@lateos/npm-scan 0.7.4 → 0.7.5

package/README.md

@@ -21,7 +21,7 @@ npx @lateos/npm-scan scan lodash
 - **SBOM Output** — CycloneDX 1.5 and SPDX 2.3 with findings mapped as vulnerabilities
 - **NIST 800-161 Compliance** — HTML report includes control traceability matrix (SR-2.1 → SR-11.4)
 - **EU CRA Compliance** — report maps findings to Cyber Resilience Act articles and Annex I requirements
-- **SIEM Export** — CEF format for Splunk and other SIEM ingestion (premium)
+- **SIEM Export** — Splunk CEF, Elastic ECS, Microsoft Sentinel, IBM QRadar formats (premium)
 - **EU CRA Compliance** — report maps findings to Cyber Resilience Act articles (premium)
 - **License Key Gating** — premium features locked behind signed license keys
 - **REST API** — FastAPI-based API with webhooks, auth, scan management (premium)
@@ -47,7 +47,7 @@ npm-scan report -i <id> --sbom spdx  Generate SPDX SBOM
 npm-scan report -i <id> --html       Generate HTML report (with NIST table)
 npm-scan report -i <id> --nist       Print NIST 800-161 compliance table
 npm-scan report -i <id> --cra        Print EU CRA compliance table
-npm-scan report -i <id> --siem cef   Generate SIEM CEF output (premium)
+npm-scan report -i <id> --siem <fmt>   Generate SIEM output (cef|ecs|sentinel|qradar) (premium)
 npm-scan report --html               Generate HTML report for all scans
 npm-scan report --nist               Print NIST compliance for all scans
 npm-scan report --cra                Print EU CRA compliance for all scans (premium)

package/backend/siem/ecs.js

@@ -0,0 +1,41 @@
+export function generateECS(scans) {
+  const events = [];
+  for (const s of scans) {
+    for (const f of (s.findings || [])) {
+      const atkId = f.atk_id || f.id;
+      const sevMap = { critical: 100, high: 80, medium: 50, low: 20 };
+      events.push({
+        '@timestamp': new Date().toISOString(),
+        event: {
+          kind: 'alert',
+          category: 'threat',
+          type: ['indicator', 'threat'],
+          action: 'npm-scan-detected',
+          severity: sevMap[f.severity] || 50,
+        },
+        message: `[${atkId}] ${f.severity.toUpperCase()}: ${f.description || f.title || 'Unknown finding'}`,
+        log: { level: f.severity },
+        observer: {
+          vendor: 'Lateos',
+          product: 'npm-scan',
+          version: process.env.npm_package_version || '0.7.0',
+        },
+        labels: {
+          package: s.package_name || 'unknown',
+          version: s.version || 'unknown',
+          atk_id: atkId,
+          severity: f.severity,
+        },
+        vulnerability: {
+          classification: 'npm-supply-chain',
+          reference: `https://npm-scan.io/atk/${atkId}`,
+          id: atkId,
+          description: f.description || f.title || null,
+          enumeration: 'ATK',
+        },
+        file: f.evidence ? { name: f.evidence } : undefined,
+      });
+    }
+  }
+  return events.map(e => JSON.stringify(e)).join('\n');
+}

package/backend/siem/index.js

@@ -1,10 +1,19 @@
 import { generateCEF } from './cef.js';
+import { generateECS } from './ecs.js';
+import { generateSentinel } from './sentinel.js';
+import { generateQRadar } from './qradar.js';
 
 export function generateSIEM(scans, format = 'cef') {
   switch (format) {
     case 'cef':
       return generateCEF(scans);
+    case 'ecs':
+      return generateECS(scans);
+    case 'sentinel':
+      return generateSentinel(scans);
+    case 'qradar':
+      return generateQRadar(scans);
     default:
-      throw new Error(`Unknown SIEM format: ${format}`);
+      throw new Error(`Unknown SIEM format: ${format}. Supported: cef, ecs, sentinel, qradar`);
   }
 }

package/backend/siem/qradar.js

@@ -0,0 +1,57 @@
+export function generateQRadar(scans) {
+  const events = [];
+  for (const s of scans) {
+    for (const f of (s.findings || [])) {
+      const atkId = f.atk_id || f.id;
+      events.push({
+        source: 'npm-scan',
+        version: process.env.npm_package_version || '0.7.0',
+        devicetime: new Date().toISOString(),
+        devicepayload: [
+          s.package_name || 'unknown',
+          s.version || 'unknown',
+          atkId,
+          f.severity,
+          f.title || f.description || '',
+          f.evidence || '',
+        ].join('\t'),
+        devicevendor: 'Lateos',
+        devicename: 'npm-scan',
+        deviceproduct: 'npm-scan',
+        atk_id: atkId,
+        severity: f.severity,
+        package_name: s.package_name || 'unknown',
+        package_version: s.version || 'unknown',
+        finding_title: f.title || f.description || '',
+        finding_description: f.description || f.title || '',
+        evidence: f.evidence || '',
+        mitigation: f.mitigation || '',
+        raw_category: 'NPM Supply Chain Threat',
+        qid: _qrQid(f.severity),
+        category: _qrCategory(f.severity),
+      });
+    }
+  }
+  return events.map(e => JSON.stringify(e)).join('\n');
+}
+
+const QID_MAP = {
+  critical: 90050001,
+  high: 90050002,
+  medium: 90050003,
+  low: 90050004,
+};
+
+function _qrQid(severity) {
+  return QID_MAP[severity] || 90050003;
+}
+
+function _qrCategory(severity) {
+  const map = {
+    critical: 'Critical Severity Malware',
+    high: 'High Severity Malware',
+    medium: 'Medium Severity Malware',
+    low: 'Low Severity Malware',
+  };
+  return map[severity] || 'Medium Severity Malware';
+}

package/backend/siem/sentinel.js

@@ -0,0 +1,28 @@
+export function generateSentinel(scans) {
+  const events = [];
+  for (const s of scans) {
+    for (const f of (s.findings || [])) {
+      const atkId = f.atk_id || f.id;
+      events.push({
+        TimeGenerated: new Date().toISOString(),
+        Computer: process.env.COMPUTERNAME || process.env.HOSTNAME || 'npm-scan-host',
+        SourceSystem: 'npm-scan',
+        DeviceVendor: 'Lateos',
+        DeviceProduct: 'npm-scan',
+        DeviceVersion: process.env.npm_package_version || '0.7.0',
+        SeverityLevel: f.severity,
+        Severity: f.severity.toUpperCase(),
+        EventType: 'npm-supply-chain-threat',
+        ATKId: atkId,
+        FindingTitle: f.title || f.description || '',
+        FindingDescription: f.description || f.title || '',
+        Evidence: f.evidence || '',
+        PackageName: s.package_name || 'unknown',
+        PackageVersion: s.version || 'unknown',
+        Mitigation: f.mitigation || '',
+        ThreatClassification: 'npm-supply-chain',
+      });
+    }
+  }
+  return JSON.stringify(events, null, 2);
+}

package/cli/cli.js

@@ -60,7 +60,7 @@ program
   .option('--html', 'HTML report')
   .option('--nist', 'NIST 800-161 compliance report')
   .option('--cra', 'EU CRA compliance report')
-  .option('--siem <format>', 'SIEM format (cef)')
+  .option('--siem <format>', 'SIEM format (cef|ecs|sentinel|qradar)')
   .option('-l, --license-key <key>', 'Premium license')
   .action(async (options) => {
     const licenseKey = options.licenseKey || process.env.NPM_SCAN_LICENSE_KEY;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lateos/npm-scan",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Powerful npm supply chain security scanner - detects malicious packages (Shai-Hulud style), behavioral analysis, SBOM, and compliance reporting.",
   "main": "backend/index.js",
   "bin": {