n8n-nodes-binalyze-air/dist/nodes/Air/api/acquisitions/acquisitions.d.ts

Binalyze AIR nodes for automating DFIR with n8n workflows

import { IExecuteFunctions, ILoadOptionsFunctions } from 'n8n-workflow';
import { AirCredentials } from '../../../../credentials/AirApi.credentials';
import { BaseApiResponse, PaginatedApiResponse, EmptyApiResponse } from '../api';
export interface AcquisitionSettings {
    artifacts?: string[];
    evidence?: string[];
    customSettings?: Record<string, string | number | boolean>;
}
export interface AcquisitionEndpointFilter {
    searchTerm?: string;
    name?: string;
    ipAddress?: string;
    groupId?: string;
    groupFullPath?: string;
    label?: string;
    lastSeenAfter?: string;
    lastSeenBefore?: string;
    managedStatus?: string[];
    isolationStatus?: string[];
    platform?: string[];
    issue?: string[];
    onlineStatus?: string[];
    tags?: string[];
    version?: string;
    policy?: string;
    includedEndpointIds?: string[];
    excludedEndpointIds?: string[];
    organizationIds: number[];
    connectionRouteId?: number;
    caseId?: string;
    awsRegions?: string[];
    azureRegions?: string[];
    agentInstalled?: boolean;
    isServer?: boolean;
    assetType?: string;
    vendorIds?: string[];
    vendorDeviceIds?: string[];
}
export interface TaskConfig {
    choice: 'useCustomOptions' | 'useDefaultOptions';
    saveTo?: Record<string, any>;
    cpu?: {
        usageLimit: number;
    };
    bandwidth?: {
        limit: number;
    };
    diskSpace?: {
        limit: number;
    };
    compression?: {
        enabled: boolean;
    };
    sendTo?: Record<string, any>;
    triageLocalDrivesOnly?: Record<string, any>;
    locard?: Record<string, any>;
}
export interface DroneConfig {
    autoPilot: boolean;
    enabled: boolean;
    mitreEnabled: boolean;
    analyzers: string[];
    keywords: string[];
    minScore: number;
}
export interface EventLogRecordsConfig {
    startDate: string | null;
    endDate: string | null;
    maxEventCount: number;
}
export interface TaskSchedulerConfig {
    when: 'now' | 'scheduled';
    timezoneType?: 'asset' | 'custom';
    timezone?: string;
    startDate?: number;
    isRepeat?: boolean;
    recurrence?: string;
    repeatEvery?: number;
    repeatOnWeek?: string[];
    repeatOnMonth?: number;
    endRepeatType?: string;
    endDate?: number;
    limit?: number;
}
export interface AcquisitionProfile {
    _id: string;
    name: string;
    description?: string;
    organizationId: number;
    createdAt: string;
    createdBy: string;
    updatedAt?: string;
    updatedBy?: string;
    isDefault?: boolean;
    settings?: AcquisitionSettings;
}
export interface CreateAcquisitionProfileRequest {
    name: string;
    description?: string;
    organizationId: number;
    settings?: AcquisitionSettings;
}
export interface UpdateAcquisitionProfileRequest {
    name: string;
    description?: string;
    settings?: AcquisitionSettings;
}
export interface AssignEvidenceTaskRequest {
    taskName?: string;
    caseId: string;
    acquisitionProfileId: string;
    taskConfig: TaskConfig;
    filter: AcquisitionEndpointFilter;
    droneConfig: DroneConfig;
    eventLogRecordsConfig: EventLogRecordsConfig;
    schedulerConfig?: TaskSchedulerConfig;
}
export interface AssignImageTaskRequest {
    taskName?: string;
    caseId: string;
    taskConfig: TaskConfig;
    filter: AcquisitionEndpointFilter;
    diskImageOptions: Record<string, any>;
    schedulerConfig?: TaskSchedulerConfig;
}
export interface CreateOffNetworkTaskRequest {
    caseId: string;
    acquisitionProfileId: string;
    organizationId: number;
    name: string;
    description?: string;
}
export type AcquisitionProfilesResponse = PaginatedApiResponse<AcquisitionProfile>;
export type CreateAcquisitionProfileResponse = BaseApiResponse<AcquisitionProfile>;
export type UpdateAcquisitionProfileResponse = BaseApiResponse<AcquisitionProfile>;
export type GetAcquisitionProfileResponse = BaseApiResponse<AcquisitionProfile>;
export type DeleteAcquisitionProfileResponse = EmptyApiResponse;
export type AssignAcquisitionTaskResponse = BaseApiResponse<Array<{
    _id: string;
    name: string;
    organizationId: number;
}>>;
export type CreateOffNetworkTaskResponse = BaseApiResponse<{
    _id: string;
    name: string;
    organizationId: number;
    caseId: string;
    acquisitionProfileId: string;
}>;
export declare const api: {
    getAcquisitionProfiles(context: IExecuteFunctions | ILoadOptionsFunctions, credentials: AirCredentials, organizationIds?: string | string[], queryParams?: Record<string, string | number>): Promise<AcquisitionProfilesResponse>;
    createAcquisitionProfile(context: IExecuteFunctions | ILoadOptionsFunctions, credentials: AirCredentials, data: CreateAcquisitionProfileRequest): Promise<CreateAcquisitionProfileResponse>;
    getAcquisitionProfileById(context: IExecuteFunctions | ILoadOptionsFunctions, credentials: AirCredentials, id: string): Promise<GetAcquisitionProfileResponse>;
    assignEvidenceAcquisitionTask(context: IExecuteFunctions | ILoadOptionsFunctions, credentials: AirCredentials, data: AssignEvidenceTaskRequest): Promise<AssignAcquisitionTaskResponse>;
    assignImageAcquisitionTask(context: IExecuteFunctions | ILoadOptionsFunctions, credentials: AirCredentials, data: AssignImageTaskRequest): Promise<AssignAcquisitionTaskResponse>;
    createOffNetworkAcquisitionTask(context: IExecuteFunctions | ILoadOptionsFunctions, credentials: AirCredentials, data: CreateOffNetworkTaskRequest): Promise<CreateOffNetworkTaskResponse>;
};