go.mondoo.com/cnquery@v0.0.0-20231005093811-59568235f6ea/providers/os/resources/os.lr

// Copyright (c) Mondoo, Inc.
// SPDX-License-Identifier: BUSL-1.1

import "../../core/resources/core.lr"
import "../../network/resources/network.lr"

option provider = "go.mondoo.com/cnquery/providers/os"
option go_package = "go.mondoo.com/cnquery/providers/os/resources"

alias os.base.command = command
alias os.base.user = user
alias os.base.group = group
alias os.base.file = file
alias os.base.packages = packages
alias os.base.service = service
alias os.base.services = services
alias os.unix.sshd = sshd
alias k8s.kubelet = kubelet

extend asset {
  vulnerabilityReport() dict
}

asset.eol @defaults("date") {
  // Documentation URL
  docsUrl string
  // Product URL
  productUrl string
  // End-of-Life date
  date time
}

// Returns platform EOL date information.
private mondoo.eol {
  // Product Name
  product string
  // Product Version
  version string
  // End-of-Life date for the product
  date() time
}

// Information about the platform end-of-life. Deprecated in favor of `asset.eol`. This resource will be removed in version 10.0.
// Please use asset.eol instead.
platform.eol @defaults("date") {
  // Documentation URL
  docsUrl string
  // Product URL
  productUrl string
  // End-of-Life date
  date time
}

platform {
  // Full advisory & vulnerability report
  vulnerabilityReport() dict
}

// Returns all platform/package advisories
platform.advisories {
  []audit.advisory
  // Worst CVSS score for all advisories
  cvss() audit.cvss
  // Statistical information: total, critical, high, medium, low, none, unknown
  stats() dict
}

// Returns all platform/package cves
platform.cves {
  []audit.cve
  // Worst CVSS score for all cves
  cvss() audit.cvss
  // Statistical information: total, critical, high, medium, low, none, unknown
  stats() dict
}

// Common Vulnerability Scoring System (CVSS) Score
private audit.cvss {
  // CVSS Score ranging from 0.0 to 10.0
  score   float
  // CVSS score is also represented as a vector string
  vector  string
}

// Platform/package advisory
private audit.advisory {
  // Advisory ID
  id          string
  // Mondoo Advisory Identifier
  mrn         string
  // Advisory Title
  title       string
  // Advisory Description
  description string
  // Advisory publication date
  published   time
  // Last modification date
  modified    time
  // Worst CVSS Score of all assigned CVEs
  worstScore    audit.cvss
}

// Common Vulnerabilities and Exposures (CVE)
private audit.cve {
  // CVE ID
  id        string
  // Mondoo CVE Identifier
  mrn       string
  // CVE state
  state     string
  // Summary Description
  summary   string
  // Indicates if the CVE has a CVSS score
  unscored  bool
  // publication date
  published   time
  // Last modification date
  modified    time
  // Worst CVSS Score of all assigned CVEs
  worstScore    audit.cvss
}

machine {}

// SMBIOS BIOS information
machine.bios {
  // BIOS vendor
  vendor string
  // BIOS version
  version string
  // BIOS release date
  releaseDate string
}

// SMBIOS system information
machine.system {
  // Manufacturer
  manufacturer string
  // Product Name
  product string
  // Version
  version string
  // Serial Number
  serial string
  // UUID
  uuid string
  // SKU Number
  sku string
  // Family
  family string
}

// SMBIOS baseboard (or module) information
machine.baseboard {
  // Manufacturer
  manufacturer string
  // Product
  product string
  // Version
  version string
  // Serial Number
  serial string
  // Asset Tag
  assetTag string
}

// SMBIOS system enclosure or chassis
machine.chassis {
  // Manufacturer
  manufacturer string
  // Version
  version string
  // Serial Number
  serial string
  // Asset Tag Number
  assetTag string
}

// Operating system information
os {
  // Pretty hostname on macOS/Linux or device name on Windows
  name() string
  // ENV variable contents
  env() map[string]string
  // PATH variable contents
  path(env) []string
  // Current uptime
  uptime() time
  // List of available OS updates
  updates() []os.update
  // Indicates if a reboot is pending
  rebootpending() bool
  // Hostname for this OS
  hostname() string
  // Machine ID for this OS
  machineid() string
}

// Operating system update information
os.update @defaults("name")  {
  // Name of the update
  name string
  // Category of the update
  category string
  // Severity of the update
  severity string
  // Indicates if a restart is required
  restart bool
  // Package format for this update
  format string
}

os.base {
  embed machine

  // Pretty Hostname on macOS/Linux or device name on Windows
  name() string
  // ENV variable contents
  env() map[string]string
  // PATH variable contents
  path(env) []string
  // Current uptime
  uptime() time
  // List of available OS updates
  updates() []os.update
  // Indicates if a reboot is pending
  rebootpending() bool
  // Hostname for this OS
  hostname() string
  // User groups
  groups() groups
  // Users
  users() users
}

os.unix {
  embed os.base as base
}

os.linux {
  embed os.unix as unix

  // iptables firewall for IPv4
  iptables() iptables
  // iptables firewall for IPv6
  ip6tables() ip6tables
}

// Operating system root certificates
os.rootCertificates {
  []certificate(content)
  // List of files that define these certificates
  files []file
  content(files) []string
}

// Results of running a command on the system
command {
  init(command string)
  // Raw contents of the command
  command string
  // Standard output from running the command
  stdout(command) string
  // Standard error output from running the command
  stderr(command) string
  // Exit code the command returned
  exitcode(command) int
}

// Results of running a PowerShell script on the system
powershell {
  init(script string)
  // Raw contents of the script
  script string
  // Standard output from running the script
  stdout() string
  // Standard error output from running the script
  stderr() string
  // Exit code the script returned
  exitcode() int
}

// File on the system
file @defaults("path size permissions.string") {
  init(path string)
  // Location of the file on the system
  path string
  // Filename without path prefix of this file
  basename(path) string
  // Path to the folder containing this file
  dirname(path) string
  // Contents of this file
  content(path, exists) string
  // Indicator if this file exists on the system
  exists(path) bool
  // Permissions for this file
  permissions(path) file.permissions
  // Size of this file on disk
  size(path) int
  // Ownership information about the user
  user() user
  // Ownership information about the group
  group() group
  // Denotes whether the path is empty
  empty(path) bool
}

// Access permissions for a given file
private file.permissions @defaults("string") {
  // Raw POSIX mode for the permissions
  mode int
  // Indicator if this file is readable by its owner
  user_readable bool
  // Indicator if this file is writeable by its owner
  user_writeable bool
  // Indicator if this file is executable by its owner
  user_executable bool
  // Indicator if this file is readable by members of the group
  group_readable bool
  // Indicator if this file is writeable by members of the group
  group_writeable bool
  // Indicator if this file is executable by members of the group
  group_executable bool
  // Indicator if this file is readable by others
  other_readable bool
  // Indicator if this file is writeable by others
  other_writeable bool
  // Indicator if this file is executable by others
  other_executable bool
  // SUID bit indicator
  suid bool
  // SGID bit indicator
  sgid bool
  // Sticky bit indicator
  sticky bool
  // Whether the file describes a directory
  isDirectory bool
  // Whether the file describes a regular file
  isFile bool
  // Whether the file is a symlink
  isSymlink bool
  // A simple printed string version of the permissions
  string() string
}

files {}

// Find files on the system
files.find {
  []file
  // From sets the starting point for the search operation
  from string
  // xdev indicates if other devices will be searched
  xdev bool
  // What types of files will be listed (directories, files, devices, etc)
  type string
  // A regular expression for the file search
  regex string
  // What permissions the file matches
  permissions int
  // Search name of the name
  name string
}

// Parse INI files
parse.ini {
  init(path string, delimiter string)
  // Symbol that is separating keys and values
  delimiter string
  // File that is being parsed
  file file
  // Raw content of the file that is parsed
  content(file) string
  // A map of sections and key-value pairs
  sections(content, delimiter) map[string]map[string]string
  // A map of parameters that don't belong to sections
  params(sections) map[string]string
}

// Parse JSON files
parse.json {
  init(path string)
  // File that is being parsed
  file file
  // Raw content of the file that is parsed
  content(file) string
  // The parsed parameters that are defined in this file
  params(content) dict
}

// Parse plist files
parse.plist {
  init(path string)
  // File that is being parsed
  file file
  // Raw content of the file that is parsed
  content(file) string
  // The parsed parameters that are defined in this file
  params(content) dict
}

// Parse YAML files
parse.yaml {
  init(path string)
  // File that is being parsed
  file file
  // Raw content of the file that is parsed
  content(file) string
  // The parsed parameters that are defined in this file
  params(content) dict
}

// Parse Certificates from files
parse.certificates {
  []network.certificate(content, path)
  init(path string)
  // Certificate file path
  path string
  // Certificate file
  file() file
  // Certificate file content
  content(file) string
}

// Parse OpenPGP from files
parse.openpgp {
  []network.openpgp.entity(content)
  init(path string)
  // Path of the OpenPGP file. Deprecated: Please use file.path instead
  path string
  // OpenPGP file
  file file
  // OpenPGP file content
  content(file) string
}

// User on this system
user @defaults("name uid gid") {
  // User ID
  uid int
  // User's Group ID
  gid int
  // User's Security Identifier (Windows)
  sid string
  // Name of the user
  name string
  // Home folder
  home string
  // Default shell configured
  shell string
  // Indicates if the user is enabled
  enabled bool
  // List of authorized keys
  authorizedkeys(home) authorizedkeys
  // List of SSH keys
  sshkeys() []privatekey
  // Group that user is a member of
  group(gid) group
}

// Private Key Resource
privatekey {
  // PEM data
  pem string
  // Key path on disk (deprecated, use file instead)
  path string
  // File on disk for this private key
  file file
  encrypted bool
}

// Users configured on this system
users {
  []user
}

// List of SSH Authorized Keys
authorizedkeys {
  []authorizedkeys.entry(file, content)
  init(path string)
  path string
  file file
  content(file) string
}

// SSH authorized keys entry
authorizedkeys.entry @defaults("key") {
  line int
  type string
  key string
  label string
  options []string
  file file
}

// Group on this system
group @defaults("name gid") {
  init(id string)
  // Group ID
  gid int
  // Group's Security Identifier (Windows)
  sid string
  // Name of this group
  name string
  // Users who are members of this group
  members() []user
}

// Groups configured on this system
groups {
  []group
}

// Package on the platform or OS
package @defaults("name version") {
  // May be initialized with the name only, in which case it will look up
  // the package with the given name on the system.
  init(name string)

  // Name of the package
  name string
  // Current version of the package
  version string
  // Architecture of this package
  arch string
  // Epoch of this package
  epoch string

  // Format of this package (e.g. rpm, deb)
  format string
  // Status of this package (e.g. if it is needed)
  status() string
  // Package description
  description string

  // Package origin (optional)
  origin() string

  // Available version
  available string
  // Indicates if this package is installed
  installed bool
  // Indicates if this package is outdated
  outdated() bool
}

// List of packages on this system
packages {
  []package
}

// PAM configuration (Pluggable Authentication Module)
pam.conf {
  init(path string)
  // List of files that make up the PAM configuration
  files() []file
  // The raw PAM configuration (across all files)
  content(files) string
  // Deprecated: A list of services that are configured via PAM
  services(files) map[string][]string
  // List of services with parsed entries that are configured via PAM
  entries(files) map[string][]pam.conf.serviceEntry
}

private pam.conf.serviceEntry @defaults("service module") {
  // Service file that entry is from
  service string
  // Line number in service file - used for ID
  lineNumber int
  // Type for pam entry, ie auth, password etc
  pamType string
  // Level of control, ie required, requisite, sufficient
  control string
  // PAM module used
  module string
  // Configuration options for pam service entry
  options []string
}

// SSH server resource
sshd {}

// SSH server configuration
sshd.config {
  init(path? string)
  // File of this SSH server configuration
  file() file
  // A list of lexically sorted files making up the SSH server configuration
  files(file) []file
  // Raw content of this SSH server config
  content(files) string
  // Configuration values of this SSH server
  params(content) map[string]string
  // Ciphers configured for this SSH server
  ciphers(params) []string
  // MACs configured for this SSH server
  macs(params) []string
  // Key Exchange Algorithms configured for this SSH server
  kexs(params) []string
  // Host Keys configured for this SSH server
  hostkeys(params) []string
}

// Service on this system
service @defaults("name running enabled type") {
  init(name string)
  // Name of this service
  name string
  // Service description
  description string
  // Is it installed?
  installed bool
  // Is it running?
  running bool
  // Is it enabled? (start at boot)
  enabled bool
  // Type information
  type string
  // Is it masked?
  masked bool
}

// Services configured on this system
services {
  []service
}

// System kernel information
kernel @defaults("info") {
  // Active kernel information
  info() dict
  // Kernel parameters map
  parameters() map[string]string
  // List of kernel modules
  modules() []kernel.module
  // Installed Versions
  installed() []dict
}

// System kernel module information
kernel.module @defaults("name loaded") {
  init(name string)

  // Name of the kernel module
  name string
  // Size of the kernel module
  size string
  // Indicates if this module is loaded
  loaded bool
}

// Docker host resource
docker {
  // List all Docker images
  images() []docker.image
  // List all Docker containers
  containers() []docker.container
}

// Docker image
docker.image {
  // Image ID
  id string
  // Image size in kilobytes
  size int
  // Virtual image size in kilobytes
  virtualsize int
  // Tag key value pairs
  tags []string
  // Labels key value pairs
  labels map[string]string
}

// Docker container
docker.container {
  embed os.linux as os

  // Container ID
  id string
  // Container command
  command string
  // Container image
  image string
  // Image ID
  imageid string
  // Container names
  names []string
  // Container state
  state string
  // Status message
  status string
  // Label key value pairs
  labels map[string]string
}

// IPv4 tables
iptables {
  // IPv4 input chain stats
  input() []iptables.entry
  // IPv4 output chain stats
  output() []iptables.entry
}

// IPv6 tables
ip6tables {
  // IPv6 input chain stats
  input() []iptables.entry
  // IPv6 output chain stats
  output() []iptables.entry
}

iptables.entry {
  //Line number of statistic - used to create id
  lineNumber int
  //packets from iptable
  packets int
  //This field tells us how large the packet is in octets, including headers and everything.
  bytes int
  //If a packet matches the rule, the target specifies what should be done with it.
  target string
  //protocol of the next level layer. For example, this may be TCP, UDP or ICMP among others.
  protocol string
  //indicates IP options
  opt string
  //input
  in string
  //output
  out string
  //source address field that lets the receiver know where the packet came from.
  source string
  //The destination IP address or subnet of the traffic, or anywhere
  destination string
  //The options field contains different optional settings within the header,
  //such as Internet timestamps, SACK or record route options.
  options string
  //input or output - used to create id
  chain string
}

// Process on this system
process @defaults("executable pid state") {
  init(pid int)
  // PID (process ID)
  pid int
  // State of the process (sleeping, running, etc)
  state() string
  // Executable that is running this process
  executable() string
  // Full command used to run this process
  command() string
  // Map of additional flags
  flags() map[string]string
}

// Processes available on this system
processes {
  []process
}

// TCP/IP port on the system
port @defaults("port protocol address process.executable") {
  // Protocol of this port
  protocol string
  // Port number
  port int
  // Local address of this port
  address string
  // User configured for this port
  user user
  // Process that is connected to this port
  process() process
  // State of this open port
  state string
  // Remote address connected to this port
  remoteAddress string
  // Remote port connected to this port
  remotePort int
  // TLS on this port, if it is available
  tls(address, port, protocol) network.tls
}

// TCP/IP ports on the system
ports {
  []port
  // All listening ports
  listening() []port
}

// Windows audit policies
auditpol {
  []auditpol.entry
}

// Windows audit policy
auditpol.entry  @defaults("subcategory inclusionsetting exclusionsetting") {
  // Machine name
  machinename string
  // Policy Target
  policytarget string
  // Subcategory
  subcategory string
  // Subcategory GUID
  subcategoryguid string
  // Inclusive setting
  inclusionsetting string
  // Exclusive settings
  exclusionsetting string
}

// Windows local security policy
secpol {
  // System Access
  systemaccess() map[string]string
  // Event Audit
  eventaudit() map[string]string
  // Registry Values
  registryvalues() map[string]string
  // Privilege Rights
  privilegerights() map[string][]string
}

// NTP service configuration
ntp.conf {
  init(path string)
  // File of this NTP service configuration
  file() file
  // Raw contents of this NTP service configuration
  content(file) string
  // List of settings for this NTP service
  settings(content) []string
  // List of servers for this NTP service
  servers(settings) []string
  // List of access control restrictions for this NTP service
  restrict(settings) []string
  // Additional information for clock drivers
  fudge(settings) []string
}

// Rsyslog service configuration
rsyslog.conf {
  init(path string)
  // Path for the main rsyslog file and search
  path() string
  // Files that make up this Rsyslog service configuration
  files(path) []file
  // Raw contents of this Rsyslog service configuration
  content(files) string
  // List of settings for this Rsyslog service
  settings(content) []string
}

// Shadow password suite configuration
logindefs {
  init(path string)
  // Current configuration file for resource
  file() file
  // Content of the configuration file
  content(file) string
  // Parsed logindef parameter
  params(content) map[string]string
}

// Unix list block devices
lsblk {
  []lsblk.entry
}

// Unix block device
lsblk.entry {
  // Device name
  name string
  // Filesystem Type
  fstype string
  // label for the fs
  label string
  // uuid for the fs
  uuid string
  // mountpoints for the device
  mountpoints []string
}

// Unix Mounted Filesystem
mount {
  []mount.point
}

// Unix mount point
mount.point @defaults("device path fstype") {
  init(path string)
  // Device
  device string
  // Path
  path string
  // Filesystem Type
  fstype string
  // Mount Options
  options map[string]string
  // Flag whether the mount point is mounted
  mounted bool
}

// Shadowed Password File
shadow {
  []shadow.entry
}

// Shadowed password file entry
shadow.entry {
  // User
  user string
  // Password
  password string
  // Date of last password change
  lastchanged time
  // Minimum password age
  mindays int
  // Maximum password age
  maxdays int
  // Password warning period
  warndays int
  // Password inactivity period
  inactivedays int
  // Account expiration date
  expirydates string
  // Reserved field
  reserved string
}

// Yum package manager resource
yum {
  // variables defined built-in in Yum configuration files (/etc/yum.conf and all .repo files in the /etc/yum.repos.d/)
  vars() map[string]string
  // List of all configured yum repositories
  repos() []yum.repo
}

// Yum repository resource
yum.repo {
  init(id string)
  // Repository ID
  id string
  // Human-readable repository name
  name string
  // Repository status
  status string
  // URL where the repodata directory of a repository is located
  baseurl []string
  // Indicator when the repository will expire
  expire string
  // Deprecated: location of the repo configuration file, use file.path
  filename string
  // Repository configuration file path
  file file
  // Repository revision
  revision string
  // Packages in repository
  pkgs string
  // File size of this repository
  size string
  // Mirrors for this repository
  mirrors string
  // Indicates if this repository is used as package source
  enabled() bool
}

// Windows registry key
registrykey @defaults("path") {
  init(path string)
  // Registry key path
  path string
  // Indicates if the property exists
  exists() bool
  // deprecated: Registry key properties, use `items` instead
  properties() map[string]string
  // Registry key items
  items() []registrykey.property
  // Registry key children
  children() []string
}

// Windows registry key property
registrykey.property @defaults("path name") {
  init(path string, name string)
  // Registry key path
  path string
  // Registry key name
  name string
  // Indicates if the property exists
  exists() bool
  // deprecated: Registry key property value converted to string, use `data` instead
  value() string
  // Registry key type
  type() string
  // Registry key data
  data() dict
}

// Container Image
container.image @defaults("name") {
  // Image reference
  reference string
  // Fully-qualified reference name
  name string
  // Identifier of type-specific portion of the image reference
  identifier string
  // Identifier Type `tag` or `digest`
  identifierType string
  // Repository used for Container Image
  repository() container.repository
}

// Container registry repository
container.repository {
  // Container Registry Repository Name
  name string
  // URL Scheme
  scheme string
  // Container Registry Repository URL
  fullName string
  // Container Registry URL
  registry string
}

// Kubernetes Kubelet configuration
kubelet {
  // Kubelet config file
  configFile file
  // Kubelet process
  process process
  // Combination of config file parameters and cli parameters
  configuration dict
}

// Python package details found on operating system image
python {
  init(path? string)
  // Path to a specific site-packages location to exclusively scan through (empty means search through default locations)
  path string

  // Packages returns a list of all discovered packages
  packages() []python.package

  // Toplevel returns a list of all packages which were specifically installed (ie. not auto-installed as a dependency)
  toplevel() []python.package
}

// Python package information
python.package @defaults("name version") {
  init(path? string)

  // ID is the python.package unique identifier
  id string

  // Name of the package
  name() string

  // File containing the package metadata
  file file

  // Version of the package
  version() string

  // License of the package
  license() string

  // Author of the package
  author() string

  // Short package description
  summary() string

  // List of packages depended on
  dependencies() []python.package
}

// macOS specific resources
macos {
  // macOS user defaults
  userPreferences() map[string]dict
  // macOS user defaults for current host
  userHostPreferences() map[string]dict
  // macOS global account policies
  globalAccountPolicies() dict
}

// macOS application layer firewall (ALF) service
macos.alf {
  // Allow downloaded software to receive incoming connections
  allowDownloadSignedEnabled int
  // Allow built-in software to receive incoming connections for signed software
  allowSignedEnabled int
  // Flag if firewall is unloaded
  firewallUnload int
  // Indicates if the firewall is enabled
  globalState int
  // Specifies if alf.log is used
  loggingEnabled int
  // Specifies logging flags
  loggingOption int
  // Stealth mode
  stealthEnabled int
  // ALF version
  version string
  // Service exceptions
  exceptions []dict
  // Services explicitly allowed to perform networking
  explicitAuths []string
  // Applications with exceptions for network blocking
  applications []dict
}

// macOS Time Machine
macos.timemachine {
  // macOS Time Machine preferences
  preferences() dict
}

// macOS machine settings
// The resource requires at least "admin" privileges to run
macos.systemsetup {
  // Current date
  date() string
  // Current time in 24-hour format
  time() string
  // Current time zone
  timeZone() string
  // Whether network time is on or off
  usingNetworkTime() string
  // Configured network time server
  networkTimeServer() string
  // Amount of idle time until machine sleeps
  sleep() []string
  // Amount of idle time until display sleeps
  displaySleep() string
  // Amount of idle time until hard disk sleeps
  harddiskSleep() string
  // Whether wake on modem is on or off
  wakeOnModem() string
  // Whether wake on network access is on or off
  wakeOnNetworkAccess() string
  // Whether restart on power failure is on or off
  restartPowerFailure() string
  // Whether restart on freeze is on or off
  restartFreeze() string
  // Whether the power button can sleep the computer
  allowPowerButtonToSleepComputer() string
  // Whether remote login (SSH) is on or off
  remoteLogin() string
  // Whether remote apple events are on or off
  remoteAppleEvents() string
  // Computer name
  computerName() string
  // Local subnet name
  localSubnetName() string
  // Current startup disk
  startupDisk() string
  // Number of seconds after which the computer will start up after a power failure
  waitForStartupAfterPowerFailure() string
  // Whether or not the keyboard should be disabled when the X Serve enclosure lock is engaged
  disableKeyboardWhenEnclosureLockIsEngaged() string
}

// Windows-specific resource to get operating system details
windows {
  // A consolidated object of system and operating system properties
  // 
  // see https://docs.microsoft.com/en-us/dotnet/api/microsoft.powershell.commands.computerinfo?view=powershellsdk-1.1.0 for more information
  computerInfo() dict

  // Hotfixes installed on the computer
  hotfixes() []windows.hotfix

  // Information about Windows Server roles, role services, and features that are available for installation and installed on a specified server.
  features() []windows.feature
}

// Windows hotfix resource
windows.hotfix {
  init(hotfixId string)
  // Hotfix ID
  hotfixId string
  // Type of hotfix eg. `Update` or `Security Update`
  description string
  // Reference to knowledge base
  caption string
  // Date the hotfix was installed on
  installedOn time
  // User that installed the hotfix
  installedBy string
}

// Windows feature resource
windows.feature {
  init(name string)
  // Feature full path 
  path string
  // Command IDs of role, role service, or feature
  name string
  // Feature name
  displayName string
  // Feature description
  description string
  // Flag indicates whether the feature is installed
  installed bool
  // Feature installation state
  installState int
}

// Windows Firewall resource
windows.firewall {
  // Global firewall settings
  settings() dict
  // Settings that apply to the per-profile configurations of the Windows Firewall with Advanced Security
  profiles() []windows.firewall.profile
  // Firewall rules
  rules() []windows.firewall.rule
}

// Windows Firewall profile entry
// https://docs.microsoft.com/en-us/previous-versions/windows/desktop/wfascimprov/msft-netfirewallprofile
windows.firewall.profile {
  instanceID string
  // Name of the profile
  name string
  // Whether the firewall is enabled on this profile
  enabled int
  // Default action for inbound traffic
  defaultInboundAction int
  // Default action for outbound traffic
  defaultOutboundAction int
  // If this is true, administrators will be able to create firewall rules which allow unsolicited inbound traffic to be accepted if this is false, such rules will be ignored
  allowInboundRules int
  // Determines whether local firewall rules should be merged into the effective policy along with group policy settings
  allowLocalFirewallRules int
  // Determines whether local IPsec rules should be merged into the effective policy along with rules from group policy
  allowLocalIPsecRules int
  // Whether to respect user allowed applications created in the legacy firewall
  allowUserApps int
  // Whether to respect globally opened ports created in the legacy firewall
  allowUserPorts int
  // Whether to allow unicast responses to multicast traffic
  allowUnicastResponseToMulticast int
  // If true, users will be notified when an application listens on a port that is close
  notifyOnListen int
  // Whether to use stealth mode for IPsec-protected traffic
  enableStealthModeForIPsec int
  // Maximum size the log file can reach before being rotated
  logMaxSizeKilobytes int
  // Whether to log allowed packets
  logAllowed int
  // Whether to log blocked traffic
  logBlocked int
  // Whether to log an event when rules are ignored
  logIgnored int
  // Filename in which to store the firewall log
  logFileName string
}

// Windows Firewall rule entry
// https://docs.microsoft.com/en-us/previous-versions/windows/desktop/wfascimprov/msft-netfirewallrule
windows.firewall.rule {
  // A string that uniquely identifies this instance within the PolicyStore
  instanceID string
  // Name of the rule
  name string
  // Localized name of this rule
  displayName string
  // Brief description of the rule
  description string
  // The group that this rule belongs to
  displayGroup string
  // Indicates whether this rule is administratively enabled or disabled
  // values: enabled (1), disabled (2)
  enabled int
  // Specifies which direction of traffic to match with this rule
  // values: inbound (1), outbound (2)
  direction int
  // Specifies the action to take on traffic that matches this rule
  action int
  // Specifies how this firewall rule will handle edge traversal cases
  // values: block (0), allow (1), defer to user (2), defer to app (3)
  edgeTraversalPolicy int
  // Whether to group UDP packets into conversations based upon the local address, local port, and remote port
  looseSourceMapping bool
  // Whether to group UDP packets into conversations based only upon the local address and port
  localOnlyMapping bool
  // PrimaryStatus provides a high level status value
  // values: unknown (0), ok (1), degraded (2), error (3)
  primaryStatus int
  // Detailed status of the rule
  status string
  // If this object is retrieved from the ActiveStore
  enforcementStatus string
  // Contains the path to the policy store where this rule originally came from
  policyStoreSource string
  // Describes the type of policy store where this rule originally came from
  policyStoreSourceType int
}

// Windows BitLocker
windows.bitlocker {
  volumes() []windows.bitlocker.volume
}

// Windows BitLocker volume
windows.bitlocker.volume {
  // Unique identifier for the volume
  deviceID string
  // Drive letter of the volume
  driveLetter string
  // Indicates the status of the encryption or decryption on the volume
  conversionStatus dict
  // Encryption algorithm and key size used on the volume
  encryptionMethod dict
  // Indicates whether the contents of the volume are accessible from Windows
  // 0 = full contents of the volume are accessible
  // 1 = all or a portion of the contents of the volume are not accessible
  lockStatus int
  // Persistent identifier for the volume on this system
  persistentVolumeID string
  // Status of the volume, whether or not BitLocker is protecting the volume
  // 0 = Protection Off
  // 1 = Protection On
  // 2 = Protection Unknown
  protectionStatus dict
  // BitLocker Full Volume Encryption metadata version of the volume
  version dict
}

windows.security {
  products() []windows.security.product
}

private windows.security.product {
  type string
  guid string
  name string
  state int
  productState string
  signatureState string
  timestamp time
}

// Returns the health for Windows security provider
windows.security.health {
  firewall dict
  autoUpdate dict
  antiVirus dict
  antiSpyware dict
  internetSettings dict
  uac dict
  securityCenterService dict
}