^^&&^^

Edit File: user.yaml

malware user list:
  return_type: MalwareUserListAgentResponse
  help: Show the list of users in the system and their infection status
  type: dict
  cli:
    users:
    - root
  schema:
    search:
      type: string
      nullable: true
      help: Search by user name.
    limit:
      type: integer
      coerce: int
      default: 100
      help: Page size
    offset:
      type: integer
      coerce: int
      default: 0
      help: Page offset
    order_by:
      type: list
      schema:
        type: order_by
        coerce: order_by
      nullable: true
      help: |
        List of fields to order by, each followed by a `+` (ascending) or `-` (descending).
        E.g. `["scan_status+","scan_date-"]` would order by `scan_status` ascending and `scan_date` descending.
    user:  # TODO: remove this field
      type: string
      nullable: true
    ids:
      type: list
      schema:
        type: string
      nullable: true
      help: |
        List exact usernames to return. Incompatible with `search` and ignores `order_by`.

malware user scan:
  return_type: NullAgentResponse
  help: Queue on-demand scans for each user on the server
  type: dict
  cli:
    users:
    - root
  schema:
    background:
      type: boolean
      default: false
      help: |
        (internal) Treat it as a "background" scan - lower priority, different cancellation rules, etc.

follow_symlinks:
      type: boolean
      default: false
      dependencies:
        scan_file: true
      help: If true, the scanner may traverse outside of the users' home directories.

detect_elf:
      type: boolean
      default: false
      dependencies:
        scan_file: true
      help: Treat ELF binaries in home directories as malware.

scan_file:
      type: boolean
      default: true
      help: Whether or not to scan users' files.

scan_db:
      type: boolean
      default: null
      coerce: scan_db
      help: Whether or not to scan users' databases.