{"resources":{"artifactory":{"id":"artifactory","name":"artifactory","fields":{"accessToken":{"name":"accessToken","type":"\u001bartifactory.accessToken","title":"Artifactory Access Token","desc":"A bearer token issued against the instance. The `expiry` field is null on a token that never expires, which stays usable until someone revokes it by hand. The `scope` field holds what the token may do, and `grantsAdmin` reduces it to whether the token carries administrative rights. Query `artifactory.accessTokens.where(expiry == null)` for the tokens that outlive every rotation.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"accessTokens":{"name":"accessTokens","type":"\u0019\u001bartifactory.accessToken","title":"Access tokens issued against the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"backup":{"name":"backup","type":"\u001bartifactory.backup","title":"Artifactory Backup","desc":"A scheduled export of the instance. The export contains the artifacts and the configuration, including the secrets held in it, so where it is written and how long it is kept are part of the instance's exposure. The `excludedRepositories` field reports what is left out of it, and `excludeNewRepositories` reports whether a repository created later is left out without anyone deciding so.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"backups":{"name":"backups","type":"\u0019\u001bartifactory.backup","title":"Scheduled exports of the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"cleanupPolicies":{"name":"cleanupPolicies","type":"\u0019\u001bartifactory.cleanupPolicy","title":"Cleanup policies that delete artifacts on a schedule","provider":"go.mondoo.com/mql/providers/artifactory"},"cleanupPolicy":{"name":"cleanupPolicy","type":"\u001bartifactory.cleanupPolicy","title":"Artifactory Cleanup Policy","desc":"A scheduled deletion of artifacts that match a search. The `enabled` and `cronExpression` fields report whether and when it runs, and the `repositories` field reports what it deletes from. A policy that reaches a repository a platform installs from removes artifacts a consumer may still pin, so read `keepLastNVersions` and the age thresholds together with the repositories the policy covers.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"crowdSettings":{"name":"crowdSettings","type":"\u001bartifactory.crowdSettings","title":"Artifactory Crowd Settings","desc":"Sign-in through Atlassian Crowd or Jira. The `noAutoUserCreation` field decides whether a successful authentication creates an account here, and `directAuthentication` decides whether the instance forwards credentials to Crowd itself rather than accepting a Crowd session.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"group":{"name":"group","type":"\u001bartifactory.group","title":"Artifactory Group","desc":"A set of users that permission targets grant to as a unit. The `adminPrivileges` field reports whether membership alone carries instance-wide administrative rights, and `autoJoin` reports whether new accounts land in the group without anyone adding them. The `realm` field separates a group maintained on the instance from one synchronized out of an identity provider. Select a group with `artifactory.groups.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001bartifactory.group","title":"Groups known to the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"httpSsoSettings":{"name":"httpSsoSettings","type":"\u001bartifactory.httpSsoSettings","title":"Artifactory HTTP Single Sign-On Settings","desc":"Sign-in taken from a request header set by a reverse proxy. The instance trusts whatever the header says, so this is only as strong as the proxy in front of it: a caller that reaches the instance directly can set the header itself. Read `httpSsoProxied` for whether the instance believes it is behind such a proxy at all.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"ldapGroupSetting":{"name":"ldapGroupSetting","type":"\u001bartifactory.ldapGroupSetting","title":"Artifactory LDAP Group Mapping","desc":"A mapping from an LDAP group tree onto the instance's groups. Whatever a mapped group is granted is granted to everyone the directory places in it, so a mapping onto a group with publishing rights moves that decision into the directory. The `strategy` field reports how membership is resolved.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"ldapSetting":{"name":"ldapSetting","type":"\u001bartifactory.ldapSetting","title":"Artifactory LDAP Server","desc":"An LDAP server the instance authenticates accounts against. The `autoCreateUser` field reports whether a successful bind creates an account on the instance, which is what makes every principal in the directory a principal here. Read it together with the groups the directory maps onto, which `artifactory.security.ldapGroupSettings` reports.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"oauthProvider":{"name":"oauthProvider","type":"\u001bartifactory.oauthProvider","title":"Artifactory OAuth Provider","desc":"One OAuth provider the instance accepts a sign-in from. Every enabled provider is a separate path to a principal on the instance, so the set of providers bounds who can sign in at all. The `domain` field, where the provider type supports it, limits which accounts of that provider are accepted.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"oauthSettings":{"name":"oauthSettings","type":"\u001bartifactory.oauthSettings","title":"Artifactory OAuth Settings","desc":"Sign-in through OAuth providers. The `persistUsers` field decides whether a successful sign-in creates an account here. The `providers` field lists every configured provider, each of which is a separate way to become a principal on this instance.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"permissionTarget":{"name":"permissionTarget","type":"\u001bartifactory.permissionTarget","title":"Artifactory Permission Target","desc":"A named grant that gives principals a set of actions over a set of repository, build, or release bundle patterns. This is where an over-broad grant becomes visible: `repo` holds the repository scope with its repository keys and its include and exclude patterns, and `principals` lists every user and group the target names together with the actions it gives them. The `grantsAnonymousDeploy` field reduces the target to the single question of whether an unauthenticated caller may publish through it. Select a target with `artifactory.permissionTargets.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets granting principals actions on repository patterns","provider":"go.mondoo.com/mql/providers/artifactory"},"project":{"name":"project","type":"\u001bartifactory.project","title":"Artifactory Project","desc":"A project, which delegates part of the instance to its own administrators. The `manageMembers` and `manageResources` fields report what a project administrator may do without a platform administrator: add members, and attach repositories to the project. That delegation is a second path to access alongside the instance's permission targets, so read `members` together with `artifactory.permissionTargets`. Select a project with `artifactory.projects.where(key == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"projects":{"name":"projects","type":"\u0019\u001bartifactory.project","title":"Projects defined on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"replication":{"name":"replication","type":"\u001bartifactory.replication","title":"Artifactory Replication","desc":"A configured copy of a repository's contents between this instance and another one. The `url` field is the other end: a push replication sends every artifact there, so an unexpected URL is an export of the registry, and a pull replication brings that instance's artifacts here under a trusted repository name. The `syncDeletes` field reports whether a deletion at one end removes the artifact at the other. Select a repository's replications with `artifactory.repositories.where(key == \"example-docker\") { replications }`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"repositories":{"name":"repositories","type":"\u0019\u001bartifactory.repository","title":"Repositories configured on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"repository":{"name":"repository","type":"\u001bartifactory.repository","title":"Artifactory Repository","desc":"A repository on the instance, which is where artifacts are stored, proxied, or aggregated. The `type` field separates a local repository (artifacts are pushed to it) from a remote one (artifacts are proxied from an upstream) and from a virtual one (several repositories are served under one name). For a remote repository, `url` is the upstream it fetches from, so an unexpected upstream on a repository a platform installs from is detectable. The `permissionTargets` field reports which grants reach the repository, and `anonymousActions` reduces those grants to what an unauthenticated caller may do. Select a repository with `artifactory.repositories.where(key == \"example-docker\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"samlSettings":{"name":"samlSettings","type":"\u001bartifactory.samlSettings","title":"Artifactory SAML Settings","desc":"Single sign-on through a SAML identity provider. The `noAutoUserCreation` field decides whether a successful assertion creates an account here, and `autoRedirect` decides whether the instance still offers its own sign-in form. Read `syncGroups` for whether the identity provider also decides group membership, which decides what the account may do.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"security":{"name":"security","type":"\u001bartifactory.securitySettings","title":"Instance-wide security settings","provider":"go.mondoo.com/mql/providers/artifactory"},"securitySettings":{"name":"securitySettings","type":"\u001bartifactory.securitySettings","title":"Artifactory Security Settings","desc":"Instance-wide security settings, read from the instance configuration. The `anonymousAccessEnabled` field is the gate every anonymous grant depends on: while it is off, a permission target naming the anonymous user has no effect, and while it is on, every such target applies. The `anonymousDeployTargets` field lists the targets that would then let an unauthenticated caller publish, and `anonymousCanDeploy` reduces the whole instance to that single question.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"system":{"name":"system","type":"\u001bartifactory.systemInfo","title":"Version and identity of the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"systemInfo":{"name":"systemInfo","type":"\u001bartifactory.systemInfo","title":"Artifactory Instance Identity","desc":"Version and identity of the Artifactory instance the scan connected to. The `serviceId` field is the instance's stable identifier, which is also the asset's platform identifier. Use `version` and `revision` to tell whether an endpoint that this provider reads is available on the instance.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"user":{"name":"user","type":"\u001bartifactory.user","title":"Artifactory User","desc":"An account on the instance. The `admin` field reports whether it holds instance-wide administrative rights, and `realm` reports where it authenticates: an internal account carries a password on the instance, while a federated one is backed by an external identity provider and is removed there rather than here. Select a user with `artifactory.users.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bartifactory.user","title":"Users known to the instance, both internal and federated","provider":"go.mondoo.com/mql/providers/artifactory"},"xray":{"name":"xray","type":"\u001bartifactory.xray","title":"Xray scanning configuration, or null when the platform has no reachable Xray","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"JFrog Artifactory","desc":"Configuration of a JFrog Artifactory instance, the registry that stores the packages, container images, and OCI artifacts a platform installs from. The `repositories` field lists every repository with its type, package type, and the upstream a remote repository proxies. The `permissionTargets` field reports which principals hold which actions on which repository patterns, which is where an over-broad grant on a publishing repository becomes visible. The `users` and `groups` fields cover the principals themselves, `accessTokens` covers the tokens issued against them, and `security` reports instance-wide settings such as anonymous access. The `cleanupPolicies` field covers scheduled deletion of artifacts, and `system` identifies the instance.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.accessToken":{"id":"artifactory.accessToken","name":"artifactory.accessToken","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"expires":{"name":"expires","type":"\u0004","is_mandatory":true,"title":"Whether the token has an expiry at all","provider":"go.mondoo.com/mql/providers/artifactory"},"expiry":{"name":"expiry","type":"\t","is_mandatory":true,"title":"Time the token stops being accepted, or null when it never expires","desc":"A token without an expiry stays usable until it is revoked by hand, so it survives the rotation of everything issued around it.","provider":"go.mondoo.com/mql/providers/artifactory"},"grantsAdmin":{"name":"grantsAdmin","type":"\u0004","is_mandatory":true,"title":"Whether the token carries instance-wide administrative rights","desc":"True when the scope contains applied-permissions/admin. Such a token bypasses every permission target for as long as it is valid.","provider":"go.mondoo.com/mql/providers/artifactory"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier of the token","provider":"go.mondoo.com/mql/providers/artifactory"},"issuedAt":{"name":"issuedAt","type":"\t","is_mandatory":true,"title":"Time the token was issued, or null when the instance does not report it","provider":"go.mondoo.com/mql/providers/artifactory"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Service that issued the token","provider":"go.mondoo.com/mql/providers/artifactory"},"refreshable":{"name":"refreshable","type":"\u0004","is_mandatory":true,"title":"Whether the token can be exchanged for a new one without reauthenticating","provider":"go.mondoo.com/mql/providers/artifactory"},"scope":{"name":"scope","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes the token carries","desc":"Contains entries such as applied-permissions/user, applied-permissions/admin, applied-permissions/groups:example, or a repository scope. A token carries at most the rights of the principal it was issued for.","provider":"go.mondoo.com/mql/providers/artifactory"},"subject":{"name":"subject","type":"\u0007","is_mandatory":true,"title":"Principal the token authenticates as, for example jfrt@01ab2c3d/users/example","provider":"go.mondoo.com/mql/providers/artifactory"},"subjectRef":{"name":"subjectRef","type":"\u001bartifactory.user","title":"User the token authenticates as, or null when the subject is not a user on this instance","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Access Token","desc":"A bearer token issued against the instance. The `expiry` field is null on a token that never expires, which stays usable until someone revokes it by hand. The `scope` field holds what the token may do, and `grantsAdmin` reduces it to whether the token carries administrative rights. Query `artifactory.accessTokens.where(expiry == null)` for the tokens that outlive every rotation.","private":true,"min_provider_version":"13.0.0","defaults":"id subject expiry","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.backup":{"id":"artifactory.backup","name":"artifactory.backup","fields":{"createArchive":{"name":"createArchive","type":"\u0004","is_mandatory":true,"title":"Whether the export is written as an archive rather than a directory tree","provider":"go.mondoo.com/mql/providers/artifactory"},"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Schedule the backup runs on, as a cron expression","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the backup runs","provider":"go.mondoo.com/mql/providers/artifactory"},"excludeBuilds":{"name":"excludeBuilds","type":"\u0004","is_mandatory":true,"title":"Whether build info is left out of the export","provider":"go.mondoo.com/mql/providers/artifactory"},"excludeNewRepositories":{"name":"excludeNewRepositories","type":"\u0004","is_mandatory":true,"title":"Whether a repository created after the backup was configured is left out","desc":"When true, a repository added later is silently outside the backup.","provider":"go.mondoo.com/mql/providers/artifactory"},"excludedRepositories":{"name":"excludedRepositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys left out of the export","provider":"go.mondoo.com/mql/providers/artifactory"},"excludedRepositoryRefs":{"name":"excludedRepositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories left out of the export","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key of the backup, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"retentionPeriodHours":{"name":"retentionPeriodHours","type":"\u0005","is_mandatory":true,"title":"Hours an export is kept before it is removed, or null when it is kept forever","desc":"An export that is kept forever accumulates every secret the instance held at each point in time.","provider":"go.mondoo.com/mql/providers/artifactory"},"sendMailOnError":{"name":"sendMailOnError","type":"\u0004","is_mandatory":true,"title":"Whether a failed run sends mail","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Backup","desc":"A scheduled export of the instance. The export contains the artifacts and the configuration, including the secrets held in it, so where it is written and how long it is kept are part of the instance's exposure. The `excludedRepositories` field reports what is left out of it, and `excludeNewRepositories` reports whether a repository created later is left out without anyone deciding so.","private":true,"min_provider_version":"13.0.0","defaults":"key enabled cronExpression","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.cleanupPolicy":{"id":"artifactory.cleanupPolicy","name":"artifactory.cleanupPolicy","fields":{"createdBeforeInMonths":{"name":"createdBeforeInMonths","type":"\u0005","is_mandatory":true,"title":"Age in months an artifact must reach before the policy deletes it, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Schedule the policy runs on, as a cron expression","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"durationInMinutes":{"name":"durationInMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes the policy is allowed to run for, or null when unbounded","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy runs","provider":"go.mondoo.com/mql/providers/artifactory"},"excludedRepositories":{"name":"excludedRepositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the policy is withheld from","provider":"go.mondoo.com/mql/providers/artifactory"},"keepLastNVersions":{"name":"keepLastNVersions","type":"\u0005","is_mandatory":true,"title":"Versions the policy keeps regardless of age, or null when it keeps none","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key of the policy, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"lastDownloadedBeforeInMonths":{"name":"lastDownloadedBeforeInMonths","type":"\u0005","is_mandatory":true,"title":"Months an artifact must go undownloaded before the policy deletes it, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"packageTypes":{"name":"packageTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Package types the policy deletes, empty when it covers every type","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the policy deletes from","provider":"go.mondoo.com/mql/providers/artifactory"},"repositoryRefs":{"name":"repositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories the policy deletes from","provider":"go.mondoo.com/mql/providers/artifactory"},"skipTrashcan":{"name":"skipTrashcan","type":"\u0004","is_mandatory":true,"title":"Whether deleted artifacts skip the trash can and are removed at once","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Cleanup Policy","desc":"A scheduled deletion of artifacts that match a search. The `enabled` and `cronExpression` fields report whether and when it runs, and the `repositories` field reports what it deletes from. A policy that reaches a repository a platform installs from removes artifacts a consumer may still pin, so read `keepLastNVersions` and the age thresholds together with the repositories the policy covers.","private":true,"min_provider_version":"13.0.0","defaults":"key enabled cronExpression","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.crowdSettings":{"id":"artifactory.crowdSettings","name":"artifactory.crowdSettings","fields":{"allowUserToAccessProfile":{"name":"allowUserToAccessProfile","type":"\u0004","is_mandatory":true,"title":"Whether an account authenticated this way may edit its own profile","provider":"go.mondoo.com/mql/providers/artifactory"},"applicationName":{"name":"applicationName","type":"\u0007","is_mandatory":true,"title":"Application name the instance authenticates to Crowd as","provider":"go.mondoo.com/mql/providers/artifactory"},"directAuthentication":{"name":"directAuthentication","type":"\u0004","is_mandatory":true,"title":"Whether credentials are sent to Crowd rather than a session being accepted","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the instance authenticates against Crowd","provider":"go.mondoo.com/mql/providers/artifactory"},"noAutoUserCreation":{"name":"noAutoUserCreation","type":"\u0004","is_mandatory":true,"title":"Whether an authentication for an unknown account is refused","desc":"When false, a successful authentication creates an account on the instance.","provider":"go.mondoo.com/mql/providers/artifactory"},"serverUrl":{"name":"serverUrl","type":"\u0007","is_mandatory":true,"title":"URL of the Crowd server","provider":"go.mondoo.com/mql/providers/artifactory"},"sessionValidationInterval":{"name":"sessionValidationInterval","type":"\u0005","is_mandatory":true,"title":"Seconds between session validations, or null when unset","desc":"A long interval keeps a session usable after Crowd has ended it.","provider":"go.mondoo.com/mql/providers/artifactory"},"useDefaultProxy":{"name":"useDefaultProxy","type":"\u0004","is_mandatory":true,"title":"Whether the instance reaches Crowd through its default proxy","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Crowd Settings","desc":"Sign-in through Atlassian Crowd or Jira. The `noAutoUserCreation` field decides whether a successful authentication creates an account here, and `directAuthentication` decides whether the instance forwards credentials to Crowd itself rather than accepting a Crowd session.","private":true,"min_provider_version":"13.0.0","defaults":"enabled serverUrl","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.group":{"id":"artifactory.group","name":"artifactory.group","fields":{"adminPrivileges":{"name":"adminPrivileges","type":"\u0004","title":"Whether every member holds instance-wide administrative rights","desc":"Administrative rights carried by group membership are granted by adding someone to the group, which is a different review path than granting them on the account.","provider":"go.mondoo.com/mql/providers/artifactory"},"autoJoin":{"name":"autoJoin","type":"\u0004","title":"Whether new accounts join the group automatically","desc":"When true, every account created on the instance receives whatever this group is granted, including accounts created by a federated sign-in.","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"internal":{"name":"internal","type":"\u0004","title":"Whether the group is maintained on the instance rather than synchronized from an identity provider","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets that name the group","provider":"go.mondoo.com/mql/providers/artifactory"},"realm":{"name":"realm","type":"\u0007","title":"Realm the group is maintained in, for example internal, ldap, or saml","provider":"go.mondoo.com/mql/providers/artifactory"},"realmAttributes":{"name":"realmAttributes","type":"\u0007","title":"Identity provider settings the group is synchronized with, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"users":{"name":"users","type":"\u0019\u001bartifactory.user","title":"Users that belong to the group","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Group","desc":"A set of users that permission targets grant to as a unit. The `adminPrivileges` field reports whether membership alone carries instance-wide administrative rights, and `autoJoin` reports whether new accounts land in the group without anyone adding them. The `realm` field separates a group maintained on the instance from one synchronized out of an identity provider. Select a group with `artifactory.groups.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name realm adminPrivileges","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.httpSsoSettings":{"id":"artifactory.httpSsoSettings","name":"artifactory.httpSsoSettings","fields":{"allowUserToAccessProfile":{"name":"allowUserToAccessProfile","type":"\u0004","is_mandatory":true,"title":"Whether an account authenticated this way may edit its own profile","provider":"go.mondoo.com/mql/providers/artifactory"},"httpSsoProxied":{"name":"httpSsoProxied","type":"\u0004","is_mandatory":true,"title":"Whether the instance takes the account name from a request header","desc":"When true, the named header decides who the caller is. A deployment that also accepts requests that did not pass through the proxy lets a caller choose any account.","provider":"go.mondoo.com/mql/providers/artifactory"},"noAutoUserCreation":{"name":"noAutoUserCreation","type":"\u0004","is_mandatory":true,"title":"Whether a header naming an unknown account is refused","desc":"When false, the header creates the account it names.","provider":"go.mondoo.com/mql/providers/artifactory"},"remoteUserRequestVariable":{"name":"remoteUserRequestVariable","type":"\u0007","is_mandatory":true,"title":"Header the account name is read from, for example REMOTE_USER","provider":"go.mondoo.com/mql/providers/artifactory"},"syncLdapGroups":{"name":"syncLdapGroups","type":"\u0004","is_mandatory":true,"title":"Whether LDAP group membership is refreshed on such a sign-in","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory HTTP Single Sign-On Settings","desc":"Sign-in taken from a request header set by a reverse proxy. The instance trusts whatever the header says, so this is only as strong as the proxy in front of it: a caller that reaches the instance directly can set the header itself. Read `httpSsoProxied` for whether the instance believes it is behind such a proxy at all.","private":true,"min_provider_version":"13.0.0","defaults":"httpSsoProxied remoteUserRequestVariable","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.ldapGroupSetting":{"id":"artifactory.ldapGroupSetting","name":"artifactory.ldapGroupSetting","fields":{"descriptionAttribute":{"name":"descriptionAttribute","type":"\u0007","is_mandatory":true,"title":"Attribute the description is read from, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"filter":{"name":"filter","type":"\u0007","is_mandatory":true,"title":"Filter that selects the groups, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"forceAttributeSearch":{"name":"forceAttributeSearch","type":"\u0004","is_mandatory":true,"title":"Whether the member attribute is searched even when it is not indexed","provider":"go.mondoo.com/mql/providers/artifactory"},"groupBaseDn":{"name":"groupBaseDn","type":"\u0007","is_mandatory":true,"title":"Subtree the groups are read from","provider":"go.mondoo.com/mql/providers/artifactory"},"groupMemberAttribute":{"name":"groupMemberAttribute","type":"\u0007","is_mandatory":true,"title":"Attribute the members are read from","provider":"go.mondoo.com/mql/providers/artifactory"},"groupNameAttribute":{"name":"groupNameAttribute","type":"\u0007","is_mandatory":true,"title":"Attribute the group name is read from","provider":"go.mondoo.com/mql/providers/artifactory"},"ldapSetting":{"name":"ldapSetting","type":"\u001bartifactory.ldapSetting","title":"LDAP server the mapping applies to, or null when it names none on this instance","provider":"go.mondoo.com/mql/providers/artifactory"},"ldapSettingKey":{"name":"ldapSettingKey","type":"\u0007","is_mandatory":true,"title":"Key of the LDAP server the mapping applies to, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the mapping, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"strategy":{"name":"strategy","type":"\u0007","is_mandatory":true,"title":"How membership is resolved, for example STATIC, DYNAMIC, or HIERARCHY","provider":"go.mondoo.com/mql/providers/artifactory"},"subTree":{"name":"subTree","type":"\u0004","is_mandatory":true,"title":"Whether the search descends the whole subtree","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory LDAP Group Mapping","desc":"A mapping from an LDAP group tree onto the instance's groups. Whatever a mapped group is granted is granted to everyone the directory places in it, so a mapping onto a group with publishing rights moves that decision into the directory. The `strategy` field reports how membership is resolved.","private":true,"min_provider_version":"13.0.0","defaults":"name strategy groupBaseDn","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.ldapSetting":{"id":"artifactory.ldapSetting","name":"artifactory.ldapSetting","fields":{"allowUserToAccessProfile":{"name":"allowUserToAccessProfile","type":"\u0004","is_mandatory":true,"title":"Whether an account authenticated this way may edit its own profile","provider":"go.mondoo.com/mql/providers/artifactory"},"autoCreateUser":{"name":"autoCreateUser","type":"\u0004","is_mandatory":true,"title":"Whether a successful bind creates an account on the instance","desc":"When true, every principal the directory accepts becomes a principal here, and what it may do is whatever the auto-join groups and the anonymous grants give it.","provider":"go.mondoo.com/mql/providers/artifactory"},"emailAttribute":{"name":"emailAttribute","type":"\u0007","is_mandatory":true,"title":"Attribute the account email is read from, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the instance authenticates against this server","provider":"go.mondoo.com/mql/providers/artifactory"},"hasManagerCredential":{"name":"hasManagerCredential","type":"\u0004","is_mandatory":true,"title":"Whether a manager credential is stored for the directory","desc":"True when a manager distinguished name is configured. The credential itself is never exposed.","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key of the setting, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"ldapPoisoningProtection":{"name":"ldapPoisoningProtection","type":"\u0004","is_mandatory":true,"title":"Whether responses from the directory are filtered against injection","provider":"go.mondoo.com/mql/providers/artifactory"},"ldapUrl":{"name":"ldapUrl","type":"\u0007","is_mandatory":true,"title":"URL of the directory, including the search base","desc":"A URL with the ldap scheme rather than ldaps carries the bind credential over an unencrypted connection.","provider":"go.mondoo.com/mql/providers/artifactory"},"searchBase":{"name":"searchBase","type":"\u0007","is_mandatory":true,"title":"Subtree the search starts from, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"searchFilter":{"name":"searchFilter","type":"\u0007","is_mandatory":true,"title":"Filter used to find an account in the directory, or null when a pattern is used instead","provider":"go.mondoo.com/mql/providers/artifactory"},"searchSubTree":{"name":"searchSubTree","type":"\u0004","is_mandatory":true,"title":"Whether the search descends the whole subtree","provider":"go.mondoo.com/mql/providers/artifactory"},"userDnPattern":{"name":"userDnPattern","type":"\u0007","is_mandatory":true,"title":"Pattern a distinguished name is built from, or null when a search is used instead","provider":"go.mondoo.com/mql/providers/artifactory"},"usesEncryptedTransport":{"name":"usesEncryptedTransport","type":"\u0004","is_mandatory":true,"title":"Whether the URL uses an encrypted transport","desc":"True when the URL uses the ldaps scheme. A plain ldap URL sends the bind credential in the clear unless the deployment adds transport security outside Artifactory.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory LDAP Server","desc":"An LDAP server the instance authenticates accounts against. The `autoCreateUser` field reports whether a successful bind creates an account on the instance, which is what makes every principal in the directory a principal here. Read it together with the groups the directory maps onto, which `artifactory.security.ldapGroupSettings` reports.","private":true,"min_provider_version":"13.0.0","defaults":"key enabled ldapUrl","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.oauthProvider":{"id":"artifactory.oauthProvider","name":"artifactory.oauthProvider","fields":{"apiUrl":{"name":"apiUrl","type":"\u0007","is_mandatory":true,"title":"API endpoint of the provider, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"authUrl":{"name":"authUrl","type":"\u0007","is_mandatory":true,"title":"Authorization endpoint of the provider, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"basicUrl":{"name":"basicUrl","type":"\u0007","is_mandatory":true,"title":"Base URL of the provider, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"Client identifier the instance registered with the provider, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"domain":{"name":"domain","type":"\u0007","is_mandatory":true,"title":"Account domain the provider accepts a sign-in from, or null when any is accepted","desc":"Empty means the provider is not limited to one organization, so any account it holds can sign in.","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the instance accepts a sign-in from this provider","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the provider, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"providerType":{"name":"providerType","type":"\u0007","is_mandatory":true,"title":"Kind of provider, for example github, google, or openId","provider":"go.mondoo.com/mql/providers/artifactory"},"tokenUrl":{"name":"tokenUrl","type":"\u0007","is_mandatory":true,"title":"Token endpoint of the provider, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory OAuth Provider","desc":"One OAuth provider the instance accepts a sign-in from. Every enabled provider is a separate path to a principal on the instance, so the set of providers bounds who can sign in at all. The `domain` field, where the provider type supports it, limits which accounts of that provider are accepted.","private":true,"min_provider_version":"13.0.0","defaults":"name providerType enabled","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.oauthSettings":{"id":"artifactory.oauthSettings","name":"artifactory.oauthSettings","fields":{"allowUserToAccessProfile":{"name":"allowUserToAccessProfile","type":"\u0004","is_mandatory":true,"title":"Whether an account authenticated this way may edit its own profile","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the instance accepts OAuth sign-in","provider":"go.mondoo.com/mql/providers/artifactory"},"persistUsers":{"name":"persistUsers","type":"\u0004","is_mandatory":true,"title":"Whether a successful sign-in creates an account on the instance","desc":"When true, every principal a configured provider accepts becomes a principal here.","provider":"go.mondoo.com/mql/providers/artifactory"},"providers":{"name":"providers","type":"\u0019\u001bartifactory.oauthProvider","title":"Providers configured for OAuth sign-in","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory OAuth Settings","desc":"Sign-in through OAuth providers. The `persistUsers` field decides whether a successful sign-in creates an account here. The `providers` field lists every configured provider, each of which is a separate way to become a principal on this instance.","private":true,"min_provider_version":"13.0.0","defaults":"enabled","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.permissionTarget":{"id":"artifactory.permissionTarget","name":"artifactory.permissionTarget","fields":{"build":{"name":"build","type":"\u001bartifactory.permissionTarget.scope","title":"Build scope of the target, or null when it grants nothing over build info","provider":"go.mondoo.com/mql/providers/artifactory"},"grantsAnonymousDeploy":{"name":"grantsAnonymousDeploy","type":"\u0004","is_mandatory":true,"title":"Whether the target lets the anonymous user publish to a repository","desc":"True when the repository scope gives the anonymous user a write, deploy, delete, or manage action. An unauthenticated caller can then replace the artifacts a platform installs from. Anonymous access must also be enabled instance-wide for the grant to apply, which `artifactory.security.anonymousAccessEnabled` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"grantsAnonymousRead":{"name":"grantsAnonymousRead","type":"\u0004","is_mandatory":true,"title":"Whether the target lets the anonymous user read from a repository","desc":"Anonymous access must also be enabled instance-wide for the grant to apply, which `artifactory.security.anonymousAccessEnabled` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the permission target, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"principal":{"name":"principal","type":"\u001bartifactory.permissionTarget.principal","title":"Principal of an Artifactory Permission Target","desc":"A user or a group named by a permission target, together with the actions that target gives it. The `actions` field holds the raw action names the instance reports, for example read, write, annotate, delete, or manage, and the `canDeploy` and `canManage` fields reduce them to whether the principal may publish or may change the grant itself.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"principals":{"name":"principals","type":"\u0019\u001bartifactory.permissionTarget.principal","title":"Every principal the target names, across all of its scopes","provider":"go.mondoo.com/mql/providers/artifactory"},"releaseBundle":{"name":"releaseBundle","type":"\u001bartifactory.permissionTarget.scope","title":"Release bundle scope of the target, or null when it grants nothing over release bundles","provider":"go.mondoo.com/mql/providers/artifactory"},"repo":{"name":"repo","type":"\u001bartifactory.permissionTarget.scope","title":"Repository scope of the target, or null when it grants nothing over repositories","provider":"go.mondoo.com/mql/providers/artifactory"},"scope":{"name":"scope","type":"\u001bartifactory.permissionTarget.scope","title":"Scope of an Artifactory Permission Target","desc":"One of the three areas a permission target grants over: repositories, build info, or release bundles. The `repositories` field holds the keys the scope covers, which may include the wildcard keys the instance defines, and `includePatterns` and `excludePatterns` narrow the grant to artifact paths within them. The `appliesToAllRepositories` and `appliesToAllPaths` fields reduce those to the question of whether the scope is narrowed at all.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true}},"title":"Artifactory Permission Target","desc":"A named grant that gives principals a set of actions over a set of repository, build, or release bundle patterns. This is where an over-broad grant becomes visible: `repo` holds the repository scope with its repository keys and its include and exclude patterns, and `principals` lists every user and group the target names together with the actions it gives them. The `grantsAnonymousDeploy` field reduces the target to the single question of whether an unauthenticated caller may publish through it. Select a target with `artifactory.permissionTargets.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.permissionTarget.principal":{"id":"artifactory.permissionTarget.principal","name":"artifactory.permissionTarget.principal","fields":{"actions":{"name":"actions","type":"\u0019\u0007","is_mandatory":true,"title":"Actions the permission target gives the principal","desc":"Contains entries such as read, write, annotate, delete, manage, managedXrayMeta, or distribute. The exact set depends on the scope and on the product version.","provider":"go.mondoo.com/mql/providers/artifactory"},"canDeploy":{"name":"canDeploy","type":"\u0004","is_mandatory":true,"title":"Whether the actions let the principal publish artifacts","desc":"True when the actions contain write, deploy, delete, or manage. Publishing rights on a repository a platform installs from let the principal replace what every consumer of that repository receives.","provider":"go.mondoo.com/mql/providers/artifactory"},"canManage":{"name":"canManage","type":"\u0004","is_mandatory":true,"title":"Whether the actions let the principal change the grant itself","desc":"True when the actions contain manage. A principal that can manage a permission target can widen its own access.","provider":"go.mondoo.com/mql/providers/artifactory"},"group":{"name":"group","type":"\u001bartifactory.group","title":"Group the principal names, or null when the principal is a user or the group is unknown","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the user or group","provider":"go.mondoo.com/mql/providers/artifactory"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope of the permission target the actions apply to, one of repo, build, or releaseBundle","provider":"go.mondoo.com/mql/providers/artifactory"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of principal, one of user or group","provider":"go.mondoo.com/mql/providers/artifactory"},"user":{"name":"user","type":"\u001bartifactory.user","title":"User the principal names, or null when the principal is a group or the user is unknown","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Principal of an Artifactory Permission Target","desc":"A user or a group named by a permission target, together with the actions that target gives it. The `actions` field holds the raw action names the instance reports, for example read, write, annotate, delete, or manage, and the `canDeploy` and `canManage` fields reduce them to whether the principal may publish or may change the grant itself.","private":true,"min_provider_version":"13.0.0","defaults":"name type actions","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.permissionTarget.scope":{"id":"artifactory.permissionTarget.scope","name":"artifactory.permissionTarget.scope","fields":{"appliesToAllPaths":{"name":"appliesToAllPaths","type":"\u0004","is_mandatory":true,"title":"Whether the scope covers every artifact path in the repositories it names","desc":"True when no include pattern narrows the grant, or when a pattern matches every path.","provider":"go.mondoo.com/mql/providers/artifactory"},"appliesToAllRepositories":{"name":"appliesToAllRepositories","type":"\u0004","is_mandatory":true,"title":"Whether the scope covers every repository through a wildcard key","desc":"True when the repository keys contain one of the instance's wildcard keys. The grant then reaches repositories created after the target was written.","provider":"go.mondoo.com/mql/providers/artifactory"},"excludePatterns":{"name":"excludePatterns","type":"\u0019\u0007","is_mandatory":true,"title":"Artifact path patterns the grant is withheld from","provider":"go.mondoo.com/mql/providers/artifactory"},"includePatterns":{"name":"includePatterns","type":"\u0019\u0007","is_mandatory":true,"title":"Artifact path patterns the grant applies to, for example **/*","desc":"Empty or a single match-everything pattern means the grant covers the whole repository rather than part of it.","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Area the scope grants over, one of repo, build, or releaseBundle","provider":"go.mondoo.com/mql/providers/artifactory"},"principals":{"name":"principals","type":"\u0019\u001bartifactory.permissionTarget.principal","title":"Principals the scope names and the actions it gives them","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the scope covers","desc":"May contain a wildcard key the instance defines rather than a real repository, for example ANY, ANY LOCAL, ANY REMOTE, ANY VIRTUAL, ANY FEDERATED, or ANY DISTRIBUTION. Such a key covers repositories that did not exist when the target was written, including ones created later.","provider":"go.mondoo.com/mql/providers/artifactory"},"repositoryRefs":{"name":"repositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories the scope covers that exist on the instance","desc":"Resolves the scope's repository keys against the instance. A wildcard key has no repository of its own and is skipped, so compare the length against `repositories` or read `appliesToAllRepositories` to see whether a wildcard is in play.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Scope of an Artifactory Permission Target","desc":"One of the three areas a permission target grants over: repositories, build info, or release bundles. The `repositories` field holds the keys the scope covers, which may include the wildcard keys the instance defines, and `includePatterns` and `excludePatterns` narrow the grant to artifact paths within them. The `appliesToAllRepositories` and `appliesToAllPaths` fields reduce those to the question of whether the scope is narrowed at all.","private":true,"min_provider_version":"13.0.0","defaults":"name repositories","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.project":{"id":"artifactory.project","name":"artifactory.project","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the project","provider":"go.mondoo.com/mql/providers/artifactory"},"indexResources":{"name":"indexResources","type":"\u0004","is_mandatory":true,"title":"Whether a project administrator may index repositories for scanning","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key of the project, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"manageMembers":{"name":"manageMembers","type":"\u0004","is_mandatory":true,"title":"Whether a project administrator may add and remove members","desc":"When true, who reaches the project's repositories is decided inside the project rather than by a platform administrator.","provider":"go.mondoo.com/mql/providers/artifactory"},"manageResources":{"name":"manageResources","type":"\u0004","is_mandatory":true,"title":"Whether a project administrator may attach and detach repositories","desc":"When true, a project administrator can bring a repository under the project's own roles.","provider":"go.mondoo.com/mql/providers/artifactory"},"member":{"name":"member","type":"\u001bartifactory.project.member","title":"Member of an Artifactory Project","desc":"An account that belongs to a project, together with the roles it holds there. A role is granted inside the project, so it does not appear in the instance's permission targets. The `isAdmin` field reports whether the member holds a role that administers the project itself.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bartifactory.project.member","title":"Accounts that belong to the project, with the roles they hold","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u001bartifactory.repository","title":"Repositories attached to the project","desc":"Resolved from the repositories that report this project. A repository a project administrator attached is reached through the project's roles as well as through the instance's permission targets.","provider":"go.mondoo.com/mql/providers/artifactory"},"softLimit":{"name":"softLimit","type":"\u0004","is_mandatory":true,"title":"Whether the storage quota only warns rather than blocks","provider":"go.mondoo.com/mql/providers/artifactory"},"storageQuotaBytes":{"name":"storageQuotaBytes","type":"\u0005","is_mandatory":true,"title":"Storage the project may use, in bytes, or null when it is not limited","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Project","desc":"A project, which delegates part of the instance to its own administrators. The `manageMembers` and `manageResources` fields report what a project administrator may do without a platform administrator: add members, and attach repositories to the project. That delegation is a second path to access alongside the instance's permission targets, so read `members` together with `artifactory.permissionTargets`. Select a project with `artifactory.projects.where(key == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"key displayName","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.project.member":{"id":"artifactory.project.member","name":"artifactory.project.member","fields":{"isAdmin":{"name":"isAdmin","type":"\u0004","is_mandatory":true,"title":"Whether the member administers the project","desc":"True when a role administers the project. Such a member decides who else reaches the project's repositories, as far as `manageMembers` allows.","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the account","provider":"go.mondoo.com/mql/providers/artifactory"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Roles the account holds in the project","desc":"Contains the built-in roles, for example Project Admin, Developer, Contributor, Viewer, or Release Manager, and any role the project defines itself.","provider":"go.mondoo.com/mql/providers/artifactory"},"user":{"name":"user","type":"\u001bartifactory.user","title":"User the member names, or null when the account is unknown to the instance","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Member of an Artifactory Project","desc":"An account that belongs to a project, together with the roles it holds there. A role is granted inside the project, so it does not appear in the instance's permission targets. The `isAdmin` field reports whether the member holds a role that administers the project itself.","private":true,"min_provider_version":"13.0.0","defaults":"name roles","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.replication":{"id":"artifactory.replication","name":"artifactory.replication","fields":{"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Schedule the replication runs on, as a cron expression, or null when it is event driven","provider":"go.mondoo.com/mql/providers/artifactory"},"enableEventReplication":{"name":"enableEventReplication","type":"\u0004","is_mandatory":true,"title":"Whether the replication runs on every change rather than on a schedule","desc":"Event replication copies each artifact as it is written, so the other end follows this instance continuously.","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the replication runs","provider":"go.mondoo.com/mql/providers/artifactory"},"excludePathPrefixPattern":{"name":"excludePathPrefixPattern","type":"\u0007","is_mandatory":true,"title":"Path patterns the replication leaves out, or null when it leaves out nothing","provider":"go.mondoo.com/mql/providers/artifactory"},"hasCredential":{"name":"hasCredential","type":"\u0004","is_mandatory":true,"title":"Whether a credential is stored for the other end","desc":"True when a user name is configured. The credential itself is never exposed. A stored credential is what a plain HTTP URL sends in the clear.","provider":"go.mondoo.com/mql/providers/artifactory"},"includePathPrefixPattern":{"name":"includePathPrefixPattern","type":"\u0007","is_mandatory":true,"title":"Path patterns the replication is limited to, or null when it covers the whole repository","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key of the replication, or null when the instance does not report one","provider":"go.mondoo.com/mql/providers/artifactory"},"repository":{"name":"repository","type":"\u001bartifactory.repository","title":"Repository the replication belongs to","provider":"go.mondoo.com/mql/providers/artifactory"},"repositoryKey":{"name":"repositoryKey","type":"\u0007","is_mandatory":true,"title":"Key of the repository the replication belongs to","provider":"go.mondoo.com/mql/providers/artifactory"},"socketTimeoutMillis":{"name":"socketTimeoutMillis","type":"\u0005","is_mandatory":true,"title":"Milliseconds the replication waits on the other end, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"syncDeletes":{"name":"syncDeletes","type":"\u0004","is_mandatory":true,"title":"Whether a deletion is copied to the other end","desc":"When true, removing an artifact here removes it there as well, so the other end is not a copy that survives a deletion.","provider":"go.mondoo.com/mql/providers/artifactory"},"syncProperties":{"name":"syncProperties","type":"\u0004","is_mandatory":true,"title":"Whether artifact properties are copied","provider":"go.mondoo.com/mql/providers/artifactory"},"syncStatistics":{"name":"syncStatistics","type":"\u0004","is_mandatory":true,"title":"Whether download statistics are copied","provider":"go.mondoo.com/mql/providers/artifactory"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"URL of the other end of the replication","desc":"Every artifact of the repository is sent to, or fetched from, this URL. A URL that is not the expected instance moves the registry's contents somewhere that was never reviewed.","provider":"go.mondoo.com/mql/providers/artifactory"},"usesEncryptedTransport":{"name":"usesEncryptedTransport","type":"\u0004","is_mandatory":true,"title":"Whether the URL uses an encrypted transport","desc":"False when the URL uses plain HTTP, which sends both the artifacts and the stored credential in the clear.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Replication","desc":"A configured copy of a repository's contents between this instance and another one. The `url` field is the other end: a push replication sends every artifact there, so an unexpected URL is an export of the registry, and a pull replication brings that instance's artifacts here under a trusted repository name. The `syncDeletes` field reports whether a deletion at one end removes the artifact at the other. Select a repository's replications with `artifactory.repositories.where(key == \"example-docker\") { replications }`.","private":true,"min_provider_version":"13.0.0","defaults":"repositoryKey url enabled","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.repository":{"id":"artifactory.repository","name":"artifactory.repository","fields":{"allowAnyHostAuth":{"name":"allowAnyHostAuth","type":"\u0004","title":"Whether a remote repository sends its credentials to any host it is redirected to","desc":"Null on repository types that do not proxy. When true, a redirect from the upstream can carry the stored credentials to an unrelated host.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousActions":{"name":"anonymousActions","type":"\u0019\u0007","title":"Actions the anonymous user holds on the repository","desc":"The union of the actions every permission target grants to the anonymous user over this repository, for example read, write, or delete. Empty when no target grants the anonymous user anything. The union is taken at repository level and does not evaluate the targets' path patterns, so an action listed here may be limited to part of the repository. Anonymous access must also be enabled instance-wide for these actions to apply, which `artifactory.security.anonymousAccessEnabled` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"archiveBrowsingEnabled":{"name":"archiveBrowsingEnabled","type":"\u0004","title":"Whether a client may browse inside a stored archive","desc":"Null when the repository does not carry the setting. Browsing extracts an archive on the instance and serves single entries from it.","provider":"go.mondoo.com/mql/providers/artifactory"},"blackedOut":{"name":"blackedOut","type":"\u0004","title":"Whether the repository is blocked from serving and accepting artifacts","provider":"go.mondoo.com/mql/providers/artifactory"},"blockPushingSchema1":{"name":"blockPushingSchema1","type":"\u0004","title":"Whether the repository refuses Docker image manifests of schema version 1","desc":"Null on repository types and package formats that do not carry the setting. A schema 1 manifest is not content addressable, so a tag can be moved to different content without the digest changing.","provider":"go.mondoo.com/mql/providers/artifactory"},"bypassHeadRequests":{"name":"bypassHeadRequests","type":"\u0004","title":"Whether a remote repository skips the HEAD request before a download","desc":"Null on repository types that do not proxy.","provider":"go.mondoo.com/mql/providers/artifactory"},"cdnRedirect":{"name":"cdnRedirect","type":"\u0004","title":"Whether a download is served through a content delivery network","desc":"Null when the repository does not carry the setting.","provider":"go.mondoo.com/mql/providers/artifactory"},"contentSynchronisationEnabled":{"name":"contentSynchronisationEnabled","type":"\u0004","title":"Whether a remote repository mirrors the upstream continuously","desc":"Null when the repository does not carry the setting. Continuous synchronization copies whatever the upstream publishes without a request for it.","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"downloadRedirect":{"name":"downloadRedirect","type":"\u0004","title":"Whether a download is served by a redirect to another host","desc":"Null when the repository does not carry the setting. A redirected download leaves the instance, so its access log does not record what was fetched.","provider":"go.mondoo.com/mql/providers/artifactory"},"enableTokenAuthentication":{"name":"enableTokenAuthentication","type":"\u0004","title":"Whether the repository accepts an access token in place of a password","desc":"Null on repository types and package formats that do not carry the setting.","provider":"go.mondoo.com/mql/providers/artifactory"},"excludesPattern":{"name":"excludesPattern","type":"\u0007","title":"Artifact path patterns the repository refuses to serve","provider":"go.mondoo.com/mql/providers/artifactory"},"externalDependenciesEnabled":{"name":"externalDependenciesEnabled","type":"\u0004","title":"Whether a remote repository may resolve dependencies from hosts other than its upstream","desc":"Null on repository types that do not proxy. When true, a build resolving through the repository can reach a host that was never reviewed.","provider":"go.mondoo.com/mql/providers/artifactory"},"forceNugetAuthentication":{"name":"forceNugetAuthentication","type":"\u0004","title":"Whether a client must authenticate to resolve NuGet packages","desc":"Null on repository types and package formats that do not carry the setting.","provider":"go.mondoo.com/mql/providers/artifactory"},"hasUpstreamCredential":{"name":"hasUpstreamCredential","type":"\u0004","title":"Whether a remote repository is configured with a credential for its upstream","desc":"True when a user name is stored for the upstream. The credential itself is never exposed. A stored credential is what `allowAnyHostAuth` can leak to an unrelated host on a redirect. Null on repository types that do not proxy.","provider":"go.mondoo.com/mql/providers/artifactory"},"includesPattern":{"name":"includesPattern","type":"\u0007","title":"Artifact path patterns the repository serves, for example **/*","provider":"go.mondoo.com/mql/providers/artifactory"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Repository key, which is its unique name on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"memberRepositories":{"name":"memberRepositories","type":"\u0019\u0007","title":"Repository keys aggregated by a virtual repository","desc":"Empty on repository types that do not aggregate. A virtual repository serves each member under one name, so a member with weaker controls is reachable through the virtual name.","provider":"go.mondoo.com/mql/providers/artifactory"},"memberRepositoryRefs":{"name":"memberRepositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories aggregated by a virtual repository","provider":"go.mondoo.com/mql/providers/artifactory"},"notes":{"name":"notes","type":"\u0007","title":"Free-form notes stored with the repository, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"offline":{"name":"offline","type":"\u0004","title":"Whether a remote repository serves only what is already cached","provider":"go.mondoo.com/mql/providers/artifactory"},"packageType":{"name":"packageType","type":"\u0007","is_mandatory":true,"title":"Package format the repository serves, for example docker, helm, maven, or generic","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets whose repository scope covers this repository","provider":"go.mondoo.com/mql/providers/artifactory"},"priorityResolution":{"name":"priorityResolution","type":"\u0004","title":"Whether the repository is resolved before others in a virtual repository","desc":"Null when the repository does not carry the setting. A repository resolved first decides which copy of a package name a consumer receives.","provider":"go.mondoo.com/mql/providers/artifactory"},"projectKey":{"name":"projectKey","type":"\u0007","title":"Project the repository belongs to, or null when it is not in a project","provider":"go.mondoo.com/mql/providers/artifactory"},"propertySets":{"name":"propertySets","type":"\u0019\u0007","title":"Property sets applied to the artifacts of the repository","provider":"go.mondoo.com/mql/providers/artifactory"},"replications":{"name":"replications","type":"\u0019\u001bartifactory.replication","title":"Replications configured on the repository","desc":"A push replication sends the repository's artifacts to another instance, and a pull replication brings another instance's artifacts here. Empty when the repository replicates nothing. Read on demand, one call per repository.","provider":"go.mondoo.com/mql/providers/artifactory"},"repoLayoutRef":{"name":"repoLayoutRef","type":"\u0007","title":"Layout the repository stores artifacts under, for example simple-default","provider":"go.mondoo.com/mql/providers/artifactory"},"signedUrlTtl":{"name":"signedUrlTtl","type":"\u0005","title":"Seconds a signed download URL of the repository stays valid, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"storeArtifactsLocally":{"name":"storeArtifactsLocally","type":"\u0004","title":"Whether a remote repository keeps a copy of what it proxies","desc":"Null on repository types that do not proxy. When false, the repository resolves from the upstream every time, so the upstream decides what a consumer receives on every request rather than only on the first.","provider":"go.mondoo.com/mql/providers/artifactory"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Repository type","desc":"One of local, remote, virtual, federated, or distribution. A local repository holds artifacts pushed to it, a remote one proxies an upstream, and a virtual one aggregates other repositories under a single name.","provider":"go.mondoo.com/mql/providers/artifactory"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Upstream URL a remote repository fetches from, or null on other types","desc":"Every artifact served by a remote repository originates here, so an upstream that is not the expected registry places untrusted content behind a trusted repository name.","provider":"go.mondoo.com/mql/providers/artifactory"},"xrayBlocksDownload":{"name":"xrayBlocksDownload","type":"\u0004","title":"Whether a policy enforced on the repository stops a download","desc":"True when any enforced policy blocks an artifact that has a violation. When false, a violation is recorded and the artifact stays installable.","provider":"go.mondoo.com/mql/providers/artifactory"},"xrayDataTtl":{"name":"xrayDataTtl","type":"\u0005","title":"Days Xray data for the repository is kept, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"xrayIndex":{"name":"xrayIndex","type":"\u0004","title":"Whether Xray indexes the repository for vulnerability scanning","desc":"Null when the instance does not report the setting for the repository type. A repository that is not indexed is never scanned, so a finding on an artifact stored there is never raised.","provider":"go.mondoo.com/mql/providers/artifactory"},"xrayPolicies":{"name":"xrayPolicies","type":"\u0019\u001bartifactory.xray.policy","title":"Xray policies enforced on the repository","desc":"The policies of every active watch that reaches the repository. Empty when nothing is enforced on it, whatever `xrayIndex` reports.","provider":"go.mondoo.com/mql/providers/artifactory"},"xrayWatches":{"name":"xrayWatches","type":"\u0019\u001bartifactory.xray.watch","title":"Active Xray watches that reach the repository","desc":"A repository that no active watch names is scanned but never acted on, so this is the difference between being indexed and being covered. Includes the watches that reach it through a wildcard rather than by name.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Repository","desc":"A repository on the instance, which is where artifacts are stored, proxied, or aggregated. The `type` field separates a local repository (artifacts are pushed to it) from a remote one (artifacts are proxied from an upstream) and from a virtual one (several repositories are served under one name). For a remote repository, `url` is the upstream it fetches from, so an unexpected upstream on a repository a platform installs from is detectable. The `permissionTargets` field reports which grants reach the repository, and `anonymousActions` reduces those grants to what an unauthenticated caller may do. Select a repository with `artifactory.repositories.where(key == \"example-docker\")`.","private":true,"min_provider_version":"13.0.0","defaults":"key type packageType","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.samlSettings":{"id":"artifactory.samlSettings","name":"artifactory.samlSettings","fields":{"allowUserToAccessProfile":{"name":"allowUserToAccessProfile","type":"\u0004","is_mandatory":true,"title":"Whether an account authenticated this way may edit its own profile","provider":"go.mondoo.com/mql/providers/artifactory"},"autoRedirect":{"name":"autoRedirect","type":"\u0004","is_mandatory":true,"title":"Whether callers are sent to the identity provider without seeing a sign-in form","desc":"When false, the instance still accepts its own credentials, so an internal account stays usable outside the identity provider's controls.","provider":"go.mondoo.com/mql/providers/artifactory"},"emailAttribute":{"name":"emailAttribute","type":"\u0007","is_mandatory":true,"title":"Attribute the account email is read from, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the instance accepts SAML assertions","provider":"go.mondoo.com/mql/providers/artifactory"},"groupAttribute":{"name":"groupAttribute","type":"\u0007","is_mandatory":true,"title":"Attribute the groups are read from, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"hasCertificate":{"name":"hasCertificate","type":"\u0004","is_mandatory":true,"title":"Whether a signing certificate is configured for the identity provider","desc":"The certificate itself is not exposed. Without one, an assertion cannot be verified against the identity provider that claims to have issued it.","provider":"go.mondoo.com/mql/providers/artifactory"},"loginUrl":{"name":"loginUrl","type":"\u0007","is_mandatory":true,"title":"URL callers are sent to in order to sign in","provider":"go.mondoo.com/mql/providers/artifactory"},"logoutUrl":{"name":"logoutUrl","type":"\u0007","is_mandatory":true,"title":"URL callers are sent to in order to sign out, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"noAutoUserCreation":{"name":"noAutoUserCreation","type":"\u0004","is_mandatory":true,"title":"Whether an assertion for an unknown account is refused","desc":"When false, a successful assertion creates an account on the instance, so every principal the identity provider accepts becomes a principal here.","provider":"go.mondoo.com/mql/providers/artifactory"},"serviceProviderName":{"name":"serviceProviderName","type":"\u0007","is_mandatory":true,"title":"Name the instance identifies itself with to the identity provider","provider":"go.mondoo.com/mql/providers/artifactory"},"syncGroups":{"name":"syncGroups","type":"\u0004","is_mandatory":true,"title":"Whether group membership is taken from the assertion","provider":"go.mondoo.com/mql/providers/artifactory"},"useEncryptedAssertion":{"name":"useEncryptedAssertion","type":"\u0004","is_mandatory":true,"title":"Whether the instance requires an encrypted assertion","provider":"go.mondoo.com/mql/providers/artifactory"},"verifyAudienceRestriction":{"name":"verifyAudienceRestriction","type":"\u0004","is_mandatory":true,"title":"Whether the audience restriction of an assertion is checked","desc":"When false, an assertion minted for another service provider can be replayed against this instance.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory SAML Settings","desc":"Single sign-on through a SAML identity provider. The `noAutoUserCreation` field decides whether a successful assertion creates an account here, and `autoRedirect` decides whether the instance still offers its own sign-in form. Read `syncGroups` for whether the identity provider also decides group membership, which decides what the account may do.","private":true,"min_provider_version":"13.0.0","defaults":"enabled loginUrl","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.securitySettings":{"id":"artifactory.securitySettings","name":"artifactory.securitySettings","fields":{"anonymousAccessEnabled":{"name":"anonymousAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether unauthenticated callers may use the instance at all","desc":"While this is off, a permission target naming the anonymous user grants nothing. While it is on, every such target applies, so read it together with `anonymousCanDeploy`.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousAccessToBuildInfosDisabled":{"name":"anonymousAccessToBuildInfosDisabled","type":"\u0004","is_mandatory":true,"title":"Whether unauthenticated callers are blocked from reading build info","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousCanDeploy":{"name":"anonymousCanDeploy","type":"\u0004","title":"Whether an unauthenticated caller may publish to any repository","desc":"True when anonymous access is enabled instance-wide and a permission target gives the anonymous user a write, deploy, delete, or manage action. This is the state in which anyone on the network can replace the artifacts the instance serves.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousCanRead":{"name":"anonymousCanRead","type":"\u0004","title":"Whether an unauthenticated caller may read any repository","desc":"True when anonymous access is enabled instance-wide and a permission target gives the anonymous user a read action.","provider":"go.mondoo.com/mql/providers/artifactory"},"anonymousDeployTargets":{"name":"anonymousDeployTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets that would let an unauthenticated caller publish","desc":"Listed whether or not anonymous access is enabled instance-wide, so that turning it on shows what would immediately apply.","provider":"go.mondoo.com/mql/providers/artifactory"},"buildGlobalBasicReadAllowed":{"name":"buildGlobalBasicReadAllowed","type":"\u0004","is_mandatory":true,"title":"Whether any authenticated account may read every build","desc":"When true, build info is readable instance-wide regardless of the permission targets, so a build that names its artifacts and its environment is visible to every account.","provider":"go.mondoo.com/mql/providers/artifactory"},"buildGlobalBasicReadForAnonymous":{"name":"buildGlobalBasicReadForAnonymous","type":"\u0004","is_mandatory":true,"title":"Whether an unauthenticated caller may read every build","desc":"The anonymous form of the instance-wide build read. It bypasses the permission targets in the same way and needs no account at all.","provider":"go.mondoo.com/mql/providers/artifactory"},"crowd":{"name":"crowd","type":"\u001bartifactory.crowdSettings","title":"Atlassian Crowd settings, or null when the instance has none","provider":"go.mondoo.com/mql/providers/artifactory"},"hideUnauthorizedResources":{"name":"hideUnauthorizedResources","type":"\u0004","is_mandatory":true,"title":"Whether a caller is told nothing about a resource it may not read","desc":"When false, the response distinguishes a resource that is absent from one the caller may not see, which confirms an artifact exists to someone who cannot fetch it.","provider":"go.mondoo.com/mql/providers/artifactory"},"httpSso":{"name":"httpSso","type":"\u001bartifactory.httpSsoSettings","title":"HTTP single sign-on settings, or null when the instance has none","provider":"go.mondoo.com/mql/providers/artifactory"},"ldapGroupSettings":{"name":"ldapGroupSettings","type":"\u0019\u001bartifactory.ldapGroupSetting","title":"LDAP group trees mapped onto instance groups","provider":"go.mondoo.com/mql/providers/artifactory"},"ldapSettings":{"name":"ldapSettings","type":"\u0019\u001bartifactory.ldapSetting","title":"LDAP servers the instance authenticates against","provider":"go.mondoo.com/mql/providers/artifactory"},"loginAttempts":{"name":"loginAttempts","type":"\u0005","is_mandatory":true,"title":"Failed sign-in attempts allowed before an account is locked, or null when locking is off","provider":"go.mondoo.com/mql/providers/artifactory"},"oauth":{"name":"oauth","type":"\u001bartifactory.oauthSettings","title":"OAuth settings, or null when the instance has none","provider":"go.mondoo.com/mql/providers/artifactory"},"passwordEncryptionPolicy":{"name":"passwordEncryptionPolicy","type":"\u0007","is_mandatory":true,"title":"Policy applied to passwords held in the instance configuration, for example SUPPORTED or REQUIRED","provider":"go.mondoo.com/mql/providers/artifactory"},"passwordExpiryDays":{"name":"passwordExpiryDays","type":"\u0005","is_mandatory":true,"title":"Days an internal password stays valid, or null when passwords do not expire","provider":"go.mondoo.com/mql/providers/artifactory"},"passwordExpiryEnabled":{"name":"passwordExpiryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether internal passwords expire","provider":"go.mondoo.com/mql/providers/artifactory"},"saml":{"name":"saml","type":"\u001bartifactory.samlSettings","title":"SAML single sign-on settings, or null when the instance has none","provider":"go.mondoo.com/mql/providers/artifactory"},"userLockPolicyEnabled":{"name":"userLockPolicyEnabled","type":"\u0004","is_mandatory":true,"title":"Whether an account is locked after repeated failed sign-ins","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Security Settings","desc":"Instance-wide security settings, read from the instance configuration. The `anonymousAccessEnabled` field is the gate every anonymous grant depends on: while it is off, a permission target naming the anonymous user has no effect, and while it is on, every such target applies. The `anonymousDeployTargets` field lists the targets that would then let an unauthenticated caller publish, and `anonymousCanDeploy` reduces the whole instance to that single question.","private":true,"min_provider_version":"13.0.0","defaults":"anonymousAccessEnabled anonymousCanDeploy","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.systemInfo":{"id":"artifactory.systemInfo","name":"artifactory.systemInfo","fields":{"addons":{"name":"addons","type":"\u0019\u0007","is_mandatory":true,"title":"Licensed add-ons enabled on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"revision":{"name":"revision","type":"\u0007","is_mandatory":true,"title":"Build revision of the running version","provider":"go.mondoo.com/mql/providers/artifactory"},"serviceId":{"name":"serviceId","type":"\u0007","is_mandatory":true,"title":"Stable identifier of the Artifactory service, for example jfrt@01ab2c3d","provider":"go.mondoo.com/mql/providers/artifactory"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Product version, for example 7.90.10","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory Instance Identity","desc":"Version and identity of the Artifactory instance the scan connected to. The `serviceId` field is the instance's stable identifier, which is also the asset's platform identifier. Use `version` and `revision` to tell whether an endpoint that this provider reads is available on the instance.","private":true,"min_provider_version":"13.0.0","defaults":"version serviceId","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.user":{"id":"artifactory.user","name":"artifactory.user","fields":{"admin":{"name":"admin","type":"\u0004","title":"Whether the account holds instance-wide administrative rights","desc":"An administrator bypasses every permission target, so the count of administrators bounds how much a permission review can guarantee.","provider":"go.mondoo.com/mql/providers/artifactory"},"disableUiAccess":{"name":"disableUiAccess","type":"\u0004","title":"Whether the account is blocked from signing in to the web interface","provider":"go.mondoo.com/mql/providers/artifactory"},"email":{"name":"email","type":"\u0007","title":"Email address of the account, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"groupRefs":{"name":"groupRefs","type":"\u0019\u001bartifactory.group","title":"Groups the account belongs to","provider":"go.mondoo.com/mql/providers/artifactory"},"groups":{"name":"groups","type":"\u0019\u0007","title":"Group names the account belongs to","provider":"go.mondoo.com/mql/providers/artifactory"},"internal":{"name":"internal","type":"\u0004","title":"Whether the account is local to the instance rather than backed by an identity provider","desc":"True when the realm is internal. A local account keeps working after the identity provider disables the person, and it is outside any single sign-on control.","provider":"go.mondoo.com/mql/providers/artifactory"},"internalPasswordDisabled":{"name":"internalPasswordDisabled","type":"\u0004","title":"Whether the account's internal password is disabled","desc":"True on an account that can only authenticate through its identity provider or an access token. False on a federated account means it also carries a password on the instance.","provider":"go.mondoo.com/mql/providers/artifactory"},"lastLoggedIn":{"name":"lastLoggedIn","type":"\t","title":"Time the account last signed in, or null when it never has","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User name, which is unique on the instance","provider":"go.mondoo.com/mql/providers/artifactory"},"permissionTargets":{"name":"permissionTargets","type":"\u0019\u001bartifactory.permissionTarget","title":"Permission targets that name the account directly","desc":"Does not include the targets the account reaches through its groups. Read those from the groups themselves.","provider":"go.mondoo.com/mql/providers/artifactory"},"profileUpdatable":{"name":"profileUpdatable","type":"\u0004","title":"Whether the account may edit its own profile, including its API key","provider":"go.mondoo.com/mql/providers/artifactory"},"realm":{"name":"realm","type":"\u0007","title":"Realm the account authenticates against, for example internal, ldap, saml, or oauth","provider":"go.mondoo.com/mql/providers/artifactory"},"status":{"name":"status","type":"\u0007","title":"Lifecycle state of the account, for example enabled, locked, or disabled","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Artifactory User","desc":"An account on the instance. The `admin` field reports whether it holds instance-wide administrative rights, and `realm` reports where it authenticates: an internal account carries a password on the instance, while a federated one is backed by an external identity provider and is removed there rather than here. Select a user with `artifactory.users.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name realm admin","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.xray":{"id":"artifactory.xray","name":"artifactory.xray","fields":{"ignoreRule":{"name":"ignoreRule","type":"\u001bartifactory.xray.ignoreRule","title":"Xray Ignore Rule","desc":"A suppression that stops a finding from being reported. An ignore rule without an expiry suppresses its finding until somebody removes it by hand, so a policy that blocks on severity stops blocking for whatever the rule covers. The scope fields report what is suppressed, and `expires` reports whether the suppression ends on its own.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"ignoreRules":{"name":"ignoreRules","type":"\u0019\u001bartifactory.xray.ignoreRule","title":"Rules that suppress a finding","provider":"go.mondoo.com/mql/providers/artifactory"},"policies":{"name":"policies","type":"\u0019\u001bartifactory.xray.policy","title":"Policies, each holding the rules that decide what is blocked","provider":"go.mondoo.com/mql/providers/artifactory"},"policy":{"name":"policy","type":"\u001bartifactory.xray.policy","title":"Xray Policy","desc":"A set of rules that decide what a violation is and what happens when one is found. A policy only acts through a watch, so read `watches` for where it is enforced. The `blocksDownload` and `failsBuild` fields reduce the rules to whether the policy stops anything at all: a policy that only notifies leaves the artifact installable. Select a policy with `artifactory.xray.policies.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Product version of the Xray service","provider":"go.mondoo.com/mql/providers/artifactory"},"watch":{"name":"watch","type":"\u001bartifactory.xray.watch","title":"Xray Watch","desc":"A binding of policies to the resources they are enforced on. A watch is what turns a policy into something that acts: a repository that no active watch names is scanned but never blocked. The `resources` field reports what the watch names, including the wildcard entries that cover repositories created later, and `policies` reports what is enforced on them. Select a watch with `artifactory.xray.watches.where(name == \"example\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"watches":{"name":"watches","type":"\u0019\u001bartifactory.xray.watch","title":"Watches, each binding policies to a set of resources","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"JFrog Xray","desc":"The scanning service of the platform, and what it is configured to act on. Being indexed is not the same as being covered: a repository is only acted on when a watch names it and that watch carries a policy. The `watches` field reports what each watch names, `policies` reports what each policy blocks, and `ignoreRules` reports the findings that are suppressed. Null on a platform with no reachable Xray, which is a different answer from a platform whose Xray has no watch.","private":true,"min_provider_version":"13.0.0","defaults":"version","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.xray.ignoreRule":{"id":"artifactory.xray.ignoreRule","name":"artifactory.xray.ignoreRule","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Account that created the rule, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the rule was created, or null when the platform does not report it","provider":"go.mondoo.com/mql/providers/artifactory"},"expires":{"name":"expires","type":"\u0004","is_mandatory":true,"title":"Whether the suppression ends on its own","desc":"False on a rule that suppresses its finding until somebody removes it.","provider":"go.mondoo.com/mql/providers/artifactory"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the suppression ends, or null when it never does","provider":"go.mondoo.com/mql/providers/artifactory"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Identifier of the rule","provider":"go.mondoo.com/mql/providers/artifactory"},"isExpired":{"name":"isExpired","type":"\u0004","is_mandatory":true,"title":"Whether the rule is no longer in force","provider":"go.mondoo.com/mql/providers/artifactory"},"licenses":{"name":"licenses","type":"\u0019\u0007","is_mandatory":true,"title":"Licenses the rule suppresses","provider":"go.mondoo.com/mql/providers/artifactory"},"notes":{"name":"notes","type":"\u0007","is_mandatory":true,"title":"Reason recorded for the suppression, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"repositories":{"name":"repositories","type":"\u0019\u0007","is_mandatory":true,"title":"Repository keys the rule is limited to, empty when it is not limited","provider":"go.mondoo.com/mql/providers/artifactory"},"repositoryRefs":{"name":"repositoryRefs","type":"\u0019\u001bartifactory.repository","title":"Repositories the rule is limited to","provider":"go.mondoo.com/mql/providers/artifactory"},"vulnerabilities":{"name":"vulnerabilities","type":"\u0019\u0007","is_mandatory":true,"title":"Vulnerability identifiers the rule suppresses","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Xray Ignore Rule","desc":"A suppression that stops a finding from being reported. An ignore rule without an expiry suppresses its finding until somebody removes it by hand, so a policy that blocks on severity stops blocking for whatever the rule covers. The scope fields report what is suppressed, and `expires` reports whether the suppression ends on its own.","private":true,"min_provider_version":"13.0.0","defaults":"id notes expiresAt","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.xray.policy":{"id":"artifactory.xray.policy","name":"artifactory.xray.policy","fields":{"blocksDownload":{"name":"blocksDownload","type":"\u0004","is_mandatory":true,"title":"Whether any rule blocks a download","desc":"True when a rule blocks an artifact that has a violation. A policy that does not block leaves the artifact installable however severe the finding.","provider":"go.mondoo.com/mql/providers/artifactory"},"blocksReleaseBundleDistribution":{"name":"blocksReleaseBundleDistribution","type":"\u0004","is_mandatory":true,"title":"Whether any rule blocks the distribution of a release bundle","provider":"go.mondoo.com/mql/providers/artifactory"},"blocksUnscanned":{"name":"blocksUnscanned","type":"\u0004","is_mandatory":true,"title":"Whether any rule blocks an unscanned artifact","desc":"An artifact Xray has not finished scanning has no findings yet. When this is false, it can be downloaded before anything is known about it.","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"failsBuild":{"name":"failsBuild","type":"\u0004","is_mandatory":true,"title":"Whether any rule fails a build","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the policy, which is unique on the platform","provider":"go.mondoo.com/mql/providers/artifactory"},"rule":{"name":"rule","type":"\u001bartifactory.xray.policy.rule","title":"Rule of an Xray Policy","desc":"One condition of a policy and what happens when it matches. The criteria fields report what counts as a violation, for example a minimum severity or a CVSS range, and the action fields report what is stopped. A rule whose actions stop nothing records the violation and leaves the artifact usable.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"rules":{"name":"rules","type":"\u0019\u001bartifactory.xray.policy.rule","title":"Rules the policy holds","provider":"go.mondoo.com/mql/providers/artifactory"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of policy, one of security, license, or operational_risk","provider":"go.mondoo.com/mql/providers/artifactory"},"watches":{"name":"watches","type":"\u0019\u001bartifactory.xray.watch","title":"Watches that enforce the policy","desc":"A policy no watch names is not enforced anywhere, whatever its rules say.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Xray Policy","desc":"A set of rules that decide what a violation is and what happens when one is found. A policy only acts through a watch, so read `watches` for where it is enforced. The `blocksDownload` and `failsBuild` fields reduce the rules to whether the policy stops anything at all: a policy that only notifies leaves the artifact installable. Select a policy with `artifactory.xray.policies.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.xray.policy.rule":{"id":"artifactory.xray.policy.rule","name":"artifactory.xray.policy.rule","fields":{"allowUnknownLicenses":{"name":"allowUnknownLicenses","type":"\u0004","is_mandatory":true,"title":"Whether an unrecognized license counts as permitted","provider":"go.mondoo.com/mql/providers/artifactory"},"allowedLicenses":{"name":"allowedLicenses","type":"\u0019\u0007","is_mandatory":true,"title":"Licenses the rule permits","provider":"go.mondoo.com/mql/providers/artifactory"},"applicableCvesOnly":{"name":"applicableCvesOnly","type":"\u0004","is_mandatory":true,"title":"Whether the rule only counts a vulnerability reachable from the artifact","provider":"go.mondoo.com/mql/providers/artifactory"},"bannedLicenses":{"name":"bannedLicenses","type":"\u0019\u0007","is_mandatory":true,"title":"Licenses the rule refuses","provider":"go.mondoo.com/mql/providers/artifactory"},"blockDownload":{"name":"blockDownload","type":"\u0004","is_mandatory":true,"title":"Whether a download of a matching artifact is blocked","provider":"go.mondoo.com/mql/providers/artifactory"},"blockReleaseBundleDistribution":{"name":"blockReleaseBundleDistribution","type":"\u0004","is_mandatory":true,"title":"Whether the distribution of a release bundle is blocked","provider":"go.mondoo.com/mql/providers/artifactory"},"blockReleaseBundlePromotion":{"name":"blockReleaseBundlePromotion","type":"\u0004","is_mandatory":true,"title":"Whether the promotion of a release bundle is blocked","provider":"go.mondoo.com/mql/providers/artifactory"},"blockUnscanned":{"name":"blockUnscanned","type":"\u0004","is_mandatory":true,"title":"Whether a download is blocked before the scan has finished","provider":"go.mondoo.com/mql/providers/artifactory"},"buildFailureGracePeriodInDays":{"name":"buildFailureGracePeriodInDays","type":"\u0005","is_mandatory":true,"title":"Days a build keeps passing after the rule starts matching, or null when unset","desc":"A grace period leaves a build passing while the violation already exists.","provider":"go.mondoo.com/mql/providers/artifactory"},"customSeverity":{"name":"customSeverity","type":"\u0007","is_mandatory":true,"title":"Severity the rule records a violation as, or null when it uses the finding's own","provider":"go.mondoo.com/mql/providers/artifactory"},"cvssRangeFrom":{"name":"cvssRangeFrom","type":"\u0006","is_mandatory":true,"title":"Lowest CVSS score that counts as a violation, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"cvssRangeTo":{"name":"cvssRangeTo","type":"\u0006","is_mandatory":true,"title":"Highest CVSS score that counts as a violation, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"failBuild":{"name":"failBuild","type":"\u0004","is_mandatory":true,"title":"Whether a build that resolves a matching artifact fails","provider":"go.mondoo.com/mql/providers/artifactory"},"fixVersionDependant":{"name":"fixVersionDependant","type":"\u0004","is_mandatory":true,"title":"Whether the rule only counts a finding that has a fix available","desc":"When true, a vulnerability with no released fix is not a violation, so it does not block anything.","provider":"go.mondoo.com/mql/providers/artifactory"},"maliciousPackage":{"name":"maliciousPackage","type":"\u0004","is_mandatory":true,"title":"Whether the rule counts a package flagged as malicious","provider":"go.mondoo.com/mql/providers/artifactory"},"minSeverity":{"name":"minSeverity","type":"\u0007","is_mandatory":true,"title":"Lowest severity that counts as a violation, or null when the rule uses another criterion","desc":"One of All, Low, Medium, High, or Critical.","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the rule","provider":"go.mondoo.com/mql/providers/artifactory"},"notifyDeployer":{"name":"notifyDeployer","type":"\u0004","is_mandatory":true,"title":"Whether the account that deployed the artifact is notified","provider":"go.mondoo.com/mql/providers/artifactory"},"notifyWatchRecipients":{"name":"notifyWatchRecipients","type":"\u0004","is_mandatory":true,"title":"Whether the watch recipients are notified","provider":"go.mondoo.com/mql/providers/artifactory"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Order the rule is evaluated in, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Rule of an Xray Policy","desc":"One condition of a policy and what happens when it matches. The criteria fields report what counts as a violation, for example a minimum severity or a CVSS range, and the action fields report what is stopped. A rule whose actions stop nothing records the violation and leaves the artifact usable.","private":true,"min_provider_version":"13.0.0","defaults":"name priority minSeverity","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.xray.watch":{"id":"artifactory.xray.watch","name":"artifactory.xray.watch","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the watch is enforced","desc":"An inactive watch keeps its resources and its policies but acts on nothing, so a repository it names is not covered.","provider":"go.mondoo.com/mql/providers/artifactory"},"coversAllRepositories":{"name":"coversAllRepositories","type":"\u0004","is_mandatory":true,"title":"Whether the watch names every repository through a wildcard","desc":"True when a resource covers all repositories rather than naming them. The watch then reaches repositories created after it was written.","provider":"go.mondoo.com/mql/providers/artifactory"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the watch, which is unique on the platform","provider":"go.mondoo.com/mql/providers/artifactory"},"policies":{"name":"policies","type":"\u0019\u001bartifactory.xray.policy","title":"Policies the watch enforces","desc":"A watch that names a policy the platform does not hold reports fewer policies than `policyNames`, which is a watch that enforces nothing.","provider":"go.mondoo.com/mql/providers/artifactory"},"policyNames":{"name":"policyNames","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the policies the watch enforces","provider":"go.mondoo.com/mql/providers/artifactory"},"resource":{"name":"resource","type":"\u001bartifactory.xray.watch.resource","title":"Resource of an Xray Watch","desc":"One entry of what a watch is enforced on. The `type` field separates a named repository from a wildcard covering every repository, every build, or every release bundle. The `filters` field narrows the entry further, so a watch that names a repository may still act on only part of it.","is_private":true,"provider":"go.mondoo.com/mql/providers/artifactory","is_implicit_resource":true},"resources":{"name":"resources","type":"\u0019\u001bartifactory.xray.watch.resource","title":"Resources the watch names","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Xray Watch","desc":"A binding of policies to the resources they are enforced on. A watch is what turns a policy into something that acts: a repository that no active watch names is scanned but never blocked. The `resources` field reports what the watch names, including the wildcard entries that cover repositories created later, and `policies` reports what is enforced on them. Select a watch with `artifactory.xray.watches.where(name == \"example\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name active","provider":"go.mondoo.com/mql/providers/artifactory"},"artifactory.xray.watch.resource":{"id":"artifactory.xray.watch.resource","name":"artifactory.xray.watch.resource","fields":{"filters":{"name":"filters","type":"\u0019\n","is_mandatory":true,"title":"Filters that narrow the entry","desc":"Each entry is the filter type and its value, for example package-type or path-ant-patterns. A filtered resource is covered only where the filter matches, so a watch naming a repository may still act on part of it.","provider":"go.mondoo.com/mql/providers/artifactory"},"isWildcard":{"name":"isWildcard","type":"\u0004","is_mandatory":true,"title":"Whether the entry is a wildcard covering a whole class of resources","provider":"go.mondoo.com/mql/providers/artifactory"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the resource, or null on a wildcard entry","provider":"go.mondoo.com/mql/providers/artifactory"},"project":{"name":"project","type":"\u0007","is_mandatory":true,"title":"Project the entry belongs to, or null when unset","provider":"go.mondoo.com/mql/providers/artifactory"},"repoType":{"name":"repoType","type":"\u0007","is_mandatory":true,"title":"Repository type the entry is limited to, for example local or remote","provider":"go.mondoo.com/mql/providers/artifactory"},"repository":{"name":"repository","type":"\u001bartifactory.repository","title":"Repository the entry names, or null when it names none on this instance","provider":"go.mondoo.com/mql/providers/artifactory"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Kind of resource","desc":"One of repository, build, releaseBundle, releaseBundleV2, project, gitRepository, or one of the all-repos, all-builds, all-releaseBundles, all-releaseBundlesV2, and all-projects wildcards.","provider":"go.mondoo.com/mql/providers/artifactory"}},"title":"Resource of an Xray Watch","desc":"One entry of what a watch is enforced on. The `type` field separates a named repository from a wildcard covering every repository, every build, or every release bundle. The `filters` field narrows the entry further, so a watch that names a repository may still act on only part of it.","private":true,"min_provider_version":"13.0.0","defaults":"type name","provider":"go.mondoo.com/mql/providers/artifactory"}}}