{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/oracle/json-schema/oracle-target-detector-recipe-detector-rule-schema.json",
  "title": "TargetDetectorRecipeDetectorRule",
  "description": "A TargetDetectorRecipeDetectorRule resource contains a specific instance of a\nsingle detector rule in one of the supported detector types (for example,\nactivity, configuration, or threat).\n\nA TargetDetectorRecipeDetectorRule resource:\n* Is effectively a copy of a DetectorRecipeRule resource (made when\na detector recipe is attached to a target) in which users can make\ncertain changes if it’s Oracle-managed, and other changes if it’s user-managed.\n* Is visible on the Cloud Guard Targets, Target Details page.\n* Is effectively located in a specific OCI compartment, through the\nThreatDetectorRecipe resource to which it belongs.\n* Can be modified by users, programmatically or through the UI.\n* Changes that can be made here apply locally, to resources in OCI compartments\nmapped to the target that attaches the associated detector recipe\n(in a TargetDetectorRecipe resource), and override any changes made in rules\nassociated with the corresponding DetectorRecipe resource.\n",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/oracle-cloudguard-api-openapi.yml#/components/schemas/TargetDetectorRecipeDetectorRule",
  "properties": {
    "dataSourceId": {
      "description": "The ID of the attached data source",
      "type": "string"
    },
    "description": {
      "description": "Description for TargetDetectorRecipeDetectorRule resource",
      "type": "string"
    },
    "details": {
      "$ref": "#/$defs/TargetDetectorDetails"
    },
    "detector": {
      "description": "Detector type for the rule",
      "enum": [
        "IAAS_ACTIVITY_DETECTOR",
        "IAAS_CONFIGURATION_DETECTOR",
        "IAAS_THREAT_DETECTOR",
        "IAAS_LOGGING_DETECTOR",
        "IAAS_LOG_INSIGHT_DETECTOR",
        "SAAS_FA_ACTIVITY_DETECTOR",
        "IAAS_CONTAINER_SECURITY_DETECTOR"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/DetectorEnum"
    },
    "detectorRuleId": {
      "description": "The unique identifier of the detector rule",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "displayName": {
      "description": "Display name for TargetDetectorRecipeDetectorRule resource",
      "type": "string"
    },
    "entitiesMappings": {
      "description": "Data source entities mapping for a detector rule",
      "items": {
        "$ref": "#/$defs/EntitiesMapping"
      },
      "type": "array"
    },
    "isCloneable": {
      "description": "Is the rule cloneable?",
      "type": "boolean"
    },
    "lifecycleDetails": {
      "description": "A message describing the current state in more detail. For example, can be used to provide actionable information for a resource in Failed state.",
      "type": "string"
    },
    "lifecycleState": {
      "description": "The current lifecycle state of the detector rule",
      "enum": [
        "CREATING",
        "UPDATING",
        "ACTIVE",
        "INACTIVE",
        "DELETING",
        "DELETED",
        "FAILED"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/LifecycleState"
    },
    "locks": {
      "description": "Locks associated with this resource.",
      "items": {
        "$ref": "#/$defs/ResourceLock"
      },
      "maxItems": 1,
      "type": "array"
    },
    "managedListTypes": {
      "description": "List of managed list types related to this rule",
      "items": {
        "enum": [
          "CIDR_BLOCK",
          "USERS",
          "GROUPS",
          "IPV4ADDRESS",
          "IPV6ADDRESS",
          "RESOURCE_OCID",
          "REGION",
          "COUNTRY",
          "STATE",
          "CITY",
          "TAGS",
          "GENERIC",
          "FUSION_APPS_ROLE",
          "FUSION_APPS_PERMISSION",
          "NAMESPACE_SELECTOR",
          "POD_RESOURCE_SELECTOR"
        ],
        "type": "string"
      },
      "type": "array"
    },
    "recommendation": {
      "description": "Recommendation for TargetDetectorRecipeDetectorRule resource",
      "type": "string"
    },
    "resourceType": {
      "description": "The type of resource which is monitored by the detector rule.\nFor example, Instance, Database, VCN, Policy. To find the resource type for a\nparticular rule, see [Detector Recipe Reference]\n(/iaas/cloud-guard/using/detect-recipes.htm#detect-recipes-reference).\n\nOr try [Detector Recipe Reference]\n(/cloud-guard/using/detect-recipes.htm#detect-recipes-reference).\n",
      "type": "string"
    },
    "ruleType": {
      "description": "Rule category type",
      "items": {
        "$ref": "#/$defs/RuleType"
      },
      "type": "array"
    },
    "serviceType": {
      "description": "Service type of the configuration to which the rule is applied",
      "type": "string"
    },
    "sourceDetectorRuleId": {
      "description": "The unique identifier of the source detector rule",
      "type": "string"
    },
    "timeCreated": {
      "description": "The date and time the target detector recipe rule was created. Format defined by RFC3339.",
      "format": "date-time",
      "type": "string"
    },
    "timeUpdated": {
      "description": "The date and time the target detector recipe rule was last updated. Format defined by RFC3339.",
      "format": "date-time",
      "type": "string"
    }
  },
  "required": [
    "detectorRuleId",
    "serviceType",
    "resourceType",
    "detector"
  ],
  "type": "object",
  "$defs": {
    "AdditionalConfigPropertyDefinition": {
      "description": "Detector rule additional property field",
      "properties": {
        "key": {
          "description": "Name for Additional Property, for example, \"interpreter\", \"router\"",
          "type": "string"
        },
        "propertyType": {
          "description": "Property Type",
          "enum": [
            "HINT",
            "RANGE"
          ],
          "type": "string"
        },
        "value": {
          "description": "Value for Property Name, for example, \"generic\", \"cloudguard\"",
          "type": "string"
        }
      },
      "type": "object"
    },
    "Condition": {
      "description": "The base condition resource.",
      "properties": {
        "kind": {
          "description": "Type of condition resource",
          "enum": [
            "COMPOSITE",
            "SIMPLE"
          ],
          "type": "string"
        }
      },
      "required": [
        "kind"
      ]
    },
    "ConditionGroup": {
      "description": "Details for a condition configured on a target.",
      "properties": {
        "compartmentId": {
          "description": "Compartment OCID associated with condition",
          "type": "string"
        },
        "condition": {
          "$ref": "#/$defs/Condition"
        }
      },
      "required": [
        "compartmentId",
        "condition"
      ],
      "type": "object"
    },
    "ConfigValue": {
      "description": "Details for a configuration value for a managed list.",
      "properties": {
        "listType": {
          "description": "Configuration list item type (CUSTOM or MANAGED)",
          "enum": [
            "MANAGED",
            "CUSTOM"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/ConfigurationListItemType"
        },
        "managedListType": {
          "description": "Type of content in the managed list",
          "type": "string"
        },
        "value": {
          "description": "Configuration value",
          "type": "string"
        }
      },
      "required": [
        "listType",
        "managedListType",
        "value"
      ],
      "type": "object"
    },
    "DetectorConfiguration": {
      "description": "Configuration details for a detector.",
      "properties": {
        "additionalProperties": {
          "description": "Map of additional property values for configuration",
          "items": {
            "$ref": "#/$defs/AdditionalConfigPropertyDefinition"
          },
          "type": "array"
        },
        "allowedValues": {
          "description": "Map of possible values for configuration",
          "items": {
            "$ref": "#/$defs/PropertyTuple"
          },
          "type": "array"
        },
        "allowedValuesDataType": {
          "description": "Map property Value data type",
          "type": "string"
        },
        "configKey": {
          "description": "Unique identifier of the configuration",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "dataType": {
          "description": "Configuration data type",
          "type": "string"
        },
        "name": {
          "description": "Configuration name",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "value": {
          "description": "Configuration value",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        },
        "values": {
          "description": "List of configuration values",
          "items": {
            "$ref": "#/$defs/ConfigValue"
          },
          "type": "array"
        }
      },
      "required": [
        "configKey",
        "name"
      ],
      "type": "object"
    },
    "EntitiesMapping": {
      "description": "Parameters for entities mapping to data source.",
      "properties": {
        "displayName": {
          "description": "Display name of the entity",
          "type": "string"
        },
        "entityType": {
          "description": "Type of entity",
          "enum": [
            "EXTERNAL_IP",
            "INTERNAL_IP",
            "TEXT",
            "JSON_LIST"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/EntityType"
        },
        "queryField": {
          "description": "The entity value mapped to a data source query",
          "type": "string"
        }
      },
      "required": [
        "queryField"
      ],
      "type": "object"
    },
    "MitreDetails": {
      "description": "MITRE ATT@CK framework details for the sighting type.",
      "properties": {
        "tacticDetails": {
          "$ref": "#/$defs/MitreTactic"
        },
        "techniqueDetails": {
          "$ref": "#/$defs/MitreTechnique"
        }
      },
      "type": "object"
    },
    "MitreTactic": {
      "description": "MITRE ATT@CK framework tactic",
      "properties": {
        "displayName": {
          "description": "The display name of MITRE ATT@CK framework tactic",
          "type": "string"
        },
        "id": {
          "description": "The unique identifier of MITRE ATT@CK framework tactic",
          "type": "string"
        }
      },
      "type": "object"
    },
    "MitreTechnique": {
      "description": "MITRE ATT@CK framework technique",
      "properties": {
        "displayName": {
          "description": "Display name of the MITRE ATT@CK framework technique",
          "type": "string"
        },
        "id": {
          "description": "Unique identifier of the MITRE ATT@CK framework technique",
          "type": "string"
        }
      },
      "type": "object"
    },
    "PropertyTuple": {
      "description": "key and value pair for configuration values",
      "properties": {
        "key": {
          "description": "key",
          "type": "string"
        },
        "value": {
          "description": "value",
          "type": "string"
        }
      },
      "required": [
        "key",
        "value"
      ],
      "type": "object"
    },
    "ResourceLock": {
      "description": "Resource locks are used to prevent certain APIs from being called for the resource.\nA full lock prevents both updating the resource and deleting the resource. A delete\nlock prevents deleting the resource.\n",
      "properties": {
        "message": {
          "description": "A message added by the creator of the lock. This is typically used to give an\nindication of why the resource is locked.\n",
          "type": "string"
        },
        "relatedResourceId": {
          "description": "The ID of the resource that is locking this resource. Indicates that deleting this resource will remove the lock.\n",
          "type": "string"
        },
        "timeCreated": {
          "description": "When the lock was created, in the format defined by RFC 3339.",
          "format": "date-time",
          "type": "string"
        },
        "type": {
          "description": "Type of the lock.",
          "enum": [
            "FULL",
            "DELETE"
          ],
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    },
    "RuleType": {
      "description": "The detector rule types.",
      "properties": {
        "key": {
          "description": "The unique identifier of the detector rule type",
          "enum": [
            "CATEGORY"
          ],
          "type": "string"
        },
        "value": {
          "description": "Detector rule type value",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "required": [
        "key",
        "value"
      ],
      "type": "object"
    },
    "SightingType": {
      "description": "Information for a sighting type",
      "properties": {
        "additionalEntitiesMapping": {
          "description": "Data source additional entities mapping for a detector rule",
          "items": {
            "$ref": "#/$defs/EntitiesMapping"
          },
          "maxItems": 15,
          "minItems": 0,
          "type": "array"
        },
        "dataSourceId": {
          "description": "Unique identifier of the associated data source",
          "type": "string"
        },
        "description": {
          "description": "Description of the sighting type",
          "type": "string"
        },
        "displayName": {
          "description": "Display name of the sighting type",
          "type": "string"
        },
        "id": {
          "description": "The unique identifier of the sighting type",
          "type": "string"
        },
        "mitreDetails": {
          "$ref": "#/$defs/MitreDetails"
        },
        "mitreLink": {
          "description": "MITRE ATT@CK framework link for the sighting type",
          "type": "string"
        },
        "owner": {
          "description": "Owner type for the sighting type",
          "enum": [
            "CUSTOMER",
            "ORACLE"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/OwnerType"
        },
        "tactic": {
          "description": "MITRE ATT@CK framework tactic for the sighting type",
          "type": "string"
        },
        "techniques": {
          "description": "List of MITRE ATT@CK framework techniques for the sighting type",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "timeCreated": {
          "description": "The date and time the sighting type was created. Format defined by RFC3339.",
          "format": "date-time",
          "type": "string"
        },
        "timeUpdated": {
          "description": "The date and time the sighting type was updated. Format defined by RFC3339.",
          "format": "date-time",
          "type": "string"
        }
      },
      "type": "object"
    },
    "TargetDetectorDetails": {
      "description": "Overriden settings of a detector rule in recipe attached to target.",
      "properties": {
        "conditionGroups": {
          "description": "Condition group corresponding to each compartment",
          "items": {
            "$ref": "#/$defs/ConditionGroup"
          },
          "type": "array"
        },
        "configurations": {
          "description": "List of detector rule configurations",
          "items": {
            "$ref": "#/$defs/DetectorConfiguration"
          },
          "type": "array"
        },
        "isConfigurationAllowed": {
          "description": "Configuration allowed or not",
          "type": "boolean"
        },
        "isEnabled": {
          "description": "Enablement state of the detector rule",
          "type": "boolean"
        },
        "labels": {
          "description": "User-defined labels for a detector rule",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "problemThreshold": {
          "description": "Point at which an elevated resource risk score creates a problem",
          "type": "integer"
        },
        "riskLevel": {
          "description": "The risk level of the detector rule",
          "enum": [
            "CRITICAL",
            "HIGH",
            "MEDIUM",
            "LOW",
            "MINOR"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/RiskLevel"
        },
        "sightingTypes": {
          "description": "List of sighting types",
          "items": {
            "$ref": "#/$defs/SightingType"
          },
          "type": "array"
        },
        "targetTypes": {
          "description": "List of target types for which the detector rule is applicable",
          "items": {
            "type": "string"
          },
          "type": "array"
        }
      },
      "required": [
        "isEnabled"
      ],
      "type": "object"
    }
  }
}