@cyvest/cyvest-js 5.4.1 → 6.1.0

package/dist/index.cjs

@@ -36,30 +36,30 @@ __export(index_exports, {
   areConnected: () => areConnected,
   compareLevels: () => compareLevels,
   countRelationshipsByType: () => countRelationshipsByType,
-  findCheckByName: () => findCheckByName,
-  findChecksAtLeast: () => findChecksAtLeast,
-  findChecksByLevel: () => findChecksByLevel,
-  findChecksForObservable: () => findChecksForObservable,
-  findChecksForTag: () => findChecksForTag,
   findExternalObservables: () => findExternalObservables,
-  findHighestScoringChecks: () => findHighestScoringChecks,
+  findFindingByName: () => findFindingByName,
+  findFindingsAtLeast: () => findFindingsAtLeast,
+  findFindingsByLevel: () => findFindingsByLevel,
+  findFindingsForObservable: () => findFindingsForObservable,
+  findFindingsForTag: () => findFindingsForTag,
+  findHighestScoringFindings: () => findHighestScoringFindings,
   findHighestScoringObservables: () => findHighestScoringObservables,
   findInternalObservables: () => findInternalObservables,
   findLeafObservables: () => findLeafObservables,
-  findMaliciousChecks: () => findMaliciousChecks,
+  findMaliciousFindings: () => findMaliciousFindings,
   findMaliciousObservables: () => findMaliciousObservables,
   findObservablesAtLeast: () => findObservablesAtLeast,
   findObservablesByLevel: () => findObservablesByLevel,
   findObservablesByType: () => findObservablesByType,
   findObservablesByValue: () => findObservablesByValue,
   findObservablesContaining: () => findObservablesContaining,
-  findObservablesForCheck: () => findObservablesForCheck,
+  findObservablesForFinding: () => findObservablesForFinding,
   findObservablesMatching: () => findObservablesMatching,
   findObservablesWithThreatIntel: () => findObservablesWithThreatIntel,
   findOrphanObservables: () => findOrphanObservables,
   findPath: () => findPath,
   findSourceObservables: () => findSourceObservables,
-  findSuspiciousChecks: () => findSuspiciousChecks,
+  findSuspiciousFindings: () => findSuspiciousFindings,
   findSuspiciousObservables: () => findSuspiciousObservables,
   findTagsAtLeast: () => findTagsAtLeast,
   findTagsByLevel: () => findTagsByLevel,
@@ -69,22 +69,21 @@ __export(index_exports, {
   findThreatIntelBySource: () => findThreatIntelBySource,
   findThreatIntelsForObservable: () => findThreatIntelsForObservable,
   findWhitelistedObservables: () => findWhitelistedObservables,
-  generateCheckKey: () => generateCheckKey,
   generateEnrichmentKey: () => generateEnrichmentKey,
+  generateFindingKey: () => generateFindingKey,
   generateObservableKey: () => generateObservableKey,
   generateTagKey: () => generateTagKey,
   generateThreatIntelKey: () => generateThreatIntelKey,
-  getAllCheckKeys: () => getAllCheckKeys,
-  getAllChecks: () => getAllChecks,
   getAllEnrichments: () => getAllEnrichments,
+  getAllEvidences: () => getAllEvidences,
+  getAllFindingKeys: () => getAllFindingKeys,
+  getAllFindings: () => getAllFindings,
   getAllObservableTypes: () => getAllObservableTypes,
   getAllObservables: () => getAllObservables,
   getAllRelationshipTypes: () => getAllRelationshipTypes,
   getAllTags: () => getAllTags,
   getAllThreatIntelSources: () => getAllThreatIntelSources,
   getAllThreatIntels: () => getAllThreatIntels,
-  getCheck: () => getCheck,
-  getCheckByName: () => getCheckByName,
   getColorForLevel: () => getColorForLevel,
   getColorForScore: () => getColorForScore,
   getCounts: () => getCounts,
@@ -92,6 +91,9 @@ __export(index_exports, {
   getEnrichment: () => getEnrichment,
   getEnrichmentByName: () => getEnrichmentByName,
   getEntityLevel: () => getEntityLevel,
+  getEvidence: () => getEvidence,
+  getFinding: () => getFinding,
+  getFindingByName: () => getFindingByName,
   getLevelFromScore: () => getLevelFromScore,
   getObservable: () => getObservable,
   getObservableByTypeValue: () => getObservableByTypeValue,
@@ -127,13 +129,13 @@ __export(index_exports, {
   maxLevel: () => maxLevel,
   minLevel: () => minLevel,
   normalizeLevel: () => normalizeLevel,
-  parseCheckKey: () => parseCheckKey,
   parseCyvest: () => parseCyvest,
+  parseFindingKey: () => parseFindingKey,
   parseKeyType: () => parseKeyType,
   parseObservableKey: () => parseObservableKey,
   parseThreatIntelKey: () => parseThreatIntelKey,
-  sortChecksByLevel: () => sortChecksByLevel,
-  sortChecksByScore: () => sortChecksByScore,
+  sortFindingsByLevel: () => sortFindingsByLevel,
+  sortFindingsByScore: () => sortFindingsByScore,
   sortObservablesByLevel: () => sortObservablesByLevel,
   sortObservablesByScore: () => sortObservablesByScore,
   validateKey: () => validateKey
@@ -238,69 +240,6 @@ var cyvest_schema_default = {
       title: "AuditEvent",
       type: "object"
     },
-    Check: {
-      description: "Represents a verification step in the investigation.\n\nA check validates a specific aspect of the data under investigation\nand contributes to the overall investigation score.",
-      properties: {
-        check_name: {
-          title: "Check Name",
-          type: "string"
-        },
-        description: {
-          title: "Description",
-          type: "string"
-        },
-        comment: {
-          title: "Comment",
-          type: "string"
-        },
-        extra: {
-          additionalProperties: true,
-          title: "Extra",
-          type: "object"
-        },
-        score: {
-          title: "Score",
-          type: "number"
-        },
-        level: {
-          $ref: "#/$defs/Level"
-        },
-        origin_investigation_id: {
-          title: "Origin Investigation Id",
-          type: "string"
-        },
-        observable_links: {
-          items: {
-            $ref: "#/$defs/ObservableLink"
-          },
-          title: "Observable Links",
-          type: "array"
-        },
-        key: {
-          title: "Key",
-          type: "string"
-        },
-        score_display: {
-          readOnly: true,
-          title: "Score Display",
-          type: "string"
-        }
-      },
-      required: [
-        "check_name",
-        "description",
-        "comment",
-        "extra",
-        "score",
-        "level",
-        "origin_investigation_id",
-        "observable_links",
-        "key",
-        "score_display"
-      ],
-      title: "Check",
-      type: "object"
-    },
     DataExtractionSchema: {
       additionalProperties: false,
       description: "Schema for data extraction metadata.",
@@ -361,6 +300,182 @@ var cyvest_schema_default = {
       title: "Enrichment",
       type: "object"
     },
+    Evidence: {
+      description: "Structured material supporting one or more findings.",
+      properties: {
+        type: {
+          title: "Type",
+          type: "string"
+        },
+        title: {
+          title: "Title",
+          type: "string"
+        },
+        description: {
+          title: "Description",
+          type: "string"
+        },
+        source: {
+          title: "Source",
+          type: "string"
+        },
+        external_id: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ],
+          title: "External Id"
+        },
+        content: {
+          anyOf: [
+            {},
+            {
+              type: "null"
+            }
+          ],
+          title: "Content"
+        },
+        uri: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ],
+          title: "Uri"
+        },
+        captured_at: {
+          format: "date-time",
+          title: "Captured At",
+          type: "string"
+        },
+        extra: {
+          additionalProperties: true,
+          title: "Extra",
+          type: "object"
+        },
+        key: {
+          title: "Key",
+          type: "string"
+        },
+        finding_links: {
+          description: "Findings that currently link to this evidence (navigation-only).",
+          items: {
+            type: "string"
+          },
+          readOnly: true,
+          title: "Finding Links",
+          type: "array"
+        }
+      },
+      required: [
+        "type",
+        "title",
+        "description",
+        "source",
+        "external_id",
+        "content",
+        "uri",
+        "captured_at",
+        "extra",
+        "key",
+        "finding_links"
+      ],
+      title: "Evidence",
+      type: "object"
+    },
+    EvidenceLink: {
+      additionalProperties: false,
+      description: "Edge metadata for a Finding\u2194Evidence association.",
+      properties: {
+        evidence_key: {
+          title: "Evidence Key",
+          type: "string"
+        }
+      },
+      required: [
+        "evidence_key"
+      ],
+      title: "EvidenceLink",
+      type: "object"
+    },
+    Finding: {
+      description: "Represents a verification step in the investigation.\n\nA finding validates a specific aspect of the data under investigation\nand contributes to the overall investigation score.",
+      properties: {
+        finding_name: {
+          title: "Finding Name",
+          type: "string"
+        },
+        description: {
+          title: "Description",
+          type: "string"
+        },
+        comment: {
+          title: "Comment",
+          type: "string"
+        },
+        extra: {
+          additionalProperties: true,
+          title: "Extra",
+          type: "object"
+        },
+        score: {
+          title: "Score",
+          type: "number"
+        },
+        level: {
+          $ref: "#/$defs/Level"
+        },
+        origin_investigation_id: {
+          title: "Origin Investigation Id",
+          type: "string"
+        },
+        observable_links: {
+          items: {
+            $ref: "#/$defs/ObservableLink"
+          },
+          title: "Observable Links",
+          type: "array"
+        },
+        evidence_links: {
+          items: {
+            $ref: "#/$defs/EvidenceLink"
+          },
+          title: "Evidence Links",
+          type: "array"
+        },
+        key: {
+          title: "Key",
+          type: "string"
+        },
+        score_display: {
+          readOnly: true,
+          title: "Score Display",
+          type: "string"
+        }
+      },
+      required: [
+        "finding_name",
+        "description",
+        "comment",
+        "extra",
+        "score",
+        "level",
+        "origin_investigation_id",
+        "observable_links",
+        "evidence_links",
+        "key",
+        "score_display"
+      ],
+      title: "Finding",
+      type: "object"
+    },
     InvestigationWhitelist: {
       description: "Represents a whitelist entry on an investigation.",
       properties: {
@@ -395,7 +510,7 @@ var cyvest_schema_default = {
       type: "object"
     },
     Level: {
-      description: "Security level classification for checks, observables, and threat intelligence.\n\nLevels are ordered from lowest (NONE) to highest (MALICIOUS) severity.",
+      description: "Security level classification for findings, observables, and threat intelligence.\n\nLevels are ordered from lowest (NONE) to highest (MALICIOUS) severity.",
       enum: [
         "NONE",
         "TRUSTED",
@@ -409,12 +524,35 @@ var cyvest_schema_default = {
       type: "string"
     },
     Observable: {
-      description: "Represents a cyber observable (IP, URL, domain, hash, etc.).\n\nObservables can be linked to threat intelligence, checks, and other observables\nthrough relationships.",
+      description: "Represents a cyber observable (IP, URL, domain, hash, etc.).\n\nObservables can be linked to threat intelligence, findings, and other observables\nthrough relationships.",
       properties: {
         type: {
           title: "Type",
           type: "string"
         },
+        subtype: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ],
+          title: "Subtype"
+        },
+        namespace: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ],
+          default: null,
+          title: "Namespace"
+        },
         value: {
           title: "Value",
           type: "string"
@@ -443,6 +581,19 @@ var cyvest_schema_default = {
         level: {
           $ref: "#/$defs/Level"
         },
+        aliases: {
+          items: {
+            $ref: "#/$defs/ObservableAlias"
+          },
+          title: "Aliases",
+          type: "array"
+        },
+        occurrence_count: {
+          default: 1,
+          minimum: 1,
+          title: "Occurrence Count",
+          type: "integer"
+        },
         threat_intels: {
           items: {
             type: "string"
@@ -461,13 +612,13 @@ var cyvest_schema_default = {
           title: "Key",
           type: "string"
         },
-        check_links: {
-          description: "Checks that currently link to this observable (navigation-only).",
+        finding_links: {
+          description: "Findings that currently link to this observable (navigation-only).",
           items: {
             type: "string"
           },
           readOnly: true,
-          title: "Check Links",
+          title: "Finding Links",
           type: "array"
         },
         score_display: {
@@ -485,18 +636,67 @@ var cyvest_schema_default = {
         "extra",
         "score",
         "level",
+        "aliases",
         "threat_intels",
         "relationships",
         "key",
-        "check_links",
+        "finding_links",
         "score_display"
       ],
       title: "Observable",
       type: "object"
     },
+    ObservableAlias: {
+      description: "Source observable identity attached to a canonical observable.",
+      properties: {
+        type: {
+          title: "Type",
+          type: "string"
+        },
+        subtype: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ],
+          title: "Subtype"
+        },
+        namespace: {
+          anyOf: [
+            {
+              type: "string"
+            },
+            {
+              type: "null"
+            }
+          ],
+          default: null,
+          title: "Namespace"
+        },
+        value: {
+          title: "Value",
+          type: "string"
+        },
+        count: {
+          default: 1,
+          minimum: 1,
+          title: "Count",
+          type: "integer"
+        }
+      },
+      required: [
+        "type",
+        "value"
+      ],
+      title: "ObservableAlias",
+      type: "object"
+    },
     ObservableLink: {
       additionalProperties: false,
-      description: "Edge metadata for a Check\u2194Observable association.",
+      description: "Edge metadata for a Finding\u2194Observable association.",
       properties: {
         observable_key: {
           title: "Observable Key",
@@ -514,7 +714,7 @@ var cyvest_schema_default = {
       type: "object"
     },
     PropagationMode: {
-      description: "Controls how a Check\u2194Observable link propagates across merged investigations.",
+      description: "Controls how a Finding\u2194Observable link propagates across merged investigations.",
       enum: [
         "LOCAL_ONLY",
         "GLOBAL"
@@ -615,24 +815,45 @@ var cyvest_schema_default = {
           title: "Observables By Type And Level",
           type: "object"
         },
-        total_checks: {
+        total_findings: {
           minimum: 0,
-          title: "Total Checks",
+          title: "Total Findings",
           type: "integer"
         },
-        applied_checks: {
+        applied_findings: {
           minimum: 0,
-          title: "Applied Checks",
+          title: "Applied Findings",
           type: "integer"
         },
-        checks_by_level: {
+        findings_by_level: {
           additionalProperties: {
             items: {
               type: "string"
             },
             type: "array"
           },
-          title: "Checks By Level",
+          title: "Findings By Level",
+          type: "object"
+        },
+        total_evidences: {
+          minimum: 0,
+          title: "Total Evidences",
+          type: "integer"
+        },
+        evidences_by_type: {
+          additionalProperties: {
+            minimum: 0,
+            type: "integer"
+          },
+          title: "Evidences By Type",
+          type: "object"
+        },
+        evidences_by_source: {
+          additionalProperties: {
+            minimum: 0,
+            type: "integer"
+          },
+          title: "Evidences By Source",
           type: "object"
         },
         total_threat_intel: {
@@ -667,8 +888,9 @@ var cyvest_schema_default = {
         "internal_observables",
         "external_observables",
         "whitelisted_observables",
-        "total_checks",
-        "applied_checks",
+        "total_findings",
+        "applied_findings",
+        "total_evidences",
         "total_threat_intel",
         "total_tags"
       ],
@@ -677,7 +899,7 @@ var cyvest_schema_default = {
     },
     Tag: {
       additionalProperties: false,
-      description: 'Groups checks for categorical organization.\n\nTags allow structuring the investigation into logical sections\nwith aggregated scores and levels. Hierarchy is automatic based on\nthe ":" delimiter in tag names (e.g., "header:auth:dkim").',
+      description: 'Groups findings for categorical organization.\n\nTags allow structuring the investigation into logical sections\nwith aggregated scores and levels. Hierarchy is automatic based on\nthe ":" delimiter in tag names (e.g., "header:auth:dkim").',
       properties: {
         name: {
           title: "Name",
@@ -688,11 +910,11 @@ var cyvest_schema_default = {
           title: "Description",
           type: "string"
         },
-        checks: {
+        findings: {
           items: {
             type: "string"
           },
-          title: "Checks",
+          title: "Findings",
           type: "array"
         },
         key: {
@@ -700,20 +922,20 @@ var cyvest_schema_default = {
           type: "string"
         },
         direct_score: {
-          description: "Calculate the score from direct checks only (no hierarchy).\n\nFor hierarchical aggregation (including descendant tags), use\nInvestigation.get_tag_aggregated_score() or TagProxy.get_aggregated_score().\n\nReturns:\n    Total score from direct checks",
+          description: "Calculate the score from direct findings only (no hierarchy).\n\nFor hierarchical aggregation (including descendant tags), use\nInvestigation.get_tag_aggregated_score() or TagProxy.get_aggregated_score().\n\nReturns:\n    Total score from direct findings",
           readOnly: true,
           title: "Direct Score",
           type: "number"
         },
         direct_level: {
           $ref: "#/$defs/Level",
-          description: "Calculate the level from direct checks only (no hierarchy).\n\nFor hierarchical aggregation (including descendant tags), use\nInvestigation.get_tag_aggregated_level() or TagProxy.get_aggregated_level().\n\nReturns:\n    Level based on direct score",
+          description: "Calculate the level from direct findings only (no hierarchy).\n\nFor hierarchical aggregation (including descendant tags), use\nInvestigation.get_tag_aggregated_level() or TagProxy.get_aggregated_level().\n\nReturns:\n    Level based on direct score",
           readOnly: true
         }
       },
       required: [
         "name",
-        "checks",
+        "findings",
         "key",
         "direct_score",
         "direct_level"
@@ -809,6 +1031,12 @@ var cyvest_schema_default = {
   additionalProperties: false,
   description: "Schema for a complete serialized investigation.\n\nThis model describes the output of `serialize_investigation()` from\n`cyvest.io_serialization`. It is the top-level schema for exported investigations.\n\nEntity types reference the runtime models directly. When generating schemas with\n`mode='serialization'`, Pydantic respects field_serializer decorators and produces\nschemas matching the actual model_dump() output.",
   properties: {
+    schema_version: {
+      const: "6.0.0",
+      default: "6.0.0",
+      title: "Schema Version",
+      type: "string"
+    },
     investigation_id: {
       description: "Stable investigation identity (ULID).",
       title: "Investigation Id",
@@ -872,12 +1100,20 @@ var cyvest_schema_default = {
       title: "Observables",
       type: "object"
     },
-    checks: {
+    findings: {
+      additionalProperties: {
+        $ref: "#/$defs/Finding"
+      },
+      description: "Findings keyed by their unique key.",
+      title: "Findings",
+      type: "object"
+    },
+    evidences: {
       additionalProperties: {
-        $ref: "#/$defs/Check"
+        $ref: "#/$defs/Evidence"
       },
-      description: "Checks keyed by their unique key.",
-      title: "Checks",
+      description: "Evidence objects keyed by their unique key.",
+      title: "Evidences",
       type: "object"
     },
     threat_intels: {
@@ -926,7 +1162,8 @@ var cyvest_schema_default = {
     "whitelisted",
     "whitelists",
     "observables",
-    "checks",
+    "findings",
+    "evidences",
     "threat_intels",
     "enrichments",
     "tags",
@@ -965,6 +1202,108 @@ function isCyvest(json) {
 function normalizeValue(value) {
   return value.trim().toLowerCase();
 }
+function normalizeObservableValue(obsType, value, subtype) {
+  const normalizedType = normalizeValue(obsType);
+  const normalizedSubtype = subtype ? normalizeValue(subtype) : void 0;
+  const stripped = value.trim();
+  if (normalizedType === "command_line") return stripped;
+  if (normalizedType === "email" || normalizedType === "host") {
+    return stripped.toLowerCase();
+  }
+  if (normalizedType === "user" && (normalizedSubtype === "email" || normalizedSubtype === "upn")) {
+    return stripped.toLowerCase();
+  }
+  if (normalizedSubtype === "uid" || normalizedSubtype === "pid") {
+    if (!/^[+-]?\d+$/.test(stripped)) {
+      throw new Error(`${normalizedSubtype} observable values must be base-10 integers`);
+    }
+    return BigInt(stripped).toString(10);
+  }
+  return stripped;
+}
+function sha256(content) {
+  const bytes = new TextEncoder().encode(content);
+  const words = [];
+  const bitLength = bytes.length * 8;
+  for (const byte of bytes) {
+    words.push(byte);
+  }
+  words.push(128);
+  while (words.length % 64 !== 56) words.push(0);
+  for (let i = 7; i >= 0; i--) {
+    words.push(Math.floor(bitLength / 2 ** (i * 8)) & 255);
+  }
+  const h = [
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ];
+  const k = Array.from({ length: 64 }, (_, index) => {
+    let primeCount = 0;
+    let candidate = 2;
+    while (true) {
+      let prime = true;
+      for (let divisor = 2; divisor * divisor <= candidate; divisor++) {
+        if (candidate % divisor === 0) {
+          prime = false;
+          break;
+        }
+      }
+      if (prime && primeCount++ === index) {
+        return Math.floor(Math.cbrt(candidate) % 1 * 2 ** 32) >>> 0;
+      }
+      candidate++;
+    }
+  });
+  const rotateRight = (value, amount) => value >>> amount | value << 32 - amount;
+  for (let offset = 0; offset < words.length; offset += 64) {
+    const schedule = new Array(64);
+    for (let i = 0; i < 16; i++) {
+      const base = offset + i * 4;
+      schedule[i] = (words[base] << 24 | words[base + 1] << 16 | words[base + 2] << 8 | words[base + 3]) >>> 0;
+    }
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotateRight(schedule[i - 15], 7) ^ rotateRight(schedule[i - 15], 18) ^ schedule[i - 15] >>> 3;
+      const s1 = rotateRight(schedule[i - 2], 17) ^ rotateRight(schedule[i - 2], 19) ^ schedule[i - 2] >>> 10;
+      schedule[i] = schedule[i - 16] + s0 + schedule[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 64; i++) {
+      const s1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
+      const choice = e & f ^ ~e & g;
+      const temp1 = hh + s1 + choice + k[i] + schedule[i] >>> 0;
+      const s0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
+      const majority = a & b ^ a & c ^ b & c;
+      const temp2 = s0 + majority >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    [a, b, c, d, e, f, g, hh].forEach((value, index) => {
+      h[index] = h[index] + value >>> 0;
+    });
+  }
+  return h.map((value) => value.toString(16).padStart(8, "0")).join("");
+}
+function encodeKeyPart(value, keepSlash = false) {
+  let encoded = encodeURIComponent(value).replace(
+    /[!'()*]/g,
+    (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`
+  );
+  encoded = encoded.replace(/%40/gi, "@");
+  if (keepSlash) encoded = encoded.replace(/%2F/gi, "/").replace(/%5C/gi, "\\");
+  return encoded;
+}
 function hashString(content, length = 16) {
   let hash = 0;
   for (let i = 0; i < content.length; i++) {
@@ -974,14 +1313,35 @@ function hashString(content, length = 16) {
   const hex = Math.abs(hash).toString(16).padStart(8, "0");
   return hex.slice(0, length);
 }
-function generateObservableKey(obsType, value) {
+function generateObservableKey(obsType, value, subtype, namespace) {
   const normalizedType = normalizeValue(obsType);
-  const normalizedValue = normalizeValue(value);
-  return `obs:${normalizedType}:${normalizedValue}`;
+  const normalizedSubtype = subtype ? normalizeValue(subtype) : void 0;
+  const normalizedNamespace = namespace?.trim().toLowerCase() || void 0;
+  const normalizedValue = normalizeObservableValue(
+    normalizedType,
+    value,
+    normalizedSubtype
+  );
+  const identity = JSON.stringify({
+    namespace: normalizedNamespace ?? null,
+    subtype: normalizedSubtype ?? null,
+    type: normalizedType,
+    value: normalizedValue
+  });
+  if (normalizedType === "command_line" || new TextEncoder().encode(identity).length > 128) {
+    return `obs:${normalizedType}:sha256:${sha256(identity)}`;
+  }
+  if (!normalizedSubtype && !normalizedNamespace) {
+    return `obs:${normalizedType}:${normalizedValue.toLowerCase()}`;
+  }
+  const parts = ["obs", encodeKeyPart(normalizedType), normalizedSubtype ? encodeKeyPart(normalizedSubtype) : "_"];
+  if (normalizedNamespace) parts.push(encodeKeyPart(normalizedNamespace));
+  parts.push(encodeKeyPart(normalizedValue, true));
+  return parts.join(":");
 }
-function generateCheckKey(checkName) {
-  const normalizedName = normalizeValue(checkName);
-  return `chk:${normalizedName}`;
+function generateFindingKey(findingName) {
+  const normalizedName = normalizeValue(findingName);
+  return `fnd:${normalizedName}`;
 }
 function generateThreatIntelKey(source, observableKey) {
   const normalizedSource = normalizeValue(source);
@@ -1020,7 +1380,7 @@ function isTagDescendantOf(descendantName, ancestorName) {
 function parseKeyType(key) {
   if (key.includes(":")) {
     const prefix = key.split(":", 1)[0];
-    if (["obs", "chk", "ti", "enr", "tag"].includes(prefix)) {
+    if (["obs", "fnd", "evd", "ti", "enr", "tag"].includes(prefix)) {
       return prefix;
     }
   }
@@ -1053,14 +1413,14 @@ function parseObservableKey(key) {
   }
   return null;
 }
-function parseCheckKey(key) {
-  if (!validateKey(key, "chk")) {
+function parseFindingKey(key) {
+  if (!validateKey(key, "fnd")) {
     return null;
   }
   const parts = key.split(":");
   if (parts.length >= 2) {
     return {
-      checkName: parts.slice(1).join(":")
+      findingName: parts.slice(1).join(":")
     };
   }
   return null;
@@ -1193,15 +1553,8 @@ function getEntityLevel(entity) {
 function getObservable(inv, key) {
   return inv.observables[key];
 }
-function getObservableByTypeValue(inv, type, value) {
-  const normalizedType = type.trim().toLowerCase();
-  const normalizedValue = value.trim().toLowerCase();
-  for (const obs of Object.values(inv.observables)) {
-    if (obs.type.toLowerCase() === normalizedType && obs.value.toLowerCase() === normalizedValue) {
-      return obs;
-    }
-  }
-  return void 0;
+function getObservableByTypeValue(inv, type, value, subtype, namespace) {
+  return inv.observables[generateObservableKey(type, value, subtype, namespace)];
 }
 function getRootObservable(inv) {
   const rootType = inv.data_extraction.root_type;
@@ -1211,15 +1564,21 @@ function getRootObservable(inv) {
   const rootKey = generateObservableKey(rootType, "root");
   return inv.observables[rootKey];
 }
-function getCheck(inv, key) {
-  return inv.checks[key];
+function getFinding(inv, key) {
+  return inv.findings[key];
+}
+function getFindingByName(inv, findingName) {
+  const key = generateFindingKey(findingName);
+  return inv.findings[key];
+}
+function getAllFindings(inv) {
+  return Object.values(inv.findings);
 }
-function getCheckByName(inv, checkName) {
-  const key = generateCheckKey(checkName);
-  return inv.checks[key];
+function getEvidence(inv, key) {
+  return inv.evidences[key];
 }
-function getAllChecks(inv) {
-  return Object.values(inv.checks);
+function getAllEvidences(inv) {
+  return Object.values(inv.evidences);
 }
 function getThreatIntel(inv, key) {
   return inv.threat_intels[key];
@@ -1276,7 +1635,8 @@ function getDataExtraction(inv) {
 function getCounts(inv) {
   return {
     observables: Object.keys(inv.observables).length,
-    checks: getAllChecks(inv).length,
+    findings: getAllFindings(inv).length,
+    evidences: getAllEvidences(inv).length,
     threatIntels: Object.keys(inv.threat_intels).length,
     enrichments: Object.keys(inv.enrichments).length,
     tags: getAllTags(inv).length,
@@ -1358,18 +1718,18 @@ function findObservablesWithThreatIntel(inv) {
     (obs) => obs.threat_intels.length > 0
   );
 }
-function findChecksByLevel(inv, level) {
-  return Object.values(inv.checks).filter((check) => check.level === level);
+function findFindingsByLevel(inv, level) {
+  return Object.values(inv.findings).filter((finding) => finding.level === level);
 }
-function findChecksAtLeast(inv, minLevel2) {
-  return Object.values(inv.checks).filter(
-    (check) => isLevelAtLeast(check.level, minLevel2)
+function findFindingsAtLeast(inv, minLevel2) {
+  return Object.values(inv.findings).filter(
+    (finding) => isLevelAtLeast(finding.level, minLevel2)
   );
 }
-function findCheckByName(inv, checkName) {
-  const normalizedName = checkName.trim().toLowerCase();
-  return Object.values(inv.checks).find(
-    (check) => check.check_name.toLowerCase() === normalizedName
+function findFindingByName(inv, findingName) {
+  const normalizedName = findingName.trim().toLowerCase();
+  return Object.values(inv.findings).find(
+    (finding) => finding.finding_name.toLowerCase() === normalizedName
   );
 }
 function findThreatIntelBySource(inv, source) {
@@ -1397,26 +1757,26 @@ function findTagsAtLeast(inv, minLevel2) {
 function findTagsByNamePattern(inv, pattern) {
   return Object.values(inv.tags).filter((tag) => pattern.test(tag.name));
 }
-function findChecksForObservable(inv, observableKey) {
+function findFindingsForObservable(inv, observableKey) {
   const result = [];
   const seen = /* @__PURE__ */ new Set();
   const observable = inv.observables[observableKey];
   if (observable) {
-    for (const checkKey of observable.check_links) {
-      const check = inv.checks[checkKey];
-      if (check && !seen.has(check.key)) {
-        result.push(check);
-        seen.add(check.key);
+    for (const findingKey of observable.finding_links) {
+      const finding = inv.findings[findingKey];
+      if (finding && !seen.has(finding.key)) {
+        result.push(finding);
+        seen.add(finding.key);
       }
     }
   }
-  for (const check of Object.values(inv.checks)) {
-    if (seen.has(check.key)) {
+  for (const finding of Object.values(inv.findings)) {
+    if (seen.has(finding.key)) {
       continue;
     }
-    if (check.observable_links.some((link) => link.observable_key === observableKey)) {
-      result.push(check);
-      seen.add(check.key);
+    if (finding.observable_links.some((link) => link.observable_key === observableKey)) {
+      result.push(finding);
+      seen.add(finding.key);
     }
   }
   return result;
@@ -1430,37 +1790,37 @@ function findThreatIntelsForObservable(inv, observableKey) {
     (ti) => ti.observable_key === observableKey
   );
 }
-function findObservablesForCheck(inv, checkKey) {
-  const check = inv.checks[checkKey];
-  if (check) {
+function findObservablesForFinding(inv, findingKey) {
+  const finding = inv.findings[findingKey];
+  if (finding) {
     const keys = /* @__PURE__ */ new Set();
-    for (const link of check.observable_links) {
+    for (const link of finding.observable_links) {
       keys.add(link.observable_key);
     }
     return Array.from(keys).map((obsKey) => inv.observables[obsKey]).filter((obs) => obs !== void 0);
   }
   return [];
 }
-function findChecksForTag(inv, tagKey, recursive = false) {
+function findFindingsForTag(inv, tagKey, recursive = false) {
   const result = [];
   const tag = inv.tags[tagKey];
   if (!tag) {
     return result;
   }
-  for (const checkKey of tag.checks) {
-    const check = inv.checks[checkKey];
-    if (check) {
-      result.push(check);
+  for (const findingKey of tag.findings) {
+    const finding = inv.findings[findingKey];
+    if (finding) {
+      result.push(finding);
     }
   }
   if (recursive) {
     const prefix = tag.name + ":";
     for (const otherTag of Object.values(inv.tags)) {
       if (otherTag.name.startsWith(prefix)) {
-        for (const checkKey of otherTag.checks) {
-          const check = inv.checks[checkKey];
-          if (check) {
-            result.push(check);
+        for (const findingKey of otherTag.findings) {
+          const finding = inv.findings[findingKey];
+          if (finding) {
+            result.push(finding);
           }
         }
       }
@@ -1471,24 +1831,24 @@ function findChecksForTag(inv, tagKey, recursive = false) {
 function sortObservablesByScore(observables) {
   return [...observables].sort((a, b) => b.score - a.score);
 }
-function sortChecksByScore(checks) {
-  return [...checks].sort((a, b) => b.score - a.score);
+function sortFindingsByScore(findings) {
+  return [...findings].sort((a, b) => b.score - a.score);
 }
 function sortObservablesByLevel(observables) {
   return [...observables].sort(
     (a, b) => LEVEL_VALUES[b.level] - LEVEL_VALUES[a.level]
   );
 }
-function sortChecksByLevel(checks) {
-  return [...checks].sort(
+function sortFindingsByLevel(findings) {
+  return [...findings].sort(
     (a, b) => LEVEL_VALUES[b.level] - LEVEL_VALUES[a.level]
   );
 }
 function findHighestScoringObservables(inv, n = 10) {
   return sortObservablesByScore(Object.values(inv.observables)).slice(0, n);
 }
-function findHighestScoringChecks(inv, n = 10) {
-  return sortChecksByScore(Object.values(inv.checks)).slice(0, n);
+function findHighestScoringFindings(inv, n = 10) {
+  return sortFindingsByScore(Object.values(inv.findings)).slice(0, n);
 }
 function findMaliciousObservables(inv) {
   return findObservablesByLevel(inv, "MALICIOUS");
@@ -1496,14 +1856,14 @@ function findMaliciousObservables(inv) {
 function findSuspiciousObservables(inv) {
   return findObservablesByLevel(inv, "SUSPICIOUS");
 }
-function findMaliciousChecks(inv) {
-  return findChecksByLevel(inv, "MALICIOUS");
+function findMaliciousFindings(inv) {
+  return findFindingsByLevel(inv, "MALICIOUS");
 }
-function findSuspiciousChecks(inv) {
-  return findChecksByLevel(inv, "SUSPICIOUS");
+function findSuspiciousFindings(inv) {
+  return findFindingsByLevel(inv, "SUSPICIOUS");
 }
-function getAllCheckKeys(inv) {
-  return Object.keys(inv.checks);
+function getAllFindingKeys(inv) {
+  return Object.keys(inv.findings);
 }
 function getAllObservableTypes(inv) {
   const types = /* @__PURE__ */ new Set();
@@ -1788,30 +2148,30 @@ function getRelationshipsForObservable(inv, observableKey) {
   areConnected,
   compareLevels,
   countRelationshipsByType,
-  findCheckByName,
-  findChecksAtLeast,
-  findChecksByLevel,
-  findChecksForObservable,
-  findChecksForTag,
   findExternalObservables,
-  findHighestScoringChecks,
+  findFindingByName,
+  findFindingsAtLeast,
+  findFindingsByLevel,
+  findFindingsForObservable,
+  findFindingsForTag,
+  findHighestScoringFindings,
   findHighestScoringObservables,
   findInternalObservables,
   findLeafObservables,
-  findMaliciousChecks,
+  findMaliciousFindings,
   findMaliciousObservables,
   findObservablesAtLeast,
   findObservablesByLevel,
   findObservablesByType,
   findObservablesByValue,
   findObservablesContaining,
-  findObservablesForCheck,
+  findObservablesForFinding,
   findObservablesMatching,
   findObservablesWithThreatIntel,
   findOrphanObservables,
   findPath,
   findSourceObservables,
-  findSuspiciousChecks,
+  findSuspiciousFindings,
   findSuspiciousObservables,
   findTagsAtLeast,
   findTagsByLevel,
@@ -1821,22 +2181,21 @@ function getRelationshipsForObservable(inv, observableKey) {
   findThreatIntelBySource,
   findThreatIntelsForObservable,
   findWhitelistedObservables,
-  generateCheckKey,
   generateEnrichmentKey,
+  generateFindingKey,
   generateObservableKey,
   generateTagKey,
   generateThreatIntelKey,
-  getAllCheckKeys,
-  getAllChecks,
   getAllEnrichments,
+  getAllEvidences,
+  getAllFindingKeys,
+  getAllFindings,
   getAllObservableTypes,
   getAllObservables,
   getAllRelationshipTypes,
   getAllTags,
   getAllThreatIntelSources,
   getAllThreatIntels,
-  getCheck,
-  getCheckByName,
   getColorForLevel,
   getColorForScore,
   getCounts,
@@ -1844,6 +2203,9 @@ function getRelationshipsForObservable(inv, observableKey) {
   getEnrichment,
   getEnrichmentByName,
   getEntityLevel,
+  getEvidence,
+  getFinding,
+  getFindingByName,
   getLevelFromScore,
   getObservable,
   getObservableByTypeValue,
@@ -1879,13 +2241,13 @@ function getRelationshipsForObservable(inv, observableKey) {
   maxLevel,
   minLevel,
   normalizeLevel,
-  parseCheckKey,
   parseCyvest,
+  parseFindingKey,
   parseKeyType,
   parseObservableKey,
   parseThreatIntelKey,
-  sortChecksByLevel,
-  sortChecksByScore,
+  sortFindingsByLevel,
+  sortFindingsByScore,
   sortObservablesByLevel,
   sortObservablesByScore,
   validateKey