	Home        string   `json:"home" textlog:"home"`
	Shell       string   `json:"shell" textlog:"shell"`
	Crontab     string   `json:"crontab" textlog:"-"`
	AccessFiles []string `json:"access_files" textlog:"-" jsonschema:"nullable"`
}

type UnknownObject struct {
	jsonlog.ObjectHeader
	Data map[string]any
}

type UsnEntry struct {
	LogObjectHeader

	EventTime time.Time  `json:"event_time" textlog:"event_time"`
	Filename  string     `json:"filename" textlog:"filename"`
	Reasons   StringList `json:"reasons" textlog:"reason"`
}

type Version = common.Version

type VersionInfo struct {
	Thor       string `json:"thor" textlog:"version"`
	Build      string `json:"build" textlog:"build"`
	Signatures string `json:"signatures" textlog:"signature_version"`
	Sigma      string `json:"sigma_rules" textlog:"sigma_version"`
}

type VirusTotalHistory struct {
	Names           StringList `json:"names,omitempty" textlog:"names" jsonschema:"nullable"`
	Tags            StringList `json:"tags,omitempty" textlog:"tags" jsonschema:"nullable"`
	Submissions     int64      `json:"submissions,omitempty"  textlog:"submissions"`
	FirstSubmission *time.Time `json:"first_submission,omitempty" textlog:"first_submission,omitempty"`
	LastSubmission  *time.Time `json:"last_submission,omitempty" textlog:"last_submission,omitempty"`
}

type VirusTotalInformation struct {
	LookupResult     string             `json:"result" textlog:"result"`
	PositiveVerdicts int64              `json:"positive_verdicts" textlog:"verdicts"`
	TotalVerdicts    int64              `json:"total_verdicts"`
	History          *VirusTotalHistory `json:"history,omitempty" textlog:",omitempty,expand"`
}

type WebDownload struct {
	jsonlog.ObjectHeader

	// URL is the URL of the downloaded file.
	URL string `json:"url" textlog:"url"`
	// Time is the time when the download was started.
	Time time.Time `json:"time" textlog:"time"`

	// File contains the information about the downloaded file.
	File *File `json:"file" textlog:"file,expand"`
}

type WebPageVisit struct {
	jsonlog.ObjectHeader

	URL  string    `json:"url" textlog:"url"`
	Time time.Time `json:"time" textlog:"time"`
	// Title is the title of the visited page.
	Title string `json:"title" textlog:"title"`
}

type WerCrashReport struct {
	Type        string    `json:"-" textlog:"-"`
	Exe         string    `json:"exe" textlog:"exe"`
	Date        time.Time `json:"date" textlog:"date"`
	AppPath     string    `json:"app_path" textlog:"apppath"`
	Error       string    `json:"error" textlog:"error"`
	FaultModule string    `json:"fault_in_module" textlog:"fault_in_module"`
}

type WindowsEvent struct {
	LogObjectHeader
	Event string `json:"event" textlog:"event"`
}

type WindowsEventlogEntry struct {
	jsonlog.ObjectHeader

	EventId       uint16    `json:"-" textlog:"event_id"`
	EventLevel    int       `json:"-" textlog:"event_level"`
	EventTime     time.Time `json:"-" textlog:"event_time"`
	EventChannel  string    `json:"-" textlog:"event_channel,omitempty"`
	EventComputer string    `json:"-" textlog:"event_computer,omitempty"`

	Entry KeyValueList `json:"entry" textlog:"entry"`
}

type WindowsMutex struct {
	LogObjectHeader

	Mutex string `json:"mutex" textlog:"mutex"`
}

type WindowsPermissions struct {
	LogObjectHeader

	Owner       string     `json:"owner" textlog:"owner"` // FIXME: Could include information like the original SID
	Permissions AclEntries `json:"permissions" textlog:"permissions" jsonschema:"nullable"`
}

type WindowsPipe struct {
	LogObjectHeader

	Pipe string `json:"pipe" textlog:"pipe"`
}

type WindowsPipeList struct {
	jsonlog.ObjectHeader
	Pipes StringList `json:"pipes" textlog:"pipes"`
}

type WindowsService struct {
	LogObjectHeader

	Key            string    `json:"key" textlog:"key"`
	KeyName        string    `json:"key_name" textlog:"key_name"`
	ServiceName    string    `json:"service_name" textlog:"service_name"`
	Modified       time.Time `json:"modified" textlog:"modified"`
	StartType      string    `json:"start_type" textlog:"start_type"`
	ServiceType    string    `json:"service_type" textlog:"service_type"`
	User           string    `json:"user" textlog:"user"`
	Description    string    `json:"description" textlog:"description"`
	FailureCommand string    `json:"failure_command" textlog:"failure_command,omitempty"`
	Image          *File     `json:"image" textlog:"image,expand"`
}

type WindowsUser struct {
	LogObjectHeader

	User                 string       `json:"user" textlog:"user"`
	FullName             string       `json:"full_name" textlog:"full_name"`
	IsAdmin              bool         `json:"is_admin" textlog:"is_admin"`
	LastLogon            time.Time    `json:"last_logon" textlog:"last_logon"`
	BadPasswordCount     int          `json:"bad_password_count" textlog:"bad_password_count"`
	NumberOfLogons       int          `json:"num_logons" textlog:"num_logons"`
	PasswordAge          HourDuration `json:"pass_age" textlog:"pass_age"`
	PasswordNeverExpires bool         `json:"no_expire" textlog:"no_expire"`
	IsEnabled            bool         `json:"active" textlog:"active"`
	IsLocked             bool         `json:"locked" textlog:"locked"`
	Comment              string       `json:"comment" textlog:"comment"`
}

type WmiElement struct {
	jsonlog.ObjectHeader

	Key        string `json:"key" textlog:"key"`
	Filtertype string `json:"filter_type" textlog:"filtertype"`

	Eventfiltername   string `json:"event_filter_name" textlog:"eventfiltername"`
	Eventconsumername string `json:"event_consumer_name" textlog:"eventconsumername"`
	Eventfilter       string `json:"event_filter" textlog:"eventfilter"`
	Eventconsumer     string `json:"event_consumer" textlog:"eventconsumer"`
}

type WmiStartupCommand struct {
	jsonlog.ObjectHeader
	Location string `json:"location" textlog:"location"`
	Caption  string `json:"caption" textlog:"caption"`
	Command  string `json:"command" textlog:"command"`
}