package com.hiveops.aria.kafka;

import lombok.AllArgsConstructor;
import lombok.Builder;
import lombok.Data;
import lombok.NoArgsConstructor;

import java.time.Instant;
import java.util.UUID;

@Data
@Builder
@NoArgsConstructor
@AllArgsConstructor
public class AriaThreatEvent {

    private UUID eventId;

    private Long deviceId;
    private String deviceAgentId;
    private String institutionKey;

    private String signalKey;
    private String eventType;

    /** CRITICAL | HIGH | MEDIUM | LOW | INFO */
    private String severity;

    private String description;

    private String matchedIocValue;
    private String matchedIocType;

    /** Attack phase if part of a sequence: PHYSICAL_ACCESS | MALWARE_STAGING | etc. */
    private String attackPhase;

    /** Groups events belonging to the same attack chain. */
    private UUID sequenceId;

    private Instant detectedAt;

    private String sourceService;
}
