From 381a03179e3ce054d78ae545f457fcd42a002eec Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:24:13 -0400
Subject: [PATCH 01/27] add the new splunk matcher

---
 pkg/threatest/matchers/splunk/api/types.go   |  20 +
 pkg/threatest/matchers/splunk/splunk.go      | 443 +++++++++++++++++++
 pkg/threatest/matchers/splunk/splunk_test.go |   3 +
 pkg/threatest/matchers/splunk/types.go       |  50 +++
 4 files changed, 516 insertions(+)
 create mode 100644 pkg/threatest/matchers/splunk/api/types.go
 create mode 100644 pkg/threatest/matchers/splunk/splunk.go
 create mode 100644 pkg/threatest/matchers/splunk/splunk_test.go
 create mode 100644 pkg/threatest/matchers/splunk/types.go

diff --git a/pkg/threatest/matchers/splunk/api/types.go b/pkg/threatest/matchers/splunk/api/types.go
new file mode 100644
index 0000000..b8fb5b7
--- /dev/null
+++ b/pkg/threatest/matchers/splunk/api/types.go
@@ -0,0 +1,20 @@
+package api
+
+import "net/http"
+
+// SplunkAPI defines the interface for Splunk operations
+type SplunkAPI interface {
+	SearchNotables(filter map[string]string) ([]map[string]interface{}, error)
+	CloseNotable(id string) error
+}
+
+// TokenTransport adds auth token to all requests
+type TokenTransport struct {
+	token   string
+	wrapped http.RoundTripper
+}
+
+func (t *TokenTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Authorization", "Bearer "+t.token)
+	return t.wrapped.RoundTrip(req)
+}
diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
new file mode 100644
index 0000000..bde79e6
--- /dev/null
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -0,0 +1,443 @@
+package splunk
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	log "github.com/sirupsen/logrus"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// SplunkAPIConfig holds configuration for the Splunk API client
+type SplunkAPIConfig struct {
+	BaseURL            string
+	AuthToken          string
+	Username           string
+	Password           string
+	AppName            string
+	InsecureSkipVerify bool
+}
+
+// SplunkAPIImpl implements the SplunkAPI interface
+type SplunkAPIImpl struct {
+	client    *http.Client
+	baseURL   string
+	authToken string
+	username  string
+	password  string
+	ctx       context.Context
+	appName   string
+}
+
+// Constants for Splunk API endpoints
+const (
+	SearchJobsEndpoint    = "/services/search/jobs"
+	NotableUpdateEndpoint = "/services/notable_update"
+)
+
+// Ensure SplunkAPIImpl implements the SplunkAPI interface
+//var _ api.SplunkAPI = &SplunkAPIImpl{}
+
+// NewSplunkAPI creates a new SplunkAPI implementation
+func NewSplunkAPI(config SplunkAPIConfig) *SplunkAPIImpl {
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: config.InsecureSkipVerify},
+	}
+	client := &http.Client{Transport: tr}
+
+	return &SplunkAPIImpl{
+		client:    client,
+		baseURL:   config.BaseURL,
+		authToken: config.AuthToken,
+		username:  config.Username,
+		password:  config.Password,
+		ctx:       context.Background(),
+		appName:   config.AppName,
+	}
+}
+
+func (api *SplunkAPIImpl) createRequest(method, endpoint string, body io.Reader) (*http.Request, error) {
+	url := fmt.Sprintf("%s%s", api.baseURL, endpoint)
+	req, err := http.NewRequestWithContext(api.ctx, method, url, body)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set auth header based on available credentials
+	if api.authToken != "" {
+		req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", api.authToken))
+	} else if api.username != "" && api.password != "" {
+		req.SetBasicAuth(api.username, api.password)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	return req, nil
+}
+
+// Splunk API Operations
+
+// SearchNotables searches for notable events based on filter criteria
+func (s *SplunkAPIImpl) SearchNotables(filter map[string]string) ([]map[string]interface{}, error) {
+	// Convert map to SplunkNotableFilter
+	internalFilter := SplunkNotableFilter{
+		RuleName:     filter["RuleName"],
+		Severity:     filter["Severity"],
+		DetectionUID: filter["DetectionUID"],
+		StartTime:    filter["StartTime"],
+		EndTime:      filter["EndTime"],
+	}
+
+	// Build query and execute search
+	searchQuery := s.buildNotableQuery(internalFilter)
+	searchJobID, err := s.createSearchJob(searchQuery)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create notable search job: %w", err)
+	}
+
+	if err := s.waitForJobCompletion(searchJobID); err != nil {
+		return nil, fmt.Errorf("failed waiting for notable search job: %w", err)
+	}
+
+	notables, err := s.getSearchResults(searchJobID)
+	if err != nil {
+		return nil, err
+	}
+
+	// Convert to map format for the interface
+	results := make([]map[string]interface{}, len(notables))
+	for i, notable := range notables {
+		results[i] = notable.Custom
+		results[i]["_id"] = notable.ID
+		results[i]["_name"] = notable.Name
+	}
+
+	return results, nil
+}
+
+// buildNotableQuery builds a Splunk query for notable events
+func (s *SplunkAPIImpl) buildNotableQuery(filter SplunkNotableFilter) string {
+	// Start with search command
+	queryStart := "search "
+
+	// Add time parameters
+	if filter.StartTime != "" {
+		queryStart += fmt.Sprintf("earliest=%s ", filter.StartTime)
+	}
+	if filter.EndTime != "" {
+		queryStart += fmt.Sprintf("latest=%s ", filter.EndTime)
+	}
+
+	// Add index name
+	queryStart += "`notable`"
+
+	// Build search conditions
+	var conditions []string
+	if filter.RuleName != "" {
+		conditions = append(conditions, fmt.Sprintf("search_name=\"%s\"", filter.RuleName))
+	}
+	if filter.Severity != "" {
+		conditions = append(conditions, fmt.Sprintf("severity=\"%s\"", filter.Severity))
+	}
+	// Always add detectionuid condition if present
+	if filter.DetectionUID != "" {
+		conditions = append(conditions, fmt.Sprintf("%s", filter.DetectionUID))
+	}
+
+	// Combine into final query
+	searchConditions := "search " + strings.Join(conditions, " ")
+	return fmt.Sprintf("%s | %s", queryStart, searchConditions)
+}
+
+// createSearchJob creates a new search job
+func (s *SplunkAPIImpl) createSearchJob(query string) (string, error) {
+	payload := fmt.Sprintf("search=%s", query)
+
+	req, err := s.createRequest("POST", SearchJobsEndpoint+"?output_mode=json", strings.NewReader(payload))
+	if err != nil {
+		return "", fmt.Errorf("failed to create search request: %w", err)
+	}
+
+	log.Debugf("Creating search job with URL: %s", req.URL.String())
+	log.Debugf("Query: %s", query)
+
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("failed to execute search request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		body, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("search request failed with status %d: %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		SID string `json:"sid"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return "", fmt.Errorf("failed to parse job response: %w", err)
+	}
+
+	return result.SID, nil
+}
+
+// waitForJobCompletion waits for a search job to complete
+func (s *SplunkAPIImpl) waitForJobCompletion(jobID string) error {
+	statusEndpoint := fmt.Sprintf("%s/%s?output_mode=json", SearchJobsEndpoint, jobID)
+
+	log.Debugf("Starting job status check for job %s", jobID)
+
+	maxAttempts := 30
+	for i := 0; i < maxAttempts; i++ {
+		req, err := s.createRequest("GET", statusEndpoint, nil)
+		if err != nil {
+			return fmt.Errorf("failed to create status request: %w", err)
+		}
+
+		log.Debugf("Checking job status (attempt %d/%d): %s",
+			i+1, maxAttempts, req.URL.String())
+
+		resp, err := s.client.Do(req)
+		if err != nil {
+			return fmt.Errorf("failed to check job status: %w", err)
+		}
+
+		var status struct {
+			Entry []struct {
+				Content struct {
+					IsDone bool `json:"isDone"`
+				} `json:"content"`
+			} `json:"entry"`
+		}
+
+		if err := json.NewDecoder(resp.Body).Decode(&status); err != nil {
+			resp.Body.Close()
+			return fmt.Errorf("failed to parse status response: %w", err)
+		}
+		resp.Body.Close()
+
+		if len(status.Entry) > 0 && status.Entry[0].Content.IsDone {
+			return nil
+		}
+
+		// Add a sleep between check attempts to prevent API spamming
+		// TODO make this user configurable? meh
+		time.Sleep(2 * time.Second)
+	}
+
+	return errors.New("job timed out")
+}
+
+// getSearchResults gets results from a completed search job
+func (s *SplunkAPIImpl) getSearchResults(jobID string) ([]SplunkNotable, error) {
+	resultsEndpoint := fmt.Sprintf("%s/%s/results?output_mode=json", SearchJobsEndpoint, jobID)
+
+	log.Debugf("Getting search results from job %s", jobID)
+
+	req, err := s.createRequest("GET", resultsEndpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create results request: %w", err)
+	}
+
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get search results: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var results struct {
+		Results []map[string]interface{} `json:"results"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&results); err != nil {
+		return nil, fmt.Errorf("failed to parse results: %w", err)
+	}
+
+	notables := make([]SplunkNotable, 0, len(results.Results))
+	for _, result := range results.Results {
+		// Extract relevant fields from the result
+		notable := SplunkNotable{
+			ID:     fmt.Sprintf("%v", result["event_id"]), // This is the notable UID
+			Name:   fmt.Sprintf("%v", result["search_name"]),
+			Custom: result,
+		}
+
+		if severity, ok := result["severity"]; ok {
+			notable.Severity = fmt.Sprintf("%v", severity)
+		}
+
+		//if timestamp, ok := result["trigger_time_rendered"]; ok {
+		//	notable.Timestamp = fmt.Sprintf("%v", timestamp)
+		//}
+
+		notables = append(notables, notable)
+	}
+
+	return notables, nil
+}
+
+// CloseNotable closes a notable event
+func (s *SplunkAPIImpl) CloseNotable(id string) error {
+	payload := fmt.Sprintf("ruleUIDs=%s&status=5&comment=Closed by Threatest", id)
+
+	log.Infof("Closing Splunk notable %s", id)
+
+	req, err := s.createRequest("POST", NotableUpdateEndpoint, strings.NewReader(payload))
+	if err != nil {
+		return fmt.Errorf("failed to create notable update request: %w", err)
+	}
+
+	resp, err := s.client.Do(req)
+	if err != nil {
+		return fmt.Errorf("failed to execute notable update request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("notable update failed with status %d: %s", resp.StatusCode, string(body))
+	}
+
+	return nil
+}
+
+// notableMatchesExecution checks if a notable matches a specific execution
+func (m *SplunkNotableGeneratedAssertion) notableMatchesExecution(notable map[string]interface{}, executionID string) bool {
+	data, _ := json.Marshal(notable)
+	rawNotable := string(data)
+	return strings.Contains(rawNotable, executionID)
+}
+
+// HasExpectedAlert checks if an expected notable exists
+func (m *SplunkNotableGeneratedAssertion) HasExpectedAlert(executionID string) (bool, error) {
+	// Create a map from the filter
+	filterMap := convertFilterToMap(m.NotableFilter)
+
+	// Store the executionID in the filter map
+	filterMap["DetectionUID"] = executionID
+
+	notables, err := m.SplunkAPI.SearchNotables(filterMap)
+	if err != nil {
+		return false, fmt.Errorf("unable to search for Splunk notables: %w", err)
+	}
+
+	for _, notable := range notables {
+		if m.notableMatchesExecution(notable, executionID) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+// performActionOnMatchingNotables performs an action on all matching notables
+func (m *SplunkNotableGeneratedAssertion) performActionOnMatchingNotables(executionID string, actionName string) error {
+	filterMap := convertFilterToMap(m.NotableFilter)
+	filterMap["DetectionUID"] = executionID
+
+	notables, err := m.SplunkAPI.SearchNotables(filterMap)
+	if err != nil {
+		return fmt.Errorf("unable to search for Splunk notables: %w", err)
+	}
+
+	for _, notable := range notables {
+		if m.notableMatchesExecution(notable, executionID) {
+			id := fmt.Sprintf("%v", notable["_id"])
+			if err := m.SplunkAPI.CloseNotable(id); err != nil {
+				return fmt.Errorf("unable to %s notable %s: %w", actionName, id, err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// Assert checks for matching notables and closes them
+func (m *SplunkNotableGeneratedAssertion) Assert(executionID string) error {
+	return m.performActionOnMatchingNotables(executionID, "assert")
+}
+
+// Cleanup removes any notables associated with the execution
+func (m *SplunkNotableGeneratedAssertion) Cleanup(executionID string) error {
+	log.Infof("Starting cleanup for Splunk notables related to execution ID: %s", executionID)
+	return m.performActionOnMatchingNotables(executionID, "cleanup")
+}
+
+// String returns a string representation of the assertion
+func (m *SplunkNotableGeneratedAssertion) String() string {
+	return fmt.Sprintf("Splunk notable '%s'", m.NotableFilter.RuleName)
+}
+
+// SplunkNotableEvent creates a new builder for SplunkNotableGeneratedAssertion
+func SplunkNotableEvent(ruleName string) *SplunkNotableGeneratedAssertionBuilder {
+	builder := &SplunkNotableGeneratedAssertionBuilder{}
+
+	// Use environment variables for configuration
+	baseUrl := os.Getenv("SPLUNK_BASE_URL")
+	if baseUrl == "" {
+		baseUrl = "https://localhost:8089"
+	}
+
+	authToken := os.Getenv("SPLUNK_AUTH_TOKEN")
+	username := os.Getenv("SPLUNK_USERNAME")
+	password := os.Getenv("SPLUNK_PASSWORD")
+
+	// Default to false for insecureSkipVerify
+	skipVerify := false
+	if os.Getenv("SPLUNK_INSECURE_SKIP_VERIFY") == "true" {
+		skipVerify = true
+	}
+
+	apiConfig := SplunkAPIConfig{
+		BaseURL:            baseUrl,
+		AuthToken:          authToken,
+		Username:           username,
+		Password:           password,
+		InsecureSkipVerify: skipVerify,
+	}
+
+	builder.SplunkAPI = NewSplunkAPI(apiConfig)
+	builder.NotableFilter = SplunkNotableFilter{RuleName: ruleName}
+
+	return builder
+}
+
+// Factory function for the new builder pattern
+func (b *SplunkNotableGeneratedAssertionBuilder) Build() *SplunkNotableGeneratedAssertion {
+	return &b.SplunkNotableGeneratedAssertion
+}
+
+// NewSplunkNotableEventAssertion creates a new Splunk notable event assertion
+func NewSplunkNotableEventAssertion(ruleName string) *SplunkNotableGeneratedAssertion {
+	return SplunkNotableEvent(ruleName).Build()
+}
+
+// Helper function to convert SplunkNotableFilter to map
+func convertFilterToMap(filter SplunkNotableFilter) map[string]string {
+	result := make(map[string]string)
+
+	if filter.RuleName != "" {
+		result["RuleName"] = filter.RuleName
+	}
+	if filter.Severity != "" {
+		result["Severity"] = filter.Severity
+	}
+	if filter.DetectionUID != "" {
+		result["DetectionUID"] = filter.DetectionUID
+	}
+	if filter.StartTime != "" {
+		result["StartTime"] = filter.StartTime
+	}
+	if filter.EndTime != "" {
+		result["EndTime"] = filter.EndTime
+	}
+
+	return result
+}
diff --git a/pkg/threatest/matchers/splunk/splunk_test.go b/pkg/threatest/matchers/splunk/splunk_test.go
new file mode 100644
index 0000000..2696f54
--- /dev/null
+++ b/pkg/threatest/matchers/splunk/splunk_test.go
@@ -0,0 +1,3 @@
+package splunk
+
+// coming soon...
diff --git a/pkg/threatest/matchers/splunk/types.go b/pkg/threatest/matchers/splunk/types.go
new file mode 100644
index 0000000..8431311
--- /dev/null
+++ b/pkg/threatest/matchers/splunk/types.go
@@ -0,0 +1,50 @@
+package splunk
+
+import (
+	"github.com/datadog/threatest/pkg/threatest/matchers/splunk/api"
+)
+
+// SplunkNotable represents a Splunk notable event returned from a search
+type SplunkNotable struct {
+	ID        string // Notable UID
+	Name      string
+	Severity  string
+	Timestamp string
+	Custom    map[string]interface{}
+}
+
+type SplunkNotableGeneratedAssertion struct {
+	SplunkAPI     api.SplunkAPI
+	NotableFilter SplunkNotableFilter
+}
+
+// SplunkNotableFilter defines search criteria for Splunk alerts
+type SplunkNotableFilter struct {
+	RuleName     string
+	Severity     string
+	StartTime    string
+	EndTime      string
+	DetectionUID string
+}
+
+type SplunkNotableGeneratedAssertionBuilder struct {
+	SplunkNotableGeneratedAssertion
+}
+
+func (m *SplunkNotableGeneratedAssertionBuilder) WithSeverity(severity string) *SplunkNotableGeneratedAssertionBuilder {
+	m.NotableFilter.Severity = severity
+	return m
+}
+
+// WithStartTime sets the start time for the Splunk notable event search.
+// This is important to reduce the load on the search head when searching for notables.
+func (m *SplunkNotableGeneratedAssertionBuilder) WithStartTime(startTime string) *SplunkNotableGeneratedAssertionBuilder {
+	m.NotableFilter.StartTime = startTime
+	return m
+}
+
+// WithEndTime sets the end time for the Splunk notable event search.
+func (m *SplunkNotableGeneratedAssertionBuilder) WithEndTime(endTime string) *SplunkNotableGeneratedAssertionBuilder {
+	m.NotableFilter.EndTime = endTime
+	return m
+}

From 134e43cfb5949b9692147831d3857c456b4d8504 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:27:52 -0400
Subject: [PATCH 02/27] add required splunkNotableEvent property and
 checkInterval to threatest schema

---
 schemas/threatest.schema.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/schemas/threatest.schema.json b/schemas/threatest.schema.json
index 049c69d..3372368 100644
--- a/schemas/threatest.schema.json
+++ b/schemas/threatest.schema.json
@@ -74,16 +74,29 @@
                   "required": [
                     "datadogSecuritySignal"
                   ]
+                },
+                {
+                    "required": [
+                        "splunkNotableEvent"
+                    ]
                 }
               ],
               "properties": {
                 "datadogSecuritySignal": {
                   "$ref": "datadogSecuritySignal.schema.json"
                 },
+                "splunkNotableEvent": {
+                  "$ref": "splunkNotableEvent.schema.json"
+                },
                 "timeout": {
                   "type": "string",
                   "default": "5m",
                   "description": "The maximal time to wait for the assertion, written as a Go duration (e.g. 5m)"
+                },
+                "checkInterval": {
+                  "type": "string",
+                  "default": "1m",
+                  "description": "The interval to check for the assertion, written as a Go duration (e.g. 10s)"
                 }
               }
             }

From 2fb00eb71114b24323db8e37d6f182c165e57f4e Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:28:05 -0400
Subject: [PATCH 03/27] add CheckInterval to Scenario struct and builder

---
 pkg/threatest/scenario.go | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/pkg/threatest/scenario.go b/pkg/threatest/scenario.go
index 68ed34e..6a679fa 100644
--- a/pkg/threatest/scenario.go
+++ b/pkg/threatest/scenario.go
@@ -7,10 +7,11 @@ import (
 )
 
 type Scenario struct {
-	Name       string
-	Detonator  detonators.Detonator
-	Timeout    time.Duration
-	Assertions []matchers.AlertGeneratedMatcher
+	Name          string
+	Detonator     detonators.Detonator
+	Timeout       time.Duration
+	CheckInterval time.Duration // Duration of time between checks for all assertions
+	Assertions    []matchers.AlertGeneratedMatcher
 }
 
 type ScenarioBuilder struct {
@@ -27,6 +28,11 @@ func (m *ScenarioBuilder) WithTimeout(timeout time.Duration) *ScenarioBuilder {
 	return m
 }
 
+func (m *ScenarioBuilder) WithCheckInterval(interval time.Duration) *ScenarioBuilder {
+	m.CheckInterval = interval
+	return m
+}
+
 func (m *ScenarioBuilder) Expect(assertion matchers.AlertGeneratedMatcher) *ScenarioBuilder {
 	m.Assertions = append(m.Assertions, assertion)
 	return m
@@ -34,9 +40,10 @@ func (m *ScenarioBuilder) Expect(assertion matchers.AlertGeneratedMatcher) *Scen
 
 func (m *ScenarioBuilder) Build() *Scenario {
 	return &Scenario{
-		Name:       m.Name,
-		Detonator:  m.Detonator,
-		Timeout:    m.Timeout,
-		Assertions: m.Assertions,
+		Name:          m.Name,
+		Detonator:     m.Detonator,
+		Timeout:       m.Timeout,
+		CheckInterval: m.CheckInterval,
+		Assertions:    m.Assertions,
 	}
 }

From 053f1a5727e44cd550b327cd702de8f03aee8085 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:29:50 -0400
Subject: [PATCH 04/27] set default check interval in Scenario builder and
 update logging for assertion requeue

---
 pkg/threatest/runner.go | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkg/threatest/runner.go b/pkg/threatest/runner.go
index 0e5584d..98f45f4 100644
--- a/pkg/threatest/runner.go
+++ b/pkg/threatest/runner.go
@@ -24,6 +24,7 @@ func (m *TestRunner) Scenario(name string) *ScenarioBuilder {
 	builder := ScenarioBuilder{}
 	builder.Name = name
 	builder.Timeout = 10 * time.Minute // default timeout
+	builder.CheckInterval = m.Interval // default check interval
 	m.Builders = append(m.Builders, &builder)
 	return &builder
 }
@@ -103,12 +104,12 @@ func (m *TestRunner) runScenario(scenario *Scenario) error {
 		}
 		if hasAlert {
 			timeSpentStr := strconv.Itoa(int(time.Since(start).Seconds()))
-			log.Printf("%s: Confirmed that the expected signal (%s) was created in Datadog (took %s seconds).\n", scenario.Name, assertion.String(), timeSpentStr)
+			log.Printf("%s: Confirmed that the expected signal (%s) was created (took %s seconds).\n", scenario.Name, assertion.String(), timeSpentStr)
 		} else {
 			// requeue assertion
-			log.Debugf("Assertion %s did not pass, requeuing it", assertion.String())
+			log.Debugf("Assertion %s did not pass, requeuing it and will check again in %s", assertion.String(), scenario.CheckInterval)
 			remainingAssertions <- assertion
-			time.Sleep(m.Interval)
+			time.Sleep(scenario.CheckInterval)
 		}
 	}
 

From 00962c5d39cace7ba15e2909407990bf319ba961 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:30:50 -0400
Subject: [PATCH 05/27] add support for Splunk notable event matcher and
 implement check interval parsing

---
 pkg/threatest/parser/main.go | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkg/threatest/parser/main.go b/pkg/threatest/parser/main.go
index 78f3175..391563e 100644
--- a/pkg/threatest/parser/main.go
+++ b/pkg/threatest/parser/main.go
@@ -5,6 +5,7 @@ import (
 	"github.com/datadog/threatest/pkg/threatest"
 	"github.com/datadog/threatest/pkg/threatest/detonators"
 	"github.com/datadog/threatest/pkg/threatest/matchers/datadog"
+	"github.com/datadog/threatest/pkg/threatest/matchers/splunk"
 	"sigs.k8s.io/yaml" // we use this library as it provides a handy "YAMLToJSON" function
 	"strings"
 	"time"
@@ -71,6 +72,15 @@ func buildScenarios(parsed *ThreatestSchemaJson, sshHostname string, sshUsername
 				}
 				scenario.Assertions = append(scenario.Assertions, assertion)
 			}
+
+			if splunkNotableEventMatcher := parsedAssertion.SplunkNotableEvent; splunkNotableEventMatcher != nil {
+				assertion := splunk.SplunkNotableEvent(splunkNotableEventMatcher.Name)
+				assertion.WithStartTime(splunkNotableEventMatcher.StartTime)
+				if severity := splunkNotableEventMatcher.Severity; severity != nil {
+					assertion.WithSeverity(*severity)
+				}
+				scenario.Assertions = append(scenario.Assertions, assertion)
+			}
 		}
 
 		//TODO: in the threatest core, the timeout should be part of each assertion (not scenario level)
@@ -82,6 +92,14 @@ func buildScenarios(parsed *ThreatestSchemaJson, sshHostname string, sshUsername
 		}
 		scenario.Timeout = parsedDuration
 
+		// checkInterval - how often to check for the assertion
+		rawCheckInterval := parsedScenario.Expectations[0].CheckInterval
+		parsedCheckInterval, err := time.ParseDuration(rawCheckInterval)
+		if err != nil {
+			return nil, fmt.Errorf("scenario '%s' has an invalid check interval '%s': '%v'", parsedScenario.Name, rawCheckInterval, err)
+		}
+		scenario.CheckInterval = parsedCheckInterval
+
 		scenarios = append(scenarios, &scenario)
 	}
 	return scenarios, nil

From c37eb6d69e9bb60008b81ea0639c5e4b376e73f0 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:32:02 -0400
Subject: [PATCH 06/27] update parser.go with new schema changes

---
 pkg/threatest/parser/parser.go | 143 ++++++++++++++++++++++-----------
 1 file changed, 94 insertions(+), 49 deletions(-)

diff --git a/pkg/threatest/parser/parser.go b/pkg/threatest/parser/parser.go
index 69284d7..4a66658 100644
--- a/pkg/threatest/parser/parser.go
+++ b/pkg/threatest/parser/parser.go
@@ -5,24 +5,6 @@ package parser
 import "encoding/json"
 import "fmt"
 
-// UnmarshalJSON implements json.Unmarshaler.
-func (j *DatadogSecuritySignalSchemaJson) UnmarshalJSON(b []byte) error {
-	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
-		return err
-	}
-	if v, ok := raw["name"]; !ok || v == nil {
-		return fmt.Errorf("field name in DatadogSecuritySignalSchemaJson: required")
-	}
-	type Plain DatadogSecuritySignalSchemaJson
-	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
-		return err
-	}
-	*j = DatadogSecuritySignalSchemaJson(plain)
-	return nil
-}
-
 // Definition of an AWS CLI detonation
 type AwsCliDetonatorSchemaJson struct {
 	// Script corresponds to the JSON schema field "script".
@@ -38,6 +20,24 @@ type DatadogSecuritySignalSchemaJson struct {
 	Severity *string `json:"severity,omitempty" yaml:"severity,omitempty" mapstructure:"severity,omitempty"`
 }
 
+// UnmarshalJSON implements json.Unmarshaler.
+func (j *DatadogSecuritySignalSchemaJson) UnmarshalJSON(value []byte) error {
+	var raw map[string]interface{}
+	if err := json.Unmarshal(value, &raw); err != nil {
+		return err
+	}
+	if _, ok := raw["name"]; raw != nil && !ok {
+		return fmt.Errorf("field name in DatadogSecuritySignalSchemaJson: required")
+	}
+	type Plain DatadogSecuritySignalSchemaJson
+	var plain Plain
+	if err := json.Unmarshal(value, &plain); err != nil {
+		return err
+	}
+	*j = DatadogSecuritySignalSchemaJson(plain)
+	return nil
+}
+
 // Definition of a local command detonation
 type LocalDetonatorSchemaJson struct {
 	// Commands corresponds to the JSON schema field "commands".
@@ -50,6 +50,42 @@ type RemoteDetonatorSchemaJson struct {
 	Commands []string `json:"commands,omitempty" yaml:"commands,omitempty" mapstructure:"commands,omitempty"`
 }
 
+// Matcher for a Splunk notable events
+type SplunkNotableEventSchemaJson struct {
+	// End time of the Splunk search to match on
+	EndTime *string `json:"endTime,omitempty" yaml:"endTime,omitempty" mapstructure:"endTime,omitempty"`
+
+	// Name of the Splunk search to match on (exact match)
+	Name string `json:"name" yaml:"name" mapstructure:"name"`
+
+	// Severity of the Splunk search to match on
+	Severity *string `json:"severity,omitempty" yaml:"severity,omitempty" mapstructure:"severity,omitempty"`
+
+	// Start time of the Splunk search to match on
+	StartTime string `json:"startTime" yaml:"startTime" mapstructure:"startTime"`
+}
+
+// UnmarshalJSON implements json.Unmarshaler.
+func (j *SplunkNotableEventSchemaJson) UnmarshalJSON(value []byte) error {
+	var raw map[string]interface{}
+	if err := json.Unmarshal(value, &raw); err != nil {
+		return err
+	}
+	if _, ok := raw["name"]; raw != nil && !ok {
+		return fmt.Errorf("field name in SplunkNotableEventSchemaJson: required")
+	}
+	if _, ok := raw["startTime"]; raw != nil && !ok {
+		return fmt.Errorf("field startTime in SplunkNotableEventSchemaJson: required")
+	}
+	type Plain SplunkNotableEventSchemaJson
+	var plain Plain
+	if err := json.Unmarshal(value, &plain); err != nil {
+		return err
+	}
+	*j = SplunkNotableEventSchemaJson(plain)
+	return nil
+}
+
 // Definition of a Stratus Red Team detonator
 type StratusRedTeamDetonatorSchemaJson struct {
 	// Attack technique ID of the Stratus Red Team technique to detonate (per
@@ -57,6 +93,24 @@ type StratusRedTeamDetonatorSchemaJson struct {
 	AttackTechnique *string `json:"attackTechnique,omitempty" yaml:"attackTechnique,omitempty" mapstructure:"attackTechnique,omitempty"`
 }
 
+// Schema for a Threatest test suite
+type ThreatestSchemaJson struct {
+	// The display name of the vulnerability
+	Scenarios []ThreatestSchemaJsonScenariosElem `json:"scenarios" yaml:"scenarios" mapstructure:"scenarios"`
+}
+
+// The list of scenarios
+type ThreatestSchemaJsonScenariosElem struct {
+	// How to detonate the attack
+	Detonate ThreatestSchemaJsonScenariosElemDetonate `json:"detonate" yaml:"detonate" mapstructure:"detonate"`
+
+	// Expectations corresponds to the JSON schema field "expectations".
+	Expectations []ThreatestSchemaJsonScenariosElemExpectationsElem `json:"expectations" yaml:"expectations" mapstructure:"expectations"`
+
+	// Description of the scenario
+	Name string `json:"name" yaml:"name" mapstructure:"name"`
+}
+
 // How to detonate the attack
 type ThreatestSchemaJsonScenariosElemDetonate struct {
 	// AwsCliDetonator corresponds to the JSON schema field "awsCliDetonator".
@@ -75,25 +129,34 @@ type ThreatestSchemaJsonScenariosElemDetonate struct {
 
 // Expectations
 type ThreatestSchemaJsonScenariosElemExpectationsElem struct {
+	// The interval to check for the assertion, written as a Go duration (e.g. 10s)
+	CheckInterval string `json:"checkInterval,omitempty" yaml:"checkInterval,omitempty" mapstructure:"checkInterval,omitempty"`
+
 	// DatadogSecuritySignal corresponds to the JSON schema field
 	// "datadogSecuritySignal".
 	DatadogSecuritySignal *DatadogSecuritySignalSchemaJson `json:"datadogSecuritySignal,omitempty" yaml:"datadogSecuritySignal,omitempty" mapstructure:"datadogSecuritySignal,omitempty"`
 
+	// SplunkNotableEvent corresponds to the JSON schema field "splunkNotableEvent".
+	SplunkNotableEvent *SplunkNotableEventSchemaJson `json:"splunkNotableEvent,omitempty" yaml:"splunkNotableEvent,omitempty" mapstructure:"splunkNotableEvent,omitempty"`
+
 	// The maximal time to wait for the assertion, written as a Go duration (e.g. 5m)
 	Timeout string `json:"timeout,omitempty" yaml:"timeout,omitempty" mapstructure:"timeout,omitempty"`
 }
 
 // UnmarshalJSON implements json.Unmarshaler.
-func (j *ThreatestSchemaJsonScenariosElemExpectationsElem) UnmarshalJSON(b []byte) error {
+func (j *ThreatestSchemaJsonScenariosElemExpectationsElem) UnmarshalJSON(value []byte) error {
 	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
+	if err := json.Unmarshal(value, &raw); err != nil {
 		return err
 	}
 	type Plain ThreatestSchemaJsonScenariosElemExpectationsElem
 	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
+	if err := json.Unmarshal(value, &plain); err != nil {
 		return err
 	}
+	if v, ok := raw["checkInterval"]; !ok || v == nil {
+		plain.CheckInterval = "1m"
+	}
 	if v, ok := raw["timeout"]; !ok || v == nil {
 		plain.Timeout = "5m"
 	}
@@ -101,60 +164,42 @@ func (j *ThreatestSchemaJsonScenariosElemExpectationsElem) UnmarshalJSON(b []byt
 	return nil
 }
 
-// The list of scenarios
-type ThreatestSchemaJsonScenariosElem struct {
-	// How to detonate the attack
-	Detonate ThreatestSchemaJsonScenariosElemDetonate `json:"detonate" yaml:"detonate" mapstructure:"detonate"`
-
-	// Expectations corresponds to the JSON schema field "expectations".
-	Expectations []ThreatestSchemaJsonScenariosElemExpectationsElem `json:"expectations" yaml:"expectations" mapstructure:"expectations"`
-
-	// Description of the scenario
-	Name string `json:"name" yaml:"name" mapstructure:"name"`
-}
-
 // UnmarshalJSON implements json.Unmarshaler.
-func (j *ThreatestSchemaJsonScenariosElem) UnmarshalJSON(b []byte) error {
+func (j *ThreatestSchemaJsonScenariosElem) UnmarshalJSON(value []byte) error {
 	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
+	if err := json.Unmarshal(value, &raw); err != nil {
 		return err
 	}
-	if v, ok := raw["detonate"]; !ok || v == nil {
+	if _, ok := raw["detonate"]; raw != nil && !ok {
 		return fmt.Errorf("field detonate in ThreatestSchemaJsonScenariosElem: required")
 	}
-	if v, ok := raw["expectations"]; !ok || v == nil {
+	if _, ok := raw["expectations"]; raw != nil && !ok {
 		return fmt.Errorf("field expectations in ThreatestSchemaJsonScenariosElem: required")
 	}
-	if v, ok := raw["name"]; !ok || v == nil {
+	if _, ok := raw["name"]; raw != nil && !ok {
 		return fmt.Errorf("field name in ThreatestSchemaJsonScenariosElem: required")
 	}
 	type Plain ThreatestSchemaJsonScenariosElem
 	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
+	if err := json.Unmarshal(value, &plain); err != nil {
 		return err
 	}
 	*j = ThreatestSchemaJsonScenariosElem(plain)
 	return nil
 }
 
-// Schema for a Threatest test suite
-type ThreatestSchemaJson struct {
-	// The display name of the vulnerability
-	Scenarios []ThreatestSchemaJsonScenariosElem `json:"scenarios" yaml:"scenarios" mapstructure:"scenarios"`
-}
-
 // UnmarshalJSON implements json.Unmarshaler.
-func (j *ThreatestSchemaJson) UnmarshalJSON(b []byte) error {
+func (j *ThreatestSchemaJson) UnmarshalJSON(value []byte) error {
 	var raw map[string]interface{}
-	if err := json.Unmarshal(b, &raw); err != nil {
+	if err := json.Unmarshal(value, &raw); err != nil {
 		return err
 	}
-	if v, ok := raw["scenarios"]; !ok || v == nil {
+	if _, ok := raw["scenarios"]; raw != nil && !ok {
 		return fmt.Errorf("field scenarios in ThreatestSchemaJson: required")
 	}
 	type Plain ThreatestSchemaJson
 	var plain Plain
-	if err := json.Unmarshal(b, &plain); err != nil {
+	if err := json.Unmarshal(value, &plain); err != nil {
 		return err
 	}
 	*j = ThreatestSchemaJson(plain)

From 8694c204624b284344e141ee2ecb222c2949dacb Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:32:54 -0400
Subject: [PATCH 07/27] use scenario-specific CheckInterval in runner
 configuration if available

---
 cmd/threatest/run.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/cmd/threatest/run.go b/cmd/threatest/run.go
index 030e410..9a7da75 100644
--- a/cmd/threatest/run.go
+++ b/cmd/threatest/run.go
@@ -189,7 +189,15 @@ func (m *RunCommand) runSingleScenario(scenarios <-chan *threatest.Scenario, res
 	for scenario := range scenarios {
 		runner := threatest.Threatest()
 		runner.Scenarios = append(runner.Scenarios, scenario)
-		runner.Interval = 2 * time.Second
+
+		// Use the scenario's CheckInterval if it's set, otherwise use default
+		if scenario.CheckInterval > 0 {
+			runner.Interval = scenario.CheckInterval
+			log.Debugf("Using scenario-specific check interval: %v", scenario.CheckInterval)
+		} else {
+			runner.Interval = 2 * time.Second
+			log.Debugf("Using default check interval: 2s")
+		}
 
 		start := time.Now()
 		err := runner.Run()

From 3c6e050d99b5caf051a28e0cb083b34f34d8d784 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:34:24 -0400
Subject: [PATCH 08/27] remove todo and change comment around job completion
 sleep

---
 pkg/threatest/matchers/splunk/splunk.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index bde79e6..1d8d241 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -227,8 +227,7 @@ func (s *SplunkAPIImpl) waitForJobCompletion(jobID string) error {
 			return nil
 		}
 
-		// Add a sleep between check attempts to prevent API spamming
-		// TODO make this user configurable? meh
+		// Add a sleep between check attempts to help mitigate API spamming
 		time.Sleep(2 * time.Second)
 	}
 

From 07fd1ba776cc340f891fe8ff9cc869ba8012ca65 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 16:42:11 -0400
Subject: [PATCH 09/27] introduce closeBody function to make my IDE happy re:
 unhandled errors

---
 pkg/threatest/matchers/splunk/splunk.go | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 1d8d241..67e8ac1 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -80,6 +80,16 @@ func (api *SplunkAPIImpl) createRequest(method, endpoint string, body io.Reader)
 	return req, nil
 }
 
+// closeBody safely closes an HTTP response body and logs any errors
+func closeBody(body io.ReadCloser) {
+	if body == nil {
+		return
+	}
+	if err := body.Close(); err != nil {
+		log.Warnf("Error closing response body: %v", err)
+	}
+}
+
 // Splunk API Operations
 
 // SearchNotables searches for notable events based on filter criteria
@@ -170,7 +180,7 @@ func (s *SplunkAPIImpl) createSearchJob(query string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("failed to execute search request: %w", err)
 	}
-	defer resp.Body.Close()
+	defer closeBody(resp.Body)
 
 	if resp.StatusCode >= 400 {
 		body, _ := io.ReadAll(resp.Body)
@@ -218,10 +228,10 @@ func (s *SplunkAPIImpl) waitForJobCompletion(jobID string) error {
 		}
 
 		if err := json.NewDecoder(resp.Body).Decode(&status); err != nil {
-			resp.Body.Close()
+			closeBody(resp.Body)
 			return fmt.Errorf("failed to parse status response: %w", err)
 		}
-		resp.Body.Close()
+		closeBody(resp.Body)
 
 		if len(status.Entry) > 0 && status.Entry[0].Content.IsDone {
 			return nil
@@ -249,7 +259,7 @@ func (s *SplunkAPIImpl) getSearchResults(jobID string) ([]SplunkNotable, error)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get search results: %w", err)
 	}
-	defer resp.Body.Close()
+	defer closeBody(resp.Body)
 
 	var results struct {
 		Results []map[string]interface{} `json:"results"`
@@ -297,7 +307,7 @@ func (s *SplunkAPIImpl) CloseNotable(id string) error {
 	if err != nil {
 		return fmt.Errorf("failed to execute notable update request: %w", err)
 	}
-	defer resp.Body.Close()
+	defer closeBody(resp.Body)
 
 	if resp.StatusCode >= 400 {
 		body, _ := io.ReadAll(resp.Body)
@@ -413,11 +423,6 @@ func (b *SplunkNotableGeneratedAssertionBuilder) Build() *SplunkNotableGenerated
 	return &b.SplunkNotableGeneratedAssertion
 }
 
-// NewSplunkNotableEventAssertion creates a new Splunk notable event assertion
-func NewSplunkNotableEventAssertion(ruleName string) *SplunkNotableGeneratedAssertion {
-	return SplunkNotableEvent(ruleName).Build()
-}
-
 // Helper function to convert SplunkNotableFilter to map
 func convertFilterToMap(filter SplunkNotableFilter) map[string]string {
 	result := make(map[string]string)

From 2f85aee6cc57b28f2d2d49e98cf003040f291141 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:13:58 -0400
Subject: [PATCH 10/27] add debug statement to print final splunk search query

---
 pkg/threatest/matchers/splunk/splunk.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 67e8ac1..60b6638 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -161,6 +161,7 @@ func (s *SplunkAPIImpl) buildNotableQuery(filter SplunkNotableFilter) string {
 
 	// Combine into final query
 	searchConditions := "search " + strings.Join(conditions, " ")
+	log.Debugf("Final search query: %s", searchConditions)
 	return fmt.Sprintf("%s | %s", queryStart, searchConditions)
 }
 

From b396d559c330a780795bab2749ea824be2c03380 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:14:57 -0400
Subject: [PATCH 11/27] remove commented code

---
 pkg/threatest/matchers/splunk/splunk.go | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 60b6638..80634c9 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -283,10 +283,6 @@ func (s *SplunkAPIImpl) getSearchResults(jobID string) ([]SplunkNotable, error)
 			notable.Severity = fmt.Sprintf("%v", severity)
 		}
 
-		//if timestamp, ok := result["trigger_time_rendered"]; ok {
-		//	notable.Timestamp = fmt.Sprintf("%v", timestamp)
-		//}
-
 		notables = append(notables, notable)
 	}
 

From 5f467b068c3494a80c225e9b02697f46382cada4 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:35:33 -0400
Subject: [PATCH 12/27] Expect 2xx responses, 300s are no good either

---
 pkg/threatest/matchers/splunk/splunk.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 80634c9..8e9a6e4 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -183,7 +183,7 @@ func (s *SplunkAPIImpl) createSearchJob(query string) (string, error) {
 	}
 	defer closeBody(resp.Body)
 
-	if resp.StatusCode >= 400 {
+	if resp.StatusCode >= 300 {
 		body, _ := io.ReadAll(resp.Body)
 		return "", fmt.Errorf("search request failed with status %d: %s", resp.StatusCode, string(body))
 	}
@@ -306,7 +306,7 @@ func (s *SplunkAPIImpl) CloseNotable(id string) error {
 	}
 	defer closeBody(resp.Body)
 
-	if resp.StatusCode >= 400 {
+	if resp.StatusCode >= 300 {
 		body, _ := io.ReadAll(resp.Body)
 		return fmt.Errorf("notable update failed with status %d: %s", resp.StatusCode, string(body))
 	}

From 76f8659c3aa02a76f92963ed942c204e483bff26 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:35:43 -0400
Subject: [PATCH 13/27] add createRequest function documentation for clarity

---
 pkg/threatest/matchers/splunk/splunk.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 8e9a6e4..96ca6fd 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -62,6 +62,7 @@ func NewSplunkAPI(config SplunkAPIConfig) *SplunkAPIImpl {
 	}
 }
 
+// createRequest creates a new HTTP request with the appropriate headers for Splunk's API
 func (api *SplunkAPIImpl) createRequest(method, endpoint string, body io.Reader) (*http.Request, error) {
 	url := fmt.Sprintf("%s%s", api.baseURL, endpoint)
 	req, err := http.NewRequestWithContext(api.ctx, method, url, body)

From 55c704954febbcabf116d4065e9a23c2eabfacec Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:38:00 -0400
Subject: [PATCH 14/27] handle non-2xx response status in search results
 retrieval

---
 pkg/threatest/matchers/splunk/splunk.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 96ca6fd..08ec0fe 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -263,6 +263,11 @@ func (s *SplunkAPIImpl) getSearchResults(jobID string) ([]SplunkNotable, error)
 	}
 	defer closeBody(resp.Body)
 
+	if resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("failed to get search results with status %d: %s", resp.StatusCode, string(body))
+	}
+
 	var results struct {
 		Results []map[string]interface{} `json:"results"`
 	}

From 0a67721e568beb57fba9fe4bd9b72d6487cd9f19 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:39:03 -0400
Subject: [PATCH 15/27] add more docs

---
 pkg/threatest/matchers/splunk/types.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/threatest/matchers/splunk/types.go b/pkg/threatest/matchers/splunk/types.go
index 8431311..9321bc0 100644
--- a/pkg/threatest/matchers/splunk/types.go
+++ b/pkg/threatest/matchers/splunk/types.go
@@ -13,6 +13,7 @@ type SplunkNotable struct {
 	Custom    map[string]interface{}
 }
 
+// SplunkNotableGeneratedAssertion is a matcher for Splunk notable events
 type SplunkNotableGeneratedAssertion struct {
 	SplunkAPI     api.SplunkAPI
 	NotableFilter SplunkNotableFilter
@@ -27,10 +28,12 @@ type SplunkNotableFilter struct {
 	DetectionUID string
 }
 
+// SplunkNotableGeneratedAssertionBuilder is a builder for SplunkNotableGeneratedAssertion
 type SplunkNotableGeneratedAssertionBuilder struct {
 	SplunkNotableGeneratedAssertion
 }
 
+// WithSeverity sets the severity for the Splunk notable event search.
 func (m *SplunkNotableGeneratedAssertionBuilder) WithSeverity(severity string) *SplunkNotableGeneratedAssertionBuilder {
 	m.NotableFilter.Severity = severity
 	return m

From 0cf598c28c43ccccaee837f4aba37d207fa6727b Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Wed, 2 Apr 2025 17:43:31 -0400
Subject: [PATCH 16/27] change log level from debug to info for assertion
 requeueing

---
 pkg/threatest/runner.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/threatest/runner.go b/pkg/threatest/runner.go
index 98f45f4..6866308 100644
--- a/pkg/threatest/runner.go
+++ b/pkg/threatest/runner.go
@@ -107,7 +107,7 @@ func (m *TestRunner) runScenario(scenario *Scenario) error {
 			log.Printf("%s: Confirmed that the expected signal (%s) was created (took %s seconds).\n", scenario.Name, assertion.String(), timeSpentStr)
 		} else {
 			// requeue assertion
-			log.Debugf("Assertion %s did not pass, requeuing it and will check again in %s", assertion.String(), scenario.CheckInterval)
+			log.Infof("Assertion %s did not pass, requeuing it and will check again in %s", assertion.String(), scenario.CheckInterval)
 			remainingAssertions <- assertion
 			time.Sleep(scenario.CheckInterval)
 		}

From c44281fd1f0b7179b150411a8c6d55878a5f1491 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 08:30:28 -0400
Subject: [PATCH 17/27] remove commented code

---
 pkg/threatest/matchers/splunk/splunk.go | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index 08ec0fe..c6e51b3 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -41,9 +41,6 @@ const (
 	NotableUpdateEndpoint = "/services/notable_update"
 )
 
-// Ensure SplunkAPIImpl implements the SplunkAPI interface
-//var _ api.SplunkAPI = &SplunkAPIImpl{}
-
 // NewSplunkAPI creates a new SplunkAPI implementation
 func NewSplunkAPI(config SplunkAPIConfig) *SplunkAPIImpl {
 	tr := &http.Transport{

From 7ad2ef7f5c0da20eb23e9af5ebf64832a6a7e67d Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 08:52:30 -0400
Subject: [PATCH 18/27] add autogenerated mock for SplunkAPI

---
 .../matchers/splunk/mocks/splunk_api.go       | 72 +++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 pkg/threatest/matchers/splunk/mocks/splunk_api.go

diff --git a/pkg/threatest/matchers/splunk/mocks/splunk_api.go b/pkg/threatest/matchers/splunk/mocks/splunk_api.go
new file mode 100644
index 0000000..0f2f76b
--- /dev/null
+++ b/pkg/threatest/matchers/splunk/mocks/splunk_api.go
@@ -0,0 +1,72 @@
+// Code generated by mockery v2.53.3. DO NOT EDIT.
+
+package mocks
+
+import mock "github.com/stretchr/testify/mock"
+
+// SplunkAPI is an autogenerated mock type for the SplunkAPI type
+type SplunkAPI struct {
+	mock.Mock
+}
+
+// CloseNotable provides a mock function with given fields: id
+func (_m *SplunkAPI) CloseNotable(id string) error {
+	ret := _m.Called(id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CloseNotable")
+	}
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string) error); ok {
+		r0 = rf(id)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SearchNotables provides a mock function with given fields: filter
+func (_m *SplunkAPI) SearchNotables(filter map[string]string) ([]map[string]interface{}, error) {
+	ret := _m.Called(filter)
+
+	if len(ret) == 0 {
+		panic("no return value specified for SearchNotables")
+	}
+
+	var r0 []map[string]interface{}
+	var r1 error
+	if rf, ok := ret.Get(0).(func(map[string]string) ([]map[string]interface{}, error)); ok {
+		return rf(filter)
+	}
+	if rf, ok := ret.Get(0).(func(map[string]string) []map[string]interface{}); ok {
+		r0 = rf(filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]map[string]interface{})
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(map[string]string) error); ok {
+		r1 = rf(filter)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// NewSplunkAPI creates a new instance of SplunkAPI. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewSplunkAPI(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *SplunkAPI {
+	mock := &SplunkAPI{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

From 18526e83d53f5361b4154d5a49bb4a5fb9d68035 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 08:55:48 -0400
Subject: [PATCH 19/27] rename executionID to detonationUuid

---
 pkg/threatest/matchers/splunk/splunk.go | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index c6e51b3..cc0564f 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -325,12 +325,10 @@ func (m *SplunkNotableGeneratedAssertion) notableMatchesExecution(notable map[st
 }
 
 // HasExpectedAlert checks if an expected notable exists
-func (m *SplunkNotableGeneratedAssertion) HasExpectedAlert(executionID string) (bool, error) {
+func (m *SplunkNotableGeneratedAssertion) HasExpectedAlert(detonationUuid string) (bool, error) {
 	// Create a map from the filter
 	filterMap := convertFilterToMap(m.NotableFilter)
-
-	// Store the executionID in the filter map
-	filterMap["DetectionUID"] = executionID
+	filterMap["DetectionUID"] = detonationUuid
 
 	notables, err := m.SplunkAPI.SearchNotables(filterMap)
 	if err != nil {
@@ -338,7 +336,7 @@ func (m *SplunkNotableGeneratedAssertion) HasExpectedAlert(executionID string) (
 	}
 
 	for _, notable := range notables {
-		if m.notableMatchesExecution(notable, executionID) {
+		if m.notableMatchesExecution(notable, detonationUuid) {
 			return true, nil
 		}
 	}
@@ -357,7 +355,7 @@ func (m *SplunkNotableGeneratedAssertion) performActionOnMatchingNotables(execut
 	}
 
 	for _, notable := range notables {
-		if m.notableMatchesExecution(notable, executionID) {
+		if m.notableMatchesExecution(notable, detonationUuid) {
 			id := fmt.Sprintf("%v", notable["_id"])
 			if err := m.SplunkAPI.CloseNotable(id); err != nil {
 				return fmt.Errorf("unable to %s notable %s: %w", actionName, id, err)
@@ -369,14 +367,14 @@ func (m *SplunkNotableGeneratedAssertion) performActionOnMatchingNotables(execut
 }
 
 // Assert checks for matching notables and closes them
-func (m *SplunkNotableGeneratedAssertion) Assert(executionID string) error {
-	return m.performActionOnMatchingNotables(executionID, "assert")
+func (m *SplunkNotableGeneratedAssertion) Assert(detonationUuid string) error {
+	return m.performActionOnMatchingNotables(detonationUuid, "assert")
 }
 
 // Cleanup removes any notables associated with the execution
-func (m *SplunkNotableGeneratedAssertion) Cleanup(executionID string) error {
-	log.Infof("Starting cleanup for Splunk notables related to execution ID: %s", executionID)
-	return m.performActionOnMatchingNotables(executionID, "cleanup")
+func (m *SplunkNotableGeneratedAssertion) Cleanup(detonationUuid string) error {
+	log.Infof("Starting cleanup for Splunk notables related to execution ID: %s", detonationUuid)
+	return m.performActionOnMatchingNotables(detonationUuid, "cleanup")
 }
 
 // String returns a string representation of the assertion

From 282de4a6d5af56e7e5deb7f513ad1a61db9004ba Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 08:56:08 -0400
Subject: [PATCH 20/27] rename executionID to detonationUuid and add startTime
 fallback in performActionOnMatchingNotables

---
 pkg/threatest/matchers/splunk/splunk.go | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk.go b/pkg/threatest/matchers/splunk/splunk.go
index cc0564f..21139fb 100644
--- a/pkg/threatest/matchers/splunk/splunk.go
+++ b/pkg/threatest/matchers/splunk/splunk.go
@@ -345,11 +345,18 @@ func (m *SplunkNotableGeneratedAssertion) HasExpectedAlert(detonationUuid string
 }
 
 // performActionOnMatchingNotables performs an action on all matching notables
-func (m *SplunkNotableGeneratedAssertion) performActionOnMatchingNotables(executionID string, actionName string) error {
-	filterMap := convertFilterToMap(m.NotableFilter)
-	filterMap["DetectionUID"] = executionID
-
-	notables, err := m.SplunkAPI.SearchNotables(filterMap)
+func (m *SplunkNotableGeneratedAssertion) performActionOnMatchingNotables(detonationUuid string, actionName string) error {
+	// Use StartTime from filter if available, otherwise use default
+	startTime := "-2h" // Default fallback
+	if m.NotableFilter.StartTime != "" {
+		startTime = m.NotableFilter.StartTime
+	}
+
+	// Search for notables containing the detonation ID
+	notables, err := m.SplunkAPI.SearchNotables(map[string]string{
+		"DetectionUID": detonationUuid,
+		"StartTime":    startTime,
+	})
 	if err != nil {
 		return fmt.Errorf("unable to search for Splunk notables: %w", err)
 	}

From f41d733d95073e764af3bab4a063a1e9ca29a70c Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 08:57:18 -0400
Subject: [PATCH 21/27] add tests and utility functions for Splunk notable
 events handling

---
 pkg/threatest/matchers/splunk/splunk_test.go | 221 ++++++++++++++++++-
 1 file changed, 220 insertions(+), 1 deletion(-)

diff --git a/pkg/threatest/matchers/splunk/splunk_test.go b/pkg/threatest/matchers/splunk/splunk_test.go
index 2696f54..1d27974 100644
--- a/pkg/threatest/matchers/splunk/splunk_test.go
+++ b/pkg/threatest/matchers/splunk/splunk_test.go
@@ -1,3 +1,222 @@
 package splunk
 
-// coming soon...
+import (
+	"github.com/datadog/threatest/pkg/threatest/matchers/splunk/mocks"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"strconv"
+	"testing"
+)
+
+// Utility function to returns a sample notable event
+func sampleNotableEvent(id int) map[string]interface{} {
+	idStr := strconv.Itoa(id)
+	return map[string]interface{}{
+		"_id":         idStr,
+		"event_id":    idStr,
+		"search_name": "test-rule",
+		"severity":    "critical",
+		"description": "Sample notable event",
+	}
+}
+
+// Utility function that generates a "universe of notable events" that match either nothing, either the rule name + severity, either the
+// execution UID, either both
+func generateNotableEvents(numMatchingNothing, numMatchingRuleOnly, numMatchingUUIDOnly, numMatchingBoth int, detonationUid string) ([]map[string]interface{}, []map[string]interface{}, []map[string]interface{}, []map[string]interface{}) {
+	notablesMatchingNothing := make([]map[string]interface{}, 0)
+	notablesMatchingRuleOnly := make([]map[string]interface{}, 0)
+	notablesMatchingUUIDOnly := make([]map[string]interface{}, 0)
+	notablesMatchingBoth := make([]map[string]interface{}, 0)
+
+	// Notables matching nothing
+	for i := 0; i < numMatchingNothing; i++ {
+		notableEvent := sampleNotableEvent(i)
+		notableEvent["search_name"] = "different-rule"
+		notablesMatchingNothing = append(notablesMatchingNothing, notableEvent)
+	}
+
+	// Notables matching rule only
+	for i := 0; i < numMatchingRuleOnly; i++ {
+		notable := sampleNotableEvent(i + numMatchingNothing)
+		notablesMatchingRuleOnly = append(notablesMatchingRuleOnly, notable)
+	}
+
+	// Notables matching UUID only
+	for i := 0; i < numMatchingUUIDOnly; i++ {
+		notable := sampleNotableEvent(i + numMatchingNothing + numMatchingRuleOnly)
+		notable["search_name"] = "different-rule"
+		notable["detectionuuid"] = detonationUid
+		notablesMatchingUUIDOnly = append(notablesMatchingUUIDOnly, notable)
+	}
+
+	// Notables matching both
+	for i := 0; i < numMatchingBoth; i++ {
+		notable := sampleNotableEvent(i + numMatchingNothing + numMatchingRuleOnly + numMatchingUUIDOnly)
+		notable["detectionuuid"] = detonationUid
+		notablesMatchingBoth = append(notablesMatchingBoth, notable)
+	}
+
+	return notablesMatchingNothing, notablesMatchingRuleOnly, notablesMatchingUUIDOnly, notablesMatchingBoth
+}
+
+func union(notables ...[]map[string]interface{}) []map[string]interface{} {
+	result := make([]map[string]interface{}, 0)
+	for _, notableSet := range notables {
+		result = append(result, notableSet...)
+	}
+	return result
+}
+
+func TestSplunk(t *testing.T) {
+	detonationUid := "my-detonation-uuid"
+	tests := []struct {
+		Name                                   string
+		NumNotablesMatchingNothing             int // all signals matching neither rule/severity nor UID
+		NumNotablesMatchingOnlyRuleAndSeverity int // signals matching only the rule name
+		NumNotablesMatchingOnlyUUID            int // signals matching only the detonation UUID
+		NumNotablesMatchingBoth                int // signals matching both
+		ExpectMatch                            bool
+	}{
+		{
+			Name:                                   "No matching at all",
+			NumNotablesMatchingNothing:             0,
+			NumNotablesMatchingOnlyRuleAndSeverity: 0,
+			NumNotablesMatchingOnlyUUID:            0,
+			NumNotablesMatchingBoth:                0,
+			ExpectMatch:                            false,
+		},
+		{
+			Name:                                   "No matching notable event matching anything",
+			NumNotablesMatchingNothing:             1,
+			NumNotablesMatchingOnlyRuleAndSeverity: 0,
+			NumNotablesMatchingOnlyUUID:            0,
+			NumNotablesMatchingBoth:                0,
+			ExpectMatch:                            false,
+		},
+		{
+			Name:                                   "One notable event matching alert name and severity, but not the detonation UID, should not be closed and not result in a match",
+			NumNotablesMatchingNothing:             0,
+			NumNotablesMatchingOnlyRuleAndSeverity: 1,
+			NumNotablesMatchingOnlyUUID:            0,
+			NumNotablesMatchingBoth:                0,
+			ExpectMatch:                            false,
+		},
+		{
+			Name:                                   "One notable event matching the detonation UID, but not the alert name, should be closed without match",
+			NumNotablesMatchingNothing:             0,
+			NumNotablesMatchingOnlyRuleAndSeverity: 0,
+			NumNotablesMatchingOnlyUUID:            1,
+			NumNotablesMatchingBoth:                0,
+			ExpectMatch:                            false,
+		},
+		{
+			Name:                                   "One notable event the detonation UID and the alert name should be closed with a match",
+			NumNotablesMatchingNothing:             0,
+			NumNotablesMatchingOnlyRuleAndSeverity: 0,
+			NumNotablesMatchingOnlyUUID:            0,
+			NumNotablesMatchingBoth:                1,
+			ExpectMatch:                            true,
+		},
+		{
+			Name:                                   "One notable event matching everything, one notable event matching rule name but not UID",
+			NumNotablesMatchingNothing:             0,
+			NumNotablesMatchingOnlyRuleAndSeverity: 0,
+			NumNotablesMatchingOnlyUUID:            1,
+			NumNotablesMatchingBoth:                1,
+			ExpectMatch:                            true,
+		},
+		{
+			Name:                                   "One notable event matching everything, one notable event matching rule name but not UID, one notable event matching only UID",
+			NumNotablesMatchingNothing:             0,
+			NumNotablesMatchingOnlyRuleAndSeverity: 1,
+			NumNotablesMatchingOnlyUUID:            1,
+			NumNotablesMatchingBoth:                1,
+			ExpectMatch:                            true,
+		},
+		{
+			Name:                                   "One of each",
+			NumNotablesMatchingNothing:             1,
+			NumNotablesMatchingOnlyRuleAndSeverity: 1,
+			NumNotablesMatchingOnlyUUID:            1,
+			NumNotablesMatchingBoth:                1,
+			ExpectMatch:                            true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			// Setup mock
+			mockAPI := new(mocks.SplunkAPI)
+
+			// Generate test notables
+			notablesMatchingNothing, notablesMatchingRuleOnly, notablesMatchingUUIDOnly, notablesMatchingBoth :=
+				generateNotableEvents(
+					test.NumNotablesMatchingNothing,
+					test.NumNotablesMatchingOnlyRuleAndSeverity,
+					test.NumNotablesMatchingOnlyUUID,
+					test.NumNotablesMatchingBoth,
+					detonationUid,
+				)
+
+			allNotables := union(notablesMatchingNothing, notablesMatchingRuleOnly, notablesMatchingUUIDOnly, notablesMatchingBoth)
+
+			t.Logf("Generated notables: %+v", allNotables)
+
+			// Setup the filter criteria
+			filter := SplunkNotableFilter{
+				RuleName: "test-rule",
+				Severity: "critical",
+			}
+
+			// Setup mock expectations for HasExpectedAlert
+			mockAPI.On("SearchNotables", mock.MatchedBy(func(f map[string]string) bool {
+				return f["RuleName"] == "test-rule" && f["Severity"] == "critical" && f["DetectionUID"] == detonationUid
+			})).Return(union(notablesMatchingRuleOnly, notablesMatchingBoth), nil)
+
+			// Setup mock expectations for Cleanup
+			mockAPI.On("SearchNotables", mock.MatchedBy(func(f map[string]string) bool {
+				return f["DetectionUID"] == detonationUid && f["StartTime"] == "-2h"
+			})).Return(allNotables, nil)
+
+			// Setup mock expectations for CloseNotable - for any notables matching UUID
+			allUUIDNotables := union(notablesMatchingUUIDOnly, notablesMatchingBoth)
+			for _, notable := range allUUIDNotables {
+				mockAPI.On("CloseNotable", notable["_id"].(string)).Return(nil)
+			}
+
+			// Create the assertion object
+			matcher := SplunkNotableGeneratedAssertion{
+				SplunkAPI:     mockAPI,
+				NotableFilter: filter,
+			}
+
+			// Test HasExpectedAlert
+			matches, err := matcher.HasExpectedAlert(detonationUid)
+			require.NoError(t, err)
+
+			if test.ExpectMatch {
+				assert.True(t, matches, "matcher should find matching notables")
+			} else {
+				assert.False(t, matches, "matcher should not find matching notables")
+			}
+
+			// Test Cleanup functionality
+			err = matcher.Cleanup(detonationUid)
+			require.NoError(t, err)
+
+			// Verify that all notables with UUID were closed
+			for _, notable := range allUUIDNotables {
+				mockAPI.AssertCalled(t, "CloseNotable", notable["_id"].(string))
+			}
+
+			// Verify notables without UUID were not closed
+			for _, notable := range notablesMatchingNothing {
+				mockAPI.AssertNotCalled(t, "CloseNotable", notable["_id"].(string))
+			}
+			for _, notable := range notablesMatchingRuleOnly {
+				mockAPI.AssertNotCalled(t, "CloseNotable", notable["_id"].(string))
+			}
+		})
+	}
+}

From b41ada92331c80086f7e2b2ce8d5a05e509f84af Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 08:59:50 -0400
Subject: [PATCH 22/27] add Splunk Enterprise Security notable events to
 supported alert matchers

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 48e675b..acf088f 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,7 @@ An **alert matcher** is a platform-specific integration that can check if an exp
 
 Supported alert matchers:
 * Datadog security signals
+* Splunk Enterprise Security notable events
 
 ### Detonation and alert correlation
 

From d9988d4ac6cdabb7cd4b8b27cfd6e9625c56d981 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Thu, 10 Apr 2025 09:20:53 -0400
Subject: [PATCH 23/27] add schema for Splunk notable events matcher

---
 schemas/splunkNotableEvent.schema.json | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 schemas/splunkNotableEvent.schema.json

diff --git a/schemas/splunkNotableEvent.schema.json b/schemas/splunkNotableEvent.schema.json
new file mode 100644
index 0000000..3096478
--- /dev/null
+++ b/schemas/splunkNotableEvent.schema.json
@@ -0,0 +1,23 @@
+{
+  "type": "object",
+  "description": "Matcher for a Splunk notable events",
+  "required": ["name", "startTime"],
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Name of the Splunk search to match on (exact match)"
+    },
+    "severity": {
+      "type": "string",
+      "description": "Severity of the Splunk search to match on"
+    },
+    "startTime": {
+        "type": "string",
+        "description": "Start time of the Splunk search to match on"
+    },
+    "endTime": {
+        "type": "string",
+        "description": "End time of the Splunk search to match on"
+    }
+  }
+}
\ No newline at end of file

From de7f3501155cf8570276813c82ae0f10b61190d0 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Fri, 11 Apr 2025 12:59:11 -0400
Subject: [PATCH 24/27] refactor notable events generation to use custom type
 for improved readability

---
 pkg/threatest/matchers/splunk/splunk_test.go | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkg/threatest/matchers/splunk/splunk_test.go b/pkg/threatest/matchers/splunk/splunk_test.go
index 1d27974..8492de9 100644
--- a/pkg/threatest/matchers/splunk/splunk_test.go
+++ b/pkg/threatest/matchers/splunk/splunk_test.go
@@ -9,6 +9,8 @@ import (
 	"testing"
 )
 
+type SplunkTestNotable []map[string]interface{}
+
 // Utility function to returns a sample notable event
 func sampleNotableEvent(id int) map[string]interface{} {
 	idStr := strconv.Itoa(id)
@@ -23,11 +25,7 @@ func sampleNotableEvent(id int) map[string]interface{} {
 
 // Utility function that generates a "universe of notable events" that match either nothing, either the rule name + severity, either the
 // execution UID, either both
-func generateNotableEvents(numMatchingNothing, numMatchingRuleOnly, numMatchingUUIDOnly, numMatchingBoth int, detonationUid string) ([]map[string]interface{}, []map[string]interface{}, []map[string]interface{}, []map[string]interface{}) {
-	notablesMatchingNothing := make([]map[string]interface{}, 0)
-	notablesMatchingRuleOnly := make([]map[string]interface{}, 0)
-	notablesMatchingUUIDOnly := make([]map[string]interface{}, 0)
-	notablesMatchingBoth := make([]map[string]interface{}, 0)
+func generateNotableEvents(numMatchingNothing, numMatchingRuleOnly, numMatchingUUIDOnly, numMatchingBoth int, detonationUid string) (notablesMatchingNothing, notablesMatchingRuleOnly, notablesMatchingUUIDOnly, notablesMatchingBoth SplunkTestNotable) {
 
 	// Notables matching nothing
 	for i := 0; i < numMatchingNothing; i++ {
@@ -57,7 +55,7 @@ func generateNotableEvents(numMatchingNothing, numMatchingRuleOnly, numMatchingU
 		notablesMatchingBoth = append(notablesMatchingBoth, notable)
 	}
 
-	return notablesMatchingNothing, notablesMatchingRuleOnly, notablesMatchingUUIDOnly, notablesMatchingBoth
+	return
 }
 
 func union(notables ...[]map[string]interface{}) []map[string]interface{} {

From 886f2dde18038f32f79d3f394d9db458f2e6d068 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Fri, 11 Apr 2025 12:59:25 -0400
Subject: [PATCH 25/27] add README for Splunk Enterprise Security notable event
 matcher configuration

---
 pkg/threatest/matchers/splunk/README.md | 47 +++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 pkg/threatest/matchers/splunk/README.md

diff --git a/pkg/threatest/matchers/splunk/README.md b/pkg/threatest/matchers/splunk/README.md
new file mode 100644
index 0000000..7a6a7f3
--- /dev/null
+++ b/pkg/threatest/matchers/splunk/README.md
@@ -0,0 +1,47 @@
+# Splunk Enterprise Security notable event matcher
+To work with the Splunk Enterprise Security notable event matcher, you need to have the following prerequisites:
+- A working Splunk instance with the Enterprise Security app installed and the ability to talk to the REST API.
+- An account in Splunk with the necessary permissions to create and manage notable events.
+- A valid API token for authentication (you can also use basic auth credentials).
+
+Environment variables:
+- `SPLUNK_HOST`: The hostname or IP address of the Splunk instance including the port for the REST API (usually 8089).
+- `SPLUNK_API_TOKEN`: The API token for authentication (required if no `SPLUNK_USERNAME`/`SPLUNK_PASSWORD`).
+  - `SPLUNK_USERNAME`: The username for basic authentication (required if no `SPLUNK_API_TOKEN`).
+  - `SPLUNK_PASSWORD`: The password for basic authentication (required if no `SPLUNK_API_TOKEN`).
+- `SPLUNK_INSECURE_SKIP_VERIFY`: Default is `false`. Set to `true` to skip SSL verification (not recommended).
+
+Example scenario configuration:
+```yaml
+scenarios:
+  - name: Stop cloudtrail
+    detonate:
+      stratusRedTeamDetonator:
+        attackTechnique: aws.defense-evasion.cloudtrail-stop
+    expectations:
+      - timeout: 30m
+        checkInterval: 2m
+        splunkNotableEvent:
+          name: "ESCU - AWS Defense Evasion Stop Logging Cloudtrail - Rule"
+          startTime: -2h
+```
+For `splunkNotableEvent`, only `name` and `startTime` is required.
+
+`name` should match the name of the correlation search in Splunk that generates the notable event. 
+
+`startTime` is a relative time string that specifies the earliest time to search for notable events. It can be set to a negative value (e.g., `-2h` for 2 hours ago). This is an important field because you don't want to search the entirety of your notable index for these notables. You can also set `endTime` which works similarly but this is optional.
+
+## Expectations
+Here is an overview of how the matcher works:
+
+After a detonation, the matcher will run a search via the Splunk API for notable events that match both the `search_name` and the UUID of the detonation.
+```text
+search earliest=-2h `notable` | search search_name=\"ESCU - AWS Defense Evasion Stop Logging Cloudtrail - Rule\" a6c34363-397b-4638-85c4-de2682c6933b"
+```
+If the search job has results, that scenario will be marked as a success and the notable will be closed with the comment "Closed by Threatest".
+
+If there are no results, the matcher will continue to run the search query at the specified interval until the timeout is reached. If the timeout is reached and no results are found, the scenario will be marked as a failure. Finally, Threatest will run another search to look for notables that reference the detection UUID:
+```text
+output here
+```
+Any notables that are returned will also be closed with the comment "Closed by Threatest".
\ No newline at end of file

From 30e62da8d449131ff5b8f16894cae5688889e834 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Mon, 9 Jun 2025 10:58:06 -0400
Subject: [PATCH 26/27] updated go version to 1.23.0 and stratus-red-team to
 v2.23.2 along with other related deps

---
 go.mod | 176 ++++++++++++--------
 go.sum | 511 ++++++++++++++++++++++++++++-----------------------------
 2 files changed, 360 insertions(+), 327 deletions(-)

diff --git a/go.mod b/go.mod
index 5a175c2..a650a71 100644
--- a/go.mod
+++ b/go.mod
@@ -2,108 +2,142 @@ module github.com/datadog/threatest
 
 require (
 	github.com/DataDog/datadog-api-client-go/v2 v2.19.0
-	github.com/aws/aws-sdk-go-v2 v1.17.1
-	github.com/aws/aws-sdk-go-v2/config v1.18.2
-	github.com/aws/aws-sdk-go-v2/service/iam v1.18.23
-	github.com/aws/smithy-go v1.13.4
-	github.com/datadog/stratus-red-team/v2 v2.4.8
-	github.com/google/uuid v1.3.1
+	github.com/aws/aws-sdk-go-v2 v1.36.1
+	github.com/aws/aws-sdk-go-v2/config v1.29.6
+	github.com/aws/aws-sdk-go-v2/service/iam v1.39.1
+	github.com/aws/smithy-go v1.22.2
+	github.com/datadog/stratus-red-team/v2 v2.23.2
+	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-uuid v1.0.3
 	github.com/kevinburke/ssh_config v1.2.0
 	github.com/sirupsen/logrus v1.9.0
 	github.com/spf13/cobra v1.7.0
-	github.com/stretchr/testify v1.8.1
-	golang.org/x/crypto v0.14.0
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/crypto v0.36.0
 	gopkg.in/alessio/shellescape.v1 v1.0.0-20170105083845-52074bc9df61
 	sigs.k8s.io/yaml v1.3.0
 )
 
 require (
-	cloud.google.com/go/compute v1.20.1 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 // indirect
+	cloud.google.com/go/auth v0.14.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
+	cloud.google.com/go/compute v1.31.1 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	cloud.google.com/go/iam v1.3.1 // indirect
+	cloud.google.com/go/secretmanager v1.14.4 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.2.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.1.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
 	github.com/DataDog/zstd v1.5.2 // indirect
+	github.com/ProtonMail/go-crypto v1.1.0-alpha.2 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.2 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.25 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.19 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.26 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.20.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.72.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.20 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/lambda v1.25.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/organizations v1.16.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/rds v1.30.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.0.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.16.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.33.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.11.25 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.17.4 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.8 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.59 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.28 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.61 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.32 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.32 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.32 // indirect
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.24.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.47.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.202.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.27.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/eks v1.58.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/lambda v1.69.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/organizations v1.37.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rds v1.93.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.16.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53resolver v1.34.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.76.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ses v1.29.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.56.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.24.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.14 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/cjlapao/common-go v0.0.39 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.10.1 // indirect
-	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/jsonreference v0.20.0 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/gnostic v0.6.9 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
-	github.com/googleapis/gax-go/v2 v2.11.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.4.0 // indirect
-	github.com/hashicorp/terraform-exec v0.17.3 // indirect
-	github.com/hashicorp/terraform-json v0.14.0 // indirect
-	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/hashicorp/hc-install v0.6.4 // indirect
+	github.com/hashicorp/terraform-exec v0.21.0 // indirect
+	github.com/hashicorp/terraform-json v0.22.1 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/microsoft/kiota-abstractions-go v1.7.0 // indirect
+	github.com/microsoft/kiota-authentication-azure-go v1.1.0 // indirect
+	github.com/microsoft/kiota-http-go v1.4.4 // indirect
+	github.com/microsoft/kiota-serialization-form-go v1.0.0 // indirect
+	github.com/microsoft/kiota-serialization-json-go v1.0.8 // indirect
+	github.com/microsoft/kiota-serialization-multipart-go v1.0.0 // indirect
+	github.com/microsoft/kiota-serialization-text-go v1.0.0 // indirect
+	github.com/microsoftgraph/msgraph-beta-sdk-go v0.108.0 // indirect
+	github.com/microsoftgraph/msgraph-sdk-go v1.47.0 // indirect
+	github.com/microsoftgraph/msgraph-sdk-go-core v1.2.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/objx v0.5.0 // indirect
-	github.com/zclconf/go-cty v1.12.1 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/oauth2 v0.10.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/term v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/time v0.2.0 // indirect
-	google.golang.org/api v0.126.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
-	google.golang.org/grpc v1.55.0 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	github.com/std-uritemplate/std-uritemplate/go v0.0.57 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/zclconf/go-cty v1.14.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.34.0 // indirect
+	go.opentelemetry.io/otel/metric v1.34.0 // indirect
+	go.opentelemetry.io/otel/trace v1.34.0 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/term v0.30.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/time v0.9.0 // indirect
+	google.golang.org/api v0.218.0 // indirect
+	google.golang.org/genproto v0.0.0-20250122153221-138b5a5a4fd4 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250124145028-65684f501c47 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f // indirect
+	google.golang.org/grpc v1.70.0 // indirect
+	google.golang.org/protobuf v1.36.4 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -117,4 +151,6 @@ require (
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )
 
-go 1.18
+go 1.23.0
+
+toolchain go1.24.3
diff --git a/go.sum b/go.sum
index 5fa8ac1..2a1aeea 100644
--- a/go.sum
+++ b/go.sum
@@ -1,146 +1,178 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg=
-cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0 h1:sVW/AFBTGyJxDaMYlq0ct3jUXTtj12tQ6zE2GZUgVQw=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.2.0/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 h1:t/W5MYAuQy81cvM8VUNfRLzhtKpXhVUAN7Cd7KVbTyc=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0/go.mod h1:NBanQUfSWiWn3QEpWDTCU0IjBECKOYvl2R8xdRtMtiM=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.1 h1:Oj853U9kG+RLTCQXpjvOnrv0WaZHxgmZz1TlLywgOPY=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.1.1/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0 h1:/Di3vB4sNeQ+7A8efjUVENvyB945Wruvstucqp7ZArg=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0/go.mod h1:gM3K25LQlsET3QR+4V74zxCsFAy0r6xMNN9n80SZn+4=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.0.0 h1:lMW1lD/17LUA5z1XTURo7LcVG2ICBPlyMHjIUrcFZNQ=
+cloud.google.com/go v0.118.0 h1:tvZe1mgqRxpiVa3XlIGMiPcEUbP1gNXELgD4y/IXmeQ=
+cloud.google.com/go v0.118.0/go.mod h1:zIt2pkedt/mo+DQjcT4/L3NDxzHPR29j5HcclNH+9PM=
+cloud.google.com/go/auth v0.14.0 h1:A5C4dKV/Spdvxcl0ggWwWEzzP7AZMJSEIgrkngwhGYM=
+cloud.google.com/go/auth v0.14.0/go.mod h1:CYsoRL1PdiDuqeQpZE0bP2pnPrGqFcOkI0nldEQis+A=
+cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
+cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
+cloud.google.com/go/compute v1.31.1 h1:SObuy8Fs6woazArpXp1fsHCw+ZH4iJ/8dGGTxUhHZQA=
+cloud.google.com/go/compute v1.31.1/go.mod h1:hyOponWhXviDptJCJSoEh89XO1cfv616wbwbkde1/+8=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
+cloud.google.com/go/iam v1.3.1 h1:KFf8SaT71yYq+sQtRISn90Gyhyf4X8RGgeAVC8XGf3E=
+cloud.google.com/go/iam v1.3.1/go.mod h1:3wMtuyT4NcbnYNPLMBzYRFiEfjKfJlLVLrisE7bwm34=
+cloud.google.com/go/secretmanager v1.14.4 h1:SMWQMsUcACsdIuVhIBAw+QfKY4Xseiaa8qDnunjmhcM=
+cloud.google.com/go/secretmanager v1.14.4/go.mod h1:pjwFw8+A6B4AcWrVXruLfz1QykkpMr8T/VT+zXB91iw=
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0 h1:nyQWyZvwGTvunIMxi1Y9uXkcyr+I7TeNrr/foo4Kpk8=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.14.0/go.mod h1:l38EPgmsp71HHLq9j7De57JcKOWPyhrsW1Awm1JS6K0=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 h1:tfLQ34V6F7tVSwoTf/4lH5sE0o6eCJuNDTmH09nDpbc=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0/go.mod h1:9kIvujWAA58nmPmWB1m23fyWic1kYZMxD9CxaWn4Qpg=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.2.1 h1:UPeCRD+XY7QlaGQte2EVI2iOcWvUYA2XY8w5T/8v0NQ=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.2.1/go.mod h1:oGV6NlB0cvi1ZbYRR2UN44QHxWFyGk+iylgD0qaMXjA=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.1.2 h1:mLY+pNLjCUeKhgnAJWAKhEUQM+RJQo2H1fuGSw1Ky1E=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.1.2/go.mod h1:FbdwsQ2EzwvXxOPcMFYO8ogEc9uMMIj3YkmCdXdAFmk=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFGRSlMKCQelWwxUyYVEUqseBJVemLyqWJjvMyt0do=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0/go.mod h1:LRr2FzBTQlONPPa5HREE5+RjSCTXl7BwOvYOaWTqCaI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0 h1:2qsIIvxVT+uE6yrNldntJKlLRgxGbZ85kgtz5SNBhMw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0/go.mod h1:AW8VEadnhw9xox+VaVd9sP7NjzOAnaZBLRH6Tq3cJ38=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0 h1:pPvTJ1dY0sA35JOeFq6TsY2xj6Z85Yo23Pj4wCCvu4o=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0/go.mod h1:mLfWfj8v3jfWKsL9G4eoBoXVcsqcIUTapmdKy7uGOp0=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork v1.0.0 h1:nBy98uKOIfun5z6wx6jwWLrULcM0+cjBalBFZlEZ7CA=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0 h1:ECsQtyERDVz3NP3kvDOTLvbQhqWp/x9EsGKtb4ogUr8=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0/go.mod h1:s1tW/At+xHqjNFvWU4G0c0Qv33KOhvbGNj0RCTQDV8s=
-github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 h1:VgSJlZH5u0k2qxSpqyghcFQKmvYckj46uymKK5XzkBM=
-github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0/go.mod h1:BDJ5qMFKx9DugEg3+uQSDCdbYPr5s9vBTrL9P8TpqOU=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork v1.0.0/go.mod h1:243D9iHbcQXoFUtgHJwL7gl2zx1aDuDMjvBZVGr2uW0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.1.0 h1:Fd+iaEa+JBwzYo6OTWYSNqyvlPSLciMGsmsnYCKcXM0=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.1.0/go.mod h1:ulHyBFJOI0ONiRL4vcJTmS7rx18jQQlEPmAgo80cRdM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/DataDog/datadog-api-client-go/v2 v2.19.0 h1:Wvz/63/q39EpVwSH1T8jVyRvPcMfEABenU7sD3dO2Lc=
 github.com/DataDog/datadog-api-client-go/v2 v2.19.0/go.mod h1:oD5Lx8Li3oPRa/BSBenkn4i48z+91gwYORF/+6ph71g=
 github.com/DataDog/zstd v1.5.2 h1:vUG4lAyuPCXO0TLbXvPv7EB7cNK1QV/luu55UHLrrn8=
 github.com/DataDog/zstd v1.5.2/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
-github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.5.0 h1:Elr9Wn+sGKPlkaBvwu4mTrxtmOp3F3yV9qhaHbXGjwU=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 h1:YoJbenK9C67SkzkDfmQuVln04ygHj3vjZfd9FL+GmQQ=
-github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7/go.mod h1:z4/9nQmJSSwwds7ejkxaJwO37dru3geImFUdJlaLzQo=
-github.com/acomagu/bufpipe v1.0.3 h1:fxAGrHZTgQ9w5QqVItgzwj235/uYZYgbXitB+dLupOk=
-github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+github.com/ProtonMail/go-crypto v1.1.0-alpha.2 h1:bkyFVUP+ROOARdgCiJzNQo2V2kiB97LyUpzH9P6Hrlg=
+github.com/ProtonMail/go-crypto v1.1.0-alpha.2/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
-github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.17.1 h1:02c72fDJr87N8RAC2s3Qu0YuvMRZKNZJ9F+lAehCazk=
-github.com/aws/aws-sdk-go-v2 v1.17.1/go.mod h1:JLnGeGONAyi2lWXI1p0PCIOIy333JMVK1U7Hf0aRFLw=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 h1:RKci2D7tMwpvGpDNZnGQw9wk6v7o/xSwFcUAuNPoB8k=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9/go.mod h1:vCmV1q1VK8eoQJ5+aYE7PkK1K6v41qJ5pJdK3ggCDvg=
-github.com/aws/aws-sdk-go-v2/config v1.18.2 h1:tRhTb3xMZsB0gW0sXWpqs9FeIP8iQp5SvnvwiPXzHwo=
-github.com/aws/aws-sdk-go-v2/config v1.18.2/go.mod h1:9XVoZTdD8ICjrgI5ddb8j918q6lEZkFYpb7uohgvU6c=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.2 h1:F/v1w0XcFDZjL0bCdi9XWJenoPKjGbzljBhDKcryzEQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.2/go.mod h1:eAT5aj/WJ2UDIA0IVNFc2byQLeD89SDEi4cjzH/MKoQ=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19 h1:E3PXZSI3F2bzyj6XxUXdTIfvp425HHhwKsFvmzBwHgs=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19/go.mod h1:VihW95zQpeKQWVPGkwT+2+WJNQV8UXFfMTWdU6VErL8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.25 h1:nBO/RFxeq/IS5G9Of+ZrgucRciie2qpLy++3UGZ+q2E=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.25/go.mod h1:Zb29PYkf42vVYQY6pvSyJCJcFHlPIiY+YKdPtwnvMkY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.19 h1:oRHDrwCTVT8ZXi4sr9Ld+EXk7N/KGssOr2ygNeojEhw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.19/go.mod h1:6Q0546uHDp421okhmmGfbxzq2hBqbXFNpi4k+Q1JnQA=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.26 h1:Mza+vlnZr+fPKFKRq/lKGVvM6B/8ZZmNdEopOwSQLms=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.26/go.mod h1:Y2OJ+P+MC1u1VKnavT+PshiEuGPyh/7DqxoDNij4/bg=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.16 h1:2EXB7dtGwRYIN3XQ9qwIW504DVbKIw3r89xQnonGdsQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.16/go.mod h1:XH+3h395e3WVdd6T2Z3mPxuI+x/HVtdqVOREkTiyubs=
-github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.20.2 h1:4gX/vArgwRbgQIE7n0i0wmoatYWg+MpBL43c85izKew=
-github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.20.2/go.mod h1:G3xZtg7cjsJaJdl1oVkscYXbdDLZBfOHbE1JqcnZxOI=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.72.0 h1:bCFJL8mahOZJa3+t8+uWHL1JzuCICZCSb50FCljz9hE=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.72.0/go.mod h1:zul71QqzR4D1a90/5FloZiAnZ1CtuIjVH7R9MP997+A=
-github.com/aws/aws-sdk-go-v2/service/iam v1.18.23 h1:HOtW30EkfQevdv++mKguMyn8/agh1z2VuBGR4Hou/u8=
-github.com/aws/aws-sdk-go-v2/service/iam v1.18.23/go.mod h1:yQ92mKfw/Gg5AvgxGmfdufKEyVoa9RNBsdnB9j5Gzkk=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.10 h1:dpiPHgmFstgkLG07KaYAewvuptq5kvo52xn7tVSrtrQ=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.10/go.mod h1:9cBNUHI2aW4ho0A5T87O294iPDuuUOSIEDjnd1Lq/z0=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.20 h1:KSvtm1+fPXE0swe9GPjc6msyrdTT0LB/BP8eLugL1FI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.20/go.mod h1:Mp4XI/CkWGD79AQxZ5lIFlgvC0A+gl+4BmyG1F+SfNc=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.19 h1:GE25AWCdNUPh9AOJzI9KIJnja7IwUc1WyUqz/JTyJ/I=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.19/go.mod h1:02CP6iuYP+IVnBX5HULVdSAku/85eHB2Y9EsFhrkEwU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19 h1:piDBAaWkaxkkVV3xJJbTehXCZRXYs49kvpi/LG6LR2o=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19/go.mod h1:BmQWRVkLTmyNzYPFAZgon53qKLWBNSvonugD1MrSWUs=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.25.0 h1:2ZhmVpSd54gdJkJ0BWBSK0e2/ahIcf88lVnHJNFaqAg=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.25.0/go.mod h1:2oqKd3SCTyhVaUei20xDUOOcqOAuAnbCy79w/t1dDVs=
-github.com/aws/aws-sdk-go-v2/service/organizations v1.16.15 h1:DKPB04iAh04HwzriUgKlnRYfrpQzWkbjRdvnePO1glM=
-github.com/aws/aws-sdk-go-v2/service/organizations v1.16.15/go.mod h1:ysLUNmzoQk89rK4yF0hjDBEX83YCuYSw6fK6KXqXpJ0=
-github.com/aws/aws-sdk-go-v2/service/rds v1.30.0 h1:03M/n8D00QjKoGSSm418IzuMYE+FZrPk3Y04/B9/ZHY=
-github.com/aws/aws-sdk-go-v2/service/rds v1.30.0/go.mod h1:wPFe1Cj3nZWmNWKKdkXw961l1dJheTZQ5JjPImqbMuI=
-github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.0.12 h1:lP9dP8V4ow1YKEZt/zcPfHu2/lAWGmW1pIzgt2iPGRY=
-github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.0.12/go.mod h1:pj8fwktY8PHz60AlgCg/Mwb3nG7JDomW/4eeeud+66w=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3 h1:F6wgg8aHGNyhaAy2ONnWBThiPdLa386qNA0j33FIuSM=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3/go.mod h1:/NHbqPRiwxSPVOB2Xr+StDEH+GWV/64WwnUjv4KYzV0=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.16.7 h1:bfC2Q8ABNbYYm9mh3NfPy5kvnWOPtiqS018NBGDwPl8=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.16.7/go.mod h1:k6CPuxyzO247nYEM1baEwHH1kRtosRCvgahAepaaShw=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.33.0 h1:Whr3iK4ZLynH73qlPI7DRhXmpbQ0GNYxVGPpCeUBiO0=
-github.com/aws/aws-sdk-go-v2/service/ssm v1.33.0/go.mod h1:rEsqsZrOp9YvSGPOrcL3pR9+i/QJaWRkAYbuxMa7yCU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.25 h1:GFZitO48N/7EsFDt8fMa5iYdmWqkUDDB3Eje6z3kbG0=
-github.com/aws/aws-sdk-go-v2/service/sso v1.11.25/go.mod h1:IARHuzTXmj1C0KS35vboR0FeJ89OkEy1M9mWbK2ifCI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8 h1:jcw6kKZrtNfBPJkaHrscDOZoe5gvi9wjudnxvozYFJo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8/go.mod h1:er2JHN+kBY6FcMfcBBKNGCT3CarImmdFzishsqBmSRI=
-github.com/aws/aws-sdk-go-v2/service/sts v1.17.4 h1:YNncBj5dVYd05i4ZQ+YicOotSXo0ufc9P8kTioi13EM=
-github.com/aws/aws-sdk-go-v2/service/sts v1.17.4/go.mod h1:bXcN3koeVYiJcdDU89n3kCYILob7Y34AeLopUbZgLT4=
-github.com/aws/smithy-go v1.13.4 h1:/RN2z1txIJWeXeOkzX+Hk/4Uuvv7dWtCjbmVJcrskyk=
-github.com/aws/smithy-go v1.13.4/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/aws-sdk-go-v2 v1.36.1 h1:iTDl5U6oAhkNPba0e1t1hrwAo02ZMqbrGq4k5JBWM5E=
+github.com/aws/aws-sdk-go-v2 v1.36.1/go.mod h1:5PMILGVKiW32oDzjj6RU52yrNrDPUHcbZQYr1sM7qmM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.8 h1:zAxi9p3wsZMIaVCdoiQp2uZ9k1LsZvmAnoTBeZPXom0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.8/go.mod h1:3XkePX5dSaxveLAYY7nsbsZZrKxCyEuE5pM4ziFxyGg=
+github.com/aws/aws-sdk-go-v2/config v1.29.6 h1:fqgqEKK5HaZVWLQoLiC9Q+xDlSp+1LYidp6ybGE2OGg=
+github.com/aws/aws-sdk-go-v2/config v1.29.6/go.mod h1:Ft+WLODzDQmCTHDvqAH1JfC2xxbZ0MxpZAcJqmE1LTQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.59 h1:9btwmrt//Q6JcSdgJOLI98sdr5p7tssS9yAsGe8aKP4=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.59/go.mod h1:NM8fM6ovI3zak23UISdWidyZuI1ghNe2xjzUZAyT+08=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.28 h1:KwsodFKVQTlI5EyhRSugALzsV6mG/SGrdjlMXSZSdso=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.28/go.mod h1:EY3APf9MzygVhKuPXAc5H+MkGb8k/DOSQjWS0LgkKqI=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.61 h1:BBIPjlEWLxX1huGTkBu/eeqyaXC0pVwDCYbQuE/JPfU=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.61/go.mod h1:6dkLZQM1D/wKKFJEvyB1OCXJ0f68wcIPDOiXm0KyT8A=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.32 h1:BjUcr3X3K0wZPGFg2bxOWW3VPN8rkE3/61zhP+IHviA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.32/go.mod h1:80+OGC/bgzzFFTUmcuwD0lb4YutwQeKLFpmt6hoWapU=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.32 h1:m1GeXHVMJsRsUAqG6HjZWx9dj7F5TR+cF1bjyfYyBd4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.32/go.mod h1:IitoQxGfaKdVLNg0hD8/DXmAqNy0H4K2H2Sf91ti8sI=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 h1:Pg9URiobXy85kgFev3og2CuOZ8JZUBENF+dcgWBaYNk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.32 h1:OIHj/nAhVzIXGzbAE+4XmZ8FPvro3THr6NlqErJc3wY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.32/go.mod h1:LiBEsDo34OJXqdDlRGsilhlIiXR7DL+6Cx2f4p1EgzI=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.24.4 h1:NYHDOBe0ZIeQfaPSPRaQym2NePzA+QYM3O/Oh4IznKg=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.24.4/go.mod h1:AD+JAcEr9fNzFcfKs3CINKBdWGFK7R+/uZ+VdJRhK2U=
+github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.47.4 h1:4hiC8jzPP89L+MTljvKs1LLC12gKJLMJwysjOrbJz1E=
+github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.47.4/go.mod h1:Kj+z0vXRl21DsnPR+lA5DjVWCaRTvAmwQ/shTGHeY84=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.202.4 h1:gdFRXlTMgV0+yrhQLAJKb+vX2K32Vw3n2TntDd+8AEM=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.202.4/go.mod h1:nSbxgPGhyI9j/cMVSHUEEtNQzEYeNOkbHnHNeTuQqt0=
+github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.27.15 h1:Sro9LCF56wf/6jHdmLOfuKl3ZS8z5B0o3VXb+B3Ns5c=
+github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.27.15/go.mod h1:KNmq5FnimQbPsjXMIhgMmEY1zpUUiTgwH+kYJrMjP4c=
+github.com/aws/aws-sdk-go-v2/service/eks v1.58.0 h1:CQn77jEQBLKtHXkiCN58IcrG1jj4w1EwhXRh+NeNhHc=
+github.com/aws/aws-sdk-go-v2/service/eks v1.58.0/go.mod h1:N42HjGBTjTjcJolSqcG1s10xfeNTbAeLWI600lHgwIg=
+github.com/aws/aws-sdk-go-v2/service/iam v1.39.1 h1:N4OauekXigX0GgsJ+FUm7OO5HkrJR0ByZJ2YS5PIy3U=
+github.com/aws/aws-sdk-go-v2/service/iam v1.39.1/go.mod h1:8rUmP3N5TJXWWEzdQ+2Tc1IELc97pxBt5Zbt4QLq7KI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 h1:D4oz8/CzT9bAEYtVhSBmFj2dNOtaHOtMKc2vHBwYizA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2/go.mod h1:Za3IHqTQ+yNcRHxu1OFucBh0ACZT4j4VQFF0BqpZcLY=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.0 h1:kT2WeWcFySdYpPgyqJMSUE7781Qucjtn6wBvrgm9P+M=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.0/go.mod h1:WYH1ABybY7JK9TITPnk6ZlP7gQB8psI4c9qDmMsnLSA=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.13 h1:SYVGSFQHlchIcy6e7x12bsrxClCXSP5et8cqVhL8cuw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.13/go.mod h1:kizuDaLX37bG5WZaoxGPQR/LNFXpxp0vsUnqfkWXfNE=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.13 h1:OBsrtam3rk8NfBEq7OLOMm5HtQ9Yyw32X4UQMya/wjw=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.13/go.mod h1:3U4gFA5pmoCOja7aq4nSaIAGbaOHv2Yl2ug018cmC+Q=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.69.12 h1:9L6sXmGtRvBFzgf14G4EwlGrFkhltigC3fbGIqZ5g+c=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.69.12/go.mod h1:LUkuzqAgjdxkq+UiBnOs/z5LOGoFyEkeVKxeVXB+Rt8=
+github.com/aws/aws-sdk-go-v2/service/organizations v1.37.8 h1:VsGPLkO6PuyRFlNs0XPWt8qM1bItGR45Id+8PhxtohQ=
+github.com/aws/aws-sdk-go-v2/service/organizations v1.37.8/go.mod h1:i2X4j27XVv3td7oL251Qs7x6GE4qt/bNrgeD3i/K8Bg=
+github.com/aws/aws-sdk-go-v2/service/rds v1.93.12 h1:6vjEcP08FsczK2J55oxnbYC4UZ4UBDCBW+rBFtK0H/c=
+github.com/aws/aws-sdk-go-v2/service/rds v1.93.12/go.mod h1:oOqXBxRebL78/MgTi1EoBer+a3Myg0Wr2nO1qG881kM=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.16.15 h1:9AE2+CqB6MlVol+GT+Re84E+CzIQ5v+QtUh9ZfeDerg=
+github.com/aws/aws-sdk-go-v2/service/rolesanywhere v1.16.15/go.mod h1:f8a+xpx2vM4QDUam8IKf+zoV8iCIdYmB4d8dRqd9JqE=
+github.com/aws/aws-sdk-go-v2/service/route53resolver v1.34.13 h1:w+G01NrTwrwKcsFjO/b9X21uwNrXq1khlQk+PUEze6w=
+github.com/aws/aws-sdk-go-v2/service/route53resolver v1.34.13/go.mod h1:WzJ4vZA0cbflC74pssFJR+WobdySmclvF7c2XObKymQ=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.76.1 h1:d4ZG8mELlLeUWFBMCqPtRfEP3J6aQgg/KTC9jLSlkMs=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.76.1/go.mod h1:uZoEIR6PzGOZEjgAZE4hfYfsqK2zOHhq68JLKEvvXj4=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.18 h1:U/gg5eOAPx9vzip9A6cQ2GkIAPBthHMaKDfZ/WWEuj0=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.18/go.mod h1:ul2OTb6zT/dpZX/2bxKVwa6eIDBBlPNuau9uZuIoRAI=
+github.com/aws/aws-sdk-go-v2/service/ses v1.29.10 h1:xcMZ8EGm9vtAqXOLC8Hnp4qoSR71Fo7m0m+BFUJIYrc=
+github.com/aws/aws-sdk-go-v2/service/ses v1.29.10/go.mod h1:vxCcu1OSymrG0XuWZ/jZ687ob51ZU/niPQJz+a5X5/w=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.56.12 h1:EKEY56SQTqEsOuh68B8YVqmsLJ1nuwUGYyKImyo+0ug=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.56.12/go.mod h1:I/j1db6MPxBp7vcVrRAh+u+vERu79MWoyhoSjRaDl9E=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.15 h1:/eE3DogBjYlvlbhd2ssWyeuovWunHLxfgw3s/OJa4GQ=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.15/go.mod h1:2PCJYpi7EKeA5SkStAmZlF6fi0uUABuhtF8ILHjGc3Y=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.14 h1:M/zwXiL2iXUrHputuXgmO94TVNmcenPHxgLXLutodKE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.14/go.mod h1:RVwIw3y/IqxC2YEXSIkAzRDdEU1iRabDPaYjpGCbCGQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.14 h1:TzeR06UCMUq+KA3bDkujxK1GVGy+G8qQN/QVYzGLkQE=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.14/go.mod h1:dspXf/oYWGWo6DEvj98wpaTeqt5+DMidZD0A9BYTizc=
+github.com/aws/smithy-go v1.22.2 h1:6D9hW43xKFrRx/tXXfAlIZc4JI+yQe6snnWcQyxSyLQ=
+github.com/aws/smithy-go v1.22.2/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cjlapao/common-go v0.0.39 h1:bAAUrj2B9v0kMzbAOhzjSmiyDy+rd56r2sy7oEiQLlA=
+github.com/cjlapao/common-go v0.0.39/go.mod h1:M3dzazLjTjEtZJbbxoA5ZDiGCiHmpwqW9l4UWaddwOA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/datadog/stratus-red-team/v2 v2.4.8 h1:18wdlnAo/RFAVykdRfbLkhL9gW3ST9KEeDxIxl9q5xs=
-github.com/datadog/stratus-red-team/v2 v2.4.8/go.mod h1:ycOqiDvRsfuwk0a7wH7O3rYn0YSWCBdfYgCTmgNV8tw=
+github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
+github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
+github.com/datadog/stratus-red-team/v2 v2.23.2 h1:19cflpL4bdscIrYablgObYhqUFIENr68qTDsm7BphMQ=
+github.com/datadog/stratus-red-team/v2 v2.23.2/go.mod h1:N0FHB7KuOj26HAQJkDUCBwGgyV8yq9loHzQVhMpMRX4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dnaeon/go-vcr v1.1.0 h1:ReYa/UBrRyQdant9B4fNHGoCNKw6qh6P0fsdGmZpR7c=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153 h1:yUdfgN0XgIJw7foRItutHYUIhlcKzcSf5vDpdhQAKTc=
+github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
 github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKfrDac4bSQ=
 github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emirpasic/gods v1.12.0 h1:QAUIPSaCu4G+POclxeqb3F+WPpdKqFGlw36+yOzGlrg=
-github.com/emirpasic/gods v1.12.0/go.mod h1:YfzfFFoVP/catgzJb4IKIqXjX78Ha8FMSDh3ymbK86o=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/flowstack/go-jsonschema v0.1.1/go.mod h1:yL7fNggx1o8rm9RlgXv7hTBWxdBM0rVwpMwimd3F3N0=
-github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/gliderlabs/ssh v0.2.2/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
-github.com/go-git/gcfg v1.5.0 h1:Q5ViNfGF8zFgyJWPqYwA7qGFoMTEiBmdlkcfRmpIMa4=
-github.com/go-git/gcfg v1.5.0/go.mod h1:5m20vg6GwYabIxaOonVkTdrILxQMpEShl1xiMF4ua+E=
-github.com/go-git/go-billy/v5 v5.2.0/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-billy/v5 v5.3.1 h1:CPiOUAzKtMRvolEKw+bG1PLRpT7D3LIs3/3ey4Aiu34=
-github.com/go-git/go-billy/v5 v5.3.1/go.mod h1:pmpqyWchKfYfrkb/UVH4otLvyi/5gJlGI4Hb3ZqZ3W0=
-github.com/go-git/go-git-fixtures/v4 v4.2.1/go.mod h1:K8zd3kDUAykwTdDCr+I0per6Y6vMiRR/nnVTBtavnB0=
-github.com/go-git/go-git/v5 v5.4.2 h1:BXyZu9t0VkbiHtqrsvdq39UDhGJTl1h55VW6CSC4aY4=
-github.com/go-git/go-git/v5 v5.4.2/go.mod h1:gQ1kArt6d+n+BGd+/B/I74HwRTLhth2+zti4ihgckDc=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
+github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
+github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
+github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
 github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
@@ -153,21 +185,17 @@ github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
-github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
-github.com/golang-jwt/jwt/v4 v4.4.2 h1:rcc4lwaZgFMCZ5jxF9ABolDcIHdBytAFgqFPbSJQAYs=
-github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -178,8 +206,8 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/gnostic v0.6.9 h1:ZK/5VhkoX835RikCHpSUJV9a+S3e1zLh59YnyWeBW+0=
 github.com/google/gnostic v0.6.9/go.mod h1:Nm8234We1lq6iB9OmlgNv3nH91XLLVZHCDayfA3xq+E=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -187,86 +215,83 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
-github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/gax-go/v2 v2.11.0 h1:9V9PWXEsWnPpQhu/PeQIkS4eGzMlTLGgt80cUUI8Ki4=
-github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
-github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.5.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.4.0 h1:cZkRFr1WVa0Ty6x5fTvL1TuO1flul231rWkGH92oYYk=
-github.com/hashicorp/hc-install v0.4.0/go.mod h1:5d155H8EC5ewegao9A4PUTMNPZaq+TbOzkJJZ4vrXeI=
-github.com/hashicorp/terraform-exec v0.17.3 h1:MX14Kvnka/oWGmIkyuyvL6POx25ZmKrjlaclkx3eErU=
-github.com/hashicorp/terraform-exec v0.17.3/go.mod h1:+NELG0EqQekJzhvikkeQsOAZpsw0cv/03rbeQJqscAI=
-github.com/hashicorp/terraform-json v0.14.0 h1:sh9iZ1Y8IFJLx+xQiKHGud6/TSUCM0N8e17dKDpqV7s=
-github.com/hashicorp/terraform-json v0.14.0/go.mod h1:5A9HIWPkk4e5aeeXIBbkcOvaZbIYnAIkEyqP2pNSckM=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
+github.com/hashicorp/hc-install v0.6.4 h1:QLqlM56/+SIIGvGcfFiwMY3z5WGXT066suo/v9Km8e0=
+github.com/hashicorp/hc-install v0.6.4/go.mod h1:05LWLy8TD842OtgcfBbOT0WMoInBMUSHjmDx10zuBIA=
+github.com/hashicorp/terraform-exec v0.21.0 h1:uNkLAe95ey5Uux6KJdua6+cv8asgILFVWkd/RG0D2XQ=
+github.com/hashicorp/terraform-exec v0.21.0/go.mod h1:1PPeMYou+KDUSSeRE9szMZ/oHf4fYUmB923Wzbq1ICg=
+github.com/hashicorp/terraform-json v0.22.1 h1:xft84GZR0QzjPVWs4lRUwvTcPnegqlyS7orfb5Ltvec=
+github.com/hashicorp/terraform-json v0.22.1/go.mod h1:JbWSQCLFSXFFhg42T7l9iJwdGXBYV8fmmD6o/ML4p3A=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kevinburke/ssh_config v0.0.0-20201106050909-4977a11b4351/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
-github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/microsoft/kiota-abstractions-go v1.7.0 h1:/0OKSSEe94Z1qgpcGE7ZFI9P+4iAnsDQo9v9UOk+R8E=
+github.com/microsoft/kiota-abstractions-go v1.7.0/go.mod h1:FI1I2OHg0E7bK5t8DPnw+9C/CHVyLP6XeqDBT+95pTE=
+github.com/microsoft/kiota-authentication-azure-go v1.1.0 h1:HudH57Enel9zFQ4TEaJw6lMiyZ5RbBdrRHwdU0NP2RY=
+github.com/microsoft/kiota-authentication-azure-go v1.1.0/go.mod h1:zfPFOiLdEqM77Hua5B/2vpcXrVaGqSWjHSRzlvAWEgc=
+github.com/microsoft/kiota-http-go v1.4.4 h1:HM0KT/Q7o+JsGatFkkbTIqJL24Jzo5eMI5NNe9N4TQ4=
+github.com/microsoft/kiota-http-go v1.4.4/go.mod h1:Kup5nMDD3a9sjdgRKHCqZWqtrv3FbprjcPaGjLR6FzM=
+github.com/microsoft/kiota-serialization-form-go v1.0.0 h1:UNdrkMnLFqUCccQZerKjblsyVgifS11b3WCx+eFEsAI=
+github.com/microsoft/kiota-serialization-form-go v1.0.0/go.mod h1:h4mQOO6KVTNciMF6azi1J9QB19ujSw3ULKcSNyXXOMA=
+github.com/microsoft/kiota-serialization-json-go v1.0.8 h1:+aViv9k6wqaw1Fx6P49fl5GIB1hN3b6CG0McNTcUYBc=
+github.com/microsoft/kiota-serialization-json-go v1.0.8/go.mod h1:O8+v11U0EUwHlCz7hrW38KxDmdhKAHfv4Q89uvsBalY=
+github.com/microsoft/kiota-serialization-multipart-go v1.0.0 h1:3O5sb5Zj+moLBiJympbXNaeV07K0d46IfuEd5v9+pBs=
+github.com/microsoft/kiota-serialization-multipart-go v1.0.0/go.mod h1:yauLeBTpANk4L03XD985akNysG24SnRJGaveZf+p4so=
+github.com/microsoft/kiota-serialization-text-go v1.0.0 h1:XOaRhAXy+g8ZVpcq7x7a0jlETWnWrEum0RhmbYrTFnA=
+github.com/microsoft/kiota-serialization-text-go v1.0.0/go.mod h1:sM1/C6ecnQ7IquQOGUrUldaO5wj+9+v7G2W3sQ3fy6M=
+github.com/microsoftgraph/msgraph-beta-sdk-go v0.108.0 h1:bkyTxXYEHQAC2Qo6G2HVZ6ADA+XxawQhenAhbYUyQ+M=
+github.com/microsoftgraph/msgraph-beta-sdk-go v0.108.0/go.mod h1:X4GpYrTnhoGBUHb55rl1+/GzavHHyyS5O1GswrWb15c=
+github.com/microsoftgraph/msgraph-sdk-go v1.47.0 h1:qXfmDij9md6mPsSAJjiDNmS4hxqKo0R489GiVMZVmmY=
+github.com/microsoftgraph/msgraph-sdk-go v1.47.0/go.mod h1:Gnws5D7d/930uS9J4qlCm4BAR/zenqECMk9tgMDXeZQ=
+github.com/microsoftgraph/msgraph-sdk-go-core v1.2.1 h1:P1wpmn3xxfPMFJHg+PJPcusErfRkl63h6OdAnpDbkS8=
+github.com/microsoftgraph/msgraph-sdk-go-core v1.2.1/go.mod h1:vFmWQGWyLlhxCESNLv61vlE4qesBU+eWmEVH7DJSESA=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -276,155 +301,134 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/onsi/ginkgo/v2 v2.1.6 h1:Fx2POJZfKRQcM1pH49qSZiYeu319wji004qX+GDovrU=
+github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
 github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sebdah/goldie v1.0.0/go.mod h1:jXP4hmWywNEwZzhMuv2ccnqTSFpuq8iyQhtQdkkZBH4=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
+github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I=
 github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/std-uritemplate/std-uritemplate/go v0.0.57 h1:GHGjptrsmazP4IVDlUprssiEf9ESVkbjx15xQXXzvq4=
+github.com/std-uritemplate/std-uritemplate/go v0.0.57/go.mod h1:rG/bqh/ThY4xE5de7Rap3vaDkYUT76B0GPJ0loYeTTc=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
-github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
-github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/xanzy/ssh-agent v0.3.0 h1:wUMzuKtKilRgBAD1sUb8gOwwRr2FGoBVumcjoOACClI=
-github.com/xanzy/ssh-agent v0.3.0/go.mod h1:3s9xbODqPuuhK9JV1R321M/FlMZSBvE5aY6eAcqrDh0=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8=
-github.com/zclconf/go-cty v1.10.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk=
-github.com/zclconf/go-cty v1.12.1 h1:PcupnljUm9EIvbgSHQnHhUr3fO6oFmkOrvs2BAFNXXY=
-github.com/zclconf/go-cty v1.12.1/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeWIMfhLvA=
-github.com/zclconf/go-cty-debug v0.0.0-20191215020915-b22d67c1ba0b/go.mod h1:ZRKQfBXbGkpdV6QMzT3rU1kSTAnfu1dO8dPKjYprgj8=
+github.com/zclconf/go-cty v1.14.4 h1:uXXczd9QDGsgu0i/QFR/hzI5NYCHLf6NQw/atrbnhq8=
+github.com/zclconf/go-cty v1.14.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0 h1:PS8wXpbyaDJQ2VDHHncMe9Vct0Zn1fEjpsjrLxGJoSc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.58.0/go.mod h1:HDBUsEjOuRC0EzKZ1bSaRGZWUBAzo+MhAcUUORSr4D0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
+go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
+go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
+go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
+go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210326060303-6b1517762897/go.mod h1:uSPa2vr4CLtc/ILN5odXGNXS6mhrKVzTaCXzk9m6W3k=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0 h1:PUR+T4wwASmuSTYdKjYHI5TD22Wy5ogLU5qZCOLxBrI=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210502180810-71e4cd670f79/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/time v0.2.0 h1:52I/1L54xyEQAYdtcSuxtiT84KGYTBGXwayxmIpNJhE=
-golang.org/x/time v0.2.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
+golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -433,38 +437,36 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.126.0 h1:q4GJq+cAdMAC7XP7njvQ4tvohGLiSlytuL4BQxbIZ+o=
-google.golang.org/api v0.126.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw=
+google.golang.org/api v0.218.0 h1:x6JCjEWeZ9PFCRe9z0FBrNwj7pB7DOAqT35N+IPnAUA=
+google.golang.org/api v0.218.0/go.mod h1:5VGHBAkxrA/8EFjLVEYmMUJ8/8+gWWQ3s4cFH0FxG2M=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc h1:8DyZCyvI8mE1IdLy/60bS+52xfymkE72wv1asokgtao=
-google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc h1:kVKPf/IiYSBWEWtkIn6wZXwWGCnLKcC8oWfZvXjsGnM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
+google.golang.org/genproto v0.0.0-20250122153221-138b5a5a4fd4 h1:Pw6WnI9W/LIdRxqK7T6XGugGbHIRl5Q7q3BssH6xk4s=
+google.golang.org/genproto v0.0.0-20250122153221-138b5a5a4fd4/go.mod h1:qbZzneIOXSq+KFAFut9krLfRLZiFLzZL5u2t8SV83EE=
+google.golang.org/genproto/googleapis/api v0.0.0-20250124145028-65684f501c47 h1:5iw9XJTD4thFidQmFVvx0wi4g5yOHk76rNRUxz1ZG5g=
+google.golang.org/genproto/googleapis/api v0.0.0-20250124145028-65684f501c47/go.mod h1:AfA77qWLcidQWywD0YgqfpJzf50w2VjzBml3TybHeJU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
+google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
+google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -477,31 +479,26 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
+google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alessio/shellescape.v1 v1.0.0-20170105083845-52074bc9df61 h1:8ajkpB4hXVftY5ko905id+dOnmorcS2CHNxxHLLDcFM=
 gopkg.in/alessio/shellescape.v1 v1.0.0-20170105083845-52074bc9df61/go.mod h1:IfMagxm39Ys4ybJrDb7W3Ob8RwxftP0Yy+or/NVz1O8=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

From 99bd8f624c1aae3056b36f7adebe2d42c07157a4 Mon Sep 17 00:00:00 2001
From: Henry Smith <henry.smith@automox.com>
Date: Tue, 8 Jul 2025 09:50:02 -0400
Subject: [PATCH 27/27] add ES version info and notes re: compatibility with
 Splunk Enterprise Security 8.0

---
 pkg/threatest/matchers/splunk/README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/threatest/matchers/splunk/README.md b/pkg/threatest/matchers/splunk/README.md
index 7a6a7f3..d60f775 100644
--- a/pkg/threatest/matchers/splunk/README.md
+++ b/pkg/threatest/matchers/splunk/README.md
@@ -1,4 +1,7 @@
 # Splunk Enterprise Security notable event matcher
+
+This matcher was created/tested with Splunk Enterprise Security, Version 7.3.2 in a GovCloud environment. ES 8 is not GovCloud supported at this time, hence the lack of support/testing with the matcher, but I suspect the matcher should still work given the API endpoint for notable updates appears to be the same: [Splunk Enterprise Security 8.0 Notable Event API Reference](https://help.splunk.com/en/splunk-enterprise-security-8/rest-api-reference/8.0/notable-event-endpoints/notable-event-api-reference).
+
 To work with the Splunk Enterprise Security notable event matcher, you need to have the following prerequisites:
 - A working Splunk instance with the Enterprise Security app installed and the ability to talk to the REST API.
 - An account in Splunk with the necessary permissions to create and manage notable events.