generated: '2026-09-19'
method: derived
source: components.schemas $ref links and *_uuid/*_id fields in openapi/airmdr-case-manager-openapi.yml + openapi/airmdr-user-management-service-openapi.yml
entity_count: 533
relationship_count: 934
core_entities:
- Case
- CaseDetails
- Webhook
- Organization
- User
- Evidence
- CaseActivity
- CaseTimeline
- SecurityReport
- Permission
identifiers:
  case: case_uuid (UUID) or case_id / case_identifier (human ID, ORG-CODE-<n>, e.g. ASO-13812)
  alert: alert_uuid (UUID) + alert_id (ORG-PROVIDER-<seq>, e.g. ASO-AWS-129)
  organization: organization_uuid + organization_code (short code, e.g. ASO) + organization_identifier
  user: user_id (UUID; also sent as the User-ID request header)
  webhook: webhook_id + secret (both in the ingest URL path)
domains:
  cases: Case, CaseDetails, CaseView, CaseFilter, CaseSort, CaseActivity, CaseTimeline, comments, attachments, findings/evidence,
    history + named versions, watchers, saved views, custom fields
  alerts: AlertContent, alert types, alert catalog, alert skip list, alert budget, MITRE tactics, Webhook
  analytics: Dashboard, widgets, schedules, SOC/executive metrics, Security Review reports, Query DSL
  identity: 'Organization (+ configuration: investigation depth, credits, features, RBAC templates, SSO, Metabase), User,
    User Group, Session, API Token, Permission'
entities:
- name: 403Error
  spec: user-management-service
  fields: 1
- name: AccessibleOrganizationsFilterRequest
  spec: user-management-service
  fields: 1
- name: AccessibleOrganizationsRequest
  spec: user-management-service
  fields: 3
- name: ActionExecutionDetails
  spec: case-manager
  fields: 4
- name: AddCaseDetailFieldsRequest
  spec: case-manager
  fields: 17
- name: AddCaseFindingRequest
  spec: case-manager
  fields: 10
- name: AddCaseFindingResponse
  spec: case-manager
  fields: 2
- name: AddMitreTacticsRequest
  spec: case-manager
  fields: 1
- name: AddMitreTacticsResponse
  spec: case-manager
  fields: 2
- name: Adornments
  spec: user-management-service
  fields: 3
- name: AdrTriageCount
  spec: case-manager
  fields: 3
- name: AdrTriageDailyBreakdown
  spec: case-manager
  fields: 4
- name: AggregateRequest
  spec: case-manager
  fields: 3
- name: AirMDRFeature
  spec: user-management-service
  fields: 3
- name: AlertBudgetOverviewResponse
  spec: case-manager
  fields: 9
- name: AlertBudgetOverviewRow
  spec: case-manager
  fields: 9
- name: AlertBudgetTotals
  spec: case-manager
  fields: 3
- name: AlertCatalogCaseSummary
  spec: case-manager
  fields: 11
- name: AlertCatalogData
  spec: case-manager
  fields: 4
- name: AlertCatalogExecutionHistory
  spec: case-manager
  fields: 9
- name: AlertCatalogMetaData
  spec: case-manager
  fields: 6
- name: AlertMinimal
  spec: case-manager
  fields: 27
- name: AlertSkipItem
  spec: case-manager
  fields: 2
- name: AlertSkipLifecycleRequest
  spec: case-manager
  fields: 3
- name: AlertSkipListResponse
  spec: case-manager
  fields: 10
- name: AlertSkipRow
  spec: case-manager
  fields: 8
- name: AlertSkipSummary
  spec: case-manager
  fields: 4
- name: AlertSourceCount
  spec: case-manager
  fields: 2
- name: AlertTypeCount
  spec: case-manager
  fields: 4
- name: AlertTypeFrequency
  spec: case-manager
  fields: 3
- name: AlertTypeInvestigationConfig
  spec: user-management-service
  fields: 2
- name: AlertTypeWithProperties
  spec: case-manager
  fields: 5
- name: AlertsIOC
  spec: case-manager
  fields: 7
- name: AnalystPerformance
  spec: case-manager
  fields: 3
- name: AnalyzeAlertRequest
  spec: case-manager
  fields: 1
- name: AnalyzeAlertResponse
  spec: case-manager
  fields: 4
- name: ArchiveCasesRequest
  spec: case-manager
  fields: 2
- name: ArchiveCasesResponse
  spec: case-manager
  fields: 2
- name: AssigneeDetails
  spec: case-manager
  fields: 7
- name: AttackTypeCount
  spec: case-manager
  fields: 2
- name: AuthenticateRequest
  spec: user-management-service
  fields: 2
- name: AuthenticateUserData
  spec: user-management-service
  fields: 9
- name: AuthenticateUserResponse
  spec: user-management-service
  fields: 2
- name: AutomationWidgets
  spec: case-manager
  fields: 2
- name: BlockedByCategoryCount
  spec: case-manager
  fields: 5
- name: BriefingSummary
  spec: case-manager
  fields: 6
- name: BulkCreateDashboardScheduleRequest
  spec: case-manager
  fields: 1
- name: BulkDashboardScheduleResponse
  spec: case-manager
  fields: 1
- name: BulkDeleteAlertsRequest
  spec: case-manager
  fields: 1
- name: BulkDeleteAlertsResponse
  spec: case-manager
  fields: 2
- name: BulkDeleteCasesRequest
  spec: case-manager
  fields: 1
- name: BulkDeleteCasesResponse
  spec: case-manager
  fields: 2
- name: BulkDeleteDashboardScheduleRequest
  spec: case-manager
  fields: 1
- name: BulkUpdateDashboardScheduleRequest
  spec: case-manager
  fields: 1
- name: BusinessHoursBreakdown
  spec: case-manager
  fields: 4
- name: Case
  spec: case-manager
  fields: 12
- name: CaseAction
  spec: case-manager
  fields: 21
- name: CaseActionCount
  spec: case-manager
  fields: 2
- name: CaseActionListItem
  spec: case-manager
  fields: 27
- name: CaseActionsDateRange
  spec: case-manager
  fields: 2
- name: CaseActionsFilter
  spec: case-manager
  fields: 12
- name: CaseActionsFilterAssigneeListItem
  spec: case-manager
  fields: 2
- name: CaseActionsRequest
  spec: case-manager
  fields: 3
- name: CaseActionsResponse
  spec: case-manager
  fields: 3
- name: CaseActionsSort
  spec: case-manager
  fields: 2
- name: CaseActivity
  spec: case-manager
  fields: 4
- name: CaseAnalyticsDashboardData
  spec: case-manager
  fields: 9
- name: CaseAnalyticsDashboardResponse
  spec: case-manager
  fields: 2
- name: CaseAnalyticsEmailRequest
  spec: case-manager
  fields: 3
- name: CaseAnalyticsEmailRequestFilter
  spec: case-manager
  fields: 4
- name: CaseAnalyticsEmailResponse
  spec: case-manager
  fields: 1
- name: CaseAttachment
  spec: case-manager
  fields: 14
- name: CaseCategory
  spec: user-management-service
  fields: 2
- name: CaseComment
  spec: case-manager
  fields: 11
- name: CaseCommentsListResponse
  spec: case-manager
  fields: 3
- name: CaseConfidence
  spec: case-manager
  fields: 4
- name: CaseCustomFieldValue
  spec: case-manager
  fields: 3
- name: CaseDetailFields
  spec: case-manager
  fields: 22
- name: CaseDetails
  spec: case-manager
  fields: 25
- name: CaseDetailsV2
  spec: case-manager
  fields: 46
- name: CaseExecutionDetails
  spec: case-manager
  fields: 7
- name: CaseFactSummary
  spec: case-manager
  fields: 3
- name: CaseFeature
  spec: user-management-service
  fields: 1
- name: CaseFilter
  spec: case-manager
  fields: 13
- name: CaseFilterV2
  spec: case-manager
  fields: 27
- name: CaseFinding
  spec: case-manager
  fields: 10
- name: CaseHistoryResponse
  spec: case-manager
  fields: 3
- name: CaseLinkRequest
  spec: case-manager
  fields: 1
- name: CaseListRequest
  spec: case-manager
  fields: 4
- name: CaseListRequestV2
  spec: case-manager
  fields: 6
- name: CaseListResponse
  spec: case-manager
  fields: 3
- name: CaseListResponseV2
  spec: case-manager
  fields: 6
- name: CaseListSummary
  spec: case-manager
  fields: 3
- name: CaseMetrics
  spec: case-manager
  fields: 11
- name: CaseMetricsLLMSummary
  spec: case-manager
  fields: 6
- name: CaseMetricsResponse
  spec: case-manager
  fields: 2
- name: CaseMetricsSummaryResponse
  spec: case-manager
  fields: 2
- name: CaseNamedVersion
  spec: case-manager
  fields: 5
- name: CaseNamedVersionNameRequest
  spec: case-manager
  fields: 1
- name: CaseNamedVersionResponse
  spec: case-manager
  fields: 2
- name: CasePriorityConfig
  spec: user-management-service
  fields: 2
- name: CaseReindexRequest
  spec: case-manager
  fields: 1
- name: CaseResponseData
  spec: case-manager
  fields: 2
- name: CaseReviewMetrics
  spec: case-manager
  fields: 11
- name: CaseScore
  spec: case-manager
  fields: 6
- name: CaseScoreMinimal
  spec: case-manager
  fields: 2
- name: CaseScoreSummary
  spec: case-manager
  fields: 10
- name: CaseSort
  spec: case-manager
  fields: 2
- name: CaseStructuredData
  spec: case-manager
  fields: 4
- name: CaseSubCategory
  spec: user-management-service
  fields: 1
- name: CaseSummaryField
  spec: case-manager
  fields: 12
- name: CaseTimeline
  spec: case-manager
  fields: 8
- name: CaseTimelineMetrics
  spec: case-manager
  fields: 4
- name: CaseV2
  spec: case-manager
  fields: 29
- name: CaseWatchers
  spec: case-manager
  fields: 6
- name: CaseWatchersResponse
  spec: case-manager
  fields: 2
- name: CategoryCount
  spec: case-manager
  fields: 2
- name: CategoryFilter
  spec: case-manager
  fields: 2
- name: CausalityGraph
  spec: case-manager
  fields: 4
- name: CausalityGraphEdge
  spec: case-manager
  fields: 3
- name: CausalityGraphNode
  spec: case-manager
  fields: 3
- name: ChangeLog
  spec: case-manager
  fields: 10
- name: ChangePasswordRequest
  spec: user-management-service
  fields: 2
- name: ChargeInvestigationCreditsRequest
  spec: case-manager
  fields: 5
- name: ChargeInvestigationCreditsResponse
  spec: case-manager
  fields: 7
- name: ChatSessionDetail
  spec: case-manager
  fields: 5
- name: ChildVisibility
  spec: user-management-service
  fields: 1
- name: ChildVisibilityPermissions
  spec: user-management-service
  fields: 1
- name: CloneCaseRequest
  spec: case-manager
  fields: 6
- name: CloneCaseResponse
  spec: case-manager
  fields: 2
- name: CollectionSchema
  spec: case-manager
  fields: 3
- name: CommentSource
  spec: case-manager
  fields: 2
- name: CommunicationByDisposition
  spec: case-manager
  fields: 4
- name: CommunicationBySeverity
  spec: case-manager
  fields: 4
- name: ConcernedIOC
  spec: case-manager
  fields: 2
- name: ConclusionOverview
  spec: case-manager
  fields: 2
- name: ConnectionCountSummary
  spec: case-manager
  fields: 5
- name: ConnectionDetails
  spec: case-manager
  fields: 2
- name: ConsistencyWidgets
  spec: case-manager
  fields: 1
- name: CostTrimAnalysisResponse
  spec: case-manager
  fields: 7
- name: CostTrimEscalationsByTypeRow
  spec: case-manager
  fields: 2
- name: CostTrimRollupBase
  spec: case-manager
  fields: 6
- name: CostTrimSnapshotRow
  spec: case-manager
  fields: 14
- name: CostTrimTotals
  spec: case-manager
  fields: 4
- name: CreateAPITokenForSlackWorkflowRequest
  spec: user-management-service
  fields: 2
- name: CreateAPITokenForSlackWorkflowResponse
  spec: user-management-service
  fields: 2
- name: CreateAPITokenResponse
  spec: user-management-service
  fields: 5
- name: CreateAlertFromWebhookResponse
  spec: case-manager
  fields: 1
- name: CreateAlertsRequest
  spec: case-manager
  fields: 12
- name: CreateCaseDecisionMetricsRequest
  spec: case-manager
  fields: 4
- name: CreateCaseExecutionMetricsRequest
  spec: case-manager
  fields: 3
- name: CreateCaseRequest
  spec: case-manager
  fields: 19
- name: CreateCaseRequestV2
  spec: case-manager
  fields: 30
- name: CreateCaseResponse
  spec: case-manager
  fields: 2
- name: CreateCaseResponseV2
  spec: case-manager
  fields: 2
- name: CreateCustomCaseFieldRequest
  spec: case-manager
  fields: 4
- name: CreateDashboardRequest
  spec: case-manager
  fields: 4
- name: CreateDashboardScheduleRequest
  spec: case-manager
  fields: 6
- name: CreateOrganizationRequest
  spec: user-management-service
  fields: 17
- name: CreateSavedViewRequest
  spec: case-manager
  fields: 7
- name: CreateScoringGuidelinesRequest
  spec: case-manager
  fields: 4
- name: CreateScoringGuidelinesResponse
  spec: case-manager
  fields: 2
- name: CreateUserGroupRequest
  spec: user-management-service
  fields: 8
- name: CreateUserRequest
  spec: user-management-service
  fields: 7
- name: CreateUserResponse
  spec: user-management-service
  fields: 2
- name: CreateWebhookRequest
  spec: case-manager
  fields: 3
- name: CreateWidgetRequest
  spec: case-manager
  fields: 7
- name: CreateWidgetResponse
  spec: case-manager
  fields: 11
- name: CreateWidgetsRequest
  spec: case-manager
  fields: 1
- name: CreateWidgetsResponse
  spec: case-manager
  fields: 1
- name: CreditContext
  spec: user-management-service
  fields: 7
- name: CreditUsageEntry
  spec: case-manager
  fields: 7
- name: CustomField
  spec: case-manager
  fields: 9
- name: CustomFieldValue
  spec: case-manager
  fields: 2
- name: CustomQuestion
  spec: case-manager
  fields: 6
- name: CustomerExperienceWidgets
  spec: case-manager
  fields: 4
- name: DailyCount
  spec: case-manager
  fields: 2
- name: DailyMetrics
  spec: case-manager
  fields: 2
- name: DashboardChartConfigData
  spec: case-manager
  fields: 2
- name: DashboardChartConfigResponse
  spec: case-manager
  fields: 2
- name: DashboardSchedule
  spec: case-manager
  fields: 12
- name: DashboardScheduleExecution
  spec: case-manager
  fields: 12
- name: DashboardScheduleResult
  spec: case-manager
  fields: 4
- name: DashboardSummary
  spec: case-manager
  fields: 9
- name: DataSourceHealthSummary
  spec: case-manager
  fields: 3
- name: DecisionIoc
  spec: case-manager
  fields: 4
- name: DeleteCaseFindingResponse
  spec: case-manager
  fields: 2
- name: DeleteOrganizationResponse
  spec: user-management-service
  fields: 1
- name: DeleteReportWatcherRequest
  spec: case-manager
  fields: 2
- name: DeleteUserGroupResponse
  spec: user-management-service
  fields: 1
- name: DeleteUsersResponse
  spec: user-management-service
  fields: 1
- name: DetailedMetrics
  spec: case-manager
  fields: 4
- name: DetectionWidgets
  spec: case-manager
  fields: 5
- name: DisabledPermission
  spec: user-management-service
  fields: 2
- name: DispositionEscalationWidgets
  spec: case-manager
  fields: 3
- name: EmailCaseDetailsRequest
  spec: case-manager
  fields: 6
- name: EmailCaseDetailsResponse
  spec: case-manager
  fields: 2
- name: EmailCaseFindingDetailsRequest
  spec: case-manager
  fields: 3
- name: EmailCaseFindingDetailsResponse
  spec: case-manager
  fields: 2
- name: EmailCustomDashboardRequest
  spec: case-manager
  fields: 3
- name: EmailCustomDashboardResponse
  spec: case-manager
  fields: 1
- name: EmailSecurityReportRequest
  spec: case-manager
  fields: 2
- name: EmergingThreat
  spec: case-manager
  fields: 4
- name: Entity
  spec: case-manager
  fields: 10
- name: EntityAccess
  spec: user-management-service
  fields: 4
- name: EntityCount
  spec: case-manager
  fields: 3
- name: EntityFilter
  spec: case-manager
  fields: 2
- name: EntityFilterItem
  spec: case-manager
  fields: 2
- name: EntityRisk
  spec: case-manager
  fields: 3
- name: EnumOption
  spec: user-management-service
  fields: 3
- name: Error
  spec: user-management-service
  fields: 1
- name: Escalation
  spec: case-manager
  fields: 7
- name: EscalationBreakdown
  spec: case-manager
  fields: 4
- name: Event
  spec: case-manager
  fields: 11
- name: Evidence
  spec: case-manager
  fields: 5
- name: ExecutionSummary
  spec: case-manager
  fields: 3
- name: ExecutiveDashboardData
  spec: case-manager
  fields: 11
- name: ExecutiveDashboardResponse
  spec: case-manager
  fields: 2
- name: ExploreDeeperQuestion
  spec: case-manager
  fields: 9
- name: FPBenignSummary
  spec: case-manager
  fields: 2
- name: Faq
  spec: case-manager
  fields: 4
- name: FeaturePermission
  spec: user-management-service
  fields: 3
- name: FetchAllPermissionsResponse
  spec: user-management-service
  fields: 2
- name: FetchAllUsersResponse
  spec: user-management-service
  fields: 3
- name: FetchDisabledPermissionsResponse
  spec: user-management-service
  fields: 2
- name: FetchUserResponse
  spec: user-management-service
  fields: 2
- name: FieldChange
  spec: case-manager
  fields: 4
- name: FieldSchema
  spec: case-manager
  fields: 5
- name: FileDetails
  spec: user-management-service
  fields: 1
- name: FilterFeaturePermissionsRequest
  spec: user-management-service
  fields: 3
- name: FilterFeaturePermissionsResponse
  spec: user-management-service
  fields: 3
- name: FilterLoggedInUsersRequest
  spec: user-management-service
  fields: 1
- name: FilterOrganizationListResponse
  spec: user-management-service
  fields: 2
- name: FilterOrganizationRBACRequest
  spec: user-management-service
  fields: 3
- name: FilterOrganizationRequest
  spec: user-management-service
  fields: 7
- name: FilterUserGroupRequest
  spec: user-management-service
  fields: 2
- name: FilterUserRequest
  spec: user-management-service
  fields: 2
- name: ForcePasswordResetRequest
  spec: user-management-service
  fields: 1
- name: ForgetPasswordRequest
  spec: user-management-service
  fields: 2
- name: ForgotPasswordData
  spec: user-management-service
  fields: 1
- name: ForgotPasswordResponse
  spec: user-management-service
  fields: 2
- name: GenerateAlertUsingLLMRequest
  spec: case-manager
  fields: 3
- name: GenerateBulkCaseScoresRequest
  spec: case-manager
  fields: 1
- name: GenerateBulkCaseScoresResponse
  spec: case-manager
  fields: 2
- name: GenerateCaseScoreRequest
  spec: case-manager
  fields: 1
- name: GenerateCaseScoreResponse
  spec: case-manager
  fields: 2
- name: GenerateSecurityReportRequest
  spec: case-manager
  fields: 3
- name: GenerateSecurityReportResponse
  spec: case-manager
  fields: 2
- name: GeoInfo
  spec: case-manager
  fields: 11
- name: GetAPITokenResponse
  spec: user-management-service
  fields: 7
- name: GetAlertCatalogByExecutionIdResponse
  spec: case-manager
  fields: 2
- name: GetAlertCatalogExecutionHistoryResponse
  spec: case-manager
  fields: 3
- name: GetAlertCatalogResponse
  spec: case-manager
  fields: 3
- name: GetAlertResponse
  spec: case-manager
  fields: 33
- name: GetCaseConfigurationRequest
  spec: case-manager
  fields: 1
- name: GetCaseConfigurationResponse
  spec: case-manager
  fields: 2
- name: GetCaseDecisionMetrics
  spec: case-manager
  fields: 7
- name: GetCaseExecutionMetricsResponse
  spec: case-manager
  fields: 2
- name: GetCaseInAlertCatalogResponse
  spec: case-manager
  fields: 4
- name: GetCaseResponse
  spec: case-manager
  fields: 2
- name: GetCaseResponseV2
  spec: case-manager
  fields: 2
- name: GetCaseScoreResponse
  spec: case-manager
  fields: 2
- name: GetCustomCaseFieldValuesResponse
  spec: case-manager
  fields: 3
- name: GetCustomCaseFieldsRequest
  spec: case-manager
  fields: 2
- name: GetCustomCaseFieldsResponse
  spec: case-manager
  fields: 3
- name: GetDashboardResponse
  spec: case-manager
  fields: 7
- name: GetDetailedMetricsRequest
  spec: case-manager
  fields: 2
- name: GetDetailedMetricsResponse
  spec: case-manager
  fields: 2
- name: GetEvidenceResponse
  spec: case-manager
  fields: 2
- name: GetExecutionLogResponse
  spec: case-manager
  fields: 18
- name: GetLoginUrlRequest
  spec: user-management-service
  fields: 2
- name: GetLoginUrlResponse
  spec: user-management-service
  fields: 2
- name: GetMetabaseSessionResponse
  spec: user-management-service
  fields: 1
- name: GetOrganizationCreditContextResponse
  spec: user-management-service
  fields: 2
- name: GetOrganizationFeaturesResponse
  spec: user-management-service
  fields: 2
- name: GetOrganizationInternalResponse
  spec: user-management-service
  fields: 2
- name: GetOrganizationInvestigationConfigurationResponse
  spec: user-management-service
  fields: 2
- name: GetOrganizationListResponse
  spec: user-management-service
  fields: 2
- name: GetOrganizationRBACTemplateResponse
  spec: user-management-service
  fields: 2
- name: GetOrganizationResponse
  spec: user-management-service
  fields: 2
- name: GetScoringGuidelinesResponse
  spec: case-manager
  fields: 2
- name: GetSecurityReportResponse
  spec: case-manager
  fields: 2
- name: GetUserGroupResponse
  spec: user-management-service
  fields: 2
- name: HiddenDashboardWidgets
  spec: case-manager
  fields: 2
- name: HostWidgets
  spec: case-manager
  fields: 3
- name: HourCount
  spec: case-manager
  fields: 2
- name: IOCData
  spec: case-manager
  fields: 3
- name: IOCScore
  spec: case-manager
  fields: 4
- name: InvestigateAlertResponse
  spec: case-manager
  fields: 2
- name: InvestigationCreditUsageResponse
  spec: case-manager
  fields: 2
- name: InvestigationCreditsResponse
  spec: case-manager
  fields: 6
- name: InvestigationQualityWidgets
  spec: case-manager
  fields: 5
- name: InvestigationQuotaResponse
  spec: case-manager
  fields: 4
- name: InvestigationTierListResponse
  spec: case-manager
  fields: 1
- name: InvestigationTierRow
  spec: case-manager
  fields: 9
- name: KpiWidgets
  spec: case-manager
  fields: 4
- name: LayoutSectionItem
  spec: case-manager
  fields: 4
- name: LayoutWidgetItem
  spec: case-manager
  fields: 3
- name: LinkedAlertSource
  spec: case-manager
  fields: 5
- name: LinkedCaseSummary
  spec: case-manager
  fields: 7
- name: ListAPITokensResponse
  spec: user-management-service
  fields: 3
- name: ListAlertCatalogProvidersResponse
  spec: case-manager
  fields: 3
- name: ListAlertCatalogTypesFilter
  spec: case-manager
  fields: 2
- name: ListAlertCatalogTypesRequest
  spec: case-manager
  fields: 2
- name: ListAlertCatalogTypesResponse
  spec: case-manager
  fields: 3
- name: ListAlertTypesByProvidersRequest
  spec: case-manager
  fields: 2
- name: ListAlertTypesFilter
  spec: case-manager
  fields: 1
- name: ListAlertTypesRequest
  spec: case-manager
  fields: 1
- name: ListAlertTypesWithPropertiesResponse
  spec: case-manager
  fields: 3
- name: ListAlertsFilter
  spec: case-manager
  fields: 16
- name: ListAlertsRequest
  spec: case-manager
  fields: 3
- name: ListAlertsResponse
  spec: case-manager
  fields: 2
- name: ListCaseAttachmentsResponse
  spec: case-manager
  fields: 3
- name: ListCaseCommentsRequest
  spec: case-manager
  fields: 2
- name: ListCaseCommentsResponse
  spec: case-manager
  fields: 3
- name: ListCaseNamedVersionsResponse
  spec: case-manager
  fields: 3
- name: ListCaseScoresRequest
  spec: case-manager
  fields: 2
- name: ListCaseScoresResponse
  spec: case-manager
  fields: 3
- name: ListDashboardScheduleExecutionsRequest
  spec: case-manager
  fields: 8
- name: ListDashboardScheduleExecutionsResponse
  spec: case-manager
  fields: 2
- name: ListDashboardSchedulesResponse
  spec: case-manager
  fields: 2
- name: ListDashboardsResponse
  spec: case-manager
  fields: 1
- name: ListMitreTacticsResponse
  spec: case-manager
  fields: 3
- name: ListOrganizationRBACPermissionsResponse
  spec: user-management-service
  fields: 2
- name: ListOrganizationRBACTemplateResponse
  spec: user-management-service
  fields: 2
- name: ListReportWatchersResponse
  spec: case-manager
  fields: 3
- name: ListSavedViewsResponse
  spec: case-manager
  fields: 2
- name: ListSecurityReportsRequest
  spec: case-manager
  fields: 2
- name: ListSecurityReportsResponse
  spec: case-manager
  fields: 3
- name: ListSystemWidgetsResponse
  spec: case-manager
  fields: 1
- name: ListUserFilter
  spec: user-management-service
  fields: 12
- name: ListUserGroupFilter
  spec: user-management-service
  fields: 10
- name: ListUserGroupResponse
  spec: user-management-service
  fields: 3
- name: ListWebhooksResponse
  spec: case-manager
  fields: 1
- name: LoginRequest
  spec: user-management-service
  fields: 2
- name: LoginUrl
  spec: user-management-service
  fields: 4
- name: LoginUser
  spec: user-management-service
  fields: 14
- name: LoginUserData
  spec: user-management-service
  fields: 3
- name: LoginUserResponse
  spec: user-management-service
  fields: 2
- name: LogoDetails
  spec: user-management-service
  fields: 1
- name: MetabaseDashboard
  spec: user-management-service
  fields: 2
- name: MetricsAttributes
  spec: case-manager
  fields: 3
- name: MissingTelemetryCount
  spec: case-manager
  fields: 2
- name: MttiComparisonPoint
  spec: case-manager
  fields: 2
- name: MultiVectorHost
  spec: case-manager
  fields: 3
- name: MultiVectorUser
  spec: case-manager
  fields: 3
- name: NetworkWidgets
  spec: case-manager
  fields: 5
- name: NumberRange
  spec: case-manager
  fields: 2
- name: OperationalGapsWidgets
  spec: case-manager
  fields: 2
- name: OrgRBACPermissions
  spec: user-management-service
  fields: 3
- name: OrgVisibility
  spec: user-management-service
  fields: 1
- name: OrgVisibilityPermissions
  spec: user-management-service
  fields: 1
- name: Organization
  spec: user-management-service
  fields: 20
- name: OrganizationCaseConfiguration
  spec: user-management-service
  fields: 10
- name: OrganizationCaseConfigurationResponse
  spec: case-manager
  fields: 2
- name: OrganizationConfiguration
  spec: user-management-service
  fields: 6
- name: OrganizationDarrylConfiguration
  spec: user-management-service
  fields: 4
- name: OrganizationDarrylConfigurationRequest
  spec: user-management-service
  fields: 3
- name: OrganizationFeature
  spec: user-management-service
  fields: 6
- name: OrganizationInvestigationConfiguration
  spec: user-management-service
  fields: 8
- name: OrganizationMetabaseConfiguration
  spec: user-management-service
  fields: 2
- name: OrganizationMinimal
  spec: user-management-service
  fields: 5
- name: OrganizationMinimalWithUserGroupConfig
  spec: user-management-service
  fields: 5
- name: OrganizationRBACConfiguration
  spec: user-management-service
  fields: 4
- name: OrganizationRBACMovementAllowList
  spec: user-management-service
  fields: 2
- name: OrganizationRBACMovementResponse
  spec: user-management-service
  fields: 2
- name: OrganizationRBACTemplate
  spec: user-management-service
  fields: 5
- name: OrganizationSSOConfiguration
  spec: user-management-service
  fields: 6
- name: OutlierCase
  spec: case-manager
  fields: 7
- name: ParentVisibility
  spec: user-management-service
  fields: 2
- name: ParentVisibilityPermissions
  spec: user-management-service
  fields: 2
- name: PercentileMetric
  spec: case-manager
  fields: 3
- name: PeriodMetric
  spec: case-manager
  fields: 3
- name: Permission
  spec: user-management-service
  fields: 3
- name: PermissionAccess
  spec: user-management-service
  fields: 2
- name: PlaybookExecutionSource
  spec: case-manager
  fields: 5
- name: PrintConfig
  spec: case-manager
  fields: 3
- name: PriorityConfig
  spec: user-management-service
  fields: 3
- name: ProviderDetails
  spec: case-manager
  fields: 3
- name: ProviderEscalationCount
  spec: case-manager
  fields: 5
- name: ProviderInvestigationConfig
  spec: user-management-service
  fields: 3
- name: ProviderList
  spec: case-manager
  fields: 2
- name: ProviderSummary
  spec: case-manager
  fields: 4
- name: QualityScoreDailyPoint
  spec: case-manager
  fields: 4
- name: QueryErrorResponse
  spec: case-manager
  fields: 2
- name: QueryExecuteRequest
  spec: case-manager
  fields: 7
- name: QueryExecuteResponse
  spec: case-manager
  fields: 5
- name: QuerySchemaResponse
  spec: case-manager
  fields: 1
- name: QueryValidateRequest
  spec: case-manager
  fields: 7
- name: QueryValidateResponse
  spec: case-manager
  fields: 2
- name: QueryValidationError
  spec: case-manager
  fields: 2
- name: QuestionsAnsweredByCategory
  spec: case-manager
  fields: 3
- name: QuestionsAnsweredByOutcome
  spec: case-manager
  fields: 3
- name: QuestionsAnsweredSplit
  spec: case-manager
  fields: 3
- name: RecentMaliciousCase
  spec: case-manager
  fields: 9
- name: RefundInvestigationCreditsRequest
  spec: case-manager
  fields: 1
- name: RefundInvestigationCreditsResponse
  spec: case-manager
  fields: 1
- name: RegisterTrialRequest
  spec: user-management-service
  fields: 2
- name: RegisterTrialResponse
  spec: user-management-service
  fields: 2
- name: Relationship
  spec: case-manager
  fields: 9
- name: RemediationWidgets
  spec: case-manager
  fields: 2
- name: ReportWatcher
  spec: case-manager
  fields: 3
- name: RequestDemoResponse
  spec: case-manager
  fields: 2
- name: ResponseRemediationWidgets
  spec: case-manager
  fields: 3
- name: ResponseTimeMetric
  spec: case-manager
  fields: 4
- name: ResponseTimePercentiles
  spec: case-manager
  fields: 4
- name: ResponseTimePoint
  spec: case-manager
  fields: 2
- name: ReworkDailyPoint
  spec: case-manager
  fields: 4
- name: RiskAssessment
  spec: case-manager
  fields: 3
- name: SavedView
  spec: case-manager
  fields: 13
- name: SavedViewResponse
  spec: case-manager
  fields: 2
- name: ScheduleRecurrence
  spec: case-manager
  fields: 5
- name: ScoringGuidelines
  spec: case-manager
  fields: 8
- name: SectionSetting
  spec: case-manager
  fields: 3
- name: SecurityReport
  spec: case-manager
  fields: 11
- name: SecurityReportSummary
  spec: case-manager
  fields: 9
- name: SecurityReviewCaseDispositionMetrics
  spec: case-manager
  fields: 4
- name: SecurityReviewDataSourceStatus
  spec: case-manager
  fields: 3
- name: SecurityReviewDataSources
  spec: case-manager
  fields: 2
- name: SecurityReviewEscalation
  spec: case-manager
  fields: 1
- name: SecurityReviewImprovement
  spec: case-manager
  fields: 3
- name: SecurityReviewKPIs
  spec: case-manager
  fields: 7
- name: SecurityReviewPeriodComparison
  spec: case-manager
  fields: 5
- name: SecurityReviewReport
  spec: case-manager
  fields: 13
- name: SecurityReviewSeverityMetrics
  spec: case-manager
  fields: 4
- name: SetPasswordData
  spec: user-management-service
  fields: 1
- name: SetPasswordRequest
  spec: user-management-service
  fields: 4
- name: SetPasswordResponse
  spec: user-management-service
  fields: 2
- name: SeverityCount
  spec: case-manager
  fields: 3
- name: SeverityMetrics
  spec: case-manager
  fields: 2
- name: SkillExecutionOutput
  spec: case-manager
  fields: 5
- name: SlaAdherenceResult
  spec: case-manager
  fields: 5
- name: SlaAdherenceTrendPoint
  spec: case-manager
  fields: 4
- name: SlaConfig
  spec: case-manager
  fields: 3
- name: SocEmailRequest
  spec: case-manager
  fields: 3
- name: SocEmailRequestFilter
  spec: case-manager
  fields: 4
- name: SocEmailResponse
  spec: case-manager
  fields: 1
- name: SocPerformanceDashboardData
  spec: case-manager
  fields: 9
- name: SocPerformanceDashboardResponse
  spec: case-manager
  fields: 2
- name: SortFields
  spec: user-management-service
  fields: 2
- name: SpeedSlaWidgets
  spec: case-manager
  fields: 10
- name: StyleConfig
  spec: user-management-service
  fields: 15
- name: Success
  spec: user-management-service
  fields: 1
- name: SystemWidget
  spec: case-manager
  fields: 4
- name: SystemWidgetSelection
  spec: case-manager
  fields: 5
- name: ThreatCategorizationWidgets
  spec: case-manager
  fields: 3
- name: ThroughputWidgets
  spec: case-manager
  fields: 6
- name: TimeRange
  spec: case-manager
  fields: 2
- name: TrendWidgets
  spec: case-manager
  fields: 3
- name: UpdateAlertRequest
  spec: case-manager
  fields: 11
- name: UpdateCaseConfigurationRequest
  spec: case-manager
  fields: 2
- name: UpdateCaseConfigurationResponse
  spec: case-manager
  fields: 2
- name: UpdateCaseDecisionMetricsRequest
  spec: case-manager
  fields: 3
- name: UpdateCaseDetailFieldsRequest
  spec: case-manager
  fields: 18
- name: UpdateCaseFindingRequest
  spec: case-manager
  fields: 8
- name: UpdateCaseFindingResponse
  spec: case-manager
  fields: 2
- name: UpdateCaseRequest
  spec: case-manager
  fields: 15
- name: UpdateCaseRequestV2
  spec: case-manager
  fields: 30
- name: UpdateCaseResponse
  spec: case-manager
  fields: 2
- name: UpdateCaseResponseV2
  spec: case-manager
  fields: 2
- name: UpdateCaseStructuredData
  spec: case-manager
  fields: 4
- name: UpdateConfidenceRequest
  spec: case-manager
  fields: 4
- name: UpdateCustomCaseFieldRequest
  spec: case-manager
  fields: 1
- name: UpdateDashboardRequest
  spec: case-manager
  fields: 4
- name: UpdateDashboardResponse
  spec: case-manager
  fields: 5
- name: UpdateDashboardScheduleRequest
  spec: case-manager
  fields: 5
- name: UpdateInvestigationTierItem
  spec: case-manager
  fields: 3
- name: UpdateInvestigationTiersRequest
  spec: case-manager
  fields: 2
- name: UpdateOrganizationFeatureItem
  spec: user-management-service
  fields: 2
- name: UpdateOrganizationFeaturesRequest
  spec: user-management-service
  fields: 1
- name: UpdateOrganizationFeaturesResponse
  spec: user-management-service
  fields: 2
- name: UpdateOrganizationInvestigationConfigurationRequest
  spec: user-management-service
  fields: 8
- name: UpdateOrganizationRequest
  spec: user-management-service
  fields: 12
- name: UpdateOrganizationResponse
  spec: user-management-service
  fields: 2
- name: UpdateSavedViewRequest
  spec: case-manager
  fields: 6
- name: UpdateScoringGuidelinesRequest
  spec: case-manager
  fields: 4
- name: UpdateSecurityReportRequest
  spec: case-manager
  fields: 3
- name: UpdateSecurityReviewDataSources
  spec: case-manager
  fields: 2
- name: UpdateSecurityReviewKPIs
  spec: case-manager
  fields: 7
- name: UpdateSecurityReviewPeriodComparison
  spec: case-manager
  fields: 4
- name: UpdateSecurityReviewReport
  spec: case-manager
  fields: 13
- name: UpdateSessionRequest
  spec: user-management-service
  fields: 1
- name: UpdateSessionResponse
  spec: user-management-service
  fields: 1
- name: UpdateTemporaryFiltersRequest
  spec: case-manager
  fields: 4
- name: UpdateUserGroupRequest
  spec: user-management-service
  fields: 7
- name: UpdateUserGroupResponse
  spec: user-management-service
  fields: 2
- name: UpdateUserRequest
  spec: user-management-service
  fields: 4
- name: UpdateUserResponse
  spec: user-management-service
  fields: 2
- name: UpdateUserViewPreferenceRequest
  spec: case-manager
  fields: 2
- name: UpdateWidgetRequest
  spec: case-manager
  fields: 6
- name: UpdateWidgetResponse
  spec: case-manager
  fields: 7
- name: UploadCaseAttachmentResponse
  spec: case-manager
  fields: 2
- name: UploadFileResponse
  spec: user-management-service
  fields: 2
- name: UploadOrganizationLogoResponse
  spec: user-management-service
  fields: 2
- name: UpsertAlertTypeRequest
  spec: case-manager
  fields: 4
- name: UpsertAlertTypeResponse
  spec: case-manager
  fields: 2
- name: UpsertCaseAction
  spec: case-manager
  fields: 22
- name: UpsertCaseCommentRequest
  spec: case-manager
  fields: 6
- name: UpsertCaseCommentResponse
  spec: case-manager
  fields: 2
- name: UpsertCaseFinding
  spec: case-manager
  fields: 2
- name: UpsertCaseInAlertCatalogRequest
  spec: case-manager
  fields: 3
- name: UpsertCaseWatchersRequest
  spec: case-manager
  fields: 1
- name: UpsertCustomCaseFieldResponse
  spec: case-manager
  fields: 2
- name: UpsertCustomFieldValue
  spec: case-manager
  fields: 3
- name: UpsertCustomQuestionRequest
  spec: case-manager
  fields: 6
- name: UpsertEscalation
  spec: case-manager
  fields: 6
- name: UpsertEvidenceRequest
  spec: case-manager
  fields: 7
- name: UpsertExploreDeeperQuestionRequest
  spec: case-manager
  fields: 9
- name: UpsertFaqRequest
  spec: case-manager
  fields: 4
- name: UpsertLinkedAlertSource
  spec: case-manager
  fields: 5
- name: UpsertReportWatcherRequest
  spec: case-manager
  fields: 4
- name: User
  spec: user-management-service
  fields: 16
- name: UserDetail
  spec: case-manager
  fields: 4
- name: UserDetails
  spec: case-manager
  fields: 4
- name: UserFeaturePermission
  spec: user-management-service
  fields: 4
- name: UserGroupListItem
  spec: user-management-service
  fields: 10
- name: UserGroupMinimal
  spec: user-management-service
  fields: 3
- name: UserInformation
  spec: case-manager
  fields: 4
- name: UserManagementResponse
  spec: user-management-service
  fields: 2
- name: UserMinimal
  spec: user-management-service
  fields: 3
- name: UserViewPreference
  spec: case-manager
  fields: 12
- name: UserViewPreferenceResponse
  spec: case-manager
  fields: 2
- name: UserWidgets
  spec: case-manager
  fields: 4
- name: VerifyEmailResponse
  spec: user-management-service
  fields: 3
- name: VerifyEmailsRequest
  spec: user-management-service
  fields: 1
- name: VerifyEmailsResponse
  spec: user-management-service
  fields: 2
- name: ViewLayout
  spec: case-manager
  fields: 2
- name: ViewSettings
  spec: case-manager
  fields: 4
- name: Webhook
  spec: case-manager
  fields: 9
- name: WidgetDetail
  spec: case-manager
  fields: 15
- name: WidgetLayout
  spec: case-manager
  fields: 6
- name: WidgetLayoutUpdate
  spec: case-manager
  fields: 2
- name: schemas-ProviderSummary
  spec: case-manager
  fields: 6
relationships:
- from: CreateCaseRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateCaseRequest
  to: CaseType
  type: has_one
  via: type
- from: CreateCaseRequest
  to: CaseStatus
  type: has_one
  via: status
- from: CreateCaseRequest
  to: CaseSeverity
  type: has_one
  via: severity
- from: CreateCaseRequest
  to: CasePriority
  type: has_one
  via: priority
- from: CreateCaseRequest
  to: AlertSource
  type: has_one
  via: alert_source
- from: CreateCaseRequest
  to: AlertCategory
  type: has_one
  via: alert_category
- from: CreateCaseRequest
  to: CaseDisposition
  type: has_one
  via: disposition
- from: CreateCaseRequest
  to: CaseSummaryField
  type: has_one
  via: case_summary_fields
- from: UserDetails
  to: user
  type: belongs_to
  via: user_uuid
  inferred: true
- from: UserDetail
  to: user
  type: belongs_to
  via: user_uuid
  inferred: true
- from: ChatSessionDetail
  to: chat_session
  type: belongs_to
  via: chat_session_id
  inferred: true
- from: ChatSessionDetail
  to: UserDetail
  type: has_one
  via: owner_details
- from: Case
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: Case
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: Case
  to: CaseStatus
  type: has_one
  via: status
- from: Case
  to: CaseSeverity
  type: has_one
  via: severity
- from: Case
  to: CasePriority
  type: has_one
  via: priority
- from: Case
  to: UserDetails
  type: has_one
  via: assignee
- from: Case
  to: UserDetails
  type: has_one
  via: reporter
- from: CaseDetails
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseDetails
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseDetails
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CaseDetails
  to: CaseType
  type: has_one
  via: type
- from: CaseDetails
  to: CaseStatus
  type: has_one
  via: status
- from: CaseDetails
  to: CaseSeverity
  type: has_one
  via: severity
- from: CaseDetails
  to: CasePriority
  type: has_one
  via: priority
- from: CaseDetails
  to: UserDetails
  type: has_one
  via: assignee
- from: CaseDetails
  to: UserDetails
  type: has_one
  via: reporter
- from: CaseDetails
  to: AlertSource
  type: has_one
  via: alert_source
- from: CaseDetails
  to: AlertCategory
  type: has_one
  via: alert_category
- from: CaseDetails
  to: CaseDisposition
  type: has_one
  via: disposition
- from: CaseDetails
  to: CaseSummaryField
  type: has_one
  via: case_summary_fields
- from: CaseDetails
  to: ChatSessionDetail
  type: has_many
  via: linked_sessions
- from: CaseDetails
  to: Case
  type: has_many
  via: linked_cases
- from: CreateCaseResponse
  to: CaseDetails
  type: has_one
  via: data
- from: GetCaseResponse
  to: CaseDetails
  type: has_one
  via: data
- from: UpdateCaseRequest
  to: CaseStatus
  type: has_one
  via: status
- from: UpdateCaseRequest
  to: CaseSeverity
  type: has_one
  via: severity
- from: UpdateCaseRequest
  to: CasePriority
  type: has_one
  via: priority
- from: UpdateCaseRequest
  to: CaseDisposition
  type: has_one
  via: disposition
- from: UpdateCaseRequest
  to: CaseSummaryField
  type: has_one
  via: case_summary_fields
- from: UpdateCaseRequest
  to: AppendMode
  type: has_one
  via: append_mode
- from: UpdateCaseResponse
  to: CaseDetails
  type: has_one
  via: data
- from: EmailCaseDetailsRequest
  to: view
  type: belongs_to
  via: view_id
  inferred: true
- from: CaseFilter
  to: CaseSeverity
  type: has_many
  via: severity
- from: CaseFilter
  to: CaseStatus
  type: has_many
  via: status
- from: CaseFilter
  to: CasePriority
  type: has_many
  via: priority
- from: CaseFilter
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseSort
  to: SortOrder
  type: has_one
  via: sort_order
- from: CaseListRequest
  to: CaseView
  type: has_one
  via: requested_view
- from: CaseListRequest
  to: CaseFilter
  type: has_one
  via: filter
- from: CaseListRequest
  to: CaseSort
  type: has_many
  via: sort
- from: CaseListResponse
  to: Case
  type: has_many
  via: data
- from: UpsertLinkedAlertSource
  to: LinkedAlertSourceType
  type: has_one
  via: type
- from: CaseActivity
  to: ActionSeverityLevel
  type: has_one
  via: activity_severity
- from: UpsertCustomFieldValue
  to: field
  type: belongs_to
  via: field_identifier
  inferred: true
- from: UpsertFaqRequest
  to: question
  type: belongs_to
  via: question_id
  inferred: true
- from: UpsertCustomQuestionRequest
  to: question
  type: belongs_to
  via: question_id
  inferred: true
- from: UpsertExploreDeeperQuestionRequest
  to: question
  type: belongs_to
  via: question_id
  inferred: true
- from: UpsertExploreDeeperQuestionRequest
  to: ExploreDeeperQuestionStatus
  type: has_one
  via: status
- from: UpsertExploreDeeperQuestionRequest
  to: ExplorationType
  type: has_one
  via: exploration_type
- from: CausalityGraph
  to: CausalityGraphNode
  type: has_many
  via: nodes
- from: CausalityGraph
  to: CausalityGraphEdge
  type: has_many
  via: edges
- from: AddCaseDetailFieldsRequest
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: AddCaseDetailFieldsRequest
  to: UpsertLinkedAlertSource
  type: has_many
  via: linked_alerts
- from: AddCaseDetailFieldsRequest
  to: primary_alert
  type: belongs_to
  via: primary_alert_id
  inferred: true
- from: AddCaseDetailFieldsRequest
  to: CaseTimeline
  type: has_one
  via: timeline
- from: AddCaseDetailFieldsRequest
  to: CaseActivity
  type: has_many
  via: activity_timeline
- from: AddCaseDetailFieldsRequest
  to: UpsertCustomFieldValue
  type: has_many
  via: custom_field_values
- from: AddCaseDetailFieldsRequest
  to: ConclusionOverview
  type: has_one
  via: conclusion_overview
- from: AddCaseDetailFieldsRequest
  to: UpsertFaqRequest
  type: has_many
  via: faqs
- from: AddCaseDetailFieldsRequest
  to: UpsertCustomQuestionRequest
  type: has_many
  via: custom_questions
- from: AddCaseDetailFieldsRequest
  to: UpsertExploreDeeperQuestionRequest
  type: has_many
  via: explore_deeper_questions
- from: AddCaseDetailFieldsRequest
  to: CausalityGraph
  type: has_one
  via: causality_graph
- from: CreateCaseRequestV2
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CreateCaseRequestV2
  to: organization
  type: belongs_to
  via: organization_identifier
  inferred: true
- from: CreateCaseRequestV2
  to: CaseType
  type: has_one
  via: type
- from: CreateCaseRequestV2
  to: agentic_investigation
  type: belongs_to
  via: agentic_investigation_id
  inferred: true
- from: CreateCaseRequestV2
  to: AdrTriage
  type: has_one
  via: adr_triage
- from: CreateCaseRequestV2
  to: AddCaseDetailFieldsRequest
  type: has_one
  via: case_detail_fields
- from: CreateCaseRequestV2
  to: CaseConfidence
  type: has_one
  via: confidence
- from: AssigneeDetails
  to: assignee
  type: belongs_to
  via: assignee_id
  inferred: true
- from: AssigneeDetails
  to: user
  type: belongs_to
  via: user_uuid
  inferred: true
- from: Escalation
  to: EscalationType
  type: has_one
  via: escalation_type
- from: Escalation
  to: EscalatedToType
  type: has_one
  via: escalated_to
- from: Escalation
  to: UserDetails
  type: has_one
  via: escalated_by
- from: ActionExecutionDetails
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: CaseAction
  to: UserDetails
  type: has_one
  via: assignee
- from: CaseAction
  to: AssigneeDetails
  type: has_one
  via: assignee_v2
- from: CaseAction
  to: ActionSeverityLevel
  type: has_one
  via: action_severity
- from: CaseAction
  to: session
  type: belongs_to
  via: session_id
  inferred: true
- from: CaseAction
  to: blocking_fact
  type: belongs_to
  via: blocking_fact_id
  inferred: true
- from: CaseAction
  to: playbook
  type: belongs_to
  via: playbook_id
  inferred: true
- from: CaseAction
  to: ActionStatusV2
  type: has_one
  via: status_v2
- from: CaseAction
  to: ActionExecutionDetails
  type: has_one
  via: execution_details
- from: ProviderSummary
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: LinkedAlertSource
  to: LinkedAlertSourceType
  type: has_one
  via: type
- from: Evidence
  to: EvidenceAttachmentType
  type: has_one
  via: attached_content_type
- from: CaseFinding
  to: Evidence
  type: has_many
  via: evidences
- from: CaseFinding
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: Faq
  to: question
  type: belongs_to
  via: question_id
  inferred: true
- from: CustomQuestion
  to: question
  type: belongs_to
  via: question_id
  inferred: true
- from: ExploreDeeperQuestion
  to: question
  type: belongs_to
  via: question_id
  inferred: true
- from: ExploreDeeperQuestion
  to: ExploreDeeperQuestionStatus
  type: has_one
  via: status
- from: ExploreDeeperQuestion
  to: ExplorationType
  type: has_one
  via: exploration_type
- from: CaseDetailFields
  to: CaseAction
  type: has_many
  via: actions_required
- from: CaseDetailFields
  to: ProviderSummary
  type: has_one
  via: provider
- from: CaseDetailFields
  to: LinkedAlertSource
  type: has_many
  via: linked_alerts
- from: CaseDetailFields
  to: primary_alert
  type: belongs_to
  via: primary_alert_id
  inferred: true
- from: CaseDetailFields
  to: CaseTimeline
  type: has_one
  via: timeline
- from: CaseDetailFields
  to: CaseActivity
  type: has_many
  via: activity_timeline
- from: CaseDetailFields
  to: CaseTimelineMetrics
  type: has_one
  via: metrics
- from: CaseDetailFields
  to: CaseFinding
  type: has_many
  via: findings
- from: CaseDetailFields
  to: CustomFieldValue
  type: has_many
  via: custom_field_values
- from: CaseDetailFields
  to: ConclusionOverview
  type: has_one
  via: conclusion_overview
- from: CaseDetailFields
  to: Faq
  type: has_many
  via: faqs
- from: CaseDetailFields
  to: CustomQuestion
  type: has_many
  via: custom_questions
- from: CaseDetailFields
  to: ExploreDeeperQuestion
  type: has_many
  via: explore_deeper_questions
- from: CaseDetailFields
  to: CausalityGraph
  type: has_one
  via: causality_graph
- from: CaseDetailFields
  to: CaseFactSummary
  type: has_many
  via: facts
- from: CaseScoreMinimal
  to: ScoreStatus
  type: has_one
  via: score_status
- from: CaseV2
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseV2
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseV2
  to: CaseType
  type: has_one
  via: type
- from: CaseV2
  to: CasePriorityV2
  type: has_one
  via: priority
- from: CaseV2
  to: AssigneeDetails
  type: has_one
  via: assignee
- from: CaseV2
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: CaseV2
  to: CaseTimeline
  type: has_one
  via: timeline
- from: CaseV2
  to: CaseScoreMinimal
  type: has_one
  via: case_score
- from: EntityRisk
  to: EntityRiskLabel
  type: has_one
  via: label
- from: Entity
  to: EntityType
  type: has_one
  via: type
- from: Entity
  to: EntitySource
  type: has_one
  via: source
- from: Entity
  to: EntityRisk
  type: has_one
  via: risk
- from: Event
  to: event
  type: belongs_to
  via: event_id
  inferred: true
- from: Event
  to: EventOutcome
  type: has_one
  via: outcome
- from: Event
  to: EventSeverity
  type: has_one
  via: severity
- from: Event
  to: mitre_technique
  type: belongs_to
  via: mitre_technique_id
  inferred: true
- from: Relationship
  to: relationship
  type: belongs_to
  via: relationship_id
  inferred: true
- from: Relationship
  to: RelationshipType
  type: has_one
  via: type
- from: CaseStructuredData
  to: Entity
  type: has_many
  via: entities
- from: CaseStructuredData
  to: GeoInfo
  type: has_many
  via: geo_info
- from: CaseStructuredData
  to: Event
  type: has_many
  via: events
- from: CaseStructuredData
  to: Relationship
  type: has_many
  via: relationships
- from: CaseDetailsV2
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseDetailsV2
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseDetailsV2
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CaseDetailsV2
  to: CaseType
  type: has_one
  via: type
- from: CaseDetailsV2
  to: CasePriorityV2
  type: has_one
  via: priority
- from: CaseDetailsV2
  to: AssigneeDetails
  type: has_one
  via: assignee
- from: CaseDetailsV2
  to: UserDetails
  type: has_one
  via: reporter
- from: CaseDetailsV2
  to: Escalation
  type: has_many
  via: escalations
- from: CaseDetailsV2
  to: AdrTriage
  type: has_one
  via: adr_triage
- from: CaseDetailsV2
  to: agentic_investigation
  type: belongs_to
  via: agentic_investigation_id
  inferred: true
- from: CaseDetailsV2
  to: CaseDetailFields
  type: has_one
  via: case_detail_fields
- from: CaseDetailsV2
  to: ChatSessionDetail
  type: has_many
  via: linked_sessions
- from: CaseDetailsV2
  to: CaseV2
  type: has_many
  via: linked_cases
- from: CaseDetailsV2
  to: CaseConfidence
  type: has_one
  via: confidence
- from: CaseDetailsV2
  to: CaseStructuredData
  type: has_one
  via: structured_data
- from: CreateCaseResponseV2
  to: CaseDetailsV2
  type: has_one
  via: data
- from: GetCaseResponseV2
  to: CaseDetailsV2
  type: has_one
  via: data
- from: UpsertEscalation
  to: EscalationType
  type: has_one
  via: escalation_type
- from: UpsertEscalation
  to: EscalatedToType
  type: has_one
  via: escalated_to
- from: UpsertCaseAction
  to: ActionSeverityLevel
  type: has_one
  via: action_severity
- from: UpsertCaseAction
  to: session
  type: belongs_to
  via: session_id
  inferred: true
- from: UpsertCaseAction
  to: blocking_fact
  type: belongs_to
  via: blocking_fact_id
  inferred: true
- from: UpsertCaseAction
  to: playbook
  type: belongs_to
  via: playbook_id
  inferred: true
- from: UpsertCaseAction
  to: ActionStatusV2
  type: has_one
  via: status_v2
- from: UpsertCaseAction
  to: ActionExecutionDetails
  type: has_one
  via: execution_details
- from: UpdateCaseDetailFieldsRequest
  to: UpsertCaseAction
  type: has_many
  via: actions_required
- from: UpdateCaseDetailFieldsRequest
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: UpdateCaseDetailFieldsRequest
  to: UpsertLinkedAlertSource
  type: has_many
  via: linked_alerts
- from: UpdateCaseDetailFieldsRequest
  to: primary_alert
  type: belongs_to
  via: primary_alert_id
  inferred: true
- from: UpdateCaseDetailFieldsRequest
  to: CaseTimeline
  type: has_one
  via: timeline
- from: UpdateCaseDetailFieldsRequest
  to: CaseActivity
  type: has_many
  via: activity_timeline
- from: UpdateCaseDetailFieldsRequest
  to: UpsertCustomFieldValue
  type: has_many
  via: custom_field_values
- from: UpdateCaseDetailFieldsRequest
  to: ConclusionOverview
  type: has_one
  via: conclusion_overview
- from: UpdateCaseDetailFieldsRequest
  to: UpsertFaqRequest
  type: has_many
  via: faqs
- from: UpdateCaseDetailFieldsRequest
  to: UpsertCustomQuestionRequest
  type: has_many
  via: custom_questions
- from: UpdateCaseDetailFieldsRequest
  to: UpsertExploreDeeperQuestionRequest
  type: has_many
  via: explore_deeper_questions
- from: UpdateCaseDetailFieldsRequest
  to: CausalityGraph
  type: has_one
  via: causality_graph
- from: UpdateCaseStructuredData
  to: Entity
  type: has_many
  via: entities
- from: UpdateCaseStructuredData
  to: GeoInfo
  type: has_many
  via: geo_info
- from: UpdateCaseStructuredData
  to: Event
  type: has_many
  via: events
- from: UpdateCaseStructuredData
  to: Relationship
  type: has_many
  via: relationships
- from: UpdateCaseRequestV2
  to: UpsertEscalation
  type: has_one
  via: escalations
- from: UpdateCaseRequestV2
  to: agentic_investigation
  type: belongs_to
  via: agentic_investigation_id
  inferred: true
- from: UpdateCaseRequestV2
  to: AdrTriage
  type: has_one
  via: adr_triage
- from: UpdateCaseRequestV2
  to: UpdateCaseDetailFieldsRequest
  type: has_one
  via: case_detail_fields
- from: UpdateCaseRequestV2
  to: AppendMode
  type: has_one
  via: append_mode
- from: UpdateCaseRequestV2
  to: UpdateConfidenceRequest
  type: has_one
  via: confidence
- from: UpdateCaseRequestV2
  to: UpdateCaseStructuredData
  type: has_one
  via: structured_data
- from: UpdateCaseResponseV2
  to: CaseDetailsV2
  type: has_one
  via: data
- from: UpsertEvidenceRequest
  to: EvidenceAttachmentType
  type: has_one
  via: attached_content_type
- from: AddCaseFindingRequest
  to: UpsertEvidenceRequest
  type: has_many
  via: evidences
- from: AddCaseFindingRequest
  to: DecisionIoc
  type: has_many
  via: decision_iocs
- from: AddCaseFindingRequest
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: UpsertCaseFinding
  to: CaseFinding
  type: has_one
  via: finding
- from: AddCaseFindingResponse
  to: UpsertCaseFinding
  type: has_one
  via: data
- from: DeleteCaseFindingResponse
  to: UpsertCaseFinding
  type: has_one
  via: data
- from: UpdateCaseFindingRequest
  to: UpsertEvidenceRequest
  type: has_many
  via: evidences
- from: UpdateCaseFindingRequest
  to: DecisionIoc
  type: has_many
  via: decision_iocs
- from: UpdateCaseFindingResponse
  to: UpsertCaseFinding
  type: has_one
  via: data
- from: GetEvidenceResponse
  to: Evidence
  type: has_one
  via: data
- from: UserInformation
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: CaseAttachment
  to: attachment
  type: belongs_to
  via: attachment_uuid
  inferred: true
- from: CaseAttachment
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseAttachment
  to: comment
  type: belongs_to
  via: comment_id
  inferred: true
- from: CaseAttachment
  to: UserInformation
  type: has_one
  via: uploaded_by
- from: UploadCaseAttachmentResponse
  to: CaseAttachment
  type: has_one
  via: data
- from: ListCaseAttachmentsResponse
  to: CaseAttachment
  type: has_many
  via: data
- from: EntityFilterItem
  to: EntityType
  type: has_one
  via: type
- from: EntityFilter
  to: EntityFilterItem
  type: has_many
  via: items
- from: CaseFilterV2
  to: CustomFieldValue
  type: has_many
  via: custom_field_values
- from: CaseFilterV2
  to: assignee
  type: belongs_to
  via: assignee_id
  inferred: true
- from: CaseFilterV2
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CaseFilterV2
  to: CategoryFilter
  type: has_many
  via: categories
- from: CaseFilterV2
  to: TimeRange
  type: has_one
  via: modified_at_time_range
- from: CaseFilterV2
  to: TimeRange
  type: has_one
  via: created_at_time_range
- from: CaseFilterV2
  to: NumberRange
  type: has_one
  via: case_score
- from: CaseFilterV2
  to: EntityFilter
  type: has_one
  via: entities
- from: CaseListRequestV2
  to: CaseView
  type: has_one
  via: requested_view
- from: CaseListRequestV2
  to: CaseFilterV2
  type: has_one
  via: filter
- from: CaseListRequestV2
  to: CaseSort
  type: has_many
  via: sort
- from: CaseListRequestV2
  to: check_case
  type: belongs_to
  via: check_case_identifier
  inferred: true
- from: CaseListResponseV2
  to: CaseV2
  type: has_many
  via: data
- from: CaseListResponseV2
  to: CaseListSummary
  type: has_one
  via: metadata
- from: UpsertCaseCommentRequest
  to: CommentPrivacy
  type: has_one
  via: comment_privacy
- from: UpsertCaseCommentRequest
  to: CommentType
  type: has_one
  via: comment_type
- from: CommentSource
  to: AddCommentSource
  type: has_one
  via: source
- from: CaseComment
  to: comment
  type: belongs_to
  via: comment_id
  inferred: true
- from: CaseComment
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseComment
  to: UserInformation
  type: has_one
  via: created_by
- from: CaseComment
  to: CommentSource
  type: has_one
  via: comment_source
- from: CaseComment
  to: CommentPrivacy
  type: has_one
  via: comment_privacy
- from: CaseComment
  to: CommentType
  type: has_one
  via: comment_type
- from: UpsertCaseCommentResponse
  to: CaseComment
  type: has_one
  via: data
- from: CaseCommentsListResponse
  to: CaseComment
  type: has_many
  via: data
- from: FieldChange
  to: ChangelogActionType
  type: has_one
  via: action_type
- from: FieldChange
  to: FieldType
  type: has_one
  via: field_type
- from: ExecutionSummary
  to: skill
  type: belongs_to
  via: skill_id
  inferred: true
- from: ChangeLog
  to: change_log
  type: belongs_to
  via: change_log_id
  inferred: true
- from: ChangeLog
  to: ResourceType
  type: has_one
  via: resource_type
- from: ChangeLog
  to: resource
  type: belongs_to
  via: resource_id
  inferred: true
- from: ChangeLog
  to: FieldChange
  type: has_many
  via: field_changes
- from: ChangeLog
  to: request
  type: belongs_to
  via: request_id
  inferred: true
- from: ChangeLog
  to: UserInformation
  type: has_one
  via: performed_by
- from: ChangeLog
  to: ExecutionSummary
  type: has_one
  via: execution_summary
- from: CaseHistoryResponse
  to: ChangeLog
  type: has_many
  via: data
- from: CaseNamedVersion
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseNamedVersion
  to: change_log
  type: belongs_to
  via: change_log_id
  inferred: true
- from: CaseNamedVersion
  to: UserInformation
  type: has_one
  via: created_by
- from: ListCaseNamedVersionsResponse
  to: CaseNamedVersion
  type: has_many
  via: data
- from: CaseNamedVersionResponse
  to: CaseNamedVersion
  type: has_one
  via: data
- from: CaseWatchers
  to: user
  type: belongs_to
  via: user_uuid
  inferred: true
- from: CaseWatchers
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: CaseWatchersResponse
  to: CaseWatchers
  type: has_many
  via: data
- from: CloneCaseRequest
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: ProviderDetails
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: CaseExecutionDetails
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseExecutionDetails
  to: AlertInvestigationStatus
  type: has_one
  via: investigation_status
- from: CaseExecutionDetails
  to: investigation_playbook
  type: belongs_to
  via: investigation_playbook_id
  inferred: true
- from: CaseExecutionDetails
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: LinkedCaseSummary
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: LinkedCaseSummary
  to: agentic_investigation
  type: belongs_to
  via: agentic_investigation_id
  inferred: true
- from: ConnectionDetails
  to: connection
  type: belongs_to
  via: connection_id
  inferred: true
- from: AlertTypeWithProperties
  to: AlertTypeSeverity
  type: has_one
  via: default_severity
- from: GetAlertResponse
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: GetAlertResponse
  to: alert
  type: belongs_to
  via: alert_uuid
  inferred: true
- from: GetAlertResponse
  to: AlertsIOC
  type: has_one
  via: alert_ioc
- from: GetAlertResponse
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: GetAlertResponse
  to: fetched_playbook
  type: belongs_to
  via: fetched_playbook_id
  inferred: true
- from: GetAlertResponse
  to: fetched_execution
  type: belongs_to
  via: fetched_execution_id
  inferred: true
- from: GetAlertResponse
  to: investigation_playbook
  type: belongs_to
  via: investigation_playbook_id
  inferred: true
- from: GetAlertResponse
  to: AlertInvestigationStatus
  type: has_one
  via: investigation_status
- from: GetAlertResponse
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: GetAlertResponse
  to: linked_case
  type: belongs_to
  via: linked_case_id
  inferred: true
- from: GetAlertResponse
  to: original_alert
  type: belongs_to
  via: original_alert_id
  inferred: true
- from: GetAlertResponse
  to: ProviderDetails
  type: has_one
  via: alert_provider_details
- from: GetAlertResponse
  to: CaseExecutionDetails
  type: has_many
  via: linked_case_details
- from: GetAlertResponse
  to: LinkedCaseSummary
  type: has_one
  via: linked_case_summary
- from: GetAlertResponse
  to: ConnectionDetails
  type: has_one
  via: connection_details
- from: GetAlertResponse
  to: AlertTypeWithProperties
  type: has_one
  via: alert_type_details
- from: CaseResponseData
  to: CaseDetailsV2
  type: has_one
  via: case
- from: CaseResponseData
  to: GetAlertResponse
  type: has_many
  via: alerts
- from: CloneCaseResponse
  to: CaseResponseData
  type: has_one
  via: data
- from: ListCaseCommentsRequest
  to: TimeRange
  type: has_one
  via: date_range
- from: ListCaseCommentsResponse
  to: CaseComment
  type: has_many
  via: data
- from: CaseMetrics
  to: MetricsAttributes
  type: has_one
  via: mean_time_to_ack
- from: CaseMetrics
  to: MetricsAttributes
  type: has_one
  via: mean_time_to_investigate
- from: CaseMetrics
  to: MetricsAttributes
  type: has_one
  via: mean_time_to_contain
- from: CaseMetrics
  to: MetricsAttributes
  type: has_one
  via: mean_time_to_close
- from: CaseMetricsResponse
  to: CaseMetrics
  type: has_one
  via: data
- from: NetworkWidgets
  to: EntityCount
  type: has_many
  via: top_attacking_ips
- from: NetworkWidgets
  to: EntityCountWithDays
  type: has_many
  via: persistent_ips
- from: NetworkWidgets
  to: EntityCount
  type: has_many
  via: internal_ips
- from: NetworkWidgets
  to: EntityCount
  type: has_many
  via: top_attacking_domains
- from: NetworkWidgets
  to: EntityCount
  type: has_many
  via: common_iocs
- from: MultiVectorUser
  to: AttackTypeCount
  type: has_many
  via: attack_types
- from: UserWidgets
  to: EntityCount
  type: has_many
  via: repeat_targeted_users
- from: UserWidgets
  to: EntityCount
  type: has_many
  via: users_in_malicious_activity
- from: UserWidgets
  to: EntityCount
  type: has_many
  via: users_high_false_positives
- from: UserWidgets
  to: MultiVectorUser
  type: has_many
  via: multi_vector_targeted_users
- from: MultiVectorHost
  to: AttackTypeCount
  type: has_many
  via: attack_types
- from: HostWidgets
  to: EntityCount
  type: has_many
  via: repeat_incident_hosts
- from: HostWidgets
  to: EntityCount
  type: has_many
  via: hosts_in_malicious_activity
- from: HostWidgets
  to: MultiVectorHost
  type: has_many
  via: multi_vector_targeted_hosts
- from: DetectionWidgets
  to: AlertTypeCount
  type: has_many
  via: high_value_detections
- from: DetectionWidgets
  to: AlertTypeCount
  type: has_many
  via: false_positive_alert_types
- from: DetectionWidgets
  to: AlertTypeCount
  type: has_many
  via: uninvestigated_alerts
- from: DetectionWidgets
  to: AlertTypeCount
  type: has_many
  via: missing_data
- from: DetectionWidgets
  to: AlertTypeCount
  type: has_many
  via: top_alert_types
- from: TrendWidgets
  to: DailyCount
  type: has_many
  via: cases_over_time
- from: TrendWidgets
  to: SeverityCount
  type: has_many
  via: cases_by_severity
- from: TrendWidgets
  to: BusinessHoursBreakdown
  type: has_one
  via: business_hours_breakdown
- from: ThreatCategorizationWidgets
  to: CategoryCount
  type: has_many
  via: cases_by_threat_type
- from: ThreatCategorizationWidgets
  to: CategoryCount
  type: has_many
  via: high_severity_by_threat_type
- from: ThreatCategorizationWidgets
  to: EmergingThreat
  type: has_many
  via: emerging_threats
- from: CaseActionCount
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: RemediationWidgets
  to: CaseActionCount
  type: has_many
  via: unresolved_actions
- from: RemediationWidgets
  to: CaseActionCount
  type: has_many
  via: customer_action_cases
- from: DispositionEscalationWidgets
  to: CommunicationByDisposition
  type: has_many
  via: disposition_breakdown
- from: DispositionEscalationWidgets
  to: EscalationBreakdown
  type: has_one
  via: escalation_breakdown
- from: DispositionEscalationWidgets
  to: ProviderEscalationCount
  type: has_many
  via: escalations_by_provider
- from: CaseAnalyticsDashboardData
  to: KpiWidgets
  type: has_one
  via: kpi
- from: CaseAnalyticsDashboardData
  to: NetworkWidgets
  type: has_one
  via: network
- from: CaseAnalyticsDashboardData
  to: UserWidgets
  type: has_one
  via: users
- from: CaseAnalyticsDashboardData
  to: HostWidgets
  type: has_one
  via: hosts
- from: CaseAnalyticsDashboardData
  to: DetectionWidgets
  type: has_one
  via: detection
- from: CaseAnalyticsDashboardData
  to: TrendWidgets
  type: has_one
  via: trends
- from: CaseAnalyticsDashboardData
  to: ThreatCategorizationWidgets
  type: has_one
  via: threat_categorization
- from: CaseAnalyticsDashboardData
  to: RemediationWidgets
  type: has_one
  via: remediation
- from: CaseAnalyticsDashboardData
  to: DispositionEscalationWidgets
  type: has_one
  via: disposition_escalation
- from: CaseAnalyticsDashboardResponse
  to: CaseAnalyticsDashboardData
  type: has_one
  via: data
- from: ResponseTimePercentiles
  to: PercentileMetric
  type: has_one
  via: mtta
- from: ResponseTimePercentiles
  to: PercentileMetric
  type: has_one
  via: mtti
- from: ResponseTimePercentiles
  to: PercentileMetric
  type: has_one
  via: mttc
- from: ResponseTimePercentiles
  to: PercentileMetric
  type: has_one
  via: mtt_close
- from: SpeedSlaWidgets
  to: ResponseTimeMetric
  type: has_one
  via: mtta
- from: SpeedSlaWidgets
  to: ResponseTimeMetric
  type: has_one
  via: mtti
- from: SpeedSlaWidgets
  to: ResponseTimeMetric
  type: has_one
  via: mttc
- from: SpeedSlaWidgets
  to: ResponseTimeMetric
  type: has_one
  via: mtt_close
- from: SpeedSlaWidgets
  to: SlaConfig
  type: has_one
  via: sla_config
- from: SpeedSlaWidgets
  to: SlaAdherenceResult
  type: has_one
  via: critical_incident_adherence
- from: SpeedSlaWidgets
  to: SlaAdherenceResult
  type: has_one
  via: critical_alert_adherence
- from: SpeedSlaWidgets
  to: SlaAdherenceResult
  type: has_one
  via: non_critical_adherence
- from: SpeedSlaWidgets
  to: SlaAdherenceTrendPoint
  type: has_many
  via: sla_adherence_trend
- from: SpeedSlaWidgets
  to: ResponseTimePercentiles
  type: has_one
  via: response_time_percentiles
- from: ThroughputWidgets
  to: DailyCount
  type: has_many
  via: daily_case_volume
- from: ThroughputWidgets
  to: AnalystPerformance
  type: has_many
  via: analyst_performance
- from: ThroughputWidgets
  to: HourCount
  type: has_many
  via: peak_load_by_hour
- from: ThroughputWidgets
  to: AdrTriageCount
  type: has_many
  via: adr_triage_breakdown
- from: QuestionsAnsweredByCategory
  to: QuestionsAnsweredSplit
  type: has_one
  via: investigation_questions
- from: QuestionsAnsweredByCategory
  to: QuestionsAnsweredSplit
  type: has_one
  via: faqs
- from: QuestionsAnsweredByCategory
  to: QuestionsAnsweredSplit
  type: has_one
  via: explore_deeper
- from: InvestigationQualityWidgets
  to: QuestionsAnsweredByCategory
  type: has_one
  via: questions_per_category
- from: InvestigationQualityWidgets
  to: SeverityCount
  type: has_many
  via: escalations_by_severity
- from: InvestigationQualityWidgets
  to: ReworkDailyPoint
  type: has_many
  via: rework_daily
- from: InvestigationQualityWidgets
  to: QualityScoreDailyPoint
  type: has_many
  via: quality_score_daily
- from: InvestigationQualityWidgets
  to: QuestionsAnsweredByOutcome
  type: has_many
  via: questions_answered_by_outcome
- from: ResponseRemediationWidgets
  to: CategoryCount
  type: has_many
  via: stalled_cases_by_category
- from: ResponseRemediationWidgets
  to: ResponseTimeMetric
  type: has_one
  via: customer_response_time
- from: OutlierCase
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: OutlierCase
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: ConsistencyWidgets
  to: OutlierCase
  type: has_many
  via: outlier_cases
- from: CustomerExperienceWidgets
  to: EscalationBreakdown
  type: has_one
  via: escalation_breakdown
- from: CustomerExperienceWidgets
  to: CommunicationBySeverity
  type: has_many
  via: communication_by_severity
- from: CustomerExperienceWidgets
  to: CommunicationByDisposition
  type: has_many
  via: communication_by_disposition
- from: AutomationWidgets
  to: MttiComparisonPoint
  type: has_many
  via: time_saved_chart
- from: AutomationWidgets
  to: AdrTriageDailyBreakdown
  type: has_many
  via: adr_triage_trend
- from: OperationalGapsWidgets
  to: MissingTelemetryCount
  type: has_many
  via: missing_telemetry_by_alert_type
- from: OperationalGapsWidgets
  to: BlockedByCategoryCount
  type: has_many
  via: blocked_by_customer_by_category
- from: SocPerformanceDashboardData
  to: KpiWidgets
  type: has_one
  via: kpi
- from: SocPerformanceDashboardData
  to: SpeedSlaWidgets
  type: has_one
  via: speed_sla
- from: SocPerformanceDashboardData
  to: ThroughputWidgets
  type: has_one
  via: throughput
- from: SocPerformanceDashboardData
  to: InvestigationQualityWidgets
  type: has_one
  via: investigation_quality
- from: SocPerformanceDashboardData
  to: ResponseRemediationWidgets
  type: has_one
  via: response_remediation
- from: SocPerformanceDashboardData
  to: ConsistencyWidgets
  type: has_one
  via: consistency
- from: SocPerformanceDashboardData
  to: CustomerExperienceWidgets
  type: has_one
  via: customer_experience
- from: SocPerformanceDashboardData
  to: AutomationWidgets
  type: has_one
  via: automation
- from: SocPerformanceDashboardData
  to: OperationalGapsWidgets
  type: has_one
  via: operational_gaps
- from: SocPerformanceDashboardResponse
  to: SocPerformanceDashboardData
  type: has_one
  via: data
- from: RecentMaliciousCase
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: RecentMaliciousCase
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: ExecutiveDashboardData
  to: KpiWidgets
  type: has_one
  via: kpi
- from: ExecutiveDashboardData
  to: CommunicationByDisposition
  type: has_many
  via: escalations_by_disposition
- from: ExecutiveDashboardData
  to: ProviderEscalationCount
  type: has_many
  via: escalations_by_provider
- from: ExecutiveDashboardData
  to: AlertTypeCount
  type: has_many
  via: high_value_detections
- from: ExecutiveDashboardData
  to: AlertTypeCount
  type: has_many
  via: false_positive_alert_types
- from: ExecutiveDashboardData
  to: DailyCount
  type: has_many
  via: cases_over_time
- from: ExecutiveDashboardData
  to: DailyCount
  type: has_many
  via: escalations_over_time
- from: ExecutiveDashboardData
  to: CategoryCount
  type: has_many
  via: cases_by_threat_type
- from: ExecutiveDashboardData
  to: SeverityCount
  type: has_many
  via: escalations_by_severity
- from: ExecutiveDashboardData
  to: RecentMaliciousCase
  type: has_many
  via: recent_malicious_cases
- from: ExecutiveDashboardData
  to: EmergingThreat
  type: has_many
  via: mitre_category_volume
- from: ExecutiveDashboardResponse
  to: ExecutiveDashboardData
  type: has_one
  via: data
- from: CaseMetricsSummaryResponse
  to: CaseMetricsLLMSummary
  type: has_many
  via: summary
- from: ProviderList
  to: ProviderSummary
  type: has_one
  via: provider
- from: DailyMetrics
  to: ProviderList
  type: has_many
  via: provider_list
- from: DetailedMetrics
  to: ProviderMetrics
  type: has_many
  via: provider_metrics_list
- from: DetailedMetrics
  to: AlertTypeMetrics
  type: has_many
  via: alert_type_metrics_list
- from: DetailedMetrics
  to: GlobalMetrics
  type: has_one
  via: global_metrics
- from: DetailedMetrics
  to: DailyMetrics
  type: has_many
  via: daily_metrics_list
- from: GetDetailedMetricsResponse
  to: AggregatedMetrics
  type: has_one
  via: data
- from: CreateCaseDecisionMetricsRequest
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CreateCaseDecisionMetricsRequest
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: CreateCaseDecisionMetricsRequest
  to: RiskAssessment
  type: has_one
  via: risk_assessment
- from: CreateCaseDecisionMetricsRequest
  to: ConcernedIOC
  type: has_many
  via: concerned_iocs
- from: GetCaseDecisionMetrics
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: GetCaseDecisionMetrics
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: GetCaseDecisionMetrics
  to: RiskAssessment
  type: has_one
  via: risk_assessment
- from: GetCaseDecisionMetrics
  to: ConcernedIOC
  type: has_many
  via: concerned_iocs
- from: UpdateCaseDecisionMetricsRequest
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: UpdateCaseDecisionMetricsRequest
  to: RiskAssessment
  type: has_one
  via: risk_assessment
- from: UpdateCaseDecisionMetricsRequest
  to: ConcernedIOC
  type: has_many
  via: concerned_iocs
- from: CreateCaseExecutionMetricsRequest
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: CreateCaseExecutionMetricsRequest
  to: IOCScore
  type: has_one
  via: ioc_score
- from: IOCData
  to: ioc
  type: belongs_to
  via: ioc_id
  inferred: true
- from: IOCData
  to: IOCScore
  type: has_one
  via: ioc_score
- from: GetCaseExecutionMetricsResponse
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: GetCaseExecutionMetricsResponse
  to: IOCData
  type: has_many
  via: ioc_data
- from: ScoringGuidelines
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CaseScore
  to: ScoringGuidelines
  type: has_one
  via: referenced_scoring_guidelines
- from: CaseScore
  to: ScoreStatus
  type: has_one
  via: score_status
- from: GetCaseScoreResponse
  to: CaseScore
  type: has_one
  via: data
- from: GenerateCaseScoreRequest
  to: ScoringGuidelines
  type: has_one
  via: new_scoring_guidelines
- from: GenerateCaseScoreResponse
  to: CaseScore
  type: has_one
  via: data
- from: CreateScoringGuidelinesResponse
  to: ScoringGuidelines
  type: has_one
  via: data
- from: GetScoringGuidelinesResponse
  to: ScoringGuidelines
  type: has_one
  via: data
- from: ListCaseScoresRequest
  to: TimeRange
  type: has_one
  via: date_range
- from: CaseScoreSummary
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseScoreSummary
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseScoreSummary
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CaseScoreSummary
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: CaseScoreSummary
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: ListCaseScoresResponse
  to: CaseScoreSummary
  type: has_many
  via: data
- from: GenerateBulkCaseScoresResponse
  to: CaseScore
  type: has_many
  via: data
- from: CreateAlertsRequest
  to: fetched_playbook
  type: belongs_to
  via: fetched_playbook_id
  inferred: true
- from: CreateAlertsRequest
  to: fetched_execution
  type: belongs_to
  via: fetched_execution_id
  inferred: true
- from: CreateAlertsRequest
  to: AlertsIOC
  type: has_one
  via: alert_ioc
- from: CreateAlertsRequest
  to: original_alert
  type: belongs_to
  via: original_alert_id
  inferred: true
- from: ListAlertsFilter
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: ListAlertsFilter
  to: TimeRange
  type: has_one
  via: modified_at_time_range
- from: ListAlertsFilter
  to: TimeRange
  type: has_one
  via: created_at_time_range
- from: SortFields
  to: SortOrder
  type: has_one
  via: sort_order
- from: ListAlertsRequest
  to: ListAlertsFilter
  type: has_one
  via: filter
- from: ListAlertsRequest
  to: SortFields
  type: has_many
  via: sort
- from: UpdateAlertRequest
  to: AlertInvestigationStatus
  type: has_one
  via: investigation_status
- from: UpdateAlertRequest
  to: investigation_playbook
  type: belongs_to
  via: investigation_playbook_id
  inferred: true
- from: UpdateAlertRequest
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: UpdateAlertRequest
  to: linked_case
  type: belongs_to
  via: linked_case_id
  inferred: true
- from: UpdateAlertRequest
  to: AlertsIOC
  type: has_one
  via: alert_ioc
- from: UpdateAlertRequest
  to: original_alert
  type: belongs_to
  via: original_alert_id
  inferred: true
- from: InvestigateAlertResponse
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: ListAlertTypesWithPropertiesResponse
  to: AlertTypeWithProperties
  type: has_many
  via: data
- from: UpsertAlertTypeRequest
  to: AlertTypeSeverity
  type: has_one
  via: default_severity
- from: UpsertAlertTypeResponse
  to: AlertTypeWithProperties
  type: has_one
  via: data
- from: ListAlertTypesRequest
  to: ListAlertTypesFilter
  type: has_one
  via: filter
- from: CostTrimSnapshotRow
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: CostTrimAnalysisResponse
  to: CostTrimTotals
  type: has_one
  via: totals
- from: InvestigationTierListResponse
  to: InvestigationTierRow
  type: has_many
  via: tiers
- from: UpdateInvestigationTiersRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: UpdateInvestigationTiersRequest
  to: UpdateInvestigationTierItem
  type: has_many
  via: tiers
- from: CreditUsageEntry
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: InvestigationCreditUsageResponse
  to: CreditUsageEntry
  type: has_many
  via: entries
- from: ChargeInvestigationCreditsRequest
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: AlertBudgetOverviewRow
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: AlertBudgetOverviewRow
  to: AlertSkipSummary
  type: has_one
  via: skip_summary
- from: AlertBudgetOverviewResponse
  to: AlertBudgetOverviewRow
  type: has_many
  via: orgs
- from: AlertBudgetOverviewResponse
  to: AlertBudgetTotals
  type: has_one
  via: totals
- from: AlertSkipListResponse
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: AlertSkipListResponse
  to: AlertSkipRow
  type: has_many
  via: rows
- from: AlertSkipLifecycleRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: AlertSkipLifecycleRequest
  to: AlertSkipItem
  type: has_many
  via: items
- from: AlertMinimal
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: AlertMinimal
  to: alert
  type: belongs_to
  via: alert_uuid
  inferred: true
- from: AlertMinimal
  to: AlertsIOC
  type: has_one
  via: alert_ioc
- from: AlertMinimal
  to: organization
  type: belongs_to
  via: organization_uuid
  inferred: true
- from: AlertMinimal
  to: fetched_playbook
  type: belongs_to
  via: fetched_playbook_id
  inferred: true
- from: AlertMinimal
  to: fetched_execution
  type: belongs_to
  via: fetched_execution_id
  inferred: true
- from: AlertMinimal
  to: investigation_playbook
  type: belongs_to
  via: investigation_playbook_id
  inferred: true
- from: AlertMinimal
  to: AlertInvestigationStatus
  type: has_one
  via: investigation_status
- from: AlertMinimal
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: AlertMinimal
  to: linked_case
  type: belongs_to
  via: linked_case_id
  inferred: true
- from: AlertMinimal
  to: original_alert
  type: belongs_to
  via: original_alert_id
  inferred: true
- from: AlertMinimal
  to: ProviderDetails
  type: has_one
  via: alert_provider_details
- from: ListAlertsResponse
  to: AlertMinimal
  type: has_many
  via: data
- from: Webhook
  to: webhook
  type: belongs_to
  via: webhook_id
  inferred: true
- from: Webhook
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: Webhook
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: Webhook
  to: UserInformation
  type: has_one
  via: created_by
- from: ListWebhooksResponse
  to: Webhook
  type: has_many
  via: webhooks
- from: CreateWebhookRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateWebhookRequest
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: CreateAlertFromWebhookResponse
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: ListAlertCatalogTypesFilter
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: ListAlertCatalogTypesRequest
  to: ListAlertCatalogTypesFilter
  type: has_one
  via: filter
- from: ListAlertCatalogTypesRequest
  to: SortFields
  type: has_many
  via: sort
- from: AlertCatalogCaseSummary
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: AlertCatalogCaseSummary
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: AlertCatalogCaseSummary
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: ListAlertCatalogTypesResponse
  to: AlertCatalogCaseSummary
  type: has_many
  via: data
- from: schemas-ProviderSummary
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: ListAlertCatalogProvidersResponse
  to: schemas-ProviderSummary
  type: has_many
  via: data
- from: GetExecutionLogResponse
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: GetExecutionLogResponse
  to: skill
  type: belongs_to
  via: skill_id
  inferred: true
- from: GetExecutionLogResponse
  to: alert
  type: belongs_to
  via: alert_id
  inferred: true
- from: GetExecutionLogResponse
  to: SkillExecutionOutput
  type: has_many
  via: step_outputs
- from: GetExecutionLogResponse
  to: chat_session
  type: belongs_to
  via: chat_session_id
  inferred: true
- from: AlertCatalogMetaData
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: AlertCatalogData
  to: CaseDetailsV2
  type: has_one
  via: case
- from: AlertCatalogData
  to: GetExecutionLogResponse
  type: has_one
  via: playbook_execution
- from: AlertCatalogData
  to: AlertCatalogMetaData
  type: has_one
  via: meta_data
- from: GetAlertCatalogResponse
  to: AlertCatalogData
  type: has_one
  via: data
- from: GetCaseInAlertCatalogResponse
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: GetCaseInAlertCatalogResponse
  to: previous_case
  type: belongs_to
  via: previous_case_id
  inferred: true
- from: GetCaseInAlertCatalogResponse
  to: AlertCatalogMetaData
  type: has_one
  via: meta_data
- from: UpsertCaseInAlertCatalogRequest
  to: provider
  type: belongs_to
  via: provider_id
  inferred: true
- from: AlertCatalogExecutionHistory
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: AlertCatalogExecutionHistory
  to: alert_provider
  type: belongs_to
  via: alert_provider_id
  inferred: true
- from: GetAlertCatalogExecutionHistoryResponse
  to: AlertCatalogExecutionHistory
  type: has_many
  via: data
- from: GetAlertCatalogByExecutionIdResponse
  to: AlertCatalogData
  type: has_one
  via: data
- from: GenerateSecurityReportRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: GenerateSecurityReportResponse
  to: review
  type: belongs_to
  via: review_id
  inferred: true
- from: SecurityReportSummary
  to: review
  type: belongs_to
  via: review_id
  inferred: true
- from: SecurityReportSummary
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: SecurityReportSummary
  to: SecurityReviewStatus
  type: has_one
  via: status
- from: ListSecurityReportsResponse
  to: SecurityReportSummary
  type: has_many
  via: data
- from: SecurityReviewKPIs
  to: ResponseTimeMetric
  type: has_one
  via: mtti
- from: SecurityReviewKPIs
  to: ResponseTimeMetric
  type: has_one
  via: mtta
- from: SecurityReviewDataSources
  to: AlertSourceCount
  type: has_many
  via: top_alert_sources
- from: SecurityReviewDataSources
  to: AlertTypeFrequency
  type: has_many
  via: top_alert_types_by_frequency
- from: DataSourceHealthSummary
  to: ConnectionCountSummary
  type: has_one
  via: connections_summary
- from: SecurityReviewDataSourceStatus
  to: DataSourceConnectionStatus
  type: has_one
  via: status
- from: SecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: total_cases
- from: SecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: escalations
- from: SecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: fp_rate
- from: SecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: avg_mtti
- from: SecurityReviewReport
  to: SecurityReviewKPIs
  type: has_one
  via: kpis
- from: SecurityReviewReport
  to: BriefingSummary
  type: has_many
  via: executive_briefing
- from: SecurityReviewReport
  to: SecurityReviewDataSources
  type: has_one
  via: data_sources
- from: SecurityReviewReport
  to: SecurityReviewCaseDispositionMetrics
  type: has_one
  via: case_disposition_breakdown
- from: SecurityReviewReport
  to: SecurityReviewSeverityMetrics
  type: has_one
  via: severity_breakdown
- from: SecurityReviewReport
  to: SecurityReviewEscalation
  type: has_many
  via: escalations
- from: SecurityReviewReport
  to: FPBenignSummary
  type: has_one
  via: fp_benign_summary
- from: SecurityReviewReport
  to: DataSourceHealthSummary
  type: has_many
  via: data_source_health
- from: SecurityReviewReport
  to: SecurityReviewDataSourceStatus
  type: has_many
  via: missing_data_sources
- from: SecurityReviewReport
  to: SecurityReviewImprovement
  type: has_many
  via: strategic_improvements
- from: SecurityReviewReport
  to: SecurityReviewPeriodComparison
  type: has_one
  via: period_comparison
- from: SecurityReport
  to: review
  type: belongs_to
  via: review_id
  inferred: true
- from: SecurityReport
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: SecurityReport
  to: SecurityReviewStatus
  type: has_one
  via: status
- from: SecurityReport
  to: SecurityReviewReport
  type: has_one
  via: report
- from: GetSecurityReportResponse
  to: SecurityReport
  type: has_one
  via: data
- from: UpdateSecurityReviewKPIs
  to: ResponseTimeMetric
  type: has_one
  via: mtti
- from: UpdateSecurityReviewKPIs
  to: ResponseTimeMetric
  type: has_one
  via: mtta
- from: UpdateSecurityReviewDataSources
  to: AlertSourceCount
  type: has_many
  via: top_alert_sources
- from: UpdateSecurityReviewDataSources
  to: AlertTypeFrequency
  type: has_many
  via: top_alert_types_by_frequency
- from: UpdateSecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: total_cases
- from: UpdateSecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: escalations
- from: UpdateSecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: fp_rate
- from: UpdateSecurityReviewPeriodComparison
  to: PeriodMetric
  type: has_one
  via: avg_mtti
- from: UpdateSecurityReviewReport
  to: UpdateSecurityReviewKPIs
  type: has_one
  via: kpis
- from: UpdateSecurityReviewReport
  to: BriefingSummary
  type: has_many
  via: executive_briefing
- from: UpdateSecurityReviewReport
  to: UpdateSecurityReviewDataSources
  type: has_one
  via: data_sources
- from: UpdateSecurityReviewReport
  to: SecurityReviewCaseDispositionMetrics
  type: has_one
  via: case_disposition_breakdown
- from: UpdateSecurityReviewReport
  to: SecurityReviewSeverityMetrics
  type: has_one
  via: severity_breakdown
- from: UpdateSecurityReviewReport
  to: SecurityReviewEscalation
  type: has_many
  via: escalations
- from: UpdateSecurityReviewReport
  to: FPBenignSummary
  type: has_one
  via: fp_benign_summary
- from: UpdateSecurityReviewReport
  to: SecurityReviewDataSourceStatus
  type: has_many
  via: data_source_health
- from: UpdateSecurityReviewReport
  to: SecurityReviewDataSourceStatus
  type: has_many
  via: missing_data_sources
- from: UpdateSecurityReviewReport
  to: SecurityReviewImprovement
  type: has_many
  via: strategic_improvements
- from: UpdateSecurityReviewReport
  to: UpdateSecurityReviewPeriodComparison
  type: has_one
  via: period_comparison
- from: UpdateSecurityReportRequest
  to: SecurityReviewStatus
  type: has_one
  via: status
- from: UpdateSecurityReportRequest
  to: UpdateSecurityReviewReport
  type: has_one
  via: report
- from: ListReportWatchersResponse
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: ListReportWatchersResponse
  to: ReportWatcher
  type: has_many
  via: watchers
- from: UpsertReportWatcherRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: DeleteReportWatcherRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: SectionSetting
  to: CaseSection
  type: has_one
  via: field_name
- from: LayoutSectionItem
  to: LayoutWidgetItem
  type: has_many
  via: children
- from: ViewLayout
  to: LayoutWidgetItem
  type: has_many
  via: pinned
- from: ViewSettings
  to: SectionSetting
  type: has_many
  via: sections
- from: ViewSettings
  to: ViewLayout
  type: has_one
  via: layout
- from: SavedView
  to: view
  type: belongs_to
  via: view_id
  inferred: true
- from: SavedView
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: SavedView
  to: CaseFilterV2
  type: has_one
  via: filter
- from: SavedView
  to: CaseSort
  type: has_many
  via: sort
- from: SavedView
  to: UserDetails
  type: has_one
  via: created_by
- from: SavedView
  to: UserDetails
  type: has_one
  via: modified_by
- from: SavedView
  to: CaseViewMode
  type: has_one
  via: view_mode
- from: SavedView
  to: ViewSettings
  type: has_one
  via: view_settings
- from: ListSavedViewsResponse
  to: SavedView
  type: has_many
  via: data
- from: CreateSavedViewRequest
  to: CaseFilterV2
  type: has_one
  via: filter
- from: CreateSavedViewRequest
  to: CaseSort
  type: has_many
  via: sort
- from: CreateSavedViewRequest
  to: CaseViewMode
  type: has_one
  via: view_mode
- from: CreateSavedViewRequest
  to: ViewSettings
  type: has_one
  via: view_settings
- from: SavedViewResponse
  to: SavedView
  type: has_one
  via: data
- from: UpdateSavedViewRequest
  to: CaseFilterV2
  type: has_one
  via: filter
- from: UpdateSavedViewRequest
  to: CaseSort
  type: has_many
  via: sort
- from: UpdateSavedViewRequest
  to: CaseViewMode
  type: has_one
  via: view_mode
- from: UpdateSavedViewRequest
  to: ViewSettings
  type: has_one
  via: view_settings
- from: UserViewPreference
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: UserViewPreference
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: UserViewPreference
  to: selected_view
  type: belongs_to
  via: selected_view_id
  inferred: true
- from: UserViewPreference
  to: selected_preset
  type: belongs_to
  via: selected_preset_id
  inferred: true
- from: UserViewPreference
  to: selected_case
  type: belongs_to
  via: selected_case_id
  inferred: true
- from: UserViewPreference
  to: CaseFilterV2
  type: has_one
  via: selected_view_filter
- from: UserViewPreference
  to: CaseSort
  type: has_many
  via: selected_view_sort
- from: UserViewPreference
  to: CaseFilterV2
  type: has_one
  via: temp_filter
- from: UserViewPreference
  to: CaseSort
  type: has_many
  via: temp_sort
- from: UserViewPreference
  to: CaseViewMode
  type: has_one
  via: selected_view_mode
- from: UserViewPreference
  to: ViewSettings
  type: has_one
  via: view_settings
- from: UserViewPreferenceResponse
  to: UserViewPreference
  type: has_one
  via: data
- from: UpdateUserViewPreferenceRequest
  to: selected_view
  type: belongs_to
  via: selected_view_id
  inferred: true
- from: UpdateUserViewPreferenceRequest
  to: selected_preset
  type: belongs_to
  via: selected_preset_id
  inferred: true
- from: UpdateTemporaryFiltersRequest
  to: CaseFilterV2
  type: has_one
  via: temp_filter
- from: UpdateTemporaryFiltersRequest
  to: CaseSort
  type: has_many
  via: temp_sort
- from: UpdateTemporaryFiltersRequest
  to: selected_case
  type: belongs_to
  via: selected_case_id
  inferred: true
- from: UpdateTemporaryFiltersRequest
  to: CaseViewMode
  type: has_one
  via: selected_view_mode
- from: CreateCustomCaseFieldRequest
  to: CustomFieldType
  type: has_one
  via: type
- from: CreateCustomCaseFieldRequest
  to: CustomFieldScope
  type: has_one
  via: scope
- from: CreateCustomCaseFieldRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CustomField
  to: CustomFieldType
  type: has_one
  via: type
- from: CustomField
  to: CustomFieldScope
  type: has_one
  via: scope
- from: CustomField
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CustomField
  to: UserInformation
  type: has_one
  via: created_by
- from: UpsertCustomCaseFieldResponse
  to: CustomField
  type: has_one
  via: data
- from: GetCustomCaseFieldsRequest
  to: CaseSort
  type: has_one
  via: sort
- from: GetCustomCaseFieldsResponse
  to: CustomField
  type: has_many
  via: data
- from: GetCustomCaseFieldValuesResponse
  to: CaseCustomFieldValue
  type: has_many
  via: data
- from: CaseCategory
  to: CaseSubCategory
  type: has_many
  via: sub_categories
- from: StyleConfig
  to: Adornments
  type: has_one
  via: start_adornments
- from: StyleConfig
  to: Adornments
  type: has_one
  via: end_adornments
- from: EnumOption
  to: StyleConfig
  type: has_one
  via: style_config
- from: CasePriorityConfig
  to: PriorityConfig
  type: has_one
  via: analyst_priority_config
- from: CasePriorityConfig
  to: PriorityConfig
  type: has_one
  via: customer_priority_config
- from: HiddenDashboardWidgets
  to: CaseAnalyticsWidget
  type: has_many
  via: case_analytics_widgets
- from: HiddenDashboardWidgets
  to: SocPerformanceWidget
  type: has_many
  via: soc_performance_widgets
- from: OrganizationCaseConfiguration
  to: CaseCategory
  type: has_many
  via: case_categories
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: severity_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: disposition_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: status_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: finding_risk_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: action_status_options
- from: OrganizationCaseConfiguration
  to: CaseFeature
  type: has_many
  via: disabled_features
- from: OrganizationCaseConfiguration
  to: CasePriorityConfig
  type: has_one
  via: case_priority_config
- from: OrganizationCaseConfiguration
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: OrganizationCaseConfiguration
  to: HiddenDashboardWidgets
  type: has_one
  via: hidden_dashboard_widgets
- from: GetCaseConfigurationResponse
  to: OrganizationCaseConfiguration
  type: has_many
  via: data
- from: OrganizationCaseConfigurationResponse
  to: OrganizationCaseConfiguration
  type: has_one
  via: data
- from: UpdateCaseConfigurationRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: UpdateCaseConfigurationRequest
  to: HiddenDashboardWidgets
  type: has_one
  via: hidden_dashboard_widgets
- from: UpdateCaseConfigurationResponse
  to: HiddenDashboardWidgets
  type: has_one
  via: data
- from: DashboardChartConfigResponse
  to: DashboardChartConfigData
  type: has_one
  via: data
- from: SystemWidget
  to: widget
  type: belongs_to
  via: widget_id
  inferred: true
- from: SystemWidget
  to: SystemWidgetDashboardSource
  type: has_one
  via: dashboard_source
- from: ListSystemWidgetsResponse
  to: SystemWidget
  type: has_many
  via: widgets
- from: DashboardSummary
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: DashboardSummary
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: DashboardSummary
  to: PrintConfig
  type: has_one
  via: print_config
- from: ListDashboardsResponse
  to: DashboardSummary
  type: has_many
  via: dashboards
- from: CreateDashboardRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateDashboardRequest
  to: PrintConfig
  type: has_one
  via: print_config
- from: PlaybookExecutionSource
  to: playbook
  type: belongs_to
  via: playbook_uuid
  inferred: true
- from: PlaybookExecutionSource
  to: node
  type: belongs_to
  via: node_id
  inferred: true
- from: PlaybookExecutionSource
  to: schedule
  type: belongs_to
  via: schedule_id
  inferred: true
- from: SystemWidgetSelection
  to: widget
  type: belongs_to
  via: widget_id
  inferred: true
- from: WidgetDetail
  to: widget
  type: belongs_to
  via: widget_id
  inferred: true
- from: WidgetDetail
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: WidgetDetail
  to: WidgetSourceType
  type: has_one
  via: source_type
- from: WidgetDetail
  to: WidgetLayout
  type: has_one
  via: layout
- from: WidgetDetail
  to: PlaybookExecutionSource
  type: has_one
  via: playbook_execution_source
- from: WidgetDetail
  to: SystemWidgetSelection
  type: has_one
  via: system_widget_source
- from: GetDashboardResponse
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: GetDashboardResponse
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: GetDashboardResponse
  to: WidgetDetail
  type: has_many
  via: widgets
- from: GetDashboardResponse
  to: PrintConfig
  type: has_one
  via: print_config
- from: WidgetLayoutUpdate
  to: widget
  type: belongs_to
  via: widget_id
  inferred: true
- from: WidgetLayoutUpdate
  to: WidgetLayout
  type: has_one
  via: layout
- from: UpdateDashboardRequest
  to: WidgetLayoutUpdate
  type: has_many
  via: widget_layout_updates
- from: UpdateDashboardRequest
  to: PrintConfig
  type: has_one
  via: print_config
- from: UpdateDashboardResponse
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: UpdateDashboardResponse
  to: PrintConfig
  type: has_one
  via: print_config
- from: EmailCustomDashboardRequest
  to: GetDashboardResponse
  type: has_one
  via: dashboard
- from: CreateWidgetRequest
  to: WidgetSourceType
  type: has_one
  via: source_type
- from: CreateWidgetRequest
  to: WidgetLayout
  type: has_one
  via: layout
- from: CreateWidgetRequest
  to: PlaybookExecutionSource
  type: has_one
  via: playbook_execution_source
- from: CreateWidgetRequest
  to: SystemWidgetSelection
  type: has_one
  via: system_widget_source
- from: CreateWidgetResponse
  to: widget
  type: belongs_to
  via: widget_id
  inferred: true
- from: CreateWidgetResponse
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: CreateWidgetResponse
  to: WidgetSourceType
  type: has_one
  via: source_type
- from: CreateWidgetResponse
  to: WidgetLayout
  type: has_one
  via: layout
- from: CreateWidgetResponse
  to: PlaybookExecutionSource
  type: has_one
  via: playbook_execution_source
- from: CreateWidgetResponse
  to: SystemWidgetSelection
  type: has_one
  via: system_widget_source
- from: CreateWidgetsRequest
  to: CreateWidgetRequest
  type: has_many
  via: widgets
- from: CreateWidgetsResponse
  to: CreateWidgetResponse
  type: has_many
  via: widgets
- from: UpdateWidgetRequest
  to: WidgetLayout
  type: has_one
  via: layout
- from: UpdateWidgetRequest
  to: PlaybookExecutionSource
  type: has_one
  via: playbook_execution_source
- from: UpdateWidgetRequest
  to: SystemWidgetSelection
  type: has_one
  via: system_widget_source
- from: UpdateWidgetResponse
  to: widget
  type: belongs_to
  via: widget_id
  inferred: true
- from: UpdateWidgetResponse
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: UpdateWidgetResponse
  to: WidgetLayout
  type: has_one
  via: layout
- from: DashboardSchedule
  to: schedule
  type: belongs_to
  via: schedule_id
  inferred: true
- from: DashboardSchedule
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: DashboardSchedule
  to: ScheduleFrequency
  type: has_one
  via: frequency
- from: DashboardSchedule
  to: ScheduleRecurrence
  type: has_one
  via: recurrence
- from: ListDashboardSchedulesResponse
  to: DashboardSchedule
  type: has_many
  via: schedules
- from: CreateDashboardScheduleRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateDashboardScheduleRequest
  to: ScheduleFrequency
  type: has_one
  via: frequency
- from: CreateDashboardScheduleRequest
  to: ScheduleRecurrence
  type: has_one
  via: recurrence
- from: BulkCreateDashboardScheduleRequest
  to: CreateDashboardScheduleRequest
  type: has_many
  via: schedules
- from: DashboardScheduleResult
  to: schedule
  type: belongs_to
  via: schedule_id
  inferred: true
- from: DashboardScheduleResult
  to: DashboardSchedule
  type: has_one
  via: schedule
- from: BulkDashboardScheduleResponse
  to: DashboardScheduleResult
  type: has_many
  via: results
- from: UpdateDashboardScheduleRequest
  to: ScheduleFrequency
  type: has_one
  via: frequency
- from: UpdateDashboardScheduleRequest
  to: ScheduleRecurrence
  type: has_one
  via: recurrence
- from: BulkUpdateDashboardScheduleRequest
  to: UpdateDashboardScheduleItem
  type: has_many
  via: schedules
- from: ListDashboardScheduleExecutionsRequest
  to: ScheduleExecutionStatus
  type: has_many
  via: statuses
- from: DashboardScheduleExecution
  to: execution
  type: belongs_to
  via: execution_id
  inferred: true
- from: DashboardScheduleExecution
  to: schedule
  type: belongs_to
  via: schedule_id
  inferred: true
- from: DashboardScheduleExecution
  to: dashboard
  type: belongs_to
  via: dashboard_id
  inferred: true
- from: DashboardScheduleExecution
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: DashboardScheduleExecution
  to: ScheduleExecutionStatus
  type: has_one
  via: status
- from: ListDashboardScheduleExecutionsResponse
  to: DashboardScheduleExecution
  type: has_many
  via: executions
- from: QueryExecuteRequest
  to: AggregateRequest
  type: has_one
  via: aggregate
- from: QueryErrorResponse
  to: QueryValidationError
  type: has_many
  via: errors
- from: QueryValidateRequest
  to: AggregateRequest
  type: has_one
  via: aggregate
- from: QueryValidateResponse
  to: QueryValidationError
  type: has_many
  via: errors
- from: SocEmailRequestFilter
  to: org
  type: belongs_to
  via: org_id
  inferred: true
- from: SocEmailRequest
  to: SocEmailRequestFilter
  type: has_one
  via: filter
- from: CaseAnalyticsEmailRequestFilter
  to: org
  type: belongs_to
  via: org_id
  inferred: true
- from: CaseAnalyticsEmailRequest
  to: CaseAnalyticsEmailRequestFilter
  type: has_one
  via: filter
- from: CaseActionsSort
  to: SortOrder
  type: has_one
  via: order
- from: CaseActionsFilter
  to: ActionSeverityLevel
  type: has_many
  via: action_severity
- from: CaseActionsFilter
  to: ActionStatusV2
  type: has_many
  via: status_v2
- from: CaseActionsFilter
  to: CaseActionsDateRange
  type: has_one
  via: case_modified_at
- from: CaseActionsFilter
  to: CaseActionsFilterAssigneeListItem
  type: has_many
  via: assignee_list
- from: CaseActionsRequest
  to: CaseActionsSort
  type: has_one
  via: sort
- from: CaseActionsRequest
  to: CaseActionsFilter
  type: has_one
  via: filter
- from: CaseActionListItem
  to: ActionSeverityLevel
  type: has_one
  via: action_severity
- from: CaseActionListItem
  to: UserDetails
  type: has_one
  via: assignee
- from: CaseActionListItem
  to: AssigneeDetails
  type: has_one
  via: assignee_v2
- from: CaseActionListItem
  to: case
  type: belongs_to
  via: case_id
  inferred: true
- from: CaseActionListItem
  to: case
  type: belongs_to
  via: case_uuid
  inferred: true
- from: CaseActionListItem
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CaseActionListItem
  to: session
  type: belongs_to
  via: session_id
  inferred: true
- from: CaseActionListItem
  to: blocking_fact
  type: belongs_to
  via: blocking_fact_id
  inferred: true
- from: CaseActionListItem
  to: playbook
  type: belongs_to
  via: playbook_id
  inferred: true
- from: CaseActionListItem
  to: ActionStatusV2
  type: has_one
  via: status_v2
- from: CaseActionListItem
  to: ActionExecutionDetails
  type: has_one
  via: execution_details
- from: CaseActionsResponse
  to: CaseActionListItem
  type: has_many
  via: items
- from: OrganizationMinimal
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: AirMDRFeature
  to: feature
  type: belongs_to
  via: feature_id
  inferred: true
- from: Permission
  to: permission
  type: belongs_to
  via: permission_id
  inferred: true
- from: Organization
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: Organization
  to: parent_organization
  type: belongs_to
  via: parent_organization_id
  inferred: true
- from: Organization
  to: OrganizationMinimal
  type: has_one
  via: parent_organization
- from: Organization
  to: AirMDRFeature
  type: has_many
  via: features
- from: Organization
  to: Permission
  type: has_many
  via: permissions
- from: GetOrganizationListResponse
  to: Organization
  type: has_many
  via: data
- from: OrganizationSSOConfiguration
  to: SSOConfigSource
  type: has_one
  via: sso_config_source
- from: OrganizationSSOConfiguration
  to: entity
  type: belongs_to
  via: entity_id
  inferred: true
- from: OrganizationDarrylConfigurationRequest
  to: ConfigSource
  type: has_one
  via: darryl_config_source
- from: AlertTypeInvestigationConfig
  to: ProviderInvestigationType
  type: has_one
  via: investigation_type
- from: ProviderInvestigationConfig
  to: ProviderInvestigationType
  type: has_one
  via: investigation_type
- from: ProviderInvestigationConfig
  to: AlertTypeInvestigationConfig
  type: has_many
  via: alert_type_configs
- from: UpdateOrganizationInvestigationConfigurationRequest
  to: CreditSource
  type: has_one
  via: credit_source
- from: UpdateOrganizationInvestigationConfigurationRequest
  to: OrgInvestigationType
  type: has_one
  via: investigation_type
- from: UpdateOrganizationInvestigationConfigurationRequest
  to: ProviderInvestigationConfig
  type: has_many
  via: provider_configs
- from: CreateOrganizationRequest
  to: parent_organization
  type: belongs_to
  via: parent_organization_id
  inferred: true
- from: CreateOrganizationRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateOrganizationRequest
  to: OrganizationSSOConfiguration
  type: has_one
  via: sso_configuration
- from: CreateOrganizationRequest
  to: OrganizationDarrylConfigurationRequest
  type: has_one
  via: darryl_configuration
- from: CreateOrganizationRequest
  to: rbac_template
  type: belongs_to
  via: rbac_template_id
  inferred: true
- from: CreateOrganizationRequest
  to: UpdateOrganizationInvestigationConfigurationRequest
  type: has_one
  via: investigation_configuration
- from: CaseCategory
  to: CaseSubCategory
  type: has_many
  via: sub_categories
- from: StyleConfig
  to: Adornments
  type: has_one
  via: start_adornments
- from: StyleConfig
  to: Adornments
  type: has_one
  via: end_adornments
- from: EnumOption
  to: StyleConfig
  type: has_one
  via: style_config
- from: CasePriorityConfig
  to: PriorityConfig
  type: has_one
  via: analyst_priority_config
- from: CasePriorityConfig
  to: PriorityConfig
  type: has_one
  via: customer_priority_config
- from: OrganizationCaseConfiguration
  to: CaseCategory
  type: has_many
  via: case_categories
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: severity_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: disposition_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: status_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: finding_risk_options
- from: OrganizationCaseConfiguration
  to: EnumOption
  type: has_many
  via: action_status_options
- from: OrganizationCaseConfiguration
  to: CaseFeature
  type: has_many
  via: disabled_features
- from: OrganizationCaseConfiguration
  to: CasePriorityConfig
  type: has_one
  via: case_priority_config
- from: OrganizationDarrylConfiguration
  to: ConfigSource
  type: has_one
  via: darryl_config_source
- from: OrganizationMetabaseConfiguration
  to: MetabaseDashboard
  type: has_many
  via: dashboards
- from: ParentVisibility
  to: VisibilitySetting
  type: has_one
  via: user_mgmt
- from: ParentVisibility
  to: VisibilitySetting
  type: has_one
  via: org_data
- from: ChildVisibility
  to: VisibilitySetting
  type: has_one
  via: org_data
- from: OrgVisibility
  to: VisibilitySetting
  type: has_one
  via: org_data
- from: OrganizationRBACConfiguration
  to: template
  type: belongs_to
  via: template_id
  inferred: true
- from: OrganizationRBACConfiguration
  to: ParentVisibility
  type: has_one
  via: parent_visibility
- from: OrganizationRBACConfiguration
  to: ChildVisibility
  type: has_one
  via: child_visibility
- from: OrganizationRBACConfiguration
  to: OrgVisibility
  type: has_one
  via: org_visibility
- from: OrganizationInvestigationConfiguration
  to: CreditSource
  type: has_one
  via: credit_source
- from: OrganizationInvestigationConfiguration
  to: OrgInvestigationType
  type: has_one
  via: investigation_type
- from: OrganizationInvestigationConfiguration
  to: ProviderInvestigationConfig
  type: has_many
  via: provider_configs
- from: OrganizationConfiguration
  to: OrganizationCaseConfiguration
  type: has_one
  via: case_configuration
- from: OrganizationConfiguration
  to: OrganizationSSOConfiguration
  type: has_one
  via: sso_configuration
- from: OrganizationConfiguration
  to: OrganizationDarrylConfiguration
  type: has_one
  via: darryl_configuration
- from: OrganizationConfiguration
  to: OrganizationMetabaseConfiguration
  type: has_one
  via: metabase_configuration
- from: OrganizationConfiguration
  to: OrganizationRBACConfiguration
  type: has_one
  via: rbac_configuration
- from: OrganizationConfiguration
  to: OrganizationInvestigationConfiguration
  type: has_one
  via: investigation_configuration
- from: UpdateOrganizationResponse
  to: OrganizationWithConfiguration
  type: has_one
  via: data
- from: FilterOrganizationRequest
  to: root_organization
  type: belongs_to
  via: root_organization_id
  inferred: true
- from: FilterOrganizationListResponse
  to: OrganizationWithConfiguration
  type: has_many
  via: data
- from: GetOrganizationResponse
  to: OrganizationWithConfiguration
  type: has_one
  via: data
- from: UpdateOrganizationRequest
  to: OrganizationSSOConfiguration
  type: has_one
  via: sso_configuration
- from: UpdateOrganizationRequest
  to: OrganizationDarrylConfigurationRequest
  type: has_one
  via: darryl_configuration
- from: UpdateOrganizationRequest
  to: rbac_template
  type: belongs_to
  via: rbac_template_id
  inferred: true
- from: UpdateOrganizationRequest
  to: UpdateOrganizationInvestigationConfigurationRequest
  type: has_one
  via: investigation_configuration
- from: UploadOrganizationLogoResponse
  to: LogoDetails
  type: has_one
  via: data
- from: UploadFileResponse
  to: FileDetails
  type: has_one
  via: data
- from: GetOrganizationInternalResponse
  to: OrganizationWithConfigurationInternal
  type: has_one
  via: data
- from: AccessibleOrganizationsRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: FeaturePermission
  to: feature
  type: belongs_to
  via: feature_id
  inferred: true
- from: CreateUserGroupRequest
  to: parent_organization
  type: belongs_to
  via: parent_organization_id
  inferred: true
- from: CreateUserGroupRequest
  to: AccessibleOrganizationsRequest
  type: has_many
  via: accessible_organizations
- from: CreateUserGroupRequest
  to: FeaturePermission
  type: has_many
  via: features
- from: UserMinimal
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: OrganizationMinimalWithUserGroupConfig
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: UserGroupListItem
  to: user_group
  type: belongs_to
  via: user_group_id
  inferred: true
- from: UserGroupListItem
  to: UserGroupType
  type: has_one
  via: type
- from: UserGroupListItem
  to: UserMinimal
  type: has_many
  via: users
- from: UserGroupListItem
  to: OrganizationMinimalWithUserGroupConfig
  type: has_many
  via: accessible_organizations
- from: UserGroupListItem
  to: OrganizationMinimal
  type: has_one
  via: parent_organization
- from: UpdateUserGroupResponse
  to: UserGroup
  type: has_one
  via: data
- from: AccessibleOrganizationsFilterRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: ListUserGroupFilter
  to: AccessibleOrganizationsFilterRequest
  type: has_many
  via: accessible_organization_list
- from: ListUserGroupFilter
  to: UserGroupType
  type: has_many
  via: user_group_types
- from: SortFields
  to: SortOrder
  type: has_one
  via: sort_order
- from: FilterUserGroupRequest
  to: ListUserGroupFilter
  type: has_one
  via: filter
- from: FilterUserGroupRequest
  to: SortFields
  type: has_many
  via: sort
- from: ListUserGroupResponse
  to: UserGroupListItem
  type: has_many
  via: data
- from: GetUserGroupResponse
  to: UserGroup
  type: has_one
  via: data
- from: UpdateUserGroupRequest
  to: AccessibleOrganizationsRequest
  type: has_many
  via: accessible_organizations
- from: UpdateUserGroupRequest
  to: FeaturePermission
  type: has_many
  via: features
- from: AuthenticateUserData
  to: session
  type: belongs_to
  via: session_id
  inferred: true
- from: AuthenticateUserData
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: AuthenticateUserData
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: AuthenticateUserData
  to: active_organization
  type: belongs_to
  via: active_organization_id
  inferred: true
- from: AuthenticateUserData
  to: token
  type: belongs_to
  via: token_id
  inferred: true
- from: AuthenticateUserResponse
  to: AuthenticateUserData
  type: has_one
  via: data
- from: LoginUser
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: LoginUser
  to: OrganizationMinimal
  type: has_one
  via: parent_organization
- from: LoginUser
  to: UserStatus
  type: has_one
  via: status
- from: LoginUser
  to: UserRole
  type: has_one
  via: role
- from: LoginUser
  to: AirMDRFeature
  type: has_many
  via: features
- from: LoginUser
  to: Permission
  type: has_many
  via: permission
- from: LoginUserData
  to: active_organization
  type: belongs_to
  via: active_organization_id
  inferred: true
- from: LoginUserData
  to: LoginUser
  type: has_one
  via: user
- from: LoginUserResponse
  to: LoginUserData
  type: has_one
  via: data
- from: LoginUrl
  to: LoginMethod
  type: has_one
  via: login_method
- from: GetLoginUrlResponse
  to: LoginUrl
  type: has_one
  via: data
- from: UpdateSessionRequest
  to: active_organization
  type: belongs_to
  via: active_organization_id
  inferred: true
- from: CreateUserRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateUserRequest
  to: UserRole
  type: has_one
  via: role
- from: UserGroupMinimal
  to: user_group
  type: belongs_to
  via: user_group_id
  inferred: true
- from: User
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: User
  to: OrganizationMinimal
  type: has_one
  via: parent_organization
- from: User
  to: UserStatus
  type: has_one
  via: status
- from: User
  to: UserRole
  type: has_one
  via: role
- from: User
  to: AirMDRFeature
  type: has_many
  via: features
- from: User
  to: Permission
  type: has_many
  via: permissions
- from: User
  to: UserGroupMinimal
  type: has_many
  via: user_groups
- from: CreateUserResponse
  to: User
  type: has_one
  via: data
- from: ListUserFilter
  to: UserStatus
  type: has_many
  via: status_list
- from: ListUserFilter
  to: UserRole
  type: has_many
  via: role_list
- from: FilterUserRequest
  to: ListUserFilter
  type: has_one
  via: filter
- from: FilterUserRequest
  to: SortFields
  type: has_many
  via: sort
- from: FetchAllUsersResponse
  to: User
  type: has_many
  via: data
- from: FetchUserResponse
  to: User
  type: has_one
  via: data
- from: UpdateUserRequest
  to: UserRole
  type: has_one
  via: role
- from: UpdateUserResponse
  to: User
  type: has_one
  via: data
- from: VerifyEmailResponse
  to: email
  type: belongs_to
  via: email_id
  inferred: true
- from: VerifyEmailResponse
  to: User
  type: has_one
  via: user
- from: VerifyEmailResponse
  to: Organization
  type: has_one
  via: organization
- from: VerifyEmailsResponse
  to: VerifyEmailResponse
  type: has_many
  via: data
- from: SetPasswordRequest
  to: email
  type: belongs_to
  via: email_id
  inferred: true
- from: SetPasswordResponse
  to: SetPasswordData
  type: has_one
  via: data
- from: ForgetPasswordRequest
  to: email
  type: belongs_to
  via: email_id
  inferred: true
- from: ForgotPasswordResponse
  to: ForgotPasswordData
  type: has_one
  via: data
- from: RegisterTrialRequest
  to: TrialFeature
  type: has_one
  via: trail_feature
- from: GetAPITokenResponse
  to: token
  type: belongs_to
  via: token_id
  inferred: true
- from: GetAPITokenResponse
  to: encrypted_version
  type: belongs_to
  via: encrypted_version_id
  inferred: true
- from: GetAPITokenResponse
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: ListAPITokensResponse
  to: GetAPITokenResponse
  type: has_many
  via: data
- from: CreateAPITokenResponse
  to: token
  type: belongs_to
  via: token_id
  inferred: true
- from: CreateAPITokenForSlackWorkflowRequest
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: CreateAPITokenForSlackWorkflowRequest
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreateAPITokenForSlackWorkflowResponse
  to: GetAPITokenResponse
  type: has_one
  via: data
- from: FilterFeaturePermissionsRequest
  to: feature
  type: belongs_to
  via: feature_identifier
  inferred: true
- from: FilterFeaturePermissionsRequest
  to: ValidateFeaturePermissionsAction
  type: has_one
  via: operation
- from: UserFeaturePermission
  to: user
  type: belongs_to
  via: user_id
  inferred: true
- from: UserFeaturePermission
  to: feature
  type: belongs_to
  via: feature_id
  inferred: true
- from: FilterFeaturePermissionsResponse
  to: UserFeaturePermission
  type: has_many
  via: data
- from: FetchAllPermissionsResponse
  to: Permission
  type: has_many
  via: data
- from: EntityAccess
  to: OrganizationHierarchy
  type: has_one
  via: org_hierarchy
- from: PermissionAccess
  to: AccessType
  type: has_one
  via: access_type
- from: PermissionAccess
  to: EntityAccess
  type: has_many
  via: entities
- from: DisabledPermission
  to: PermissionAccess
  type: has_many
  via: access_list
- from: GetOrganizationInvestigationConfigurationResponse
  to: OrganizationInvestigationConfiguration
  type: has_one
  via: data
- from: CreditContext
  to: organization
  type: belongs_to
  via: organization_id
  inferred: true
- from: CreditContext
  to: CreditSource
  type: has_one
  via: credit_source
- from: CreditContext
  to: billing_organization
  type: belongs_to
  via: billing_organization_id
  inferred: true
- from: GetOrganizationCreditContextResponse
  to: CreditContext
  type: has_one
  via: data
- from: OrganizationFeature
  to: feature
  type: belongs_to
  via: feature_id
  inferred: true
- from: OrganizationFeature
  to: inherited_from_organization
  type: belongs_to
  via: inherited_from_organization_id
  inferred: true
- from: GetOrganizationFeaturesResponse
  to: OrganizationFeature
  type: has_many
  via: data
- from: UpdateOrganizationFeatureItem
  to: feature
  type: belongs_to
  via: feature_id
  inferred: true
- from: UpdateOrganizationFeaturesRequest
  to: UpdateOrganizationFeatureItem
  type: has_many
  via: features
- from: UpdateOrganizationFeaturesResponse
  to: OrganizationFeature
  type: has_many
  via: data
- from: OrganizationRBACTemplate
  to: template
  type: belongs_to
  via: template_id
  inferred: true
- from: OrganizationRBACTemplate
  to: ParentVisibility
  type: has_one
  via: parent_visibility
- from: OrganizationRBACTemplate
  to: ChildVisibility
  type: has_one
  via: child_visibility
- from: OrganizationRBACTemplate
  to: OrgVisibility
  type: has_one
  via: org_visibility
- from: ListOrganizationRBACTemplateResponse
  to: OrganizationRBACTemplate
  type: has_many
  via: data
- from: GetOrganizationRBACTemplateResponse
  to: OrganizationRBACTemplate
  type: has_one
  via: data
- from: ParentVisibilityPermissions
  to: VisibilitySetting
  type: has_many
  via: user_mgmt
- from: ParentVisibilityPermissions
  to: VisibilitySetting
  type: has_many
  via: org_data
- from: ChildVisibilityPermissions
  to: VisibilitySetting
  type: has_many
  via: org_data
- from: OrgVisibilityPermissions
  to: VisibilitySetting
  type: has_many
  via: org_data
- from: OrgRBACPermissions
  to: ParentVisibilityPermissions
  type: has_one
  via: parent_visibility
- from: OrgRBACPermissions
  to: ChildVisibilityPermissions
  type: has_one
  via: child_visibility
- from: OrgRBACPermissions
  to: OrgVisibilityPermissions
  type: has_one
  via: org_visibility
- from: ListOrganizationRBACPermissionsResponse
  to: OrgRBACPermissions
  type: has_one
  via: data
- from: OrganizationRBACMovementAllowList
  to: template
  type: belongs_to
  via: template_id
  inferred: true
- from: OrganizationRBACMovementResponse
  to: OrganizationRBACMovementAllowList
  type: has_many
  via: data