{"resources":{"artifactory":{"id":"artifactory","name":"artifactory","fields":{"accessToken":{"name":"accessToken","type":"\u001bartifactory.accessToken","title":"Artifactory Access Token","desc":"A bearer token issued against the instance. The `expiry` field is null on a token that never expires, which stays usable until someone revokes it by hand. The `scope` field holds what the token may do, and `grantsAdmin` reduces it to whether the token carries administrative rights. Query `artifactory.accessTokens.where(expiry == null)` for the tokens that outlive every rotation.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"accessTokens":{"name":"accessTokens","type":"\u0019\u001bartifactory.accessToken","title":"Access tokens issued against the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"cleanupPolicies":{"name":"cleanupPolicies","type":"\u0019\u001bartifactory.cleanupPolicy","title":"Cleanup policies that delete artifacts on a schedule","provider":"go.mondoo.com/mql/providers/artifactory"},"cleanupPolicy":{"name":"cleanupPolicy","type":"\u001bartifactory.cleanupPolicy","title":"Artifactory Cleanup Policy","desc":"A scheduled deletion of artifacts that match a search. The `enabled` and `cronExpression` fields report whether and when it runs, and the `repositories` field reports what it deletes from. A policy that reaches a repository a platform installs from removes artifacts a consumer may still pin, so read `keepLastNVersions` and the age thresholds together with the repositories the policy covers.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"group":{"name":"group","type":"\u001bartifactory.group","title":"Artifactory Group","desc":"A set of users that permission targets grant to as a unit. The `adminPrivileges` field reports whether membership alone carries instance-wide administrative rights, and `autoJoin` reports whether new accounts land in the group without anyone adding them. The `realm` field separates a group maintained on the instance from one synchronized out of an identity provider. Select a group with `artifactory.groups.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001bartifactory.group","title":"Groups known to the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTarget":{"name":"permissionTarget","type":"\u001bartifactory.permissionTarget","title":"Artifactory Permission Target","desc":"A named grant that gives principals a set of actions over a set of repository, build, or release bundle patterns. This is where an over-broad grant becomes visible: `repo` holds the repository scope with its repository keys and its include and exclude patterns, and `principals` lists every user and group the target names together with the actions it gives them. The `grantsAnonymousDeploy` field reduces the target to the single question of whether an unauthenticated caller may publish through it. Select a target with `artifactory.permissionTargets.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets granting principals actions on repository patterns","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u001bartifactory.repository","title":"Repositories configured on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"repository":{"name":"repository","type":"\u001bartifactory.repository","title":"Artifactory Repository","desc":"A repository on the instance, which is where artifacts are stored, proxied, or aggregated. The `type` field separates a local repository (artifacts are pushed to it) from a remote one (artifacts are proxied from an upstream) and from a virtual one (several repositories are served under one name). For a remote repository, `url` is the upstream it fetches from, so an unexpected upstream on a repository a platform installs from is detectable. The `permissionTargets` field reports which grants reach the repository, and `anonymousActions` reduces those grants to what an unauthenticated caller may do. Select a repository with `artifactory.repositories.where(key == \"example-docker\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"security":{"name":"security","type":"\u001bartifactory.securitySettings","title":"Instance-wide security settings","provider":"go.mondoo.com/mql/providers/artifactory"},"securitySettings":{"name":"securitySettings","type":"\u001bartifactory.securitySettings","title":"Artifactory Security Settings","desc":"Instance-wide security settings, read from the instance configuration. The `anonymousAccessEnabled` field is the gate every anonymous grant depends on: while it is off, a permission target naming the anonymous user has no effect, and while it is on, every such target applies. The `anonymousDeployTargets` field lists the targets that would then let an unauthenticated caller publish, and `anonymousCanDeploy` reduces the whole instance to that single question.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"system":{"name":"system","type":"\u001bartifactory.systemInfo","title":"Version and identity of the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"systemInfo":{"name":"systemInfo","type":"\u001bartifactory.systemInfo","title":"Artifactory Instance Identity","desc":"Version and identity of the Artifactory instance the scan connected to. The `serviceId` field is the instance's stable identifier, which is also the asset's platform identifier. Use `version` and `revision` to tell whether an endpoint that this provider reads is available on the instance.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"user":{"name":"user","type":"\u001bartifactory.user","title":"Artifactory User","desc":"An account on the instance. The `admin` field reports whether it holds instance-wide administrative rights, and `realm` reports where it authenticates: an internal account carries a password on the instance, while a federated one is backed by an external identity provider and is removed there rather than here. Select a user with `artifactory.users.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bartifactory.user","title":"Users known to the instance, both internal and federated","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"JFrog Artifactory","desc":"Configuration of a JFrog Artifactory instance, the registry that stores the packages, container images, and OCI artifacts a platform installs from. The `repositories` field lists every repository with its type, package type, and the upstream a remote repository proxies. The `permissionTargets` field reports which principals hold which actions on which repository patterns, which is where an over-broad grant on a publishing repository becomes visible. The `users` and `groups` fields cover the principals themselves, `accessTokens` covers the tokens issued against them, and `security` reports instance-wide settings such as anonymous access. The `cleanupPolicies` field covers scheduled deletion of artifacts, and `system` identifies the instance.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.accessToken":{"id":"artifactory.accessToken","name":"artifactory.accessToken","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"expires":{"name":"expires","type":"\u0004","is_mandatory":true,"title":"Whether the token has an expiry at all","provider":"go.mondoo.com/mql/providers/artifactory"},"expiry":{"name":"expiry","type":"\t","is_mandatory":true,"title":"Time the token stops being accepted, or null when it never expires","desc":"A token without an expiry stays usable until it is revoked by hand, so it survives the rotation of everything issued around it.","provider":"go.mondoo.com/mql/providers/artifactory"},"grantsAdmin":{"name":"grantsAdmin","type":"\u0004","is_mandatory":true,"title":"Whether the token carries instance-wide administrative rights","desc":"True when the scope contains applied-permissions/admin. Such a token bypasses every permission target for as long as it is valid.","provider":"go.mondoo.com/mql/providers/artifactory"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier of the token","provider":"go.mondoo.com/mql/providers/artifactory"},"issuedAt":{"name":"issuedAt","type":"\t","is_mandatory":true,"title":"Time the token was issued, or null when the instance does not report it","provider":"go.mondoo.com/mql/providers/artifactory"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Service that issued the token","provider":"go.mondoo.com/mql/providers/artifactory"},"refreshable":{"name":"refreshable","type":"\u0004","is_mandatory":true,"title":"Whether the token can be exchanged for a new one without reauthenticating","provider":"go.mondoo.com/mql/providers/artifactory"},"scope":{"name":"scope","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes the token carries","desc":"Contains entries such as applied-permissions/user, applied-permissions/admin, applied-permissions/groups:example, or a repository scope. A token carries at most the rights of the principal it was issued for.","provider":"go.mondoo.com/mql/providers/artifactory"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Principal the token authenticates as, for example jfrt@01ab2c3d/users/example","provider":"go.mondoo.com/mql/providers/artifactory"},"subjectRef":{"name":"subjectRef","type":"\u001bartifactory.user","title":"User the token authenticates as, or null when the subject is not a user on this instance","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Access Token","desc":"A bearer token issued against the instance. The `expiry` field is null on a token that never expires, which stays usable until someone revokes it by hand. The `scope` field holds what the token may do, and `grantsAdmin` reduces it to whether the token carries administrative rights. Query `artifactory.accessTokens.where(expiry == null)` for the tokens that outlive every rotation.","private":true,"min_provider_version":"13.0.0","defaults":"id subject expiry","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.cleanupPolicy":{"id":"artifactory.cleanupPolicy","name":"artifactory.cleanupPolicy","fields":{"createdBeforeInMonths":{"name":"createdBeforeInMonths","type":"\u0005","is_mandatory":true,"title":"Age in months an artifact must reach before the policy deletes it, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Schedule the policy runs on, as a cron expression","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"durationInMinutes":{"name":"durationInMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes the policy is allowed to run for, or null when unbounded","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy runs","provider":"go.mondoo.com/mql/providers/artifactory"},"excludedRepositories":{"name":"excludedRepositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the policy is withheld from","provider":"go.mondoo.com/mql/providers/artifactory"},"keepLastNVersions":{"name":"keepLastNVersions","type":"\u0005","is_mandatory":true,"title":"Versions the policy keeps regardless of age, or null when it keeps none","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key of the policy, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"lastDownloadedBeforeInMonths":{"name":"lastDownloadedBeforeInMonths","type":"\u0005","is_mandatory":true,"title":"Months an artifact must go undownloaded before the policy deletes it, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"packageTypes":{"name":"packageTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Package types the policy deletes, empty when it covers every type","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the policy deletes from","provider":"go.mondoo.com/mql/providers/artifactory"},"repositoryRefs":{"name":"repositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories the policy deletes from","provider":"go.mondoo.com/mql/providers/artifactory"},"skipTrashcan":{"name":"skipTrashcan","type":"\u0004","is_mandatory":true,"title":"Whether deleted artifacts skip the trash can and are removed at once","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Cleanup Policy","desc":"A scheduled deletion of artifacts that match a search. The `enabled` and `cronExpression` fields report whether and when it runs, and the `repositories` field reports what it deletes from. A policy that reaches a repository a platform installs from removes artifacts a consumer may still pin, so read `keepLastNVersions` and the age thresholds together with the repositories the policy covers.","private":true,"min_provider_version":"13.0.0","defaults":"key enabled cronExpression","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.group":{"id":"artifactory.group","name":"artifactory.group","fields":{"adminPrivileges":{"name":"adminPrivileges","type":"\u0004","title":"Whether every member holds instance-wide administrative rights","desc":"Administrative rights carried by group membership are granted by adding someone to the group, which is a different review path than granting them on the account.","provider":"go.mondoo.com/mql/providers/artifactory"},"autoJoin":{"name":"autoJoin","type":"\u0004","title":"Whether new accounts join the group automatically","desc":"When true, every account created on the instance receives whatever this group is granted, including accounts created by a federated sign-in.","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"internal":{"name":"internal","type":"\u0004","title":"Whether the group is maintained on the instance rather than synchronized from an identity provider","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets that name the group","provider":"go.mondoo.com/mql/providers/artifactory"},"realm":{"name":"realm","type":"\u0007","title":"Realm the group is maintained in, for example internal, ldap, or saml","provider":"go.mondoo.com/mql/providers/artifactory"},"realmAttributes":{"name":"realmAttributes","type":"\u0007","title":"Identity provider settings the group is synchronized with, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"users":{"name":"users","type":"\u0019\u001bartifactory.user","title":"Users that belong to the group","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Group","desc":"A set of users that permission targets grant to as a unit. The `adminPrivileges` field reports whether membership alone carries instance-wide administrative rights, and `autoJoin` reports whether new accounts land in the group without anyone adding them. The `realm` field separates a group maintained on the instance from one synchronized out of an identity provider. Select a group with `artifactory.groups.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name realm adminPrivileges","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.permissionTarget":{"id":"artifactory.permissionTarget","name":"artifactory.permissionTarget","fields":{"build":{"name":"build","type":"\u001bartifactory.permissionTarget.scope","title":"Build scope of the target, or null when it grants nothing over build info","provider":"go.mondoo.com/mql/providers/artifactory"},"grantsAnonymousDeploy":{"name":"grantsAnonymousDeploy","type":"\u0004","is_mandatory":true,"title":"Whether the target lets the anonymous user publish to a repository","desc":"True when the repository scope gives the anonymous user a write, deploy, delete, or manage action. An unauthenticated caller can then replace the artifacts a platform installs from. Anonymous access must also be enabled instance-wide for the grant to apply, which `artifactory.security.anonymousAccessEnabled` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"grantsAnonymousRead":{"name":"grantsAnonymousRead","type":"\u0004","is_mandatory":true,"title":"Whether the target lets the anonymous user read from a repository","desc":"Anonymous access must also be enabled instance-wide for the grant to apply, which `artifactory.security.anonymousAccessEnabled` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the permission target, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"principal":{"name":"principal","type":"\u001bartifactory.permissionTarget.principal","title":"Principal of an Artifactory Permission Target","desc":"A user or a group named by a permission target, together with the actions that target gives it. The `actions` field holds the raw action names the instance reports, for example read, write, annotate, delete, or manage, and the `canDeploy` and `canManage` fields reduce them to whether the principal may publish or may change the grant itself.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"principals":{"name":"principals","type":"\u0019\u001bartifactory.permissionTarget.principal","title":"Every principal the target names, across all of its scopes","provider":"go.mondoo.com/mql/providers/artifactory"},"releaseBundle":{"name":"releaseBundle","type":"\u001bartifactory.permissionTarget.scope","title":"Release bundle scope of the target, or null when it grants nothing over release bundles","provider":"go.mondoo.com/mql/providers/artifactory"},"repo":{"name":"repo","type":"\u001bartifactory.permissionTarget.scope","title":"Repository scope of the target, or null when it grants nothing over repositories","provider":"go.mondoo.com/mql/providers/artifactory"},"scope":{"name":"scope","type":"\u001bartifactory.permissionTarget.scope","title":"Scope of an Artifactory Permission Target","desc":"One of the three areas a permission target grants over: repositories, build info, or release bundles. The `repositories` field holds the keys the scope covers, which may include the wildcard keys the instance defines, and `includePatterns` and `excludePatterns` narrow the grant to artifact paths within them. The `appliesToAllRepositories` and `appliesToAllPaths` fields reduce those to the question of whether the scope is narrowed at all.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true}},"title":"Artifactory Permission Target","desc":"A named grant that gives principals a set of actions over a set of repository, build, or release bundle patterns. This is where an over-broad grant becomes visible: `repo` holds the repository scope with its repository keys and its include and exclude patterns, and `principals` lists every user and group the target names together with the actions it gives them. The `grantsAnonymousDeploy` field reduces the target to the single question of whether an unauthenticated caller may publish through it. Select a target with `artifactory.permissionTargets.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.permissionTarget.principal":{"id":"artifactory.permissionTarget.principal","name":"artifactory.permissionTarget.principal","fields":{"actions":{"name":"actions","type":"\u0019\u0007","is_mandatory":true,"title":"Actions the permission target gives the principal","desc":"Contains entries such as read, write, annotate, delete, manage, managedXrayMeta, or distribute. The exact set depends on the scope and on the product version.","provider":"go.mondoo.com/mql/providers/artifactory"},"canDeploy":{"name":"canDeploy","type":"\u0004","is_mandatory":true,"title":"Whether the actions let the principal publish artifacts","desc":"True when the actions contain write, deploy, delete, or manage. Publishing rights on a repository a platform installs from let the principal replace what every consumer of that repository receives.","provider":"go.mondoo.com/mql/providers/artifactory"},"canManage":{"name":"canManage","type":"\u0004","is_mandatory":true,"title":"Whether the actions let the principal change the grant itself","desc":"True when the actions contain manage. A principal that can manage a permission target can widen its own access.","provider":"go.mondoo.com/mql/providers/artifactory"},"group":{"name":"group","type":"\u001bartifactory.group","title":"Group the principal names, or null when the principal is a user or the group is unknown","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the user or group","provider":"go.mondoo.com/mql/providers/artifactory"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope of the permission target the actions apply to, one of repo, build, or releaseBundle","provider":"go.mondoo.com/mql/providers/artifactory"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of principal, one of user or group","provider":"go.mondoo.com/mql/providers/artifactory"},"user":{"name":"user","type":"\u001bartifactory.user","title":"User the principal names, or null when the principal is a group or the user is unknown","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Principal of an Artifactory Permission Target","desc":"A user or a group named by a permission target, together with the actions that target gives it. The `actions` field holds the raw action names the instance reports, for example read, write, annotate, delete, or manage, and the `canDeploy` and `canManage` fields reduce them to whether the principal may publish or may change the grant itself.","private":true,"min_provider_version":"13.0.0","defaults":"name type actions","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.permissionTarget.scope":{"id":"artifactory.permissionTarget.scope","name":"artifactory.permissionTarget.scope","fields":{"appliesToAllPaths":{"name":"appliesToAllPaths","type":"\u0004","is_mandatory":true,"title":"Whether the scope covers every artifact path in the repositories it names","desc":"True when no include pattern narrows the grant, or when a pattern matches every path.","provider":"go.mondoo.com/mql/providers/artifactory"},"appliesToAllRepositories":{"name":"appliesToAllRepositories","type":"\u0004","is_mandatory":true,"title":"Whether the scope covers every repository through a wildcard key","desc":"True when the repository keys contain one of the instance's wildcard keys. The grant then reaches repositories created after the target was written.","provider":"go.mondoo.com/mql/providers/artifactory"},"excludePatterns":{"name":"excludePatterns","type":"\u0019\u0007","is_mandatory":true,"title":"Artifact path patterns the grant is withheld from","provider":"go.mondoo.com/mql/providers/artifactory"},"includePatterns":{"name":"includePatterns","type":"\u0019\u0007","is_mandatory":true,"title":"Artifact path patterns the grant applies to, for example **/*","desc":"Empty or a single match-everything pattern means the grant covers the whole repository rather than part of it.","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Area the scope grants over, one of repo, build, or releaseBundle","provider":"go.mondoo.com/mql/providers/artifactory"},"principals":{"name":"principals","type":"\u0019\u001bartifactory.permissionTarget.principal","title":"Principals the scope names and the actions it gives them","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the scope covers","desc":"May contain a wildcard key the instance defines rather than a real repository, for example ANY, ANY LOCAL, ANY REMOTE, ANY VIRTUAL, ANY FEDERATED, or ANY DISTRIBUTION. Such a key covers repositories that did not exist when the target was written, including ones created later.","provider":"go.mondoo.com/mql/providers/artifactory"},"repositoryRefs":{"name":"repositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories the scope covers that exist on the instance","desc":"Resolves the scope's repository keys against the instance. A wildcard key has no repository of its own and is skipped, so compare the length against `repositories` or read `appliesToAllRepositories` to see whether a wildcard is in play.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Scope of an Artifactory Permission Target","desc":"One of the three areas a permission target grants over: repositories, build info, or release bundles. The `repositories` field holds the keys the scope covers, which may include the wildcard keys the instance defines, and `includePatterns` and `excludePatterns` narrow the grant to artifact paths within them. The `appliesToAllRepositories` and `appliesToAllPaths` fields reduce those to the question of whether the scope is narrowed at all.","private":true,"min_provider_version":"13.0.0","defaults":"name repositories","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.repository":{"id":"artifactory.repository","name":"artifactory.repository","fields":{"allowAnyHostAuth":{"name":"allowAnyHostAuth","type":"\u0004","title":"Whether a remote repository sends its credentials to any host it is redirected to","desc":"Null on repository types that do not proxy. When true, a redirect from the upstream can carry the stored credentials to an unrelated host.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousActions":{"name":"anonymousActions","type":"\u0019\u0007","title":"Actions the anonymous user holds on the repository","desc":"The union of the actions every permission target grants to the anonymous user over this repository, for example read, write, or delete. Empty when no target grants the anonymous user anything. The union is taken at repository level and does not evaluate the targets' path patterns, so an action listed here may be limited to part of the repository. Anonymous access must also be enabled instance-wide for these actions to apply, which `artifactory.security.anonymousAccessEnabled` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"blackedOut":{"name":"blackedOut","type":"\u0004","title":"Whether the repository is blocked from serving and accepting artifacts","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"excludesPattern":{"name":"excludesPattern","type":"\u0007","title":"Artifact path patterns the repository refuses to serve","provider":"go.mondoo.com/mql/providers/artifactory"},"externalDependenciesEnabled":{"name":"externalDependenciesEnabled","type":"\u0004","title":"Whether a remote repository may resolve dependencies from hosts other than its upstream","desc":"Null on repository types that do not proxy. When true, a build resolving through the repository can reach a host that was never reviewed.","provider":"go.mondoo.com/mql/providers/artifactory"},"includesPattern":{"name":"includesPattern","type":"\u0007","title":"Artifact path patterns the repository serves, for example **/*","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Repository key, which is its unique name on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"memberRepositories":{"name":"memberRepositories","type":"\u0019\u0007","title":"Repository keys aggregated by a virtual repository","desc":"Empty on repository types that do not aggregate. A virtual repository serves each member under one name, so a member with weaker controls is reachable through the virtual name.","provider":"go.mondoo.com/mql/providers/artifactory"},"memberRepositoryRefs":{"name":"memberRepositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories aggregated by a virtual repository","provider":"go.mondoo.com/mql/providers/artifactory"},"offline":{"name":"offline","type":"\u0004","title":"Whether a remote repository serves only what is already cached","provider":"go.mondoo.com/mql/providers/artifactory"},"packageType":{"name":"packageType","type":"\u0007","is_mandatory":true,"title":"Package format the repository serves, for example docker, helm, maven, or generic","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets whose repository scope covers this repository","provider":"go.mondoo.com/mql/providers/artifactory"},"repoLayoutRef":{"name":"repoLayoutRef","type":"\u0007","title":"Layout the repository stores artifacts under, for example simple-default","provider":"go.mondoo.com/mql/providers/artifactory"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Repository type","desc":"One of local, remote, virtual, federated, or distribution. A local repository holds artifacts pushed to it, a remote one proxies an upstream, and a virtual one aggregates other repositories under a single name.","provider":"go.mondoo.com/mql/providers/artifactory"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Upstream URL a remote repository fetches from, or null on other types","desc":"Every artifact served by a remote repository originates here, so an upstream that is not the expected registry places untrusted content behind a trusted repository name.","provider":"go.mondoo.com/mql/providers/artifactory"},"xrayIndex":{"name":"xrayIndex","type":"\u0004","title":"Whether Xray indexes the repository for vulnerability scanning","desc":"Null when the instance does not report the setting for the repository type. A repository that is not indexed is never scanned, so a finding on an artifact stored there is never raised.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Repository","desc":"A repository on the instance, which is where artifacts are stored, proxied, or aggregated. The `type` field separates a local repository (artifacts are pushed to it) from a remote one (artifacts are proxied from an upstream) and from a virtual one (several repositories are served under one name). For a remote repository, `url` is the upstream it fetches from, so an unexpected upstream on a repository a platform installs from is detectable. The `permissionTargets` field reports which grants reach the repository, and `anonymousActions` reduces those grants to what an unauthenticated caller may do. Select a repository with `artifactory.repositories.where(key == \"example-docker\")`.","private":true,"min_provider_version":"13.0.0","defaults":"key type packageType","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.securitySettings":{"id":"artifactory.securitySettings","name":"artifactory.securitySettings","fields":{"anonymousAccessEnabled":{"name":"anonymousAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether unauthenticated callers may use the instance at all","desc":"While this is off, a permission target naming the anonymous user grants nothing. While it is on, every such target applies, so read it together with `anonymousCanDeploy`.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousAccessToBuildInfosDisabled":{"name":"anonymousAccessToBuildInfosDisabled","type":"\u0004","is_mandatory":true,"title":"Whether unauthenticated callers are blocked from reading build info","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousCanDeploy":{"name":"anonymousCanDeploy","type":"\u0004","title":"Whether an unauthenticated caller may publish to any repository","desc":"True when anonymous access is enabled instance-wide and a permission target gives the anonymous user a write, deploy, delete, or manage action. This is the state in which anyone on the network can replace the artifacts the instance serves.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousCanRead":{"name":"anonymousCanRead","type":"\u0004","title":"Whether an unauthenticated caller may read any repository","desc":"True when anonymous access is enabled instance-wide and a permission target gives the anonymous user a read action.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousDeployTargets":{"name":"anonymousDeployTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets that would let an unauthenticated caller publish","desc":"Listed whether or not anonymous access is enabled instance-wide, so that turning it on shows what would immediately apply.","provider":"go.mondoo.com/mql/providers/artifactory"},"hideUnauthorizedResources":{"name":"hideUnauthorizedResources","type":"\u0004","is_mandatory":true,"title":"Whether a caller is told nothing about a resource it may not read","desc":"When false, the response distinguishes a resource that is absent from one the caller may not see, which confirms an artifact exists to someone who cannot fetch it.","provider":"go.mondoo.com/mql/providers/artifactory"},"loginAttempts":{"name":"loginAttempts","type":"\u0005","is_mandatory":true,"title":"Failed sign-in attempts allowed before an account is locked, or null when locking is off","provider":"go.mondoo.com/mql/providers/artifactory"},"passwordEncryptionPolicy":{"name":"passwordEncryptionPolicy","type":"\u0007","is_mandatory":true,"title":"Policy applied to passwords held in the instance configuration, for example SUPPORTED or REQUIRED","provider":"go.mondoo.com/mql/providers/artifactory"},"passwordExpiryDays":{"name":"passwordExpiryDays","type":"\u0005","is_mandatory":true,"title":"Days an internal password stays valid, or null when passwords do not expire","provider":"go.mondoo.com/mql/providers/artifactory"},"passwordExpiryEnabled":{"name":"passwordExpiryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether internal passwords expire","provider":"go.mondoo.com/mql/providers/artifactory"},"userLockPolicyEnabled":{"name":"userLockPolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether an account is locked after repeated failed sign-ins","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Security Settings","desc":"Instance-wide security settings, read from the instance configuration. The `anonymousAccessEnabled` field is the gate every anonymous grant depends on: while it is off, a permission target naming the anonymous user has no effect, and while it is on, every such target applies. The `anonymousDeployTargets` field lists the targets that would then let an unauthenticated caller publish, and `anonymousCanDeploy` reduces the whole instance to that single question.","private":true,"min_provider_version":"13.0.0","defaults":"anonymousAccessEnabled anonymousCanDeploy","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.systemInfo":{"id":"artifactory.systemInfo","name":"artifactory.systemInfo","fields":{"addons":{"name":"addons","type":"\u0019\u0007","is_mandatory":true,"title":"Licensed add-ons enabled on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"revision":{"name":"revision","type":"\u0007","is_mandatory":true,"title":"Build revision of the running version","provider":"go.mondoo.com/mql/providers/artifactory"},"serviceId":{"name":"serviceId","type":"\u0007","is_mandatory":true,"title":"Stable identifier of the Artifactory service, for example jfrt@01ab2c3d","provider":"go.mondoo.com/mql/providers/artifactory"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Product version, for example 7.90.10","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Instance Identity","desc":"Version and identity of the Artifactory instance the scan connected to. The `serviceId` field is the instance's stable identifier, which is also the asset's platform identifier. Use `version` and `revision` to tell whether an endpoint that this provider reads is available on the instance.","private":true,"min_provider_version":"13.0.0","defaults":"version serviceId","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.user":{"id":"artifactory.user","name":"artifactory.user","fields":{"admin":{"name":"admin","type":"\u0004","title":"Whether the account holds instance-wide administrative rights","desc":"An administrator bypasses every permission target, so the count of administrators bounds how much a permission review can guarantee.","provider":"go.mondoo.com/mql/providers/artifactory"},"disableUiAccess":{"name":"disableUiAccess","type":"\u0004","title":"Whether the account is blocked from signing in to the web interface","provider":"go.mondoo.com/mql/providers/artifactory"},"email":{"name":"email","type":"\u0007","title":"Email address of the account, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"groupRefs":{"name":"groupRefs","type":"\u0019\u001bartifactory.group","title":"Groups the account belongs to","provider":"go.mondoo.com/mql/providers/artifactory"},"groups":{"name":"groups","type":"\u0019\u0007","title":"Group names the account belongs to","provider":"go.mondoo.com/mql/providers/artifactory"},"internal":{"name":"internal","type":"\u0004","title":"Whether the account is local to the instance rather than backed by an identity provider","desc":"True when the realm is internal. A local account keeps working after the identity provider disables the person, and it is outside any single sign-on control.","provider":"go.mondoo.com/mql/providers/artifactory"},"internalPasswordDisabled":{"name":"internalPasswordDisabled","type":"\u0004","title":"Whether the account's internal password is disabled","desc":"True on an account that can only authenticate through its identity provider or an access token. False on a federated account means it also carries a password on the instance.","provider":"go.mondoo.com/mql/providers/artifactory"},"lastLoggedIn":{"name":"lastLoggedIn","type":"\t","title":"Time the account last signed in, or null when it never has","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User name, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets that name the account directly","desc":"Does not include the targets the account reaches through its groups. Read those from the groups themselves.","provider":"go.mondoo.com/mql/providers/artifactory"},"profileUpdatable":{"name":"profileUpdatable","type":"\u0004","title":"Whether the account may edit its own profile, including its API key","provider":"go.mondoo.com/mql/providers/artifactory"},"realm":{"name":"realm","type":"\u0007","title":"Realm the account authenticates against, for example internal, ldap, saml, or oauth","provider":"go.mondoo.com/mql/providers/artifactory"},"status":{"name":"status","type":"\u0007","title":"Lifecycle state of the account, for example enabled, locked, or disabled","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory User","desc":"An account on the instance. The `admin` field reports whether it holds instance-wide administrative rights, and `realm` reports where it authenticates: an internal account carries a password on the instance, while a federated one is backed by an external identity provider and is removed there rather than here. Select a user with `artifactory.users.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name realm admin","provider":"go.mondoo.com/mql/providers/artifactory"}}}