@oneuptime/common 12.0.14 → 12.0.16

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js

@@ -0,0 +1,404 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import DetectionRule from "../../../Models/DatabaseModels/DetectionRule";
+import Alert from "../../../Models/DatabaseModels/Alert";
+import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import OneUptimeDate from "../../../Types/Date";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import OcsfSeverity, { OcsfSeverityId, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import { SigmaLevel } from "../../../Types/SecurityEvent/SigmaRule";
+import SigmaRuleParser from "../../../Utils/SecurityEvent/Sigma/SigmaRuleParser";
+import MetricSeriesFingerprint from "../../../Utils/Metrics/MetricSeriesFingerprint";
+import AlertService from "../../Services/AlertService";
+import AlertSeverityService from "../../Services/AlertSeverityService";
+import DetectionRuleService from "../../Services/DetectionRuleService";
+import OTelIngestService from "../../Services/OpenTelemetryIngestService";
+import SecurityEventService from "../../Services/SecurityEventService";
+import { resolveTelemetryRetentionInDays } from "../../../Types/Telemetry/TelemetryRetentionConfig";
+import logger from "../Logger";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+import SigmaClickhouseCompiler, { buildSigmaFieldExpression, } from "./Sigma/SigmaClickhouseCompiler";
+import { buildSecurityEventDbRow } from "./SecurityEventRow";
+const DETECTION_FINDING_CLASS_UID = 2004;
+const DETECTIONS_SERVICE_NAME = "OneUptime Detections";
+/*
+ * Cap on how far back one evaluation may scan, whatever lastEvaluatedAt
+ * says — a rule re-enabled after a month must not trigger a month-long
+ * table scan.
+ */
+const MAX_LOOKBACK_IN_MINUTES = 24 * 60;
+// One alert per distinct group value per cycle, at most.
+const MAX_GROUPS_PER_EVALUATION = 100;
+const SIGMA_LEVEL_TO_OCSF = {
+    [SigmaLevel.Informational]: OcsfSeverity.Informational,
+    [SigmaLevel.Low]: OcsfSeverity.Low,
+    [SigmaLevel.Medium]: OcsfSeverity.Medium,
+    [SigmaLevel.High]: OcsfSeverity.High,
+    [SigmaLevel.Critical]: OcsfSeverity.Critical,
+};
+/*
+ * The detections-as-code engine: every minute, evaluate due Sigma rules
+ * against the SecurityEvent table; matches open deduped alerts and write
+ * Detection Finding rows back into the events table.
+ */
+export default class DetectionRuleEvaluator {
+    static async evaluateAllDueRules() {
+        var _a;
+        const rules = await DetectionRuleService.findBy({
+            query: {
+                isEnabled: true,
+            },
+            select: {
+                _id: true,
+                projectId: true,
+                name: true,
+                description: true,
+                sigmaRuleYaml: true,
+                evaluationIntervalInMinutes: true,
+                groupByField: true,
+                shouldCreateAlert: true,
+                shouldWriteDetectionFinding: true,
+                alertSeverityId: true,
+                lastEvaluatedAt: true,
+            },
+            skip: 0,
+            limit: LIMIT_MAX,
+            props: {
+                isRoot: true,
+            },
+        });
+        const now = OneUptimeDate.getCurrentDate();
+        for (const rule of rules) {
+            const intervalInMinutes = Math.max(1, rule.evaluationIntervalInMinutes || 1);
+            if (rule.lastEvaluatedAt) {
+                const dueAt = OneUptimeDate.addRemoveMinutes(rule.lastEvaluatedAt, intervalInMinutes);
+                if (OneUptimeDate.isAfter(dueAt, now)) {
+                    continue;
+                }
+            }
+            try {
+                await this.evaluateRule(rule);
+            }
+            catch (error) {
+                logger.error(`DetectionRuleEvaluator: error evaluating rule ${(_a = rule.id) === null || _a === void 0 ? void 0 : _a.toString()}:`);
+                logger.error(error);
+                if (rule.id) {
+                    await DetectionRuleService.updateOneById({
+                        id: rule.id,
+                        data: {
+                            lastEvaluatedAt: OneUptimeDate.getCurrentDate(),
+                            lastError: error instanceof Error ? error.message : String(error),
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                }
+            }
+        }
+    }
+    static async evaluateRule(rule) {
+        if (!rule.id || !rule.projectId || !rule.sigmaRuleYaml) {
+            throw new Error("Detection rule is missing id, projectId, or YAML.");
+        }
+        const parsedRule = SigmaRuleParser.parse(rule.sigmaRuleYaml);
+        const whereFragment = SigmaClickhouseCompiler.compile(parsedRule);
+        const endTime = OneUptimeDate.getCurrentDate();
+        const intervalInMinutes = Math.max(1, rule.evaluationIntervalInMinutes || 1);
+        const earliestAllowed = OneUptimeDate.addRemoveMinutes(endTime, -MAX_LOOKBACK_IN_MINUTES);
+        let startTime = rule.lastEvaluatedAt
+            ? rule.lastEvaluatedAt
+            : OneUptimeDate.addRemoveMinutes(endTime, -intervalInMinutes);
+        if (OneUptimeDate.isBefore(startTime, earliestAllowed)) {
+            startTime = earliestAllowed;
+        }
+        const groupByExpression = rule.groupByField
+            ? buildSigmaFieldExpression(rule.groupByField)
+            : null;
+        const groups = await SecurityEventService.findDetectionMatches({
+            projectId: rule.projectId,
+            startTime,
+            endTime,
+            whereFragment,
+            groupByExpression,
+            maxGroups: MAX_GROUPS_PER_EVALUATION,
+        });
+        const matchedGroups = groups.filter((row) => {
+            return row.matchCount > 0;
+        });
+        let alertsCreated = 0;
+        let findingsWritten = 0;
+        let totalMatches = 0;
+        for (const matchGroup of matchedGroups) {
+            totalMatches += matchGroup.matchCount;
+        }
+        if (matchedGroups.length > 0) {
+            if (rule.shouldCreateAlert !== false) {
+                alertsCreated = await this.openAlertsForMatches({
+                    rule,
+                    parsedRule,
+                    matchedGroups,
+                    startTime,
+                    endTime,
+                });
+            }
+            if (rule.shouldWriteDetectionFinding !== false) {
+                findingsWritten = await this.writeDetectionFindings({
+                    rule,
+                    parsedRule,
+                    matchedGroups,
+                });
+            }
+        }
+        await DetectionRuleService.updateOneById({
+            id: rule.id,
+            data: Object.assign({ lastEvaluatedAt: endTime, lastError: null }, (matchedGroups.length > 0 ? { lastMatchAt: endTime } : {})),
+            props: {
+                isRoot: true,
+            },
+        });
+        return {
+            ruleId: rule.id.toString(),
+            matchedGroups: matchedGroups.length,
+            totalMatches,
+            alertsCreated,
+            findingsWritten,
+            error: null,
+        };
+    }
+    static async openAlertsForMatches(data) {
+        var _a, _b;
+        const { rule, parsedRule, matchedGroups } = data;
+        const projectId = rule.projectId;
+        const alertSeverityId = await this.resolveAlertSeverityId({
+            projectId,
+            rule,
+            parsedRule,
+        });
+        if (!alertSeverityId) {
+            logger.warn(`DetectionRuleEvaluator: project ${projectId.toString()} has no alert severities; skipping alert creation for rule ${(_a = rule.id) === null || _a === void 0 ? void 0 : _a.toString()}.`);
+            return 0;
+        }
+        /*
+         * Dedupe: one open alert per (rule, group value). Fingerprints are
+         * stable across cycles, so a still-firing rule updates nothing and a
+         * resolved alert can re-open as a fresh one.
+         */
+        const fingerprints = matchedGroups.map((matchGroup) => {
+            return this.buildFingerprint(rule.id, matchGroup.groupValue);
+        });
+        const openAlerts = await AlertService.findBy({
+            query: {
+                projectId,
+                currentAlertState: {
+                    isResolvedState: false,
+                },
+            },
+            select: {
+                _id: true,
+                seriesFingerprint: true,
+            },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: {
+                isRoot: true,
+            },
+        });
+        const openFingerprints = new Set(openAlerts
+            .map((alert) => {
+            return alert.seriesFingerprint || "";
+        })
+            .filter((fingerprint) => {
+            return Boolean(fingerprint);
+        }));
+        let created = 0;
+        for (let index = 0; index < matchedGroups.length; index++) {
+            const matchGroup = matchedGroups[index];
+            const fingerprint = fingerprints[index];
+            if (openFingerprints.has(fingerprint)) {
+                continue;
+            }
+            const alert = new Alert();
+            alert.projectId = projectId;
+            alert.title = matchGroup.groupValue
+                ? `[Detection] ${rule.name} — ${matchGroup.groupValue}`
+                : `[Detection] ${rule.name}`;
+            const descriptionParts = [];
+            if (rule.description || parsedRule.description) {
+                descriptionParts.push(rule.description || parsedRule.description);
+            }
+            descriptionParts.push(`Detection rule matched ${matchGroup.matchCount} security event${matchGroup.matchCount === 1 ? "" : "s"} between ${OneUptimeDate.getDateAsFormattedString(data.startTime)} and ${OneUptimeDate.getDateAsFormattedString(data.endTime)}.`);
+            if (matchGroup.sampleMessage) {
+                descriptionParts.push(`Sample event: ${matchGroup.sampleMessage}`);
+            }
+            if (matchGroup.sampleObservables.length > 0) {
+                descriptionParts.push(`Observables: ${matchGroup.sampleObservables.slice(0, 20).join(", ")}`);
+            }
+            alert.description = descriptionParts.join("\n\n");
+            alert.alertSeverityId = alertSeverityId;
+            alert.seriesFingerprint = fingerprint;
+            alert.isCreatedAutomatically = true;
+            alert.rootCause = `Sigma detection rule "${rule.name}" matched security events.`;
+            try {
+                await AlertService.create({
+                    data: alert,
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                created++;
+            }
+            catch (error) {
+                logger.error(`DetectionRuleEvaluator: failed creating alert for rule ${(_b = rule.id) === null || _b === void 0 ? void 0 : _b.toString()}:`);
+                logger.error(error);
+            }
+        }
+        return created;
+    }
+    static async writeDetectionFindings(data) {
+        const { rule, parsedRule, matchedGroups } = data;
+        const projectId = rule.projectId;
+        const serviceMetadata = await OTelIngestService.telemetryServiceFromName({
+            serviceName: DETECTIONS_SERVICE_NAME,
+            projectId,
+        });
+        const retentionDays = resolveTelemetryRetentionInDays({
+            pillar: "securityEvents",
+            serviceConfig: serviceMetadata.serviceRetentionConfig,
+            serviceRetentionInDays: serviceMetadata.serviceRetentionInDays,
+            projectConfig: serviceMetadata.projectRetentionConfig,
+            projectRetentionInDays: serviceMetadata.projectRetentionInDays,
+        });
+        const severityName = SIGMA_LEVEL_TO_OCSF[parsedRule.level] || OcsfSeverity.Medium;
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        const rows = matchedGroups.map((matchGroup) => {
+            const normalized = {
+                time: OneUptimeDate.getCurrentDate(),
+                eventUid: `detection:${rule.id.toString()}:${this.buildFingerprint(rule.id, matchGroup.groupValue)}:${OneUptimeDate.getCurrentDateAsUnixNano()}`,
+                categoryUid,
+                categoryName,
+                classUid: DETECTION_FINDING_CLASS_UID,
+                className: "Detection Finding",
+                activityName: "Create",
+                severityId: OcsfSeverityId[severityName],
+                severityName,
+                statusName: "New",
+                message: matchGroup.groupValue
+                    ? `Detection: ${rule.name} — ${matchGroup.groupValue} (${matchGroup.matchCount} events)`
+                    : `Detection: ${rule.name} (${matchGroup.matchCount} events)`,
+                vendorName: "OneUptime",
+                productName: "OneUptime Detections",
+                ruleId: rule.id.toString(),
+                ruleName: rule.name || parsedRule.title,
+                mitreTactics: parsedRule.mitreTactics,
+                mitreTechniques: parsedRule.mitreTechniques,
+                principalUser: "",
+                principalHost: "",
+                principalIp: "",
+                principalProcess: "",
+                targetUser: "",
+                targetHost: "",
+                targetIp: "",
+                targetPort: 0,
+                targetResource: "",
+                observables: matchGroup.groupValue
+                    ? [
+                        matchGroup.groupValue,
+                        ...matchGroup.sampleObservables.filter((observable) => {
+                            return observable !== matchGroup.groupValue;
+                        }),
+                    ]
+                    : matchGroup.sampleObservables,
+                attributes: Object.assign(Object.assign({ "oneuptime.detection.rule_id": rule.id.toString(), "oneuptime.detection.rule_name": rule.name || parsedRule.title, "oneuptime.detection.match_count": String(matchGroup.matchCount) }, (matchGroup.groupValue
+                    ? { "oneuptime.detection.group_value": matchGroup.groupValue }
+                    : {})), (parsedRule.id
+                    ? { "oneuptime.detection.sigma_id": parsedRule.id }
+                    : {})),
+            };
+            return buildSecurityEventDbRow({
+                normalized,
+                projectId,
+                serviceMetadata,
+                retentionDays,
+            });
+        });
+        await SecurityEventService.insertJsonRows(rows);
+        return rows.length;
+    }
+    static buildFingerprint(ruleId, groupValue) {
+        return `detection-rule:${ruleId.toString()}:${MetricSeriesFingerprint.computeFingerprint({
+            groupValue: groupValue || "",
+        })}`;
+    }
+    /*
+     * Alert severity precedence: the rule's explicit severity (validated to
+     * belong to this project), else a project severity whose name matches
+     * the Sigma level, else severity by rank — critical/high map to the
+     * project's most severe (lowest order), everything else to the least
+     * severe. Returns null only when the project has no severities at all.
+     */
+    static async resolveAlertSeverityId(data) {
+        const severities = await AlertSeverityService.findBy({
+            query: {
+                projectId: data.projectId,
+            },
+            select: {
+                _id: true,
+                name: true,
+            },
+            sort: {
+                order: SortOrder.Ascending,
+            },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: {
+                isRoot: true,
+            },
+        });
+        if (severities.length === 0) {
+            return null;
+        }
+        if (data.rule.alertSeverityId) {
+            const explicit = severities.find((severity) => {
+                var _a, _b;
+                return (((_a = severity.id) === null || _a === void 0 ? void 0 : _a.toString()) === ((_b = data.rule.alertSeverityId) === null || _b === void 0 ? void 0 : _b.toString()));
+            });
+            if (explicit && explicit.id) {
+                return explicit.id;
+            }
+        }
+        const level = data.parsedRule.level;
+        const nameMatch = severities.find((severity) => {
+            return (severity.name || "").toLowerCase() === level.toLowerCase();
+        });
+        if (nameMatch && nameMatch.id) {
+            return nameMatch.id;
+        }
+        const isSevere = level === SigmaLevel.Critical || level === SigmaLevel.High;
+        const chosen = isSevere
+            ? severities[0]
+            : severities[severities.length - 1];
+        return chosen.id || null;
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], DetectionRuleEvaluator, "evaluateAllDueRules", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [DetectionRule]),
+    __metadata("design:returntype", Promise)
+], DetectionRuleEvaluator, "evaluateRule", null);
+//# sourceMappingURL=DetectionRuleEvaluator.js.map

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DetectionRuleEvaluator.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,aAAa,MAAM,8CAA8C,CAAC;AACzE,OAAO,KAAK,MAAM,sCAAsC,CAAC;AAEzD,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAEhD,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAG9D,OAAO,YAAY,EAAE,EACnB,cAAc,GACf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAkB,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,eAAe,MAAM,oDAAoD,CAAC;AACjF,OAAO,uBAAuB,MAAM,gDAAgD,CAAC;AACrF,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,iBAEN,MAAM,2CAA2C,CAAC;AACnD,OAAO,oBAEN,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,OAAO,uBAAuB,EAAE,EAC9B,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,2BAA2B,GAAW,IAAI,CAAC;AACjD,MAAM,uBAAuB,GAAW,sBAAsB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,uBAAuB,GAAW,EAAE,GAAG,EAAE,CAAC;AAEhD,yDAAyD;AACzD,MAAM,yBAAyB,GAAW,GAAG,CAAC;AAE9C,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,aAAa;IACtD,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG;IAClC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM;IACxC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI;IACpC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,QAAQ;CAC7C,CAAC;AAWF;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,sBAAsB;IAErB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB;;QACrC,MAAM,KAAK,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI;aAChB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,IAAI;gBACnB,2BAA2B,EAAE,IAAI;gBACjC,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,2BAA2B,EAAE,IAAI;gBACjC,eAAe,EAAE,IAAI;gBACrB,eAAe,EAAE,IAAI;aACtB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;YAEF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAS,aAAa,CAAC,gBAAgB,CAChD,IAAI,CAAC,eAAe,EACpB,iBAAiB,CAClB,CAAC;gBAEF,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,iDAAiD,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACxE,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAEpB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,oBAAoB,CAAC,aAAa,CAAC;wBACvC,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,IAAI,EAAE;4BACJ,eAAe,EAAE,aAAa,CAAC,cAAc,EAAE;4BAC/C,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;yBAClE;wBACD,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,YAAY,CAC9B,IAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAc,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxE,MAAM,aAAa,GACjB,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;QAEF,MAAM,eAAe,GAAS,aAAa,CAAC,gBAAgB,CAC1D,OAAO,EACP,CAAC,uBAAuB,CACzB,CAAC;QAEF,IAAI,SAAS,GAAS,IAAI,CAAC,eAAe;YACxC,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;YACvD,SAAS,GAAG,eAAe,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAqB,IAAI,CAAC,YAAY;YAC3D,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,MAAM,GACV,MAAM,oBAAoB,CAAC,oBAAoB,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,OAAO;YACP,aAAa;YACb,iBAAiB;YACjB,SAAS,EAAE,yBAAyB;SACrC,CAAC,CAAC;QAEL,MAAM,aAAa,GAA+B,MAAM,CAAC,MAAM,CAC7D,CAAC,GAAwB,EAAW,EAAE;YACpC,OAAO,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,GAAW,CAAC,CAAC;QAC9B,IAAI,eAAe,GAAW,CAAC,CAAC;QAChC,IAAI,YAAY,GAAW,CAAC,CAAC;QAE7B,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;YACvC,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC;QACxC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBACrC,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC9C,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC;gBAC/C,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;oBAClD,IAAI;oBACJ,UAAU;oBACV,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,CAAC,aAAa,CAAC;YACvC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,kBACF,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,IAAyB,IACjC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE;YAC1B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY;YACZ,aAAa;YACb,eAAe;YACf,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAMzC;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GAAoB,MAAM,IAAI,CAAC,sBAAsB,CAAC;YACzE,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,8DAA8D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAC5I,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED;;;;WAIG;QACH,MAAM,YAAY,GAAkB,aAAa,CAAC,GAAG,CACnD,CAAC,UAA+B,EAAU,EAAE;YAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAChE,CAAC,CACF,CAAC;QAEF,MAAM,UAAU,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;YACzD,KAAK,EAAE;gBACL,SAAS;gBACT,iBAAiB,EAAE;oBACjB,eAAe,EAAE,KAAK;iBACvB;aACF;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,iBAAiB,EAAE,IAAI;aACxB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAC3C,UAAU;aACP,GAAG,CAAC,CAAC,KAAY,EAAU,EAAE;YAC5B,OAAO,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,WAAmB,EAAW,EAAE;YACvC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,OAAO,GAAW,CAAC,CAAC;QAExB,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,UAAU,GAAwB,aAAa,CAAC,KAAK,CAAE,CAAC;YAC9D,MAAM,WAAW,GAAW,YAAY,CAAC,KAAK,CAAE,CAAC;YAEjD,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAU,IAAI,KAAK,EAAE,CAAC;YACjC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5B,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,UAAU;gBACjC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,EAAE;gBACvD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC;YAE/B,MAAM,gBAAgB,GAAkB,EAAE,CAAC;YAE3C,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC/C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;YACpE,CAAC;YAED,gBAAgB,CAAC,IAAI,CACnB,0BAA0B,UAAU,CAAC,UAAU,kBAC7C,UAAU,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,YAAY,aAAa,CAAC,wBAAwB,CAChD,IAAI,CAAC,SAAS,CACf,QAAQ,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CACjE,CAAC;YAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC7B,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,gBAAgB,CAAC,IAAI,CACnB,gBAAgB,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvE,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC;YACxC,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC;YACtC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;YACpC,KAAK,CAAC,SAAS,GAAG,yBAAyB,IAAI,CAAC,IAAI,4BAA4B,CAAC;YAEjF,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,MAAM,CAAC;oBACxB,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,0DAA0D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACjF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GACnB,MAAM,iBAAiB,CAAC,wBAAwB,CAAC;YAC/C,WAAW,EAAE,uBAAuB;YACpC,SAAS;SACV,CAAC,CAAC;QAEL,MAAM,aAAa,GAAW,+BAA+B,CAAC;YAC5D,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;YAC9D,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;SAC/D,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC;QAE/D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,IAAI,GAAsB,aAAa,CAAC,GAAG,CAC/C,CAAC,UAA+B,EAAc,EAAE;YAC9C,MAAM,UAAU,GAA4B;gBAC1C,IAAI,EAAE,aAAa,CAAC,cAAc,EAAE;gBACpC,QAAQ,EAAE,aAAa,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,gBAAgB,CACjE,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,UAAU,CACtB,IAAI,aAAa,CAAC,wBAAwB,EAAE,EAAE;gBAC/C,WAAW;gBACX,YAAY;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,mBAAmB;gBAC9B,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;gBACxC,YAAY;gBACZ,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,UAAU,CAAC,UAAU;oBAC5B,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,UAAU;oBACxF,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,UAAU,UAAU;gBAC/D,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,sBAAsB;gBACnC,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE;gBAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK;gBACvC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,aAAa,EAAE,EAAE;gBACjB,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;gBACf,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,UAAU,CAAC,UAAU;oBAChC,CAAC,CAAC;wBACE,UAAU,CAAC,UAAU;wBACrB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CACpC,CAAC,UAAkB,EAAW,EAAE;4BAC9B,OAAO,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC;wBAC9C,CAAC,CACF;qBACF;oBACH,CAAC,CAAC,UAAU,CAAC,iBAAiB;gBAChC,UAAU,gCACR,6BAA6B,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,EAClD,+BAA+B,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,EAC9D,iCAAiC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAC7D,CAAC,UAAU,CAAC,UAAU;oBACvB,CAAC,CAAC,EAAE,iCAAiC,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,UAAU,CAAC,EAAE;oBACf,CAAC,CAAC,EAAE,8BAA8B,EAAE,UAAU,CAAC,EAAE,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC,CACR;aACF,CAAC;YAEF,OAAO,uBAAuB,CAAC;gBAC7B,UAAU;gBACV,SAAS;gBACT,eAAe;gBACf,aAAa;aACd,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,MAAM,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAC7B,MAAgB,EAChB,UAAkB;QAElB,OAAO,kBAAkB,MAAM,CAAC,QAAQ,EAAE,IAAI,uBAAuB,CAAC,kBAAkB,CACtF;YACE,UAAU,EAAE,UAAU,IAAI,EAAE;SAC7B,CACF,EAAE,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,MAAM,UAAU,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;YACzE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;aACX;YACD,IAAI,EAAE;gBACJ,KAAK,EAAE,SAAS,CAAC,SAAS;aAC3B;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAA8B,UAAU,CAAC,IAAI,CACzD,CAAC,QAAuB,EAAW,EAAE;;gBACnC,OAAO,CACL,CAAA,MAAA,QAAQ,CAAC,EAAE,0CAAE,QAAQ,EAAE,OAAK,MAAA,IAAI,CAAC,IAAI,CAAC,eAAe,0CAAE,QAAQ,EAAE,CAAA,CAClE,CAAC;YACJ,CAAC,CACF,CAAC;YAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAEhD,MAAM,SAAS,GAA8B,UAAU,CAAC,IAAI,CAC1D,CAAC,QAAuB,EAAW,EAAE;YACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACrE,CAAC,CACF,CAAC;QAEF,IAAI,SAAS,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GACZ,KAAK,KAAK,UAAU,CAAC,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC;QAE7D,MAAM,MAAM,GAAkB,QAAQ;YACpC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE;YAChB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAEvC,OAAO,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC;IAC3B,CAAC;CACF;AA5dqB;IADnB,WAAW,EAAE;;;;uDAmEb;AAGmB;IADnB,WAAW,EAAE;;qCAEN,aAAa;;gDAiGpB"}

package/build/dist/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient.js

@@ -0,0 +1,145 @@
+import jwt from "jsonwebtoken";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import APIException from "../../../../Types/Exception/ApiException";
+const CHRONICLE_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const TOKEN_LIFETIME_IN_SECONDS = 3600;
+const TOKEN_EXPIRY_SLACK_IN_SECONDS = 60;
+const DEFAULT_MAX_ALERTS = 1000;
+const REGION_REGEX = /^[a-z][a-z0-9-]{0,30}$/;
+const INSTANCE_REGEX = /^projects\/[^/\s]+\/locations\/[^/\s]+\/instances\/[^/\s]+$/;
+export default class GoogleSecOpsClient {
+    constructor(data) {
+        this.cachedAccessToken = null;
+        this.cachedAccessTokenExpiresAtInMs = 0;
+        GoogleSecOpsClient.validateRegion(data.region);
+        GoogleSecOpsClient.validateInstanceResourceName(data.instanceResourceName);
+        this.region = data.region;
+        this.instanceResourceName = data.instanceResourceName;
+        this.credentials = GoogleSecOpsClient.parseServiceAccountJson(data.serviceAccountJson);
+        this.fetchImplementation =
+            data.fetchImplementation || fetch;
+    }
+    static validateRegion(region) {
+        if (!REGION_REGEX.test(region || "")) {
+            throw new BadDataException("Region must be a Google SecOps regional prefix like 'us' or 'europe'.");
+        }
+    }
+    static validateInstanceResourceName(name) {
+        if (!INSTANCE_REGEX.test(name || "")) {
+            throw new BadDataException("Instance resource name must look like projects/{project}/locations/{location}/instances/{instance}.");
+        }
+    }
+    static parseServiceAccountJson(serviceAccountJson) {
+        let parsed;
+        try {
+            parsed = JSON.parse(serviceAccountJson || "");
+        }
+        catch (_a) {
+            throw new BadDataException("Service account JSON is not valid JSON.");
+        }
+        const clientEmail = String(parsed["client_email"] || "");
+        const privateKey = String(parsed["private_key"] || "");
+        const tokenUri = String(parsed["token_uri"] || "https://oauth2.googleapis.com/token");
+        if (!clientEmail || !privateKey) {
+            throw new BadDataException("Service account JSON must contain client_email and private_key.");
+        }
+        return { clientEmail, privateKey, tokenUri };
+    }
+    getApiBaseUrl() {
+        return `https://${this.region}-chronicle.googleapis.com/v1alpha/${this.instanceResourceName}`;
+    }
+    async getAccessToken() {
+        const nowInMs = Date.now();
+        if (this.cachedAccessToken &&
+            nowInMs <
+                this.cachedAccessTokenExpiresAtInMs -
+                    TOKEN_EXPIRY_SLACK_IN_SECONDS * 1000) {
+            return this.cachedAccessToken;
+        }
+        const issuedAtInSeconds = Math.floor(nowInMs / 1000);
+        const assertion = jwt.sign({
+            iss: this.credentials.clientEmail,
+            scope: CHRONICLE_SCOPE,
+            aud: this.credentials.tokenUri,
+            iat: issuedAtInSeconds,
+            exp: issuedAtInSeconds + TOKEN_LIFETIME_IN_SECONDS,
+        }, this.credentials.privateKey, { algorithm: "RS256" });
+        const body = new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+            assertion: assertion,
+        }).toString();
+        const response = await this.fetchImplementation(this.credentials.tokenUri, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body: body,
+        });
+        const responseText = await response.text();
+        if (!response.ok) {
+            throw new APIException(`Google token exchange failed (HTTP ${response.status}): ${responseText.slice(0, 500)}`);
+        }
+        const tokenResponse = JSON.parse(responseText);
+        const accessToken = String(tokenResponse["access_token"] || "");
+        const expiresInSeconds = Number(tokenResponse["expires_in"] || TOKEN_LIFETIME_IN_SECONDS);
+        if (!accessToken) {
+            throw new APIException("Google token exchange returned no access_token.");
+        }
+        this.cachedAccessToken = accessToken;
+        this.cachedAccessTokenExpiresAtInMs = nowInMs + expiresInSeconds * 1000;
+        return accessToken;
+    }
+    /*
+     * Fetch detection alerts created in a time window, via the Chronicle
+     * v1alpha legacy alerts view. Response shapes vary across tenant
+     * versions, so parsing is deliberately tolerant: `alerts`, `detections`,
+     * or a bare array all work; anything else returns [] rather than
+     * guessing.
+     */
+    async fetchDetectionAlerts(data) {
+        const accessToken = await this.getAccessToken();
+        const params = new URLSearchParams({
+            "timeRange.startTime": data.startTime.toISOString(),
+            "timeRange.endTime": data.endTime.toISOString(),
+            pageSize: String(data.maxAlerts || DEFAULT_MAX_ALERTS),
+        });
+        const url = `${this.getApiBaseUrl()}/legacy:legacyFetchAlertsView?${params.toString()}`;
+        const response = await this.fetchImplementation(url, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        });
+        const responseText = await response.text();
+        if (!response.ok) {
+            throw new APIException(`Google SecOps alerts fetch failed (HTTP ${response.status}): ${responseText.slice(0, 500)}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(responseText);
+        }
+        catch (_a) {
+            throw new APIException("Google SecOps alerts fetch returned a non-JSON body.");
+        }
+        return GoogleSecOpsClient.extractAlerts(parsed);
+    }
+    static extractAlerts(payload) {
+        if (Array.isArray(payload)) {
+            return payload.filter((item) => {
+                return (typeof item === "object" && item !== null && !Array.isArray(item));
+            });
+        }
+        if (!payload || typeof payload !== "object") {
+            return [];
+        }
+        const asObject = payload;
+        for (const key of ["alerts", "detections"]) {
+            const nested = asObject[key];
+            if (Array.isArray(nested)) {
+                return GoogleSecOpsClient.extractAlerts(nested);
+            }
+        }
+        return [];
+    }
+}
+//# sourceMappingURL=GoogleSecOpsClient.js.map

package/build/dist/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleSecOpsClient.js","sourceRoot":"","sources":["../../../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,YAAY,MAAM,0CAA0C,CAAC;AAoCpE,MAAM,eAAe,GACnB,gDAAgD,CAAC;AACnD,MAAM,yBAAyB,GAAW,IAAI,CAAC;AAC/C,MAAM,6BAA6B,GAAW,EAAE,CAAC;AACjD,MAAM,kBAAkB,GAAW,IAAI,CAAC;AAExC,MAAM,YAAY,GAAW,wBAAwB,CAAC;AACtD,MAAM,cAAc,GAClB,6DAA6D,CAAC;AAEhE,MAAM,CAAC,OAAO,OAAO,kBAAkB;IASrC,YAAmB,IAKlB;QARO,sBAAiB,GAAkB,IAAI,CAAC;QACxC,mCAA8B,GAAW,CAAC,CAAC;QAQjD,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,kBAAkB,CAAC,4BAA4B,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,uBAAuB,CAC3D,IAAI,CAAC,kBAAkB,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB;YACtB,IAAI,CAAC,mBAAmB,IAAK,KAA8B,CAAC;IAChE,CAAC;IAEM,MAAM,CAAC,cAAc,CAAC,MAAc;QACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CACxB,uEAAuE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,4BAA4B,CAAC,IAAY;QACrD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,gBAAgB,CACxB,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,uBAAuB,CACnC,kBAA0B;QAE1B,IAAI,MAAkB,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAe,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAW,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,UAAU,GAAW,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAW,MAAM,CAC7B,MAAM,CAAC,WAAW,CAAC,IAAI,qCAAqC,CAC7D,CAAC;QAEF,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CACxB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAEM,aAAa;QAClB,OAAO,WAAW,IAAI,CAAC,MAAM,qCAAqC,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAChG,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAEnC,IACE,IAAI,CAAC,iBAAiB;YACtB,OAAO;gBACL,IAAI,CAAC,8BAA8B;oBACjC,6BAA6B,GAAG,IAAI,EACxC,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAChC,CAAC;QAED,MAAM,iBAAiB,GAAW,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAW,GAAG,CAAC,IAAI,CAChC;YACE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW;YACjC,KAAK,EAAE,eAAe;YACtB,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YAC9B,GAAG,EAAE,iBAAiB;YACtB,GAAG,EAAE,iBAAiB,GAAG,yBAAyB;SACnD,EACD,IAAI,CAAC,WAAW,CAAC,UAAU,EAC3B,EAAE,SAAS,EAAE,OAAO,EAAE,CACvB,CAAC;QAEF,MAAM,IAAI,GAAW,IAAI,eAAe,CAAC;YACvC,UAAU,EAAE,6CAA6C;YACzD,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,MAAM,QAAQ,GAAsB,MAAM,IAAI,CAAC,mBAAmB,CAChE,IAAI,CAAC,WAAW,CAAC,QAAQ,EACzB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI;SACX,CACF,CAAC;QAEF,MAAM,YAAY,GAAW,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,sCAAsC,QAAQ,CAAC,MAAM,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAe,IAAI,CAAC,KAAK,CAAC,YAAY,CAAe,CAAC;QACzE,MAAM,WAAW,GAAW,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,gBAAgB,GAAW,MAAM,CACrC,aAAa,CAAC,YAAY,CAAC,IAAI,yBAAyB,CACzD,CAAC;QAEF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,iDAAiD,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;QACrC,IAAI,CAAC,8BAA8B,GAAG,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAAC;QAExE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAIjC;QACC,MAAM,WAAW,GAAW,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAExD,MAAM,MAAM,GAAoB,IAAI,eAAe,CAAC;YAClD,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;YACnD,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAC/C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACvD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAW,GAAG,IAAI,CAAC,aAAa,EAAE,iCAAiC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEhG,MAAM,QAAQ,GAAsB,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE;YACtE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAW,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CACpB,2CAA2C,QAAQ,CAAC,MAAM,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;QAED,IAAI,MAAiB,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAc,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,sDAAsD,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,kBAAkB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAEM,MAAM,CAAC,aAAa,CAAC,OAAkB;QAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAQ,OAAqB,CAAC,MAAM,CAAC,CAAC,IAAe,EAAW,EAAE;gBAChE,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAClE,CAAC;YACJ,CAAC,CAAsB,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAe,OAAqB,CAAC;QAEnD,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAc,QAAQ,CAAC,GAAG,CAAc,CAAC;YACrD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,kBAAkB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}