azure-rest-api-specs icon indicating copy to clipboard operation
azure-rest-api-specs copied to clipboard

Assisted Queries API

Open artafres opened this issue 3 years ago • 10 comments

MSFT employees can try out our new experience at OpenAPI Hub - one location for using our validation tools and finding your workflow.

Changelog

Add a changelog entry for this PR by answering the following questions:

  1. What's the purpose of the update?
    • [x] new service onboarding
    • [ ] new API version
    • [ ] update existing version for new feature
    • [ ] update existing version to fix swagger quality issue in s360
    • [x] Other, please clarify
  2. When are you targeting to deploy the new service/feature to public regions? Please provide the date or, if the date is not yet available, the month.
  3. When do you expect to publish the swagger? Please provide date or, the the date is not yet available, the month.
  4. If updating an existing version, please select the specific language SDKs and CLIs that must be refreshed after the swagger is published.
    • [ ] SDK of .NET (need service team to ensure code readiness)
    • [ ] SDK of Python
    • [ ] SDK of Java
    • [ ] SDK of Js
    • [ ] SDK of Go
    • [ ] PowerShell
    • [ ] CLI
    • [ ] Terraform
    • [ ] No refresh required for updates in this PR

Contribution checklist:

If any further question about AME onboarding or validation tools, please view the FAQ.

ARM API Review Checklist

Applicability: :warning:

If your changes encompass only the following scenarios, you should SKIP this section, as these scenarios do not require ARM review.

  • Change to data plane APIs
  • Adding new properties
  • All removals

Otherwise your PR may be subject to ARM review requirements. Complete the following:

  • [x] Check this box if any of the following appy to the PR so that the label "ARMReview" and "WaitForARMFeedback" will be added by bot to kick off ARM API Review. Missing to check this box in the following scenario may result in delays to the ARM manifest review and deployment.

    • Adding a new service
    • Adding new API(s)
    • Adding a new API version -[ ] To review changes efficiently, ensure you are using OpenAPIHub to initialize the PR for adding a new version. More details, refer to the wiki.
  • [x] Ensure you've reviewed following guidelines including ARM resource provider contract and REST guidelines. Estimated time (4 hours). This is required before you can request review from ARM API Review board.

  • [ ] If you are blocked on ARM review and want to get the PR merged with urgency, please get the ARM oncall for reviews (RP Manifest Approvers team under Azure Resource Manager service) from IcM and reach out to them.

Breaking Change Review Checklist

If any of the following scenarios apply to the PR, request approval from the Breaking Change Review Board as defined in the Breaking Change Policy.

  • [ ] Removing API(s) in a stable version
  • [ ] Removing properties in a stable version
  • [ ] Removing API version(s) in a stable version
  • [ ] Updating API in a stable or public preview version with Breaking Change Validation errors
  • [ ] Updating API(s) in public preview over 1 year (refer to Retirement of Previews)

Action: to initiate an evaluation of the breaking change, create a new intake using the template for breaking changes. Addition details on the process and office hours are on the Breaking change Wiki.

Please follow the link to find more details on PR review process.

artafres avatar Aug 01 '22 18:08 artafres

Hi, @artafres Thanks for your PR. I am workflow bot for review process. Here are some small tips.

  • Please ensure to do self-check against checklists in first PR comment.
  • PR assignee is the person auto-assigned and responsible for your current PR reviewing and merging.
  • For specs comparison cross API versions, Use API Specs Comparison Report Generator
  • If there is CI failure(s), to fix CI error(s) is mandatory for PR merging; or you need to provide justification in PR comment for explanation. How to fix?
  • Any feedback about review process or workflow bot, pls contact swagger and tools team. [email protected]

    Swagger Validation Report

    ️️✔️BreakingChange succeeded [Detail] [Expand]
    There are no breaking changes.
    ️️✔️Breaking Change(Cross-Version) succeeded [Detail] [Expand]
    There are no breaking changes.
    ️⚠️LintDiff: 1 Warnings warning [Detail]
    compared tags (via openapi-validator v1.13.0) new version base version
    package-preview-2022-11 package-preview-2022-11(73cedfc) package-preview-2022-11(feature-Sentinel-2022-11-01-preview-AssistedQueries)

    The following errors/warnings are introduced by current PR:

    Rule Message
    :warning: R3010 - TrackedResourceListByImmediateParent The child tracked resource, 'editedQueries' with immediate parent 'Query', must have a list by immediate parent operation.
    Location: Microsoft.SecurityInsights/preview/2022-11-01-preview/AssistedQueries.json#L512
    ️️✔️Avocado succeeded [Detail] [Expand]
    Validation passes for Avocado.
    ️️✔️ModelValidation succeeded [Detail] [Expand]
    Validation passes for ModelValidation.
    ️️✔️SemanticValidation succeeded [Detail] [Expand]
    Validation passes for SemanticValidation.
    ️⚠️SDK Track2 Validation: 3 Warnings warning [Detail]
    • The following tags are being changed in this PR
      • "https://github.com/Azure/azure-rest-api-specs/blob/73cedfcb4dad4ec839aa737bdcb58333cb47b674/specification/securityinsights/resource-manager/readme.md#tag-package-preview-2022-11">securityinsights/resource-manager/readme.md#package-preview-2022-11
    The following errors/warnings are introduced by current PR:
    Rule Message
    :warning: Modeler/MissingType "readme":"securityinsights/resource-manager/readme.md",
    "tag":"package-preview-2022-11",
    "details":"The schema 'components·1qaufw0·schemas·threatintelligenceindicatorproperties·properties·extensions·additionalproperties' has no type or format information whatsoever. Location:\n file:///mnt/vss/_work/1/azure-rest-api-specs/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-11-01-preview/ThreatIntelligence.json#/components/schemas/components·1qaufw0·schemas·threatintelligenceindicatorproperties·properties·extensions·additionalproperties"
    :warning: Modeler/MissingType "readme":"securityinsights/resource-manager/readme.md",
    "tag":"package-preview-2022-11",
    "details":"The schema 'components·2sbdb2·schemas·watchlistitemproperties·properties·itemskeyvalue·additionalproperties' has no type or format information whatsoever. Location:\n file:///mnt/vss/_work/1/azure-rest-api-specs/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-11-01-preview/Watchlists.json#/components/schemas/components·2sbdb2·schemas·watchlistitemproperties·properties·itemskeyvalue·additionalproperties"
    :warning: Modeler/MissingType "readme":"securityinsights/resource-manager/readme.md",
    "tag":"package-preview-2022-11",
    "details":"The schema 'components·84fvid·schemas·watchlistitemproperties·properties·entitymapping·additionalproperties' has no type or format information whatsoever. Location:\n file:///mnt/vss/_work/1/azure-rest-api-specs/specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2022-11-01-preview/Watchlists.json#/components/schemas/components·84fvid·schemas·watchlistitemproperties·properties·entitymapping·additionalproperties"


    The following errors/warnings exist before current PR submission:

    Rule Message
    :warning: UnkownSecurityScheme "readme":"securityinsights/resource-manager/readme.md",
    "tag":"package-preview-2022-11",
    "details":"Security scheme azure_auth is unknown and will not be processed. Only supported types are AADToken,
    AzureKey,
    Anonymous"
    ️️✔️PrettierCheck succeeded [Detail] [Expand]
    Validation passes for PrettierCheck.
    ️️✔️SpellCheck succeeded [Detail] [Expand]
    Validation passes for SpellCheck.
    ️️✔️CadlValidation succeeded [Detail] [Expand]
    Validation passes for CadlValidation.
    Posted by Swagger Pipeline | How to fix these errors?

    Swagger Generation Artifacts

    ️️✔️ApiDocPreview succeeded [Detail] [Expand]
     Please click here to preview with your @microsoft account. 
    ️⚠️SDK Breaking Change Tracking warning [Detail]

    Breaking Changes Tracking

    ⚠️azure-sdk-for-python-track2 - track2_azure-mgmt-securityinsight - 1.0.0
    +	Parameter alerts of model AlertsDataTypeOfDataConnector is now required
    +	Parameter alerts of model MCASDataConnectorDataTypes is now required
    +	Parameter exchange of model OfficeDataConnectorDataTypes is now required
    +	Parameter indicators of model TIDataConnectorDataTypes is now required
    +	Parameter logs of model AwsCloudTrailDataConnectorDataTypes is now required
    +	Parameter share_point of model OfficeDataConnectorDataTypes is now required
    +	Parameter state of model AwsCloudTrailDataConnectorDataTypesLogs is now required
    +	Parameter state of model DataConnectorDataTypeCommon is now required
    +	Parameter state of model OfficeDataConnectorDataTypesExchange is now required
    +	Parameter state of model OfficeDataConnectorDataTypesSharePoint is now required
    +	Parameter state of model OfficeDataConnectorDataTypesTeams is now required
    +	Parameter state of model TIDataConnectorDataTypesIndicators is now required
    +	Parameter teams of model OfficeDataConnectorDataTypes is now required
    +	Parameter tenant_id of model DataConnectorTenantId is now required
    ⚠️azure-sdk-for-js - @azure/arm-securityinsight - 1.0.0-beta.5
    +	Parameter logicAppsResourceId of interface ManualTriggerRequestBody is now required
    ️❌ azure-sdk-for-net failed [Detail]
    • Failed [Logs] Generate from 75da76291b9e916b045926596c1fc66b5890fb82. SDK Automation 14.0.0
      warn	Skip initScript due to not configured
      command	sudo apt-get install -y dotnet-sdk-6.0
      command	autorest --version=2.0.4421 --csharp --reflect-api-versions --license-header=MICROSOFT_MIT_NO_VERSION [email protected]/[email protected] --csharp-sdks-folder=/mnt/vss/_work/1/s/azure-sdk-for-net/sdk ../azure-rest-api-specs/specification/securityinsights/resource-manager/readme.md
      cmderr	[Autorest] realpath(): Permission denied
      cmderr	[Autorest] realpath(): Permission denied
      cmderr	[Autorest] realpath(): Permission denied
      cmderr	[Autorest] realpath(): Permission denied
      cmderr	[Autorest] realpath(): Permission denied
      cmderr	[Autorest] realpath(): Permission denied
      cmderr	[Autorest] No usable version of the libssl was found
      cmderr	[Autorest] FATAL: csharp/simplifier - FAILED
      cmderr	[Autorest] FATAL: Error: [Exception] AutoRest extension '@microsoft.azure/autorest.csharp' terminated.
      cmderr	[Autorest] Process() cancelled due to exception : [Exception] AutoRest extension '@microsoft.azure/autorest.csharp' terminated.
      error	Script return with result [failed] code [1] signal [null] cwd [azure-sdk-for-net]: autorest
      warn	Skip package processing as generation is failed
    ️⚠️ azure-sdk-for-python-track2 warning [Detail]
    • ⚠️Warning [Logs] Generate from 75da76291b9e916b045926596c1fc66b5890fb82. SDK Automation 14.0.0
      command	sh scripts/automation_init.sh ../azure-sdk-for-python_tmp/initInput.json ../azure-sdk-for-python_tmp/initOutput.json
      cmderr	[automation_init.sh] WARNING: Skipping azure-nspkg as it is not installed.
      command	sh scripts/automation_generate.sh ../azure-sdk-for-python_tmp/generateInput.json ../azure-sdk-for-python_tmp/generateOutput.json
      cmderr	[automation_generate.sh]  config global `--global`, `--local` are deprecated. Use `--location=global` instead.
    • ️✔️track2_azure-mgmt-securityinsight [View full logs]  [Preview SDK Changes] Breaking Change Detected
      info	[Changelog] **Features**
      info	[Changelog]
      info	[Changelog]   - Added operation DataConnectorsOperations.connect
      info	[Changelog]   - Added operation DataConnectorsOperations.disconnect
      info	[Changelog]   - Added operation IncidentsOperations.create_team
      info	[Changelog]   - Added operation IncidentsOperations.run_playbook
      info	[Changelog]   - Added operation group BookmarkOperations
      info	[Changelog]   - Added operation group BookmarkRelationsOperations
      info	[Changelog]   - Added operation group DataConnectorsCheckRequirementsOperations
      info	[Changelog]   - Added operation group DomainWhoisOperations
      info	[Changelog]   - Added operation group EditedQueriesOperations
      info	[Changelog]   - Added operation group EntitiesGetTimelineOperations
      info	[Changelog]   - Added operation group EntitiesOperations
      info	[Changelog]   - Added operation group EntitiesRelationsOperations
      info	[Changelog]   - Added operation group EntityQueriesOperations
      info	[Changelog]   - Added operation group EntityQueryTemplatesOperations
      info	[Changelog]   - Added operation group EntityRelationsOperations
      info	[Changelog]   - Added operation group IPGeodataOperations
      info	[Changelog]   - Added operation group MetadataOperations
      info	[Changelog]   - Added operation group OfficeConsentsOperations
      info	[Changelog]   - Added operation group ProductSettingsOperations
      info	[Changelog]   - Added operation group QueriesOperations
      info	[Changelog]   - Added operation group SecurityMLAnalyticsSettingsOperations
      info	[Changelog]   - Added operation group SourceControlOperations
      info	[Changelog]   - Added operation group SourceControlsOperations
      info	[Changelog]   - Model Bookmark has a new parameter entity_mappings
      info	[Changelog]   - Model Bookmark has a new parameter tactics
      info	[Changelog]   - Model Bookmark has a new parameter techniques
      info	[Changelog]   - Model FusionAlertRule has a new parameter scenario_exclusion_patterns
      info	[Changelog]   - Model FusionAlertRule has a new parameter source_settings
      info	[Changelog]   - Model FusionAlertRule has a new parameter techniques
      info	[Changelog]   - Model FusionAlertRuleTemplate has a new parameter source_settings
      info	[Changelog]   - Model FusionAlertRuleTemplate has a new parameter techniques
      info	[Changelog]   - Model Incident has a new parameter provider_incident_id
      info	[Changelog]   - Model Incident has a new parameter provider_name
      info	[Changelog]   - Model Incident has a new parameter team_information
      info	[Changelog]   - Model IncidentAdditionalData has a new parameter provider_incident_url
      info	[Changelog]   - Model IncidentAdditionalData has a new parameter techniques
      info	[Changelog]   - Model IncidentOwnerInfo has a new parameter owner_type
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter device_sub_type
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter importance
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter is_authorized
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter is_programming
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter is_scanner
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter nic_entity_ids
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter owners
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter purdue_layer
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter sensor
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter site
      info	[Changelog]   - Model IoTDeviceEntity has a new parameter zone
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter device_sub_type
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter importance
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter is_authorized
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter is_programming
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter is_scanner
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter nic_entity_ids
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter owners
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter purdue_layer
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter sensor
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter site
      info	[Changelog]   - Model IoTDeviceEntityProperties has a new parameter zone
      info	[Changelog]   - Model ScheduledAlertRule has a new parameter techniques
      info	[Changelog]   - Model ScheduledAlertRuleProperties has a new parameter techniques
      info	[Changelog]   - Model ScheduledAlertRuleTemplate has a new parameter techniques
      info	[Changelog]   - Model Watchlist has a new parameter source_type
      info	[Changelog]
      info	[Changelog] **Breaking changes**
      info	[Changelog]
      info	[Changelog]   - Parameter alerts of model AlertsDataTypeOfDataConnector is now required
      info	[Changelog]   - Parameter alerts of model MCASDataConnectorDataTypes is now required
      info	[Changelog]   - Parameter exchange of model OfficeDataConnectorDataTypes is now required
      info	[Changelog]   - Parameter indicators of model TIDataConnectorDataTypes is now required
      info	[Changelog]   - Parameter logs of model AwsCloudTrailDataConnectorDataTypes is now required
      info	[Changelog]   - Parameter share_point of model OfficeDataConnectorDataTypes is now required
      info	[Changelog]   - Parameter state of model AwsCloudTrailDataConnectorDataTypesLogs is now required
      info	[Changelog]   - Parameter state of model DataConnectorDataTypeCommon is now required
      info	[Changelog]   - Parameter state of model OfficeDataConnectorDataTypesExchange is now required
      info	[Changelog]   - Parameter state of model OfficeDataConnectorDataTypesSharePoint is now required
      info	[Changelog]   - Parameter state of model OfficeDataConnectorDataTypesTeams is now required
      info	[Changelog]   - Parameter state of model TIDataConnectorDataTypesIndicators is now required
      info	[Changelog]   - Parameter teams of model OfficeDataConnectorDataTypes is now required
      info	[Changelog]   - Parameter tenant_id of model DataConnectorTenantId is now required
    ️️✔️ azure-sdk-for-js succeeded [Detail] [Expand]
    • ️✔️Succeeded [Logs] Generate from 75da76291b9e916b045926596c1fc66b5890fb82. SDK Automation 14.0.0
      command	sh .scripts/automation_init.sh ../azure-sdk-for-js_tmp/initInput.json ../azure-sdk-for-js_tmp/initOutput.json
      warn	File azure-sdk-for-js_tmp/initOutput.json not found to read
      command	sh .scripts/automation_generate.sh ../azure-sdk-for-js_tmp/generateInput.json ../azure-sdk-for-js_tmp/generateOutput.json
    • ️✔️@azure/arm-securityinsight [View full logs]  [Preview SDK Changes] Breaking Change Detected
      info	[Changelog] **Features**
      info	[Changelog]
      info	[Changelog]   - Added operation group EditedQueries
      info	[Changelog]   - Added operation group Queries
      info	[Changelog]   - Added Interface EditedQueriesCreateOrUpdateOptionalParams
      info	[Changelog]   - Added Interface EditedQueriesDeleteOptionalParams
      info	[Changelog]   - Added Interface EditedQueriesGetOptionalParams
      info	[Changelog]   - Added Interface EditedQueriesListNextOptionalParams
      info	[Changelog]   - Added Interface EditedQueriesListOptionalParams
      info	[Changelog]   - Added Interface EditedQuery
      info	[Changelog]   - Added Interface EditedQueryList
      info	[Changelog]   - Added Interface QueriesCreateOrUpdateOptionalParams
      info	[Changelog]   - Added Interface QueriesDeleteOptionalParams
      info	[Changelog]   - Added Interface QueriesGetOptionalParams
      info	[Changelog]   - Added Interface QueriesListNextOptionalParams
      info	[Changelog]   - Added Interface QueriesListOptionalParams
      info	[Changelog]   - Added Interface Query
      info	[Changelog]   - Added Interface QueryList
      info	[Changelog]   - Added Type Alias EditedQueriesCreateOrUpdateResponse
      info	[Changelog]   - Added Type Alias EditedQueriesGetResponse
      info	[Changelog]   - Added Type Alias EditedQueriesListNextResponse
      info	[Changelog]   - Added Type Alias EditedQueriesListResponse
      info	[Changelog]   - Added Type Alias QueriesCreateOrUpdateResponse
      info	[Changelog]   - Added Type Alias QueriesGetResponse
      info	[Changelog]   - Added Type Alias QueriesListNextResponse
      info	[Changelog]   - Added Type Alias QueriesListResponse
      info	[Changelog]   - Class SecurityInsights has a new parameter editedQueries
      info	[Changelog]   - Class SecurityInsights has a new parameter queries
      info	[Changelog]
      info	[Changelog] **Breaking Changes**
      info	[Changelog]
      info	[Changelog]   - Parameter logicAppsResourceId of interface ManualTriggerRequestBody is now required
    ️️✔️ azure-sdk-for-java succeeded [Detail] [Expand]
    ️⚠️ azure-resource-manager-schemas warning [Detail]
    • ⚠️Warning [Logs] Generate from 75da76291b9e916b045926596c1fc66b5890fb82. Schema Automation 14.0.0
      command	.sdkauto/initScript.sh ../azure-resource-manager-schemas_tmp/initInput.json ../azure-resource-manager-schemas_tmp/initOutput.json
      cmderr	[initScript.sh] WARN old lockfile
      cmderr	[initScript.sh] npm WARN old lockfile The package-lock.json file was created with an old version of npm,
      cmderr	[initScript.sh] npm WARN old lockfile so supplemental metadata must be fetched from the registry.
      cmderr	[initScript.sh] npm WARN old lockfile
      cmderr	[initScript.sh] npm WARN old lockfile This is a one-time fix-up, please be patient...
      cmderr	[initScript.sh] npm WARN old lockfile
      warn	File azure-resource-manager-schemas_tmp/initOutput.json not found to read
      command	.sdkauto/generateScript.sh ../azure-resource-manager-schemas_tmp/generateInput.json ../azure-resource-manager-schemas_tmp/generateOutput.json
    • ️✔️securityinsights [View full logs]  [Preview Schema Changes]
    ️❌ azure-powershell failed [Detail]
    • Failed [Logs] Generate from 75da76291b9e916b045926596c1fc66b5890fb82. SDK Automation 14.0.0
      command	sh ./tools/SwaggerCI/init.sh ../azure-powershell_tmp/initInput.json ../azure-powershell_tmp/initOutput.json
      command	pwsh ./tools/SwaggerCI/psci.ps1 ../azure-powershell_tmp/generateInput.json ../azure-powershell_tmp/generateOutput.json
    • Az.securityinsights [View full logs]  [Preview SDK Changes]
    Posted by Swagger Pipeline | How to fix these errors?

    Generated ApiView

    Language Package Name ApiView Link
    Python track2_azure-mgmt-securityinsight Create ApiView failed. Please ensure your github account in Azure/Microsoft is public and re-trigger the CI. If issue still exists, please ask PR assignee for help
    Java azure-resourcemanager-securityinsights Create ApiView failed. Please ensure your github account in Azure/Microsoft is public and re-trigger the CI. If issue still exists, please ask PR assignee for help
    JavaScript @azure/arm-securityinsight Create ApiView failed. Please ensure your github account in Azure/Microsoft is public and re-trigger the CI. If issue still exists, please ask PR assignee for help

    Hi, @artafres your PR are labelled with WaitForARMFeedback. A notification email will be sent out shortly afterwards to notify ARM review board([email protected]).

    Hi @artafres, Your PR has some issues. Please fix the CI sequentially by following the order of Avocado, semantic validation, model validation, breaking change, lintDiff. If you have any questions, please post your questions in this channel https://aka.ms/swaggersupport.

    TaskHow to fixPriority
    AvocadoFix-AvocadoHigh
    Semantic validationFix-SemanticValidation-ErrorHigh
    Model validationFix-ModelValidation-ErrorHigh
    LintDiffFix-LintDiffhigh
    If you need further help, please feedback via swagger feedback.

    Please ensure to respond feedbacks from the ARM API reviewer. When you are ready to continue the ARM API review, please remove ARMChangesRequested

    Please respond to the comments and remove the "ARMChangesRequested" label when this PR is ready for review again .

    raosuhas avatar Aug 02 '22 00:08 raosuhas

    Issues not fixed . Please fix the Proxy resource issue before updating the tags or atleast respond to the comment.

    raosuhas avatar Aug 03 '22 22:08 raosuhas

    Hi, @artafres. Your PR has no update for 14 days and it is marked as stale PR. If no further update for over 14 days, the bot will close the PR. If you want to refresh the PR, please remove no-recent-activity label.

    ghost avatar Aug 21 '22 16:08 ghost

    Hi, @artafres. The PR will be closed since the PR has no update for 28 days. If you still need the PR review to proceed, please reopen it and @ mention PR assignee.

    ghost avatar Sep 05 '22 05:09 ghost