@grc-claw/integration-marketplace 0.8.0

package/dist/connectors/LaceworkConnector.js

@@ -0,0 +1,143 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "lacework-alerts",
+        name: "Alerts & Anomalies",
+        description: "Fetch Lacework anomaly detection alerts and threat findings",
+        evidenceCategories: ["threat_detection", "anomaly_detection"],
+    },
+    {
+        id: "lacework-compliance",
+        name: "Compliance Assessment",
+        description: "Fetch Lacework compliance posture across cloud accounts",
+        evidenceCategories: ["compliance", "configuration"],
+    },
+    {
+        id: "lacework-activity",
+        name: "Activity Analysis",
+        description: "Fetch host and cloud activity analysis results",
+        evidenceCategories: ["audit", "monitoring"],
+    },
+    {
+        id: "lacework-vulnerabilities",
+        name: "Vulnerability Assessment",
+        description: "Fetch Lacework vulnerability findings for containers and hosts",
+        evidenceCategories: ["vulnerability_management", "container_security"],
+    },
+];
+export class LaceworkConnector {
+    id = "lacework";
+    name = "Lacework";
+    category = "monitoring";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "PCI_DSS",
+        "HIPAA",
+    ];
+    async generateSignature(config, timestamp, method, path, body) {
+        const stringToSign = `${method}\n${path}\n\n\n${timestamp}`;
+        const key = Buffer.from(config.clientSecret || "", "base64");
+        const hmac = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const sig = await crypto.subtle.sign("HMAC", hmac, Buffer.from(stringToSign));
+        return Buffer.from(sig).toString("base64");
+    }
+    async fetchApi(config, path, body) {
+        const base = config.baseUrl || "https://api.lacework.net";
+        const timestamp = new Date().toISOString();
+        const bodyStr = body ? JSON.stringify(body) : "";
+        const signature = await this.generateSignature(config, timestamp, body ? "POST" : "GET", path, bodyStr);
+        const resp = await fetch(`${base}${path}`, {
+            method: body ? "POST" : "GET",
+            headers: {
+                Authorization: `ACCESS:${config.clientId}:${signature}`,
+                "X-LW-Date": timestamp,
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: body ? bodyStr : undefined,
+        });
+        if (!resp.ok)
+            throw new Error(`Lacework API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/api/v1/alerts/2.0/alerts/OWASP_TOP_10");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const account = config.extra?.accountAlias || "default";
+        const alerts = await this.fetchApi(config, "/api/v1/alerts/2.0/alerts/RECOMMENDATIONS").catch(() => ({ data: [] }));
+        const alertData = Array.isArray(alerts.data) ? alerts.data : [];
+        const criticalAlerts = alertData.filter((a) => a.severity === "Critical");
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "lacework-alerts",
+            timestamp: now,
+            hash: hashEvidence({ count: alertData.length }),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: `lacework/${account}/alerts`,
+            status: criticalAlerts.length === 0 ? "compliant" : "non_compliant",
+            data: { totalAlerts: alertData.length, criticalAlerts: criticalAlerts.length },
+            metadata: { account },
+        });
+        const compliance = await this.fetchApi(config, "/api/v1/compliance/posture/aws").catch(() => ({ data: [] }));
+        const compData = Array.isArray(compliance.data) ? compliance.data : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "lacework-compliance",
+            timestamp: now,
+            hash: hashEvidence({ count: compData.length }),
+            framework: "ISO27001",
+            controlId: "A.12.1.1",
+            source: `lacework/${account}/compliance`,
+            status: compData.length > 0 ? "compliant" : "partial",
+            data: { complianceStandards: compData.length },
+            metadata: { account },
+        });
+        const activity = await this.fetchApi(config, "/api/v1/Activity/evaluate?timeRange=7&timeRangeUnit=day").catch(() => ({ data: [] }));
+        const activityData = Array.isArray(activity.data) ? activity.data : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "lacework-activity",
+            timestamp: now,
+            hash: hashEvidence({ count: activityData.length }),
+            framework: "NIST_CSF",
+            controlId: "DE.CM",
+            source: `lacework/${account}/activity`,
+            status: "compliant",
+            data: { activityEvents: activityData.length },
+            metadata: { account },
+        });
+        const vulnerabilities = await this.fetchApi(config, "/api/v1/Vulnerabilities/Container?severity=CRITICAL,HIGH&limit=100").catch(() => ({ data: [] }));
+        const vulnData = Array.isArray(vulnerabilities.data) ? vulnerabilities.data : [];
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "lacework-vulnerabilities",
+            timestamp: now,
+            hash: hashEvidence({ count: vulnData.length }),
+            framework: "PCI_DSS",
+            controlId: "6.5.1",
+            source: `lacework/${account}/vulnerabilities`,
+            status: vulnData.length === 0 ? "compliant" : "non_compliant",
+            data: { containerVulns: vulnData.length },
+            metadata: { account },
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/LaunchDarklyConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class LaunchDarklyConnector implements IntegrationConnector {
+    readonly id = "launchdarkly";
+    readonly name = "LaunchDarkly";
+    readonly category: "ci_cd";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/LaunchDarklyConnector.js

@@ -0,0 +1,86 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "launchdarkly-flags",
+        name: "Feature Flags",
+        description: "Fetch LaunchDarkly feature flag configurations and targeting rules",
+        evidenceCategories: ["configuration", "change_management"],
+    },
+    {
+        id: "launchdarkly-audit",
+        name: "Audit Log",
+        description: "Fetch LaunchDarkly audit log events for flag changes and approvals",
+        evidenceCategories: ["audit", "change_management"],
+    },
+    {
+        id: "launchdarkly-access",
+        name: "Access Controls",
+        description: "Fetch LaunchDarkly role assignments and API key management",
+        evidenceCategories: ["access_control", "secret_management"],
+    },
+];
+export class LaunchDarklyConnector {
+    id = "launchdarkly";
+    name = "LaunchDarkly";
+    category = "ci_cd";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://app.launchdarkly.com/api/v2";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`LaunchDarkly API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/projects");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const project = config.extra?.project || "default";
+        const flags = await this.fetchApi(config, `/projects/${project}/flags?limit=100`).catch(() => ({ items: [] }));
+        const flagList = (flags.items || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "launchdarkly-flags",
+            timestamp: now,
+            hash: hashEvidence({ flagCount: flagList.length }),
+            framework: "SOC2",
+            controlId: "CC8.1",
+            source: "launchdarkly/flags",
+            status: "unknown",
+            data: { flagCount: flagList.length },
+            metadata: { project },
+        });
+        const auditLog = await this.fetchApi(config, `/auditlog?limit=100`).catch(() => ({ items: [] }));
+        const auditList = (auditLog.items || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "launchdarkly-audit",
+            timestamp: now,
+            hash: hashEvidence({ auditCount: auditList.length }),
+            framework: "SOC2",
+            controlId: "CC7.2",
+            source: "launchdarkly/auditlog",
+            status: "unknown",
+            data: { recentAuditEvents: auditList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/LinodeConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class LinodeConnector implements IntegrationConnector {
+    readonly id = "linode";
+    readonly name = "Linode (Akamai)";
+    readonly category: "cloud_provider";
+    readonly authType: "bearer_token";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/LinodeConnector.js

@@ -0,0 +1,70 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "linode-linodes",
+        name: "Linode Instances",
+        description: "Fetch Linode instance configurations and status",
+        evidenceCategories: ["cloud_configuration", "infrastructure"],
+    },
+    {
+        id: "linode-firewalls",
+        name: "Cloud Firewalls",
+        description: "Fetch cloud firewall rules and network policies",
+        evidenceCategories: ["network_security", "access_control"],
+    },
+    {
+        id: "linode-volumes",
+        name: "Block Storage",
+        description: "Fetch block storage volume configurations and encryption status",
+        evidenceCategories: ["data_protection", "cloud_configuration"],
+    },
+];
+export class LinodeConnector {
+    id = "linode";
+    name = "Linode (Akamai)";
+    category = "cloud_provider";
+    authType = "bearer_token";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.linode.com/v4";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Linode API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/linode/instances?pageSize=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const linodes = await this.fetchApi(config, "/linode/instances?pageSize=100").catch(() => ({ data: [] }));
+        const linodeList = (linodes.data || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "linode-linodes",
+            timestamp: now,
+            hash: hashEvidence({ instanceCount: linodeList.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "linode/instances",
+            status: "unknown",
+            data: { instanceCount: linodeList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/LookerConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class LookerConnector implements IntegrationConnector {
+    readonly id = "looker";
+    readonly name = "Looker";
+    readonly category: "data_warehouse";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/LookerConnector.js

@@ -0,0 +1,94 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "looker-projects",
+        name: "Project Security",
+        description: "Fetch LookML project permissions and Git connection settings",
+        evidenceCategories: ["access_control", "change_management"],
+    },
+    {
+        id: "looker-roles",
+        name: "Role-Based Access",
+        description: "Fetch roles, model sets, and permission sets",
+        evidenceCategories: ["access_control", "configuration"],
+    },
+    {
+        id: "looker-content",
+        name: "Content Access",
+        description: "Fetch dashboard and look permissions and scheduling",
+        evidenceCategories: ["access_control", "data_protection"],
+    },
+    {
+        id: "looker-queries",
+        name: "Query History",
+        description: "Fetch user query history and data access patterns",
+        evidenceCategories: ["monitoring", "access_control"],
+    },
+];
+export class LookerConnector {
+    id = "looker";
+    name = "Looker";
+    category = "data_warehouse";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = [
+        "SOC2",
+        "ISO27001",
+        "NIST_CSF",
+        "HIPAA",
+    ];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://looker.example.com/api/4.0";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Looker API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/user");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const roles = await this.fetchApi(config, "/roles").catch(() => []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "looker-roles",
+            timestamp: now,
+            hash: hashEvidence(Array.isArray(roles) ? { count: roles.length } : roles),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "looker/roles",
+            status: Array.isArray(roles) && roles.length > 0 ? "compliant" : "unknown",
+            data: { roleCount: Array.isArray(roles) ? roles.length : 0 },
+            metadata: {},
+        });
+        const projects = await this.fetchApi(config, "/projects").catch(() => []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "looker-projects",
+            timestamp: now,
+            hash: hashEvidence(Array.isArray(projects) ? { count: projects.length } : projects),
+            framework: "ISO27001",
+            controlId: "A.6.2.1",
+            source: "looker/projects",
+            status: Array.isArray(projects) && projects.length > 0 ? "compliant" : "non_compliant",
+            data: { projectCount: Array.isArray(projects) ? projects.length : 0 },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/MailchimpConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class MailchimpConnector implements IntegrationConnector {
+    readonly id = "mailchimp";
+    readonly name = "Mailchimp";
+    readonly category: "communication";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/MailchimpConnector.js

@@ -0,0 +1,71 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "mailchimp-lists",
+        name: "Audience Lists",
+        description: "Fetch Mailchimp audience lists, subscriber counts, and segmentation",
+        evidenceCategories: ["data_protection", "configuration"],
+    },
+    {
+        id: "mailchimp-security",
+        name: "Security Settings",
+        description: "Fetch Mailchimp API key permissions, 2FA status, and login history",
+        evidenceCategories: ["access_control", "audit"],
+    },
+    {
+        id: "mailchimp-campaigns",
+        name: "Campaign Statistics",
+        description: "Fetch email campaign performance and delivery metrics",
+        evidenceCategories: ["monitoring", "configuration"],
+    },
+];
+export class MailchimpConnector {
+    id = "mailchimp";
+    name = "Mailchimp";
+    category = "communication";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001"];
+    async fetchApi(config, endpoint) {
+        const dc = config.extra?.dc || "us1";
+        const base = config.baseUrl || `https://${dc}.api.mailchimp.com/3.0`;
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Mailchimp API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/ping");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const lists = await this.fetchApi(config, "/lists?count=100").catch(() => ({ lists: [] }));
+        const listList = (lists.lists || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "mailchimp-lists",
+            timestamp: now,
+            hash: hashEvidence({ listCount: listList.length }),
+            framework: "SOC2",
+            controlId: "CC6.1",
+            source: "mailchimp/lists",
+            status: "unknown",
+            data: { audienceCount: listList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/MalwarebytesConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class MalwarebytesConnector implements IntegrationConnector {
+    readonly id = "malwarebytes";
+    readonly name = "Malwarebytes";
+    readonly category: "endpoint";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}

package/dist/connectors/MalwarebytesConnector.js

@@ -0,0 +1,85 @@
+import { hashEvidence, generateEvidenceId } from "../types.js";
+const capabilities = [
+    {
+        id: "malwarebytes-endpoints",
+        name: "Endpoint Protection",
+        description: "Fetch Malwarebytes agent deployment status and protection health",
+        evidenceCategories: ["endpoint_security", "monitoring"],
+    },
+    {
+        id: "malwarebytes-detections",
+        name: "Threat Detections",
+        description: "Fetch threat detection and remediation events",
+        evidenceCategories: ["vulnerability_management", "monitoring"],
+    },
+    {
+        id: "malwarebytes-policies",
+        name: "Protection Policies",
+        description: "Fetch policy configurations and scan schedules",
+        evidenceCategories: ["policy_compliance", "configuration"],
+    },
+];
+export class MalwarebytesConnector {
+    id = "malwarebytes";
+    name = "Malwarebytes";
+    category = "endpoint";
+    authType = "api_key";
+    capabilities = capabilities;
+    frameworks = ["SOC2", "ISO27001", "NIST_CSF"];
+    async fetchApi(config, endpoint) {
+        const base = config.baseUrl || "https://api.malwarebytes.com/v2";
+        const resp = await fetch(`${base}${endpoint}`, {
+            headers: {
+                Authorization: `Bearer ${config.apiToken}`,
+                "Content-Type": "application/json",
+            },
+        });
+        if (!resp.ok)
+            throw new Error(`Malwarebytes API ${resp.status}: ${resp.statusText}`);
+        return (await resp.json());
+    }
+    async testConnection(config) {
+        try {
+            await this.fetchApi(config, "/machines?limit=1");
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async collectEvidence(config) {
+        const artifacts = [];
+        const now = new Date().toISOString();
+        const machines = await this.fetchApi(config, "/machines?limit=100").catch(() => ({ items: [] }));
+        const machineList = (machines.items || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "malwarebytes-endpoints",
+            timestamp: now,
+            hash: hashEvidence({ machineCount: machineList.length }),
+            framework: "SOC2",
+            controlId: "CC6.8",
+            source: "malwarebytes/machines",
+            status: machineList.length > 0 ? "compliant" : "unknown",
+            data: { endpointCount: machineList.length },
+            metadata: {},
+        });
+        const threats = await this.fetchApi(config, "/threats?limit=10").catch(() => ({ items: [] }));
+        const threatList = (threats.items || []);
+        artifacts.push({
+            id: generateEvidenceId(),
+            connectorId: this.id,
+            capabilityId: "malwarebytes-detections",
+            timestamp: now,
+            hash: hashEvidence({ threatCount: threatList.length }),
+            framework: "ISO27001",
+            controlId: "A.12.2.1",
+            source: "malwarebytes/threats",
+            status: threatList.length === 0 ? "compliant" : "non_compliant",
+            data: { recentThreats: threatList.length },
+            metadata: {},
+        });
+        return artifacts;
+    }
+}

package/dist/connectors/McAfeeConnector.d.ts

@@ -0,0 +1,12 @@
+import type { IntegrationConnector, ConnectorConfig, EvidenceArtifact, IntegrationCapability, ComplianceFramework } from "../types.js";
+export declare class McAfeeConnector implements IntegrationConnector {
+    readonly id = "mcafee";
+    readonly name = "McAfee (Trellix)";
+    readonly category: "endpoint";
+    readonly authType: "api_key";
+    readonly capabilities: IntegrationCapability[];
+    readonly frameworks: ComplianceFramework[];
+    private fetchApi;
+    testConnection(config: ConnectorConfig): Promise<boolean>;
+    collectEvidence(config: ConnectorConfig): Promise<EvidenceArtifact[]>;
+}