<model>
    <mount>//OPNsense/IDS</mount>
    <description>
        OPNsense IDS
    </description>
    <items>
        <rules>
            <rule type="ArrayField">
                <sid type="IntegerField">
                    <ValidationMessage>Sid should be a number.</ValidationMessage>
                    <Required>Y</Required>
                </sid>
                <enabled type="BooleanField">
                    <default>1</default>
                    <Required>Y</Required>
                </enabled>
                <action type="OptionField">
                    <Required>Y</Required>
                    <default>alert</default>
                    <OptionValues>
                        <alert>Alert</alert>
                        <drop>Drop</drop>
                    </OptionValues>
                </action>
            </rule>
        </rules>
        <userDefinedRules>
            <rule type="ArrayField">
                <!--user defined rules -->
                <enabled type="BooleanField">
                    <default>1</default>
                    <Required>Y</Required>
                </enabled>
                <fingerprint type="TextField">
                    <Required>N</Required>
                    <mask>/^([0-9a-fA-F:]){59,59}$/u</mask>
                    <ValidationMessage>A SSL fingerprint should be a 59 character long hex value.</ValidationMessage>
                </fingerprint>
                <geoip type="CountryField">
                    <Required>N</Required>
                    <Multiple>Y</Multiple>
                    <AddInverted>Y</AddInverted>
                </geoip>
                <geoip_direction type="OptionField">
                    <Required>N</Required>
                    <BlankDesc>Both</BlankDesc>
                    <default></default>
                    <OptionValues>
                        <src>Source</src>
                        <dst>Destination</dst>
                    </OptionValues>
                </geoip_direction>
                <description type="TextField">
                    <Required>Y</Required>
                    <mask>/^([\t\n\v\f\r 0-9a-zA-Z.\-,_\x{00A0}-\x{FFFF}]){1,255}$/u</mask>
                    <ValidationMessage>Description should be a string between 1 and 255 characters.</ValidationMessage>
                </description>
                <action type="OptionField">
                    <Required>Y</Required>
                    <default>alert</default>
                    <OptionValues>
                        <alert>Alert</alert>
                        <drop>Drop</drop>
                    </OptionValues>
                </action>
            </rule>
        </userDefinedRules>
        <files>
            <file type="ArrayField">
                <filename type="TextField">
                    <Required>Y</Required>
                    <mask>/^([\t\n\v\f\r\- 0-9a-zA-Z.,_\x{00A0}-\x{FFFF}]){1,255}$/u</mask>
                </filename>
                <filter type="OptionField">
                    <Required>N</Required>
                    <OptionValues>
                        <drop>Change all alerts to drop actions</drop>
                    </OptionValues>
                </filter>
                <enabled type="BooleanField">
                    <default>0</default>
                    <Required>Y</Required>
                </enabled>
            </file>
        </files>
        <general>
            <enabled type="BooleanField">
                <default>0</default>
                <Required>Y</Required>
            </enabled>
            <ips type="BooleanField">
                <default>0</default>
                <Required>Y</Required>
            </ips>
            <promisc type="BooleanField">
                <default>0</default>
                <Required>Y</Required>
            </promisc>
            <interfaces type="InterfaceField">
                <Required>Y</Required>
                <default>wan</default>
                <multiple>Y</multiple>
                <AddParentDevices>Y</AddParentDevices>
                <filters>
                    <enable>/^(?!0).*$/</enable>
                </filters>
            </interfaces>
            <UpdateCron type="ModelRelationField">
                <Model>
                    <queues>
                        <source>OPNsense.Cron.Cron</source>
                        <items>jobs.job</items>
                        <display>description</display>
                        <filters>
                            <origin>/IDS/</origin>
                        </filters>
                    </queues>
                </Model>
                <ValidationMessage>Related cron not found.</ValidationMessage>
                <Required>N</Required>
            </UpdateCron>
            <AlertLogrotate type="OptionField">
              <Required>N</Required>
              <default>W0D23</default>
              <BlankDesc>Default</BlankDesc>
              <OptionValues>
                  <W0D23>Weekly</W0D23>
                  <D0>Daily</D0>
              </OptionValues>
              <ValidationMessage>Please select a valid rotation</ValidationMessage>
            </AlertLogrotate>
            <AlertSaveLogs type="IntegerField">
                <Required>N</Required>
                <default>4</default>
                <MinimumValue>1</MinimumValue>
                <MaximumValue>1000</MaximumValue>
                <ValidationMessage>Enter a valid number of logs to save</ValidationMessage>
            </AlertSaveLogs>
            <MPMAlgo type="OptionField">
              <Required>N</Required>
              <default>ac</default>
              <BlankDesc>Default</BlankDesc>
              <OptionValues>
                  <ac>Aho-Corasick</ac>
                  <hs>Hyperscan</hs>
              </OptionValues>
              <ValidationMessage>Please select a valid pattern matcher algorithm</ValidationMessage>
            </MPMAlgo>
        </general>
    </items>
</model>