@nullbridge/sdk 1.0.0

package/src/siem.js

@@ -0,0 +1,92 @@
+'use strict';
+
+/**
+ * SiemStreamer — stream audit events to external SIEM systems
+ * Supports JSON, CEF (ArcSight), and LEEF (IBM QRadar) formats
+ */
+class SiemStreamer {
+  constructor(config, http) {
+    this._config  = config;
+    this._http    = http;
+    this._queue   = [];
+    this._timer   = null;
+    this._siemCfg = config.siem || {};
+  }
+
+  async start() {
+    if (!this._siemCfg.endpoint) {
+      console.warn('[NullBridge] SIEM endpoint not configured — streaming disabled');
+      return;
+    }
+
+    // Flush to SIEM every 60 seconds
+    this._timer = setInterval(() => this.flush(), 60 * 1000);
+    if (this._timer.unref) this._timer.unref();
+  }
+
+  /**
+   * Queue an event for SIEM streaming
+   */
+  push(event) {
+    const formatted = this._format(event);
+    this._queue.push(formatted);
+
+    // Auto-flush if queue gets large
+    if (this._queue.length >= 50) this.flush();
+  }
+
+  /**
+   * Flush all queued events to SIEM endpoint
+   */
+  async flush() {
+    if (!this._siemCfg.endpoint || this._queue.length === 0) return;
+
+    const batch = this._queue.splice(0);
+
+    try {
+      await this._http.post(
+        this._siemCfg.endpoint,
+        '',
+        { events: batch, source: 'nullbridge-sdk', version: '1.0.0' }
+      );
+    } catch (err) {
+      console.warn(`[NullBridge] SIEM flush failed: ${err.message}`);
+      // Put events back
+      this._queue.unshift(...batch);
+    }
+  }
+
+  stop() {
+    if (this._timer) clearInterval(this._timer);
+  }
+
+  _format(event) {
+    const format = this._siemCfg.format || 'json';
+
+    switch (format) {
+      case 'cef':
+        return this._toCEF(event);
+      case 'leef':
+        return this._toLEEF(event);
+      default:
+        return { ...event, _source: 'nullbridge', _version: '1.0.0' };
+    }
+  }
+
+  // Common Event Format (ArcSight)
+  _toCEF(event) {
+    const severity = event.outcome === 'blocked' ? 9 : event.outcome === 'failure' ? 6 : 3;
+    return `CEF:0|NullBridge|SDK|1.0.0|${event.action}|${event.action}|${severity}|` +
+      `agentId=${event.agentId} agentName=${event.agentName} ` +
+      `outcome=${event.outcome} ts=${event.timestamp}`;
+  }
+
+  // Log Event Extended Format (IBM QRadar)
+  _toLEEF(event) {
+    return `LEEF:1.0|NullBridge|SDK|1.0.0|${event.action}|` +
+      `agentId=${event.agentId}\tagentName=${event.agentName}\t` +
+      `outcome=${event.outcome}\tts=${event.timestamp}`;
+  }
+}
+
+module.exports = { SiemStreamer };