{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/main/json-schema/palo-alto-networks-alert-model-schema.json",
  "title": "AlertModel",
  "description": "Model for Alert",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/palo-alto-networks-alerts-api-openapi.yml#/components/schemas/AlertModel",
  "properties": {
    "alertAdditionalInfo": {
      "additionalProperties": {
        "type": "string"
      },
      "type": "object"
    },
    "alertAttribution": {
      "$ref": "#/$defs/AlertAttributionModel"
    },
    "alertCount": {
      "format": "int64",
      "type": "integer"
    },
    "alertRules": {
      "items": {
        "$ref": "#/$defs/PolicyScanConfigModel"
      },
      "type": "array"
    },
    "alertTime": {
      "description": "Timestamp when alert was last reopened for resource update, or the same as **firstSeen** if there are no status changes.",
      "format": "int64",
      "type": "integer"
    },
    "dismissalDuration": {
      "description": "Dismissal Duration",
      "type": "string"
    },
    "dismissalNote": {
      "description": "Dismissal note",
      "type": "string"
    },
    "dismissalUntilTs": {
      "description": "Dismiss until this timestamp",
      "format": "int64",
      "type": "integer"
    },
    "dismissedBy": {
      "description": "Dismissed by",
      "type": "string"
    },
    "eventOccurred": {
      "description": "Timestamp when the event occurred. Set only for Audit Event policies.",
      "format": "int64",
      "type": "integer"
    },
    "firstSeen": {
      "description": "Timestamp of the first policy violation for the alert resource (i.e. the alert creation timestamp)",
      "format": "int64",
      "type": "integer"
    },
    "history": {
      "items": {
        "$ref": "#/$defs/HistoryModel"
      },
      "type": "array"
    },
    "id": {
      "description": "Alert ID",
      "type": "string"
    },
    "lastSeen": {
      "description": "Timestamp when alert status was last updated.",
      "format": "int64",
      "type": "integer"
    },
    "lastUpdated": {
      "description": "Timestamp when alert was last updated. Updates include but are not limited to resource updates, policy updates, alert rule updates, and alert status changes.",
      "format": "int64",
      "type": "integer"
    },
    "metadata": {
      "description": "Raw JSON metadata for the alert",
      "type": "object"
    },
    "policy": {
      "$ref": "#/$defs/PolicyModel"
    },
    "policyId": {
      "description": "Policy ID",
      "type": "string"
    },
    "reason": {
      "description": "Reason",
      "readOnly": true,
      "type": "string"
    },
    "resource": {
      "$ref": "#/$defs/CloudResourceModel"
    },
    "riskDetail": {
      "allOf": [
        {
          "$ref": "#/$defs/RiskDetailModel"
        },
        {
          "description": "Risk detail (Deprecated)"
        }
      ]
    },
    "saveSearchId": {
      "description": "Saved Search ID",
      "type": "string"
    },
    "status": {
      "description": "Status",
      "enum": [
        "open",
        "dismissed",
        "snoozed",
        "resolved"
      ],
      "readOnly": true,
      "type": "string"
    },
    "triggeredBy": {
      "description": "Triggered By",
      "type": "string"
    }
  },
  "type": "object",
  "$defs": {
    "AlertAttributionModel": {
      "description": "Model for AlertAttribution",
      "properties": {
        "attributionEventList": {
          "items": {
            "$ref": "#/$defs/AttributionEventModel"
          },
          "type": "array"
        },
        "resourceCreatedBy": {
          "description": "Resource Created By",
          "type": "string"
        },
        "resourceCreatedOn": {
          "description": "Resource Created On",
          "format": "int64",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "AlertRuleNotificationConfigModel": {
      "description": "Model for Alert Rule Notification Config",
      "properties": {
        "dayOfMonth": {
          "description": "Day of month",
          "format": "int32",
          "readOnly": true,
          "type": "integer"
        },
        "daysOfWeek": {
          "description": "Days of week",
          "items": {
            "$ref": "#/$defs/WeekDay"
          },
          "readOnly": true,
          "type": "array"
        },
        "detailedReport": {
          "description": "Provide csv detailed report",
          "type": "boolean"
        },
        "enabled": {
          "description": "Scan enabled",
          "type": "boolean"
        },
        "frequency": {
          "enum": [
            "as_it_happens",
            "daily",
            "weekly",
            "monthly"
          ],
          "type": "string"
        },
        "frequencyFromRRule": {
          "description": "Frequency from RRule",
          "readOnly": true,
          "type": "string"
        },
        "hourOfDay": {
          "description": "Hour of day",
          "format": "int32",
          "readOnly": true,
          "type": "integer"
        },
        "id": {
          "description": "Alert rule notification config ID",
          "type": "string"
        },
        "includeRemediation": {
          "description": "Include remediation in detailed report",
          "type": "boolean"
        },
        "lastUpdated": {
          "description": "Last Updated",
          "format": "int64",
          "type": "integer"
        },
        "last_sent_ts": {
          "description": "Time of last notification in milliseconds",
          "format": "int64",
          "type": "integer"
        },
        "recipients": {
          "description": "* For email notifications: List of unique email addresses to notify\n* For integrations without notification templates: List of integration ids\n* For integrations with notification templates: List of notification template ids\n",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "rruleSchedule": {
          "type": "string"
        },
        "templateId": {
          "description": "Template ID",
          "type": "string"
        },
        "timezone": {
          "description": "Java time zone ID (e.g. America/Los_Angeles) ",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "Integration type",
          "enum": [
            "email",
            "slack",
            "splunk",
            "amazon_sqs",
            "jira",
            "microsoft_teams",
            "webhook",
            "aws_security_hub",
            "google_cscc",
            "service_now",
            "pager_duty",
            "azure_service_bus_queue",
            "demisto",
            "aws_s3",
            "snowflake"
          ],
          "type": "string"
        },
        "withCompression": {
          "description": "Compress detailed report",
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "AlertRulePolicyFilter": {
      "description": "Model for Alert Rule Policy Filter",
      "properties": {
        "availablePolicyFilters": {
          "description": "List of available Alert Rule Policy Filters",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "cloud.type": {
          "description": "Cloud Type Filter",
          "items": {
            "enum": [
              "ALL",
              "AWS",
              "AZURE",
              "GCP",
              "ALIBABA_CLOUD",
              "OCI",
              "IBM"
            ],
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "policy.complianceStandard": {
          "description": "Compliance Standard Filter",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "policy.label": {
          "description": "Policy Label Filter",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "policy.severity": {
          "description": "Policy Severity Filter",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        }
      },
      "type": "object"
    },
    "AttributionEventModel": {
      "description": "Model for AttributionEvent",
      "properties": {
        "event": {
          "description": "Event",
          "type": "string"
        },
        "event_ts": {
          "description": "Event Timestamp",
          "format": "int64",
          "type": "integer"
        },
        "username": {
          "description": "Username",
          "type": "string"
        }
      },
      "type": "object"
    },
    "CloudResourceModel": {
      "description": "Model for Cloud Resource",
      "properties": {
        "account": {
          "description": "Account",
          "type": "string"
        },
        "accountId": {
          "description": "Account ID",
          "type": "string"
        },
        "additionalInfo": {
          "allOf": [
            {
              "$ref": "#/$defs/JsonNode"
            },
            {
              "description": "Additional info"
            }
          ]
        },
        "cloudAccountAncestors": {
          "description": "Cloud account ancestors. For GCP.",
          "items": {
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "cloudAccountGroups": {
          "description": "Cloud account groups",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "cloudAccountOwners": {
          "description": "Cloud account owners. For Azure and GCP.",
          "items": {
            "type": "string"
          },
          "readOnly": true,
          "type": "array"
        },
        "cloudServiceName": {
          "description": "Cloud service name",
          "readOnly": true,
          "type": "string"
        },
        "cloudType": {
          "description": "Cloud type",
          "enum": [
            "ALL",
            "AWS",
            "AZURE",
            "GCP",
            "ALIBABA_CLOUD",
            "OCI",
            "IBM"
          ],
          "type": "string"
        },
        "data": {
          "description": "Raw JSON data for the resource",
          "readOnly": true,
          "type": "object"
        },
        "id": {
          "description": "Id",
          "type": "string"
        },
        "name": {
          "description": "Name",
          "type": "string"
        },
        "region": {
          "description": "Region name",
          "type": "string"
        },
        "regionId": {
          "description": "Region API identifier",
          "type": "string"
        },
        "resourceApiName": {
          "description": "Resource API name",
          "readOnly": true,
          "type": "string"
        },
        "resourceConfigJsonAvailable": {
          "type": "boolean"
        },
        "resourceDetailsAvailable": {
          "type": "boolean"
        },
        "resourceTags": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Resource tags",
          "type": "object"
        },
        "resourceType": {
          "description": "Resource type",
          "readOnly": true,
          "type": "string"
        },
        "rrn": {
          "description": "RRN",
          "type": "string"
        },
        "unifiedAssetId": {
          "type": "string"
        },
        "url": {
          "description": "URL",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ComplianceMetadataModel": {
      "description": "Model for ComplianceMetadata",
      "properties": {
        "complianceId": {
          "description": "Compliance Section UUID",
          "type": "string"
        },
        "customAssigned": {
          "type": "boolean"
        },
        "policyId": {
          "description": "Policy ID",
          "type": "string"
        },
        "requirementDescription": {
          "description": "Requirement description",
          "type": "string"
        },
        "requirementId": {
          "description": "Requirement ID",
          "type": "string"
        },
        "requirementName": {
          "description": "Requirement name",
          "type": "string"
        },
        "sectionDescription": {
          "description": "Section name",
          "type": "string"
        },
        "sectionId": {
          "description": "Section Id",
          "type": "string"
        },
        "sectionLabel": {
          "description": "Section Label",
          "type": "string"
        },
        "standardDescription": {
          "description": "Compliance standard description",
          "type": "string"
        },
        "standardId": {
          "type": "string"
        },
        "standardName": {
          "description": "Compliance standard name",
          "type": "string"
        }
      },
      "type": "object"
    },
    "HistoryModel": {
      "description": "Model for History",
      "properties": {
        "reason": {
          "description": "Reason",
          "readOnly": true,
          "type": "string"
        },
        "status": {
          "description": "Status",
          "enum": [
            "OPEN",
            "DISMISSED",
            "SNOOZED",
            "PENDING_RESOLUTION",
            "RESOLVED"
          ],
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "JsonNode": {
      "properties": {
        "array": {
          "type": "boolean"
        },
        "bigDecimal": {
          "type": "boolean"
        },
        "bigInteger": {
          "type": "boolean"
        },
        "binary": {
          "type": "boolean"
        },
        "boolean": {
          "type": "boolean"
        },
        "containerNode": {
          "type": "boolean"
        },
        "double": {
          "type": "boolean"
        },
        "float": {
          "type": "boolean"
        },
        "floatingPointNumber": {
          "type": "boolean"
        },
        "int": {
          "type": "boolean"
        },
        "integralNumber": {
          "type": "boolean"
        },
        "long": {
          "type": "boolean"
        },
        "missingNode": {
          "type": "boolean"
        },
        "nodeType": {
          "enum": [
            "ARRAY",
            "BINARY",
            "BOOLEAN",
            "MISSING",
            "NULL",
            "NUMBER",
            "OBJECT",
            "POJO",
            "STRING"
          ],
          "type": "string"
        },
        "null": {
          "type": "boolean"
        },
        "number": {
          "type": "boolean"
        },
        "object": {
          "type": "boolean"
        },
        "pojo": {
          "type": "boolean"
        },
        "short": {
          "type": "boolean"
        },
        "textual": {
          "type": "boolean"
        },
        "valueNode": {
          "type": "boolean"
        }
      },
      "type": "object"
    },
    "PolicyModel": {
      "description": "Model for Policy",
      "properties": {
        "cloudType": {
          "description": "Cloud type (Required for config policies). Not case-sensitive. Default is **ALL**.",
          "enum": [
            "ALL",
            "AWS",
            "AZURE",
            "GCP",
            "ALIBABA_CLOUD",
            "OCI",
            "IBM"
          ],
          "type": "string"
        },
        "complianceMetadata": {
          "description": "List of compliance data. Each item has compliance standard, requirement, and/or section information.",
          "items": {
            "$ref": "#/$defs/ComplianceMetadataModel"
          },
          "type": "array"
        },
        "createdBy": {
          "description": "Created by",
          "readOnly": true,
          "type": "string"
        },
        "createdOn": {
          "description": "Created on this timestamp",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "deleted": {
          "description": "Deleted",
          "readOnly": true,
          "type": "boolean"
        },
        "description": {
          "description": "Policy description",
          "type": "string"
        },
        "enabled": {
          "description": "true=enabled. false=disabled.",
          "type": "boolean"
        },
        "findingTypes": {
          "description": "Finding Type",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "labels": {
          "description": "Labels",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "lastModifiedBy": {
          "description": "Last modified by",
          "readOnly": true,
          "type": "string"
        },
        "lastModifiedOn": {
          "description": "Last modified on this timestamp",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "name": {
          "description": "Policy name",
          "type": "string"
        },
        "overridden": {
          "description": "Overridden",
          "readOnly": true,
          "type": "boolean"
        },
        "policyId": {
          "description": "Policy ID",
          "readOnly": true,
          "type": "string"
        },
        "policySubTypes": {
          "description": "Policy subtype",
          "items": {
            "enum": [
              "run",
              "build",
              "run_and_build",
              "audit",
              "data_classification",
              "dns",
              "malware",
              "network_event",
              "network",
              "ueba",
              "permissions",
              "network_config",
              "identity"
            ],
            "type": "string"
          },
          "readOnly": true,
          "type": "array",
          "uniqueItems": true
        },
        "policyType": {
          "description": "Policy type. Policy type **anomaly** is read-only.",
          "enum": [
            "config",
            "network",
            "audit_event",
            "anomaly",
            "data",
            "iam",
            "workload_vulnerability",
            "workload_incident",
            "waas_event",
            "attack_path"
          ],
          "type": "string"
        },
        "policyUpi": {
          "description": "Policy UPI",
          "readOnly": true,
          "type": "string"
        },
        "recommendation": {
          "description": "Remediation recommendation",
          "type": "string"
        },
        "remediable": {
          "description": "isRemediable",
          "readOnly": true,
          "type": "boolean"
        },
        "remediation": {
          "allOf": [
            {
              "$ref": "#/$defs/RemediationModel"
            },
            {
              "description": "Auto remediation info. Available only if policy is remediable."
            }
          ]
        },
        "restrictAlertDismissal": {
          "description": "Restrict alert dismissal",
          "readOnly": true,
          "type": "boolean"
        },
        "rule": {
          "allOf": [
            {
              "$ref": "#/$defs/RuleModel"
            },
            {
              "description": "Policy rule (Contains RQL search query or saved search)"
            }
          ]
        },
        "ruleLastModifiedOn": {
          "description": "Rule last modified on",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "severity": {
          "description": "Severity",
          "enum": [
            "high",
            "medium",
            "low"
          ],
          "type": "string"
        },
        "systemDefault": {
          "description": "true = Policy is a Prisma Cloud system default policy",
          "readOnly": true,
          "type": "boolean"
        }
      },
      "required": [
        "name",
        "policyType",
        "rule",
        "severity"
      ],
      "type": "object"
    },
    "PolicyRiskScoreModel": {
      "description": "Model for Policy Risk Score",
      "properties": {
        "cloudType": {
          "description": "Cloud type (Required for config policies). Not case-sensitive. Default is **ALL**.",
          "enum": [
            "ALL",
            "AWS",
            "AZURE",
            "GCP",
            "ALIBABA_CLOUD",
            "OCI",
            "IBM"
          ],
          "type": "string"
        },
        "complianceMetadata": {
          "description": "List of compliance data. Each item has compliance standard, requirement, and/or section information.",
          "items": {
            "$ref": "#/$defs/ComplianceMetadataModel"
          },
          "type": "array"
        },
        "createdBy": {
          "description": "Created by",
          "readOnly": true,
          "type": "string"
        },
        "createdOn": {
          "description": "Created on this timestamp",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "deleted": {
          "description": "Deleted",
          "readOnly": true,
          "type": "boolean"
        },
        "description": {
          "description": "Policy description",
          "type": "string"
        },
        "enabled": {
          "description": "true=enabled. false=disabled.",
          "type": "boolean"
        },
        "findingTypes": {
          "description": "Finding Type",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "labels": {
          "description": "Labels",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        },
        "lastModifiedBy": {
          "description": "Last modified by",
          "readOnly": true,
          "type": "string"
        },
        "lastModifiedOn": {
          "description": "Last modified on this timestamp",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "name": {
          "description": "Policy name",
          "type": "string"
        },
        "overridden": {
          "description": "Overridden",
          "readOnly": true,
          "type": "boolean"
        },
        "points": {
          "description": "Points",
          "type": "string"
        },
        "policyId": {
          "description": "Policy ID",
          "readOnly": true,
          "type": "string"
        },
        "policySubTypes": {
          "description": "Policy subtype",
          "items": {
            "enum": [
              "run",
              "build",
              "run_and_build",
              "audit",
              "data_classification",
              "dns",
              "malware",
              "network_event",
              "network",
              "ueba",
              "permissions",
              "network_config",
              "identity"
            ],
            "type": "string"
          },
          "readOnly": true,
          "type": "array",
          "uniqueItems": true
        },
        "policyType": {
          "description": "Policy type. Policy type **anomaly** is read-only.",
          "enum": [
            "config",
            "network",
            "audit_event",
            "anomaly",
            "data",
            "iam",
            "workload_vulnerability",
            "workload_incident",
            "waas_event",
            "attack_path"
          ],
          "type": "string"
        },
        "policyUpi": {
          "description": "Policy UPI",
          "readOnly": true,
          "type": "string"
        },
        "recommendation": {
          "description": "Remediation recommendation",
          "type": "string"
        },
        "remediable": {
          "description": "isRemediable",
          "readOnly": true,
          "type": "boolean"
        },
        "remediation": {
          "allOf": [
            {
              "$ref": "#/$defs/RemediationModel"
            },
            {
              "description": "Auto remediation info. Available only if policy is remediable."
            }
          ]
        },
        "restrictAlertDismissal": {
          "description": "Restrict alert dismissal",
          "readOnly": true,
          "type": "boolean"
        },
        "riskScore": {
          "$ref": "#/$defs/ScoreModel"
        },
        "rule": {
          "allOf": [
            {
              "$ref": "#/$defs/RuleModel"
            },
            {
              "description": "Policy rule (Contains RQL search query or saved search)"
            }
          ]
        },
        "ruleLastModifiedOn": {
          "description": "Rule last modified on",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "severity": {
          "description": "Severity",
          "enum": [
            "high",
            "medium",
            "low"
          ],
          "type": "string"
        },
        "systemDefault": {
          "description": "true = Policy is a Prisma Cloud system default policy",
          "readOnly": true,
          "type": "boolean"
        }
      },
      "required": [
        "name",
        "policyType",
        "rule",
        "severity"
      ],
      "type": "object"
    },
    "PolicyScanConfigModel": {
      "description": "Model for Policy Scan Config",
      "properties": {
        "alertRuleNotificationConfig": {
          "description": "List of data for notifications to third-party tools",
          "items": {
            "$ref": "#/$defs/AlertRuleNotificationConfigModel"
          },
          "type": "array"
        },
        "allowAutoRemediate": {
          "description": "Allow Auto-Remediation",
          "type": "boolean"
        },
        "delayNotificationMs": {
          "description": "Delay notifications by the specified milliseconds",
          "format": "int64",
          "type": "integer"
        },
        "description": {
          "description": "Rule/Scan description",
          "type": "string"
        },
        "enabled": {
          "description": "Rule/Scan is enabled",
          "type": "boolean"
        },
        "lastModifiedBy": {
          "description": "Last modified by",
          "readOnly": true,
          "type": "string"
        },
        "lastModifiedOn": {
          "description": "Last modified on this date/time in milliseconds",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "name": {
          "description": "Rule/Scan name",
          "type": "string"
        },
        "notifyOnDismissed": {
          "description": "include dismissed alerts in notification",
          "type": "boolean"
        },
        "notifyOnOpen": {
          "description": "include open alerts in notification",
          "type": "boolean"
        },
        "notifyOnResolved": {
          "description": "include resolved alerts in notification",
          "type": "boolean"
        },
        "notifyOnSnoozed": {
          "description": "include snoozed alerts in notification",
          "type": "boolean"
        },
        "policies": {
          "description": "List of specific policies to scan",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "policyLabels": {
          "description": "Policy labels",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "policyScanConfigId": {
          "description": "Policy Scan Config ID",
          "type": "string"
        },
        "scanAll": {
          "description": "Scan all policies",
          "type": "boolean"
        },
        "target": {
          "allOf": [
            {
              "$ref": "#/$defs/TargetFilterModel"
            },
            {
              "description": "TargetFilter model (target accounts)"
            }
          ]
        }
      },
      "required": [
        "name",
        "target"
      ],
      "type": "object"
    },
    "RemediationAction": {
      "description": "Action for remediation for data policy.",
      "properties": {
        "operation": {
          "type": "string"
        },
        "payload": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "RemediationModel": {
      "description": "Model for Remediation",
      "properties": {
        "actions": {
          "description": "Policy Action",
          "items": {
            "$ref": "#/$defs/RemediationAction"
          },
          "type": "array"
        },
        "cliScriptTemplate": {
          "description": "CLI Script Template",
          "type": "string"
        },
        "description": {
          "description": "Description",
          "type": "string"
        }
      },
      "type": "object"
    },
    "ResourceListIdsCollection": {
      "description": "Model for holding the lists resource list ids by resource list type",
      "properties": {
        "computeAccessGroupIds": {
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "RiskDetailModel": {
      "description": "Model for Risk Detail",
      "properties": {
        "policyScores": {
          "items": {
            "$ref": "#/$defs/PolicyRiskScoreModel"
          },
          "type": "array"
        },
        "rating": {
          "description": "Rating",
          "type": "string"
        },
        "riskScore": {
          "$ref": "#/$defs/ScoreModel"
        },
        "score": {
          "description": "Score",
          "type": "string"
        }
      },
      "type": "object"
    },
    "RuleCriteria": {
      "description": "Criteria for Rule",
      "properties": {
        "classificationResult": {
          "description": "Data policy. Required for DLP rule criteria.",
          "type": "string"
        },
        "exposure": {
          "description": "File exposure",
          "enum": [
            "private",
            "public",
            "conditional"
          ],
          "type": "string"
        },
        "extension": {
          "description": "File extensions",
          "items": {
            "type": "string"
          },
          "type": "array",
          "uniqueItems": true
        }
      },
      "type": "object"
    },
    "RuleModel": {
      "description": "Model for Rule",
      "properties": {
        "apiName": {
          "description": "API name",
          "readOnly": true,
          "type": "string"
        },
        "cloudAccount": {
          "description": "Cloud account",
          "readOnly": true,
          "type": "string"
        },
        "cloudType": {
          "description": "Cloud type",
          "readOnly": true,
          "type": "string"
        },
        "criteria": {
          "description": "Saved search ID that defines the rule criteria.",
          "type": "string"
        },
        "dataCriteria": {
          "allOf": [
            {
              "$ref": "#/$defs/RuleCriteria"
            },
            {
              "description": "Rule criteria for DLP data policy"
            }
          ]
        },
        "name": {
          "description": "Name",
          "type": "string"
        },
        "parameters": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Parameters (e.g. {\"savedSearch\": \"true\"})",
          "type": "object"
        },
        "resourceIdPath": {
          "description": "Resource ID path",
          "readOnly": true,
          "type": "string"
        },
        "resourceType": {
          "description": "Resource type",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "Type of rule or RQL query",
          "enum": [
            "Config",
            "Network",
            "AuditEvent",
            "DLP",
            "IAM",
            "NetworkConfig"
          ],
          "type": "string"
        }
      },
      "required": [
        "criteria",
        "name",
        "parameters",
        "type"
      ],
      "type": "object"
    },
    "ScoreModel": {
      "description": "Model for Score",
      "properties": {
        "maxScore": {
          "description": "Max Score",
          "format": "int64",
          "type": "integer"
        },
        "score": {
          "description": "Score",
          "format": "int64",
          "type": "integer"
        }
      },
      "type": "object"
    },
    "TargetFilterModel": {
      "description": "Model for Target Filter",
      "properties": {
        "accountGroups": {
          "description": "List of Account group(s)",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "alertRulePolicyFilter": {
          "allOf": [
            {
              "$ref": "#/$defs/AlertRulePolicyFilter"
            },
            {
              "description": "Policy Filters for the Alert Rule"
            }
          ]
        },
        "excludedAccounts": {
          "description": "List of excluded accounts",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "includedResourceLists": {
          "allOf": [
            {
              "$ref": "#/$defs/ResourceListIdsCollection"
            },
            {
              "description": "List of resource lists included which the resource has to match on."
            }
          ]
        },
        "regions": {
          "description": "List of regions for which alerts will be triggered for account groups. Alerts not associated with specific regions will be triggered regardless of listed regions. If no regions are specified, then the alerts will be triggered for all regions.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "tags": {
          "description": "List of TargetTag models (resource tags) for which alerts should be triggered",
          "items": {
            "$ref": "#/$defs/TargetTagModel"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "TargetTagModel": {
      "description": "Model for Target Tag",
      "properties": {
        "key": {
          "description": "Resource tag target",
          "type": "string"
        },
        "values": {
          "description": "List of value(s) for resource tag key",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "WeekDay": {
      "properties": {
        "day": {
          "enum": [
            "SU",
            "MO",
            "TU",
            "WE",
            "TH",
            "FR",
            "SA"
          ],
          "type": "string"
        },
        "offset": {
          "format": "int32",
          "type": "integer"
        }
      },
      "type": "object"
    }
  }
}