@etcsec-com/etc-collector 1.4.0

package/dist/services/audit/detectors/azure/user-security.detector.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectGlobalAdminNoMfa = detectGlobalAdminNoMfa;
+exports.detectPrivilegedUserNoMfa = detectPrivilegedUserNoMfa;
+exports.detectRiskyUserHigh = detectRiskyUserHigh;
+exports.detectUserInactive = detectUserInactive;
+exports.detectPasswordNeverExpires = detectPasswordNeverExpires;
+exports.detectRiskyUserMedium = detectRiskyUserMedium;
+exports.detectPasswordOld = detectPasswordOld;
+exports.detectUserNeverSignedIn = detectUserNeverSignedIn;
+exports.detectUserUnlicensed = detectUserUnlicensed;
+exports.detectUserExternalMember = detectUserExternalMember;
+exports.detectUserSecurityVulnerabilities = detectUserSecurityVulnerabilities;
+const entity_converter_1 = require("../../../../utils/entity-converter");
+function detectGlobalAdminNoMfa(users, roles, includeDetails) {
+    const globalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10';
+    const affected = users.filter((u) => {
+        const userRoles = roles.get(u.id) || [];
+        const isGlobalAdmin = userRoles.includes(globalAdminRoleId);
+        const hasMfa = u.strongAuthenticationMethods?.length > 0 || u.isMfaRegistered === true;
+        return isGlobalAdmin && !hasMfa;
+    });
+    return {
+        type: 'AZURE_GLOBAL_ADMIN_NO_MFA',
+        severity: 'critical',
+        category: 'identity',
+        title: 'Global Administrator without MFA',
+        description: 'Global Administrator account without Multi-Factor Authentication. Full control over Azure AD if compromised.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectPrivilegedUserNoMfa(users, roles, includeDetails) {
+    const privilegedRoleIds = [
+        '62e90394-69f5-4237-9190-012177145e10',
+        'e8611ab8-c189-46e8-94e1-60213ab1f814',
+        '194ae4cb-b126-40b2-bd5b-6091b380977d',
+        '29232cdf-9323-42fd-ade2-1d097af3e4de',
+        'f28a1f50-f6e7-4571-818b-6a12f2af6b6c',
+    ];
+    const affected = users.filter((u) => {
+        const userRoles = roles.get(u.id) || [];
+        const hasPrivilegedRole = userRoles.some((r) => privilegedRoleIds.includes(r));
+        const hasMfa = u.strongAuthenticationMethods?.length > 0 || u.isMfaRegistered === true;
+        return hasPrivilegedRole && !hasMfa;
+    });
+    return {
+        type: 'AZURE_PRIVILEGED_USER_NO_MFA',
+        severity: 'critical',
+        category: 'identity',
+        title: 'Privileged User without MFA',
+        description: 'Privileged role assigned to user without MFA. High risk if account is compromised.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectRiskyUserHigh(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const riskLevel = u.riskLevel;
+        return riskLevel === 'high';
+    });
+    return {
+        type: 'AZURE_RISKY_USER_HIGH',
+        severity: 'critical',
+        category: 'identity',
+        title: 'High-Risk User (Identity Protection)',
+        description: 'User flagged as high risk by Azure Identity Protection. Account may be compromised.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectUserInactive(users, includeDetails) {
+    const now = Date.now();
+    const ninetyDaysAgo = now - 90 * 24 * 60 * 60 * 1000;
+    const affected = users.filter((u) => {
+        if (!u.lastSignInDateTime)
+            return false;
+        const lastSignIn = new Date(u.lastSignInDateTime).getTime();
+        return lastSignIn < ninetyDaysAgo;
+    });
+    return {
+        type: 'AZURE_USER_INACTIVE',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Inactive User (90+ days)',
+        description: 'User account inactive for 90+ days. Should be disabled or deleted.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectPasswordNeverExpires(users, includeDetails) {
+    const affected = users.filter((u) => {
+        return u.passwordPolicies?.includes('DisablePasswordExpiration');
+    });
+    return {
+        type: 'AZURE_USER_PASSWORD_NEVER_EXPIRES',
+        severity: 'high',
+        category: 'accounts',
+        title: 'Password Never Expires',
+        description: 'User password expiration disabled. Increases risk of credential compromise.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectRiskyUserMedium(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const riskLevel = u.riskLevel;
+        return riskLevel === 'medium';
+    });
+    return {
+        type: 'AZURE_RISKY_USER_MEDIUM',
+        severity: 'high',
+        category: 'identity',
+        title: 'Medium-Risk User (Identity Protection)',
+        description: 'User flagged as medium risk by Azure Identity Protection. Unusual sign-in activity detected.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectPasswordOld(users, includeDetails) {
+    const now = Date.now();
+    const sixMonthsAgo = now - 180 * 24 * 60 * 60 * 1000;
+    const affected = users.filter((u) => {
+        const lastPasswordChange = u.lastPasswordChangeDateTime;
+        if (!lastPasswordChange)
+            return false;
+        return new Date(lastPasswordChange).getTime() < sixMonthsAgo;
+    });
+    return {
+        type: 'AZURE_PASSWORD_OLD',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Old Password (180+ days)',
+        description: 'User password not changed for 180+ days. Increases credential compromise risk.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectUserNeverSignedIn(users, includeDetails) {
+    const affected = users.filter((u) => {
+        return u.accountEnabled && !u.lastSignInDateTime;
+    });
+    return {
+        type: 'AZURE_USER_NEVER_SIGNED_IN',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'User Never Signed In',
+        description: 'Enabled account that has never been used. Orphaned account should be removed.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectUserUnlicensed(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const licenses = u.assignedLicenses;
+        return u.accountEnabled && (!licenses || licenses.length === 0);
+    });
+    return {
+        type: 'AZURE_USER_UNLICENSED',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'Unlicensed Active User',
+        description: 'Active user without assigned license. May indicate configuration issue.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectUserExternalMember(users, includeDetails) {
+    const affected = users.filter((u) => {
+        const userType = u.userType;
+        const isExternal = u.userPrincipalName?.includes('#EXT#');
+        return userType === 'Member' && isExternal;
+    });
+    return {
+        type: 'AZURE_USER_EXTERNAL_MEMBER',
+        severity: 'medium',
+        category: 'accounts',
+        title: 'External User as Member',
+        description: 'External domain user configured as Member instead of Guest. Security misconfiguration.',
+        count: affected.length,
+        affectedEntities: includeDetails ? (0, entity_converter_1.toAffectedAzureUserEntities)(affected) : undefined,
+    };
+}
+function detectUserSecurityVulnerabilities(users, roles, includeDetails) {
+    return [
+        detectGlobalAdminNoMfa(users, roles, includeDetails),
+        detectPrivilegedUserNoMfa(users, roles, includeDetails),
+        detectRiskyUserHigh(users, includeDetails),
+        detectUserInactive(users, includeDetails),
+        detectPasswordNeverExpires(users, includeDetails),
+        detectRiskyUserMedium(users, includeDetails),
+        detectPasswordOld(users, includeDetails),
+        detectUserNeverSignedIn(users, includeDetails),
+        detectUserUnlicensed(users, includeDetails),
+        detectUserExternalMember(users, includeDetails),
+    ].filter((finding) => finding.count > 0);
+}
+//# sourceMappingURL=user-security.detector.js.map

package/dist/services/audit/detectors/azure/user-security.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-security.detector.js","sourceRoot":"","sources":["../../../../../src/services/audit/detectors/azure/user-security.detector.ts"],"names":[],"mappings":";;AA+BA,wDAwBC;AAKD,8DA8BC;AAKD,kDAeC;AAKD,gDAmBC;AAKD,gEAcC;AAKD,sDAeC;AAKD,8CAmBC;AAKD,0DAcC;AAKD,oDAeC;AAKD,4DAgBC;AAKD,8EAiBC;AA7PD,yEAAiF;AAKjF,SAAgB,sBAAsB,CACpC,KAAkB,EAClB,KAA4B,EAC5B,cAAuB;IAEvB,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;IAEjE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAI,CAAS,CAAC,2BAA2B,EAAE,MAAM,GAAG,CAAC,IAAK,CAAS,CAAC,eAAe,KAAK,IAAI,CAAC;QAEzG,OAAO,aAAa,IAAI,CAAC,MAAM,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,8GAA8G;QAC3H,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,yBAAyB,CACvC,KAAkB,EAClB,KAA4B,EAC5B,cAAuB;IAEvB,MAAM,iBAAiB,GAAG;QACxB,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;QACtC,sCAAsC;KACvC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAI,CAAS,CAAC,2BAA2B,EAAE,MAAM,GAAG,CAAC,IAAK,CAAS,CAAC,eAAe,KAAK,IAAI,CAAC;QAEzG,OAAO,iBAAiB,IAAI,CAAC,MAAM,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,oFAAoF;QACjG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,mBAAmB,CAAC,KAAkB,EAAE,cAAuB;IAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAI,CAAS,CAAC,SAAS,CAAC;QACvC,OAAO,SAAS,KAAK,MAAM,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,qFAAqF;QAClG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,kBAAkB,CAAC,KAAkB,EAAE,cAAuB;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,CAAC,CAAC,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,OAAO,UAAU,GAAG,aAAa,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,oEAAoE;QACjF,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,0BAA0B,CAAC,KAAkB,EAAE,cAAuB;IACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,OAAQ,CAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,6EAA6E;QAC1F,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,qBAAqB,CAAC,KAAkB,EAAE,cAAuB;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAI,CAAS,CAAC,SAAS,CAAC;QACvC,OAAO,SAAS,KAAK,QAAQ,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,8FAA8F;QAC3G,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,iBAAiB,CAAC,KAAkB,EAAE,cAAuB;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,kBAAkB,GAAI,CAAS,CAAC,0BAA0B,CAAC;QACjE,IAAI,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,gFAAgF;QAC7F,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,uBAAuB,CAAC,KAAkB,EAAE,cAAuB;IACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,OAAO,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,+EAA+E;QAC5F,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,oBAAoB,CAAC,KAAkB,EAAE,cAAuB;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAI,CAAS,CAAC,gBAAgB,CAAC;QAC7C,OAAO,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,yEAAyE;QACtF,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,wBAAwB,CAAC,KAAkB,EAAE,cAAuB;IAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAI,CAAS,CAAC,QAAQ,CAAC;QACrC,MAAM,UAAU,GAAG,CAAC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,4BAA4B;QAClC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,wFAAwF;QACrG,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,8CAA2B,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC;AACJ,CAAC;AAKD,SAAgB,iCAAiC,CAC/C,KAAkB,EAClB,KAA4B,EAC5B,cAAuB;IAEvB,OAAO;QACL,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC;QACpD,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC;QACvD,mBAAmB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC1C,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC;QACzC,0BAA0B,CAAC,KAAK,EAAE,cAAc,CAAC;QACjD,qBAAqB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC5C,iBAAiB,CAAC,KAAK,EAAE,cAAc,CAAC;QACxC,uBAAuB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC9C,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC3C,wBAAwB,CAAC,KAAK,EAAE,cAAc,CAAC;KAChD,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/services/audit/detectors/index.d.ts

@@ -0,0 +1,2 @@
+export * as ADDetectors from './ad';
+//# sourceMappingURL=index.d.ts.map

package/dist/services/audit/detectors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/audit/detectors/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,WAAW,MAAM,MAAM,CAAC"}

package/dist/services/audit/detectors/index.js

@@ -0,0 +1,38 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADDetectors = void 0;
+exports.ADDetectors = __importStar(require("./ad"));
+//# sourceMappingURL=index.js.map

package/dist/services/audit/detectors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/services/audit/detectors/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,oDAAoC"}

package/dist/services/audit/response-formatter.d.ts

@@ -0,0 +1,176 @@
+import { AffectedUserEntity, AffectedAzureUserEntity, AffectedAppEntity, AffectedGroupEntity, AffectedComputerEntity, Finding, Severity } from '../../types/finding.types';
+import { SecurityScore } from './scoring.service';
+import { AttackGraphExport } from '../../types/attack-graph.types';
+export interface DomainMetadata {
+    name: string;
+    baseDN: string;
+    ldapUrl: string;
+}
+export interface AuditOptionsMetadata {
+    includeDetails: boolean;
+    includeComputers: boolean;
+    includeConfig: boolean;
+}
+export interface ExecutionMetadata {
+    timestamp: string;
+    duration: string;
+}
+export interface AuditMetadata {
+    provider: string;
+    domain: DomainMetadata;
+    options: AuditOptionsMetadata;
+    execution: ExecutionMetadata;
+}
+export interface ObjectsSummary {
+    users: number;
+    users_enabled: number;
+    users_disabled: number;
+    groups: number;
+    ous: number;
+    computers: number;
+}
+export interface RiskSummary {
+    score: number;
+    rating: string;
+    findings: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        total: number;
+        totalInstances?: number;
+    };
+}
+export interface AuditSummary {
+    objects: ObjectsSummary;
+    risk: RiskSummary;
+}
+export interface SectionFinding {
+    type: string;
+    severity: Severity;
+    title: string;
+    description: string;
+    count: number;
+    totalInstances?: number;
+    affectedEntities?: (string | AffectedUserEntity | AffectedAzureUserEntity | AffectedAppEntity | AffectedGroupEntity | AffectedComputerEntity)[];
+    details?: Record<string, unknown>;
+}
+export interface FindingsSection {
+    total: number;
+    findings: SectionFinding[];
+}
+export interface SecuritySection {
+    passwords: FindingsSection;
+    kerberos: FindingsSection;
+    advanced: FindingsSection;
+}
+export interface AccountsSection {
+    status: FindingsSection;
+    privileged: FindingsSection;
+    service: FindingsSection;
+    dangerous: FindingsSection;
+}
+export interface PasswordPolicy {
+    minPasswordLength: number;
+    passwordHistoryLength: number;
+    maxPasswordAge: string;
+    minPasswordAge: string;
+    lockoutThreshold: number;
+    lockoutDuration: string;
+    lockoutObservationWindow: string;
+    complexity: boolean;
+}
+export interface DomainInfo {
+    forestName: string;
+    domainName: string;
+    domainMode: string;
+    forestMode: string;
+    domainControllers: string[];
+    fsmoRoles: {
+        schemaMaster?: string;
+        domainNamingMaster?: string;
+        pdcEmulator?: string;
+        ridMaster?: string;
+        infrastructureMaster?: string;
+    };
+}
+export interface TrustRelationship {
+    name: string;
+    direction: 'inbound' | 'outbound' | 'bidirectional';
+    type: 'forest' | 'external' | 'realm' | 'shortcut';
+    transitive: boolean;
+}
+export interface GPOSummary {
+    totalGPOs: number;
+    linkedGPOs: number;
+}
+export interface KerberosPolicy {
+    maxTicketAge: string;
+    maxRenewAge: string;
+    maxServiceAge: string;
+    maxClockSkew: string;
+    ticketValidateClient: boolean;
+    isDefault: boolean;
+}
+export interface DomainConfig {
+    passwordPolicy: PasswordPolicy;
+    kerberosPolicy?: KerberosPolicy;
+    domainInfo: DomainInfo;
+    trusts: TrustRelationship[];
+    gpoSummary: GPOSummary;
+}
+export interface ADCSSection {
+    total: number;
+    findings: SectionFinding[];
+}
+export interface GPOSecuritySection {
+    total: number;
+    findings: SectionFinding[];
+}
+export interface TrustsAnalysisSection {
+    total: number;
+    findings: SectionFinding[];
+}
+export interface ADAuditResponse {
+    success: boolean;
+    provider: 'active-directory';
+    audit: {
+        metadata: AuditMetadata;
+        summary: AuditSummary;
+        security: SecuritySection;
+        accounts: AccountsSection;
+        groups: FindingsSection;
+        computers: FindingsSection;
+        permissions: FindingsSection;
+        temporal: FindingsSection;
+        extendedConfig: FindingsSection;
+        adcs: ADCSSection;
+        gpoSecurity: GPOSecuritySection;
+        trustsAnalysis: TrustsAnalysisSection;
+        domainConfig?: DomainConfig;
+        attackGraph?: AttackGraphExport;
+    };
+}
+export interface FormatterContext {
+    domain: DomainMetadata;
+    options: {
+        includeDetails: boolean;
+        includeComputers?: boolean;
+        includeConfig?: boolean;
+    };
+    executionTimeMs: number;
+    timestamp: Date;
+    domainConfig?: DomainConfig;
+    attackGraph?: AttackGraphExport;
+}
+export declare function formatADAuditResponse(score: SecurityScore, findings: Finding[], stats: {
+    totalUsers: number;
+    enabledUsers: number;
+    disabledUsers: number;
+    totalGroups: number;
+    totalComputers: number;
+    totalOUs: number;
+    totalFindings: number;
+    executionTimeMs: number;
+}, context: FormatterContext): ADAuditResponse;
+//# sourceMappingURL=response-formatter.d.ts.map

package/dist/services/audit/response-formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-formatter.d.ts","sourceRoot":"","sources":["../../../src/services/audit/response-formatter.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,OAAO,EACP,QAAQ,EACT,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAKnE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;CACxB;AAKD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,iBAAiB,CAAC;CAC9B;AAKD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QAEd,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAKD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,WAAW,CAAC;CACnB;AAKD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IAEpB,KAAK,EAAE,MAAM,CAAC;IAEd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,CACf,MAAM,GACN,kBAAkB,GAClB,uBAAuB,GACvB,iBAAiB,GACjB,mBAAmB,GACnB,sBAAsB,CACzB,EAAE,CAAC;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAKD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAKD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAKD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;CAC5B;AAKD,MAAM,WAAW,cAAc;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,MAAM,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;CACrB;AAKD,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE;QACT,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACH;AAKD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,GAAG,UAAU,GAAG,eAAe,CAAC;IACpD,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;IACnD,UAAU,EAAE,OAAO,CAAC;CACrB;AAKD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,OAAO,CAAC;IAE9B,SAAS,EAAE,OAAO,CAAC;CACpB;AAKD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,EAAE,UAAU,CAAC;CACxB;AAKD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAKD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAKD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAKD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE;QACL,QAAQ,EAAE,aAAa,CAAC;QACxB,OAAO,EAAE,YAAY,CAAC;QACtB,QAAQ,EAAE,eAAe,CAAC;QAC1B,QAAQ,EAAE,eAAe,CAAC;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC;QAC3B,WAAW,EAAE,eAAe,CAAC;QAC7B,QAAQ,EAAE,eAAe,CAAC;QAC1B,cAAc,EAAE,eAAe,CAAC;QAChC,IAAI,EAAE,WAAW,CAAC;QAClB,WAAW,EAAE,kBAAkB,CAAC;QAChC,cAAc,EAAE,qBAAqB,CAAC;QACtC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5B,WAAW,CAAC,EAAE,iBAAiB,CAAC;KACjC,CAAC;CACH;AAKD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE;QACP,cAAc,EAAE,OAAO,CAAC;QACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IACF,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAgHD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB,EACD,OAAO,EAAE,gBAAgB,GACxB,eAAe,CAsMjB"}