@oneuptime/common 12.0.15 → 12.0.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (707) hide show
  1. package/Models/AnalyticsModels/Index.ts +10 -0
  2. package/Models/AnalyticsModels/LogCountBaseline.ts +174 -0
  3. package/Models/AnalyticsModels/SecurityEvent.ts +794 -0
  4. package/Models/AnalyticsModels/Span.ts +29 -1
  5. package/Models/AnalyticsModels/SpanCountBaseline.ts +198 -0
  6. package/Models/DatabaseModels/Alert.ts +42 -0
  7. package/Models/DatabaseModels/AlertMeasurement.ts +1114 -0
  8. package/Models/DatabaseModels/AlertMeasurementValue.ts +501 -0
  9. package/Models/DatabaseModels/AlertStateTimeline.ts +10 -2
  10. package/Models/DatabaseModels/BillingPaymentMethod.ts +8 -10
  11. package/Models/DatabaseModels/DetectionRule.ts +487 -0
  12. package/Models/DatabaseModels/GoogleSecOpsConnection.ts +382 -0
  13. package/Models/DatabaseModels/Incident.ts +42 -0
  14. package/Models/DatabaseModels/IncidentMeasurement.ts +1114 -0
  15. package/Models/DatabaseModels/IncidentMeasurementValue.ts +501 -0
  16. package/Models/DatabaseModels/IncidentStateTimeline.ts +10 -2
  17. package/Models/DatabaseModels/IncomingCallPolicyLabelRule.ts +36 -0
  18. package/Models/DatabaseModels/IncomingCallPolicyOwnerRule.ts +42 -0
  19. package/Models/DatabaseModels/Index.ts +20 -0
  20. package/Models/DatabaseModels/Label.ts +11 -0
  21. package/Models/DatabaseModels/LlmCostBudget.ts +655 -0
  22. package/Models/DatabaseModels/LlmModelPrice.ts +481 -0
  23. package/Models/DatabaseModels/LogSavedView.ts +87 -0
  24. package/Models/DatabaseModels/MarketingConversion.ts +210 -8
  25. package/Models/DatabaseModels/MetricSavedView.ts +59 -0
  26. package/Models/DatabaseModels/OnCallDutyPolicyLabelRule.ts +36 -0
  27. package/Models/DatabaseModels/OnCallDutyPolicyOwnerRule.ts +42 -0
  28. package/Models/DatabaseModels/OnCallDutyPolicyScheduleLabelRule.ts +36 -0
  29. package/Models/DatabaseModels/OnCallDutyPolicyScheduleOwnerRule.ts +42 -0
  30. package/Models/DatabaseModels/Probe.ts +21 -0
  31. package/Models/DatabaseModels/RunbookLabelRule.ts +36 -0
  32. package/Models/DatabaseModels/RunbookOwnerRule.ts +42 -0
  33. package/Models/DatabaseModels/ScheduledMaintenanceMeasurement.ts +1104 -0
  34. package/Models/DatabaseModels/ScheduledMaintenanceMeasurementValue.ts +491 -0
  35. package/Models/DatabaseModels/ScheduledMaintenanceStateTimeline.ts +10 -2
  36. package/Models/DatabaseModels/StatusPageLabelRule.ts +36 -0
  37. package/Models/DatabaseModels/StatusPageOwnerRule.ts +42 -0
  38. package/Models/DatabaseModels/TableView.ts +15 -0
  39. package/Models/DatabaseModels/Team.ts +13 -0
  40. package/Models/DatabaseModels/TeamMember.ts +8 -0
  41. package/Models/DatabaseModels/TraceSavedView.ts +52 -0
  42. package/Models/DatabaseModels/WorkflowLabelRule.ts +36 -0
  43. package/Models/DatabaseModels/WorkflowOwnerRule.ts +42 -0
  44. package/Server/API/TelemetryAPI.ts +252 -6
  45. package/Server/API/UserAPI.ts +88 -0
  46. package/Server/EnvironmentConfig.ts +36 -1
  47. package/Server/Infrastructure/Postgres/SchemaMigrations/1788000000000-AddDetectionRuleAndGoogleSecOpsConnection.ts +88 -0
  48. package/Server/Infrastructure/Postgres/SchemaMigrations/1788100000000-AddMeasurements.ts +457 -0
  49. package/Server/Infrastructure/Postgres/SchemaMigrations/1788200000000-AddLlmCostBudget.ts +97 -0
  50. package/Server/Infrastructure/Postgres/SchemaMigrations/1788300000000-AddLlmModelPrice.ts +45 -0
  51. package/Server/Infrastructure/Postgres/SchemaMigrations/1788400000000-AddMarketingConversionAttribution.ts +105 -0
  52. package/Server/Infrastructure/Postgres/SchemaMigrations/1788500000000-RemoveLlmCostBudgetAlertColumns.ts +77 -0
  53. package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts +12 -0
  54. package/Server/Middleware/IdentityRateLimit.ts +672 -0
  55. package/Server/Services/AccessTokenService.ts +15 -2
  56. package/Server/Services/AlertMeasurementService.ts +302 -0
  57. package/Server/Services/AlertMeasurementValueService.ts +508 -0
  58. package/Server/Services/AlertService.ts +50 -0
  59. package/Server/Services/AlertStateTimelineService.ts +54 -0
  60. package/Server/Services/DetectionRuleService.ts +74 -0
  61. package/Server/Services/GoogleSecOpsConnectionService.ts +89 -0
  62. package/Server/Services/IncidentMeasurementService.ts +304 -0
  63. package/Server/Services/IncidentMeasurementValueService.ts +523 -0
  64. package/Server/Services/IncidentService.ts +51 -0
  65. package/Server/Services/IncidentStateTimelineService.ts +54 -0
  66. package/Server/Services/Index.ts +30 -0
  67. package/Server/Services/LlmCostBudgetService.ts +93 -0
  68. package/Server/Services/LlmModelPriceService.ts +202 -0
  69. package/Server/Services/LogAggregationService.ts +1106 -2
  70. package/Server/Services/LogCountBaselineService.ts +163 -0
  71. package/Server/Services/MutableMetricService.ts +30 -9
  72. package/Server/Services/ScheduledMaintenanceMeasurementService.ts +311 -0
  73. package/Server/Services/ScheduledMaintenanceMeasurementValueService.ts +546 -0
  74. package/Server/Services/ScheduledMaintenanceService.ts +53 -0
  75. package/Server/Services/ScheduledMaintenanceStateTimelineService.ts +188 -1
  76. package/Server/Services/SecurityEventService.ts +104 -0
  77. package/Server/Services/SpanCountBaselineService.ts +173 -0
  78. package/Server/Services/StatusPageService.ts +4 -3
  79. package/Server/Services/TelemetryUsageBillingService.ts +17 -2
  80. package/Server/Services/UserService.ts +284 -51
  81. package/Server/Services/UserTotpAuthService.ts +27 -86
  82. package/Server/Services/UserWebAuthnService.ts +26 -86
  83. package/Server/Types/Billing/MeteredPlan/AllMeteredPlans.ts +14 -0
  84. package/Server/Types/Database/Permissions/TenantPermission.ts +10 -0
  85. package/Server/Types/Database/QueryHelper.ts +1 -1
  86. package/Server/Utils/AI/Chat/ObservabilityChatPrompt.ts +1 -1
  87. package/Server/Utils/AI/Toolbox/Index.ts +6 -0
  88. package/Server/Utils/AI/Toolbox/SecurityEventTools.ts +349 -0
  89. package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts +13 -4
  90. package/Server/Utils/Attribution.ts +130 -34
  91. package/Server/Utils/Marketing/ConversionUploadProvider.ts +98 -16
  92. package/Server/Utils/Marketing/Providers/GoogleAds.ts +70 -7
  93. package/Server/Utils/Marketing/Providers/LinkedIn.ts +54 -16
  94. package/Server/Utils/Marketing/Providers/Meta.ts +52 -18
  95. package/Server/Utils/Marketing/Providers/MicrosoftAds.ts +37 -10
  96. package/Server/Utils/Marketing/Providers/Reddit.ts +45 -15
  97. package/Server/Utils/Measurement/MeasurementDefinitionValidator.ts +209 -0
  98. package/Server/Utils/Measurement/MeasurementMetricWriter.ts +189 -0
  99. package/Server/Utils/Monitor/Criteria/CountAnomaly.ts +182 -0
  100. package/Server/Utils/Monitor/Criteria/LogMonitorCriteria.ts +132 -0
  101. package/Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria.ts +35 -0
  102. package/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.ts +132 -0
  103. package/Server/Utils/Monitor/DataToProcess.ts +2 -0
  104. package/Server/Utils/Monitor/MonitorCriteriaDataExtractor.ts +14 -0
  105. package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts +15 -0
  106. package/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.ts +20 -0
  107. package/Server/Utils/Monitor/MonitorResource.ts +16 -0
  108. package/Server/Utils/Monitor/MonitorStepResourceIdentity.ts +1 -0
  109. package/Server/Utils/Monitor/MonitorStepsReferenceExtractor.ts +1 -0
  110. package/Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts +548 -0
  111. package/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient.ts +262 -0
  112. package/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller.ts +212 -0
  113. package/Server/Utils/SecurityEvent/SecurityEventRow.ts +101 -0
  114. package/Server/Utils/SecurityEvent/Sigma/SigmaClickhouseCompiler.ts +635 -0
  115. package/Server/Utils/Telemetry/LlmCostBudgetEvaluator.ts +379 -0
  116. package/Server/Utils/Telemetry/LlmSpan.ts +83 -4
  117. package/Server/Utils/Telemetry/LogErrorPatternSql.ts +136 -0
  118. package/Server/Utils/UserPermission/UserPermission.ts +57 -1
  119. package/Tests/App/Dashboard/AlertsSideMenu.test.tsx +4 -0
  120. package/Tests/App/Dashboard/CreatePageEntryPointPermissions.test.tsx +306 -0
  121. package/Tests/App/Dashboard/DangerZone.test.tsx +11 -0
  122. package/Tests/App/Dashboard/IncidentsSideMenu.test.tsx +4 -0
  123. package/Tests/App/Dashboard/LogMonitorAttributeOperatorPreview.test.tsx +459 -0
  124. package/Tests/App/Dashboard/OverviewCustomFields.test.tsx +24 -0
  125. package/Tests/App/Dashboard/ScheduledMaintenanceSideMenu.test.tsx +6 -0
  126. package/Tests/Models/DatabaseModels/DomainRoleTierCoverage.test.ts +323 -0
  127. package/Tests/Models/DatabaseModels/ProjectSharedResources.test.ts +386 -0
  128. package/Tests/Server/API/LogErrorPatternAPI.test.ts +811 -0
  129. package/Tests/Server/API/UserAuthenticationAPI.test.ts +11 -0
  130. package/Tests/Server/API/UserProjectsAPI.test.ts +11 -2
  131. package/Tests/Server/API/UserTwoFactorAuthAdminAPI.test.ts +918 -0
  132. package/Tests/Server/Infrastructure/LocalCache.test.ts +149 -0
  133. package/Tests/Server/Services/AccessTokenProjectUserGrant.test.ts +249 -0
  134. package/Tests/Server/Services/AlertMeasurementService.test.ts +665 -0
  135. package/Tests/Server/Services/AlertMeasurementValueService.test.ts +389 -0
  136. package/Tests/Server/Services/DetectionRuleService.test.ts +254 -0
  137. package/Tests/Server/Services/IncidentMeasurementService.test.ts +394 -0
  138. package/Tests/Server/Services/IncidentMeasurementValueService.test.ts +816 -0
  139. package/Tests/Server/Services/LlmCostBudgetService.test.ts +104 -0
  140. package/Tests/Server/Services/LogAggregationAttributeOperators.test.ts +405 -0
  141. package/Tests/Server/Services/LogErrorPatternAggregation.test.ts +804 -0
  142. package/Tests/Server/Services/MutableMetricNameRouting.test.ts +83 -0
  143. package/Tests/Server/Services/ScheduledMaintenanceMeasurementService.test.ts +750 -0
  144. package/Tests/Server/Services/ScheduledMaintenanceMeasurementValueService.test.ts +478 -0
  145. package/Tests/Server/Services/UserAuthenticationService.test.ts +216 -4
  146. package/Tests/Server/Services/UserTwoFactorAuthAdmin.test.ts +1190 -0
  147. package/Tests/Server/Types/Database/Permissions/ScopedRoleSharedResourceAccess.test.ts +466 -0
  148. package/Tests/Server/Types/Database/QueryHelperOperators.test.ts +265 -0
  149. package/Tests/Server/Types/Database/QueryHelperTextAndStructuralOperators.test.ts +206 -0
  150. package/Tests/Server/Utils/AnalyticsDatabase/ClusterAwareSchema.test.ts +6 -0
  151. package/Tests/Server/Utils/AnalyticsDatabase/FractionalAttributeThreshold.test.ts +224 -0
  152. package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts +172 -2
  153. package/Tests/Server/Utils/Attribution.test.ts +228 -1
  154. package/Tests/Server/Utils/Marketing/AdUploadableConversionTypes.test.ts +153 -92
  155. package/Tests/Server/Utils/Marketing/ConversionUploadProvider.test.ts +123 -6
  156. package/Tests/Server/Utils/Marketing/GoogleAds.test.ts +253 -1
  157. package/Tests/Server/Utils/Marketing/LinkedIn.test.ts +282 -0
  158. package/Tests/Server/Utils/Marketing/Meta.test.ts +304 -0
  159. package/Tests/Server/Utils/Marketing/MicrosoftAds.test.ts +263 -0
  160. package/Tests/Server/Utils/Marketing/Reddit.test.ts +259 -0
  161. package/Tests/Server/Utils/Measurement/MeasurementDefinitionValidator.test.ts +322 -0
  162. package/Tests/Server/Utils/Measurement/MeasurementMetricWriter.test.ts +373 -0
  163. package/Tests/Server/Utils/Monitor/Criteria/CountAnomaly.test.ts +221 -0
  164. package/Tests/Server/Utils/Monitor/Criteria/LogMonitorCriteria.test.ts +236 -0
  165. package/Tests/Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria.test.ts +147 -0
  166. package/Tests/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.test.ts +274 -0
  167. package/Tests/Server/Utils/Monitor/SecurityEventsMonitorDataExtractor.test.ts +93 -0
  168. package/Tests/Server/Utils/SecurityEvent/DetectionRuleEvaluator.test.ts +660 -0
  169. package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsClient.test.ts +308 -0
  170. package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsPoller.test.ts +271 -0
  171. package/Tests/Server/Utils/SecurityEvent/SecurityEventRow.test.ts +272 -0
  172. package/Tests/Server/Utils/SecurityEvent/SigmaClickhouseCompiler.test.ts +511 -0
  173. package/Tests/Server/Utils/Telemetry/LlmCostBudgetEvaluator.test.ts +497 -0
  174. package/Tests/Server/Utils/Telemetry/LlmSpan.test.ts +380 -0
  175. package/Tests/Server/Utils/Telemetry/LogErrorPatternSql.test.ts +207 -0
  176. package/Tests/Server/Utils/UserPermission/ProjectUserGrant.test.ts +293 -0
  177. package/Tests/Types/Monitor/MonitorStepInfraMonitorUtils.test.ts +194 -0
  178. package/Tests/Types/Monitor/MonitorStepSecurityEventsMonitor.test.ts +201 -0
  179. package/Tests/Types/SecurityEvent/OcsfEventClass.test.ts +105 -0
  180. package/Tests/Types/SecurityEvent/OcsfSeverity.test.ts +111 -0
  181. package/Tests/Types/Telemetry/LlmCostCatalog.test.ts +516 -0
  182. package/Tests/UI/Components/ActiveFilterChipsOperatorValues.test.tsx +222 -0
  183. package/Tests/UI/Components/BulkActionPermissionGating.test.tsx +296 -0
  184. package/Tests/UI/Components/CardModelDetailPermissionGating.test.tsx +305 -0
  185. package/Tests/UI/Components/CustomFields/CustomFieldsDetail.test.tsx +23 -0
  186. package/Tests/UI/Components/DictionaryFilterOperatorDisplay.test.ts +239 -0
  187. package/Tests/UI/Components/DisabledButtonTooltip.test.tsx +267 -0
  188. package/Tests/UI/Components/DuplicateModel.test.tsx +37 -0
  189. package/Tests/UI/Components/ModelCardPermissionGating.test.tsx +348 -0
  190. package/Tests/UI/Components/ModelDelete.test.tsx +25 -1
  191. package/Tests/UI/Components/ModelFormCreatePermission.test.tsx +342 -0
  192. package/Tests/UI/Components/ModelTable/BaseModelTablePermissionGating.test.tsx +680 -0
  193. package/Tests/UI/Components/OrderedStatesListCreateGate.test.tsx +174 -0
  194. package/Tests/UI/Components/SavedViewsDropdownSearch.test.tsx +1127 -0
  195. package/Tests/UI/Components/SavedViewsFacetSection.test.tsx +958 -0
  196. package/Tests/UI/Components/SavedViewsList.test.ts +699 -0
  197. package/Tests/UI/Components/SavedViewsSidebarIntegration.test.tsx +640 -0
  198. package/Tests/UI/Components/SavedViewsSurfaceParity.test.tsx +679 -0
  199. package/Tests/UI/Components/TableViewLoadFailure.test.tsx +248 -0
  200. package/Tests/UI/Types/UseComponentOutsideClick.test.tsx +226 -0
  201. package/Tests/UI/Utils/PermissionGate.test.ts +467 -0
  202. package/Tests/Utils/Measurement/MeasurementEvaluator.test.ts +639 -0
  203. package/Tests/Utils/Monitor/MonitorSummarySnapshotUtil.test.ts +1 -0
  204. package/Tests/Utils/Monitor/NetworkDeviceLinkRuleUtil.test.ts +285 -0
  205. package/Tests/Utils/NetworkDevice/DeviceHealthStateUtil.test.ts +433 -0
  206. package/Tests/Utils/SecurityEvent/GenericNormalizer.test.ts +204 -0
  207. package/Tests/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.test.ts +252 -0
  208. package/Tests/Utils/SecurityEvent/NormalizerHelpers.test.ts +274 -0
  209. package/Tests/Utils/SecurityEvent/OcsfNormalizer.test.ts +208 -0
  210. package/Tests/Utils/SecurityEvent/SecurityEventNormalizer.test.ts +172 -0
  211. package/Tests/Utils/SecurityEvent/SigmaRuleParser.test.ts +471 -0
  212. package/Tests/Utils/SecurityEvent/UdmNormalizer.test.ts +361 -0
  213. package/Tests/Utils/Telemetry/CrossSignalScope.test.ts +82 -0
  214. package/Tests/Utils/Telemetry/LogErrorPattern.test.ts +463 -0
  215. package/Types/AI/AIChatTypes.ts +1 -0
  216. package/Types/Alerts/AlertMeasurementAnchorType.ts +14 -0
  217. package/Types/Alerts/AlertStateRole.ts +11 -0
  218. package/Types/AnalyticsDatabase/AnalyticsTableName.ts +16 -0
  219. package/Types/Dashboard/Chart/ChartType.ts +1 -0
  220. package/Types/Dashboard/DashboardComponentType.ts +2 -0
  221. package/Types/Dashboard/DashboardComponents/DashboardSecurityEventsFlowComponent.ts +18 -0
  222. package/Types/Dashboard/DashboardComponents/DashboardSecurityEventsListComponent.ts +16 -0
  223. package/Types/Incident/IncidentMeasurementAnchorType.ts +34 -0
  224. package/Types/Incident/IncidentStateRole.ts +14 -0
  225. package/Types/Marketing/Attribution.ts +75 -0
  226. package/Types/Marketing/MarketingConversion.ts +37 -7
  227. package/Types/Measurement/MeasurementAggregationType.ts +43 -0
  228. package/Types/Measurement/MeasurementAnchorKind.ts +23 -0
  229. package/Types/Measurement/MeasurementOccurrence.ts +14 -0
  230. package/Types/Measurement/MeasurementStatus.ts +34 -0
  231. package/Types/MeteredPlan/ProductType.ts +1 -0
  232. package/Types/Monitor/CriteriaFilter.ts +3 -0
  233. package/Types/Monitor/MonitorCriteriaInstance.ts +64 -0
  234. package/Types/Monitor/MonitorStep.ts +28 -0
  235. package/Types/Monitor/MonitorStepSecurityEventsMonitor.ts +100 -0
  236. package/Types/Monitor/MonitorType.ts +20 -0
  237. package/Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse.ts +17 -0
  238. package/Types/Permission.ts +399 -2
  239. package/Types/ScheduledMaintenance/ScheduledMaintenanceMeasurementAnchorType.ts +20 -0
  240. package/Types/ScheduledMaintenance/ScheduledMaintenanceStateRole.ts +16 -0
  241. package/Types/SecurityEvent/NormalizedSecurityEvent.ts +92 -0
  242. package/Types/SecurityEvent/OcsfEventClass.ts +205 -0
  243. package/Types/SecurityEvent/OcsfSeverity.ts +88 -0
  244. package/Types/SecurityEvent/SecurityEventFormat.ts +23 -0
  245. package/Types/SecurityEvent/SigmaRule.ts +70 -0
  246. package/Types/Telemetry/LlmConventions.ts +20 -1
  247. package/Types/Telemetry/LlmCostCatalog.ts +557 -0
  248. package/Types/Telemetry/ServiceType.ts +1 -0
  249. package/Types/Telemetry/TelemetryRetentionConfig.ts +5 -1
  250. package/Types/Telemetry/TelemetryType.ts +1 -0
  251. package/Types/TwoFactorAuthStatus.ts +42 -0
  252. package/Types/UserAuthenticationStatus.ts +18 -0
  253. package/UI/Components/ActionButton/ActionButtonSchema.ts +7 -0
  254. package/UI/Components/BulkUpdate/BulkArchiveActions.tsx +35 -2
  255. package/UI/Components/BulkUpdate/BulkLabelActions.tsx +34 -1
  256. package/UI/Components/BulkUpdate/BulkOwnerActions.tsx +45 -1
  257. package/UI/Components/BulkUpdate/BulkUpdateForm.tsx +3 -0
  258. package/UI/Components/Button/Button.tsx +37 -2
  259. package/UI/Components/Card/Card.tsx +6 -0
  260. package/UI/Components/CustomFields/CustomFieldsDetail.tsx +24 -1
  261. package/UI/Components/Dictionary/DictionaryFilterOperator.ts +57 -0
  262. package/UI/Components/DuplicateModel/DuplicateModel.tsx +16 -0
  263. package/UI/Components/Forms/ModelForm.tsx +54 -2
  264. package/UI/Components/List/ListRow.tsx +6 -0
  265. package/UI/Components/LogsViewer/components/ActiveFilterChips.tsx +34 -7
  266. package/UI/Components/LogsViewer/components/LogsFacetSidebar.tsx +7 -40
  267. package/UI/Components/LogsViewer/components/SavedViewsDropdown.tsx +155 -3
  268. package/UI/Components/ModelDelete/ModelDelete.tsx +20 -0
  269. package/UI/Components/ModelDetail/CardModelDetail.tsx +36 -23
  270. package/UI/Components/ModelList/ModelList.tsx +21 -2
  271. package/UI/Components/ModelList/StaticModelList.tsx +11 -0
  272. package/UI/Components/ModelTable/BaseModelTable.tsx +168 -62
  273. package/UI/Components/ModelTable/ModelTable.tsx +16 -10
  274. package/UI/Components/ModelTable/TableView.tsx +36 -4
  275. package/UI/Components/MoreMenu/MoreMenuItem.tsx +36 -4
  276. package/UI/Components/OrderedStatesList/Item.tsx +6 -0
  277. package/UI/Components/OrderedStatesList/OrderedStatesList.tsx +81 -47
  278. package/UI/Components/ResetObjectID/ResetObjectID.tsx +16 -0
  279. package/UI/Components/SavedViews/SavedViewsFacetSection.tsx +242 -0
  280. package/UI/Components/SavedViews/SavedViewsList.ts +168 -0
  281. package/UI/Components/SavedViews/SavedViewsSearchInput.tsx +46 -0
  282. package/UI/Components/SavedViews/SavedViewsShowMoreButton.tsx +44 -0
  283. package/UI/Components/Table/TableRow.tsx +12 -0
  284. package/UI/Components/TelemetryViewer/components/SavedViewsDropdown.tsx +152 -2
  285. package/UI/Types/UseComponentOutsideClick.ts +47 -0
  286. package/UI/Utils/PermissionGate.ts +277 -0
  287. package/Utils/Dashboard/Components/DashboardSecurityEventsFlowComponent.ts +84 -0
  288. package/Utils/Dashboard/Components/DashboardSecurityEventsListComponent.ts +110 -0
  289. package/Utils/Dashboard/Components/Index.ts +14 -0
  290. package/Utils/Measurement/MeasurementEvaluator.ts +359 -0
  291. package/Utils/Monitor/MonitorSummarySnapshotUtil.ts +1 -0
  292. package/Utils/Monitor/NetworkDeviceLinkRuleUtil.ts +93 -11
  293. package/Utils/NetworkDevice/DeviceHealthStateUtil.ts +231 -0
  294. package/Utils/SecurityEvent/GenericNormalizer.ts +208 -0
  295. package/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.ts +206 -0
  296. package/Utils/SecurityEvent/NormalizerHelpers.ts +263 -0
  297. package/Utils/SecurityEvent/OcsfNormalizer.ts +194 -0
  298. package/Utils/SecurityEvent/SecurityEventNormalizer.ts +82 -0
  299. package/Utils/SecurityEvent/Sigma/SigmaRuleParser.ts +579 -0
  300. package/Utils/SecurityEvent/UdmNormalizer.ts +442 -0
  301. package/Utils/Telemetry/CrossSignalScope.ts +46 -9
  302. package/Utils/Telemetry/LogErrorPattern.ts +350 -0
  303. package/build/dist/Models/AnalyticsModels/Index.js +10 -0
  304. package/build/dist/Models/AnalyticsModels/Index.js.map +1 -1
  305. package/build/dist/Models/AnalyticsModels/LogCountBaseline.js +159 -0
  306. package/build/dist/Models/AnalyticsModels/LogCountBaseline.js.map +1 -0
  307. package/build/dist/Models/AnalyticsModels/SecurityEvent.js +596 -0
  308. package/build/dist/Models/AnalyticsModels/SecurityEvent.js.map +1 -0
  309. package/build/dist/Models/AnalyticsModels/Span.js +24 -1
  310. package/build/dist/Models/AnalyticsModels/Span.js.map +1 -1
  311. package/build/dist/Models/AnalyticsModels/SpanCountBaseline.js +181 -0
  312. package/build/dist/Models/AnalyticsModels/SpanCountBaseline.js.map +1 -0
  313. package/build/dist/Models/DatabaseModels/Alert.js +43 -0
  314. package/build/dist/Models/DatabaseModels/Alert.js.map +1 -1
  315. package/build/dist/Models/DatabaseModels/AlertMeasurement.js +1143 -0
  316. package/build/dist/Models/DatabaseModels/AlertMeasurement.js.map +1 -0
  317. package/build/dist/Models/DatabaseModels/AlertMeasurementValue.js +523 -0
  318. package/build/dist/Models/DatabaseModels/AlertMeasurementValue.js.map +1 -0
  319. package/build/dist/Models/DatabaseModels/AlertStateTimeline.js +9 -2
  320. package/build/dist/Models/DatabaseModels/AlertStateTimeline.js.map +1 -1
  321. package/build/dist/Models/DatabaseModels/BillingPaymentMethod.js +10 -11
  322. package/build/dist/Models/DatabaseModels/BillingPaymentMethod.js.map +1 -1
  323. package/build/dist/Models/DatabaseModels/DetectionRule.js +517 -0
  324. package/build/dist/Models/DatabaseModels/DetectionRule.js.map +1 -0
  325. package/build/dist/Models/DatabaseModels/GoogleSecOpsConnection.js +410 -0
  326. package/build/dist/Models/DatabaseModels/GoogleSecOpsConnection.js.map +1 -0
  327. package/build/dist/Models/DatabaseModels/Incident.js +43 -0
  328. package/build/dist/Models/DatabaseModels/Incident.js.map +1 -1
  329. package/build/dist/Models/DatabaseModels/IncidentMeasurement.js +1143 -0
  330. package/build/dist/Models/DatabaseModels/IncidentMeasurement.js.map +1 -0
  331. package/build/dist/Models/DatabaseModels/IncidentMeasurementValue.js +523 -0
  332. package/build/dist/Models/DatabaseModels/IncidentMeasurementValue.js.map +1 -0
  333. package/build/dist/Models/DatabaseModels/IncidentStateTimeline.js +9 -2
  334. package/build/dist/Models/DatabaseModels/IncidentStateTimeline.js.map +1 -1
  335. package/build/dist/Models/DatabaseModels/IncomingCallPolicyLabelRule.js +36 -0
  336. package/build/dist/Models/DatabaseModels/IncomingCallPolicyLabelRule.js.map +1 -1
  337. package/build/dist/Models/DatabaseModels/IncomingCallPolicyOwnerRule.js +42 -0
  338. package/build/dist/Models/DatabaseModels/IncomingCallPolicyOwnerRule.js.map +1 -1
  339. package/build/dist/Models/DatabaseModels/Index.js +20 -0
  340. package/build/dist/Models/DatabaseModels/Index.js.map +1 -1
  341. package/build/dist/Models/DatabaseModels/Label.js +11 -0
  342. package/build/dist/Models/DatabaseModels/Label.js.map +1 -1
  343. package/build/dist/Models/DatabaseModels/LlmCostBudget.js +681 -0
  344. package/build/dist/Models/DatabaseModels/LlmCostBudget.js.map +1 -0
  345. package/build/dist/Models/DatabaseModels/LlmModelPrice.js +503 -0
  346. package/build/dist/Models/DatabaseModels/LlmModelPrice.js.map +1 -0
  347. package/build/dist/Models/DatabaseModels/LogSavedView.js +87 -0
  348. package/build/dist/Models/DatabaseModels/LogSavedView.js.map +1 -1
  349. package/build/dist/Models/DatabaseModels/MarketingConversion.js +224 -8
  350. package/build/dist/Models/DatabaseModels/MarketingConversion.js.map +1 -1
  351. package/build/dist/Models/DatabaseModels/MetricSavedView.js +59 -0
  352. package/build/dist/Models/DatabaseModels/MetricSavedView.js.map +1 -1
  353. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyLabelRule.js +36 -0
  354. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyLabelRule.js.map +1 -1
  355. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyOwnerRule.js +42 -0
  356. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyOwnerRule.js.map +1 -1
  357. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyScheduleLabelRule.js +36 -0
  358. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyScheduleLabelRule.js.map +1 -1
  359. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyScheduleOwnerRule.js +42 -0
  360. package/build/dist/Models/DatabaseModels/OnCallDutyPolicyScheduleOwnerRule.js.map +1 -1
  361. package/build/dist/Models/DatabaseModels/Probe.js +21 -0
  362. package/build/dist/Models/DatabaseModels/Probe.js.map +1 -1
  363. package/build/dist/Models/DatabaseModels/RunbookLabelRule.js +36 -0
  364. package/build/dist/Models/DatabaseModels/RunbookLabelRule.js.map +1 -1
  365. package/build/dist/Models/DatabaseModels/RunbookOwnerRule.js +42 -0
  366. package/build/dist/Models/DatabaseModels/RunbookOwnerRule.js.map +1 -1
  367. package/build/dist/Models/DatabaseModels/ScheduledMaintenanceMeasurement.js +1133 -0
  368. package/build/dist/Models/DatabaseModels/ScheduledMaintenanceMeasurement.js.map +1 -0
  369. package/build/dist/Models/DatabaseModels/ScheduledMaintenanceMeasurementValue.js +515 -0
  370. package/build/dist/Models/DatabaseModels/ScheduledMaintenanceMeasurementValue.js.map +1 -0
  371. package/build/dist/Models/DatabaseModels/ScheduledMaintenanceStateTimeline.js +9 -2
  372. package/build/dist/Models/DatabaseModels/ScheduledMaintenanceStateTimeline.js.map +1 -1
  373. package/build/dist/Models/DatabaseModels/StatusPageLabelRule.js +36 -0
  374. package/build/dist/Models/DatabaseModels/StatusPageLabelRule.js.map +1 -1
  375. package/build/dist/Models/DatabaseModels/StatusPageOwnerRule.js +42 -0
  376. package/build/dist/Models/DatabaseModels/StatusPageOwnerRule.js.map +1 -1
  377. package/build/dist/Models/DatabaseModels/TableView.js +15 -0
  378. package/build/dist/Models/DatabaseModels/TableView.js.map +1 -1
  379. package/build/dist/Models/DatabaseModels/Team.js +13 -0
  380. package/build/dist/Models/DatabaseModels/Team.js.map +1 -1
  381. package/build/dist/Models/DatabaseModels/TeamMember.js +8 -0
  382. package/build/dist/Models/DatabaseModels/TeamMember.js.map +1 -1
  383. package/build/dist/Models/DatabaseModels/TraceSavedView.js +52 -0
  384. package/build/dist/Models/DatabaseModels/TraceSavedView.js.map +1 -1
  385. package/build/dist/Models/DatabaseModels/WorkflowLabelRule.js +36 -0
  386. package/build/dist/Models/DatabaseModels/WorkflowLabelRule.js.map +1 -1
  387. package/build/dist/Models/DatabaseModels/WorkflowOwnerRule.js +42 -0
  388. package/build/dist/Models/DatabaseModels/WorkflowOwnerRule.js.map +1 -1
  389. package/build/dist/Server/API/TelemetryAPI.js +136 -0
  390. package/build/dist/Server/API/TelemetryAPI.js.map +1 -1
  391. package/build/dist/Server/API/UserAPI.js +75 -2
  392. package/build/dist/Server/API/UserAPI.js.map +1 -1
  393. package/build/dist/Server/EnvironmentConfig.js +29 -1
  394. package/build/dist/Server/EnvironmentConfig.js.map +1 -1
  395. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788000000000-AddDetectionRuleAndGoogleSecOpsConnection.js +36 -0
  396. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788000000000-AddDetectionRuleAndGoogleSecOpsConnection.js.map +1 -0
  397. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788100000000-AddMeasurements.js +162 -0
  398. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788100000000-AddMeasurements.js.map +1 -0
  399. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788200000000-AddLlmCostBudget.js +40 -0
  400. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788200000000-AddLlmCostBudget.js.map +1 -0
  401. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788300000000-AddLlmModelPrice.js +22 -0
  402. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788300000000-AddLlmModelPrice.js.map +1 -0
  403. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788400000000-AddMarketingConversionAttribution.js +52 -0
  404. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788400000000-AddMarketingConversionAttribution.js.map +1 -0
  405. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788500000000-RemoveLlmCostBudgetAlertColumns.js +38 -0
  406. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/1788500000000-RemoveLlmCostBudgetAlertColumns.js.map +1 -0
  407. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/Index.js +12 -0
  408. package/build/dist/Server/Infrastructure/Postgres/SchemaMigrations/Index.js.map +1 -1
  409. package/build/dist/Server/Middleware/IdentityRateLimit.js +491 -0
  410. package/build/dist/Server/Middleware/IdentityRateLimit.js.map +1 -0
  411. package/build/dist/Server/Services/AccessTokenService.js +13 -2
  412. package/build/dist/Server/Services/AccessTokenService.js.map +1 -1
  413. package/build/dist/Server/Services/AlertMeasurementService.js +250 -0
  414. package/build/dist/Server/Services/AlertMeasurementService.js.map +1 -0
  415. package/build/dist/Server/Services/AlertMeasurementValueService.js +400 -0
  416. package/build/dist/Server/Services/AlertMeasurementValueService.js.map +1 -0
  417. package/build/dist/Server/Services/AlertService.js +37 -0
  418. package/build/dist/Server/Services/AlertService.js.map +1 -1
  419. package/build/dist/Server/Services/AlertStateTimelineService.js +48 -0
  420. package/build/dist/Server/Services/AlertStateTimelineService.js.map +1 -1
  421. package/build/dist/Server/Services/DetectionRuleService.js +50 -0
  422. package/build/dist/Server/Services/DetectionRuleService.js.map +1 -0
  423. package/build/dist/Server/Services/GoogleSecOpsConnectionService.js +55 -0
  424. package/build/dist/Server/Services/GoogleSecOpsConnectionService.js.map +1 -0
  425. package/build/dist/Server/Services/IncidentMeasurementService.js +252 -0
  426. package/build/dist/Server/Services/IncidentMeasurementService.js.map +1 -0
  427. package/build/dist/Server/Services/IncidentMeasurementValueService.js +413 -0
  428. package/build/dist/Server/Services/IncidentMeasurementValueService.js.map +1 -0
  429. package/build/dist/Server/Services/IncidentService.js +41 -0
  430. package/build/dist/Server/Services/IncidentService.js.map +1 -1
  431. package/build/dist/Server/Services/IncidentStateTimelineService.js +50 -0
  432. package/build/dist/Server/Services/IncidentStateTimelineService.js.map +1 -1
  433. package/build/dist/Server/Services/Index.js +30 -0
  434. package/build/dist/Server/Services/Index.js.map +1 -1
  435. package/build/dist/Server/Services/LlmCostBudgetService.js +89 -0
  436. package/build/dist/Server/Services/LlmCostBudgetService.js.map +1 -0
  437. package/build/dist/Server/Services/LlmModelPriceService.js +163 -0
  438. package/build/dist/Server/Services/LlmModelPriceService.js.map +1 -0
  439. package/build/dist/Server/Services/LogAggregationService.js +709 -0
  440. package/build/dist/Server/Services/LogAggregationService.js.map +1 -1
  441. package/build/dist/Server/Services/LogCountBaselineService.js +112 -0
  442. package/build/dist/Server/Services/LogCountBaselineService.js.map +1 -0
  443. package/build/dist/Server/Services/MutableMetricService.js +28 -9
  444. package/build/dist/Server/Services/MutableMetricService.js.map +1 -1
  445. package/build/dist/Server/Services/ScheduledMaintenanceMeasurementService.js +254 -0
  446. package/build/dist/Server/Services/ScheduledMaintenanceMeasurementService.js.map +1 -0
  447. package/build/dist/Server/Services/ScheduledMaintenanceMeasurementValueService.js +434 -0
  448. package/build/dist/Server/Services/ScheduledMaintenanceMeasurementValueService.js.map +1 -0
  449. package/build/dist/Server/Services/ScheduledMaintenanceService.js +37 -0
  450. package/build/dist/Server/Services/ScheduledMaintenanceService.js.map +1 -1
  451. package/build/dist/Server/Services/ScheduledMaintenanceStateTimelineService.js +134 -0
  452. package/build/dist/Server/Services/ScheduledMaintenanceStateTimelineService.js.map +1 -1
  453. package/build/dist/Server/Services/SecurityEventService.js +64 -0
  454. package/build/dist/Server/Services/SecurityEventService.js.map +1 -0
  455. package/build/dist/Server/Services/SpanCountBaselineService.js +122 -0
  456. package/build/dist/Server/Services/SpanCountBaselineService.js.map +1 -0
  457. package/build/dist/Server/Services/StatusPageService.js +4 -3
  458. package/build/dist/Server/Services/StatusPageService.js.map +1 -1
  459. package/build/dist/Server/Services/TelemetryUsageBillingService.js +15 -3
  460. package/build/dist/Server/Services/TelemetryUsageBillingService.js.map +1 -1
  461. package/build/dist/Server/Services/UserService.js +262 -42
  462. package/build/dist/Server/Services/UserService.js.map +1 -1
  463. package/build/dist/Server/Services/UserTotpAuthService.js +0 -73
  464. package/build/dist/Server/Services/UserTotpAuthService.js.map +1 -1
  465. package/build/dist/Server/Services/UserWebAuthnService.js +1 -73
  466. package/build/dist/Server/Services/UserWebAuthnService.js.map +1 -1
  467. package/build/dist/Server/Types/Billing/MeteredPlan/AllMeteredPlans.js +13 -0
  468. package/build/dist/Server/Types/Billing/MeteredPlan/AllMeteredPlans.js.map +1 -1
  469. package/build/dist/Server/Types/Database/Permissions/TenantPermission.js +10 -0
  470. package/build/dist/Server/Types/Database/Permissions/TenantPermission.js.map +1 -1
  471. package/build/dist/Server/Types/Database/QueryHelper.js +1 -1
  472. package/build/dist/Server/Types/Database/QueryHelper.js.map +1 -1
  473. package/build/dist/Server/Utils/AI/Chat/ObservabilityChatPrompt.js +1 -1
  474. package/build/dist/Server/Utils/AI/Toolbox/Index.js +3 -0
  475. package/build/dist/Server/Utils/AI/Toolbox/Index.js.map +1 -1
  476. package/build/dist/Server/Utils/AI/Toolbox/SecurityEventTools.js +257 -0
  477. package/build/dist/Server/Utils/AI/Toolbox/SecurityEventTools.js.map +1 -0
  478. package/build/dist/Server/Utils/AnalyticsDatabase/StatementGenerator.js +13 -4
  479. package/build/dist/Server/Utils/AnalyticsDatabase/StatementGenerator.js.map +1 -1
  480. package/build/dist/Server/Utils/Attribution.js +77 -33
  481. package/build/dist/Server/Utils/Attribution.js.map +1 -1
  482. package/build/dist/Server/Utils/Marketing/ConversionUploadProvider.js +46 -9
  483. package/build/dist/Server/Utils/Marketing/ConversionUploadProvider.js.map +1 -1
  484. package/build/dist/Server/Utils/Marketing/Providers/GoogleAds.js +52 -8
  485. package/build/dist/Server/Utils/Marketing/Providers/GoogleAds.js.map +1 -1
  486. package/build/dist/Server/Utils/Marketing/Providers/LinkedIn.js +41 -17
  487. package/build/dist/Server/Utils/Marketing/Providers/LinkedIn.js.map +1 -1
  488. package/build/dist/Server/Utils/Marketing/Providers/Meta.js +42 -18
  489. package/build/dist/Server/Utils/Marketing/Providers/Meta.js.map +1 -1
  490. package/build/dist/Server/Utils/Marketing/Providers/MicrosoftAds.js +24 -11
  491. package/build/dist/Server/Utils/Marketing/Providers/MicrosoftAds.js.map +1 -1
  492. package/build/dist/Server/Utils/Marketing/Providers/Reddit.js +34 -15
  493. package/build/dist/Server/Utils/Marketing/Providers/Reddit.js.map +1 -1
  494. package/build/dist/Server/Utils/Measurement/MeasurementDefinitionValidator.js +109 -0
  495. package/build/dist/Server/Utils/Measurement/MeasurementDefinitionValidator.js.map +1 -0
  496. package/build/dist/Server/Utils/Measurement/MeasurementMetricWriter.js +131 -0
  497. package/build/dist/Server/Utils/Measurement/MeasurementMetricWriter.js.map +1 -0
  498. package/build/dist/Server/Utils/Monitor/Criteria/CountAnomaly.js +111 -0
  499. package/build/dist/Server/Utils/Monitor/Criteria/CountAnomaly.js.map +1 -0
  500. package/build/dist/Server/Utils/Monitor/Criteria/LogMonitorCriteria.js +84 -1
  501. package/build/dist/Server/Utils/Monitor/Criteria/LogMonitorCriteria.js.map +1 -1
  502. package/build/dist/Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria.js +35 -0
  503. package/build/dist/Server/Utils/Monitor/Criteria/SecurityEventsMonitorCriteria.js.map +1 -0
  504. package/build/dist/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.js +84 -1
  505. package/build/dist/Server/Utils/Monitor/Criteria/TraceMonitorCriteria.js.map +1 -1
  506. package/build/dist/Server/Utils/Monitor/MonitorCriteriaDataExtractor.js +7 -0
  507. package/build/dist/Server/Utils/Monitor/MonitorCriteriaDataExtractor.js.map +1 -1
  508. package/build/dist/Server/Utils/Monitor/MonitorCriteriaEvaluator.js +12 -0
  509. package/build/dist/Server/Utils/Monitor/MonitorCriteriaEvaluator.js.map +1 -1
  510. package/build/dist/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.js +9 -0
  511. package/build/dist/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.js.map +1 -1
  512. package/build/dist/Server/Utils/Monitor/MonitorResource.js +10 -0
  513. package/build/dist/Server/Utils/Monitor/MonitorResource.js.map +1 -1
  514. package/build/dist/Server/Utils/Monitor/MonitorStepResourceIdentity.js +6 -5
  515. package/build/dist/Server/Utils/Monitor/MonitorStepResourceIdentity.js.map +1 -1
  516. package/build/dist/Server/Utils/Monitor/MonitorStepsReferenceExtractor.js +1 -0
  517. package/build/dist/Server/Utils/Monitor/MonitorStepsReferenceExtractor.js.map +1 -1
  518. package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js +404 -0
  519. package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js.map +1 -0
  520. package/build/dist/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient.js +145 -0
  521. package/build/dist/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient.js.map +1 -0
  522. package/build/dist/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller.js +176 -0
  523. package/build/dist/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller.js.map +1 -0
  524. package/build/dist/Server/Utils/SecurityEvent/SecurityEventRow.js +69 -0
  525. package/build/dist/Server/Utils/SecurityEvent/SecurityEventRow.js.map +1 -0
  526. package/build/dist/Server/Utils/SecurityEvent/Sigma/SigmaClickhouseCompiler.js +493 -0
  527. package/build/dist/Server/Utils/SecurityEvent/Sigma/SigmaClickhouseCompiler.js.map +1 -0
  528. package/build/dist/Server/Utils/Telemetry/LlmCostBudgetEvaluator.js +317 -0
  529. package/build/dist/Server/Utils/Telemetry/LlmCostBudgetEvaluator.js.map +1 -0
  530. package/build/dist/Server/Utils/Telemetry/LlmSpan.js +56 -4
  531. package/build/dist/Server/Utils/Telemetry/LlmSpan.js.map +1 -1
  532. package/build/dist/Server/Utils/Telemetry/LogErrorPatternSql.js +112 -0
  533. package/build/dist/Server/Utils/Telemetry/LogErrorPatternSql.js.map +1 -0
  534. package/build/dist/Server/Utils/UserPermission/UserPermission.js +46 -1
  535. package/build/dist/Server/Utils/UserPermission/UserPermission.js.map +1 -1
  536. package/build/dist/Types/AI/AIChatTypes.js +1 -0
  537. package/build/dist/Types/AI/AIChatTypes.js.map +1 -1
  538. package/build/dist/Types/Alerts/AlertMeasurementAnchorType.js +15 -0
  539. package/build/dist/Types/Alerts/AlertMeasurementAnchorType.js.map +1 -0
  540. package/build/dist/Types/Alerts/AlertStateRole.js +12 -0
  541. package/build/dist/Types/Alerts/AlertStateRole.js.map +1 -0
  542. package/build/dist/Types/AnalyticsDatabase/AnalyticsTableName.js +16 -0
  543. package/build/dist/Types/AnalyticsDatabase/AnalyticsTableName.js.map +1 -1
  544. package/build/dist/Types/Dashboard/Chart/ChartType.js +1 -0
  545. package/build/dist/Types/Dashboard/Chart/ChartType.js.map +1 -1
  546. package/build/dist/Types/Dashboard/DashboardComponentType.js +2 -0
  547. package/build/dist/Types/Dashboard/DashboardComponentType.js.map +1 -1
  548. package/build/dist/Types/Dashboard/DashboardComponents/DashboardSecurityEventsFlowComponent.js +2 -0
  549. package/build/dist/Types/Dashboard/DashboardComponents/DashboardSecurityEventsFlowComponent.js.map +1 -0
  550. package/build/dist/Types/Dashboard/DashboardComponents/DashboardSecurityEventsListComponent.js +2 -0
  551. package/build/dist/Types/Dashboard/DashboardComponents/DashboardSecurityEventsListComponent.js.map +1 -0
  552. package/build/dist/Types/Incident/IncidentMeasurementAnchorType.js +29 -0
  553. package/build/dist/Types/Incident/IncidentMeasurementAnchorType.js.map +1 -0
  554. package/build/dist/Types/Incident/IncidentStateRole.js +15 -0
  555. package/build/dist/Types/Incident/IncidentStateRole.js.map +1 -0
  556. package/build/dist/Types/Marketing/Attribution.js +68 -0
  557. package/build/dist/Types/Marketing/Attribution.js.map +1 -0
  558. package/build/dist/Types/Marketing/MarketingConversion.js +36 -7
  559. package/build/dist/Types/Marketing/MarketingConversion.js.map +1 -1
  560. package/build/dist/Types/Measurement/MeasurementAggregationType.js +40 -0
  561. package/build/dist/Types/Measurement/MeasurementAggregationType.js.map +1 -0
  562. package/build/dist/Types/Measurement/MeasurementAnchorKind.js +22 -0
  563. package/build/dist/Types/Measurement/MeasurementAnchorKind.js.map +1 -0
  564. package/build/dist/Types/Measurement/MeasurementOccurrence.js +15 -0
  565. package/build/dist/Types/Measurement/MeasurementOccurrence.js.map +1 -0
  566. package/build/dist/Types/Measurement/MeasurementStatus.js +32 -0
  567. package/build/dist/Types/Measurement/MeasurementStatus.js.map +1 -0
  568. package/build/dist/Types/MeteredPlan/ProductType.js +1 -0
  569. package/build/dist/Types/MeteredPlan/ProductType.js.map +1 -1
  570. package/build/dist/Types/Monitor/CriteriaFilter.js +2 -0
  571. package/build/dist/Types/Monitor/CriteriaFilter.js.map +1 -1
  572. package/build/dist/Types/Monitor/MonitorCriteriaInstance.js +59 -0
  573. package/build/dist/Types/Monitor/MonitorCriteriaInstance.js.map +1 -1
  574. package/build/dist/Types/Monitor/MonitorStep.js +17 -0
  575. package/build/dist/Types/Monitor/MonitorStep.js.map +1 -1
  576. package/build/dist/Types/Monitor/MonitorStepSecurityEventsMonitor.js +64 -0
  577. package/build/dist/Types/Monitor/MonitorStepSecurityEventsMonitor.js.map +1 -0
  578. package/build/dist/Types/Monitor/MonitorType.js +19 -0
  579. package/build/dist/Types/Monitor/MonitorType.js.map +1 -1
  580. package/build/dist/Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse.js +2 -0
  581. package/build/dist/Types/Monitor/SecurityEventsMonitor/SecurityEventsMonitorResponse.js.map +1 -0
  582. package/build/dist/Types/Permission.js +347 -2
  583. package/build/dist/Types/Permission.js.map +1 -1
  584. package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceMeasurementAnchorType.js +19 -0
  585. package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceMeasurementAnchorType.js.map +1 -0
  586. package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceStateRole.js +17 -0
  587. package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceStateRole.js.map +1 -0
  588. package/build/dist/Types/SecurityEvent/NormalizedSecurityEvent.js +2 -0
  589. package/build/dist/Types/SecurityEvent/NormalizedSecurityEvent.js.map +1 -0
  590. package/build/dist/Types/SecurityEvent/OcsfEventClass.js +181 -0
  591. package/build/dist/Types/SecurityEvent/OcsfEventClass.js.map +1 -0
  592. package/build/dist/Types/SecurityEvent/OcsfSeverity.js +81 -0
  593. package/build/dist/Types/SecurityEvent/OcsfSeverity.js.map +1 -0
  594. package/build/dist/Types/SecurityEvent/SecurityEventFormat.js +21 -0
  595. package/build/dist/Types/SecurityEvent/SecurityEventFormat.js.map +1 -0
  596. package/build/dist/Types/SecurityEvent/SigmaRule.js +16 -0
  597. package/build/dist/Types/SecurityEvent/SigmaRule.js.map +1 -0
  598. package/build/dist/Types/Telemetry/LlmConventions.js +19 -1
  599. package/build/dist/Types/Telemetry/LlmConventions.js.map +1 -1
  600. package/build/dist/Types/Telemetry/LlmCostCatalog.js +484 -0
  601. package/build/dist/Types/Telemetry/LlmCostCatalog.js.map +1 -0
  602. package/build/dist/Types/Telemetry/ServiceType.js +1 -0
  603. package/build/dist/Types/Telemetry/ServiceType.js.map +1 -1
  604. package/build/dist/Types/Telemetry/TelemetryRetentionConfig.js.map +1 -1
  605. package/build/dist/Types/Telemetry/TelemetryType.js +1 -0
  606. package/build/dist/Types/Telemetry/TelemetryType.js.map +1 -1
  607. package/build/dist/Types/TwoFactorAuthStatus.js +41 -0
  608. package/build/dist/Types/TwoFactorAuthStatus.js.map +1 -0
  609. package/build/dist/UI/Components/BulkUpdate/BulkArchiveActions.js +16 -2
  610. package/build/dist/UI/Components/BulkUpdate/BulkArchiveActions.js.map +1 -1
  611. package/build/dist/UI/Components/BulkUpdate/BulkLabelActions.js +15 -1
  612. package/build/dist/UI/Components/BulkUpdate/BulkLabelActions.js.map +1 -1
  613. package/build/dist/UI/Components/BulkUpdate/BulkOwnerActions.js +20 -1
  614. package/build/dist/UI/Components/BulkUpdate/BulkOwnerActions.js.map +1 -1
  615. package/build/dist/UI/Components/BulkUpdate/BulkUpdateForm.js +1 -1
  616. package/build/dist/UI/Components/BulkUpdate/BulkUpdateForm.js.map +1 -1
  617. package/build/dist/UI/Components/Button/Button.js +22 -1
  618. package/build/dist/UI/Components/Button/Button.js.map +1 -1
  619. package/build/dist/UI/Components/Card/Card.js +1 -1
  620. package/build/dist/UI/Components/Card/Card.js.map +1 -1
  621. package/build/dist/UI/Components/CustomFields/CustomFieldsDetail.js +14 -1
  622. package/build/dist/UI/Components/CustomFields/CustomFieldsDetail.js.map +1 -1
  623. package/build/dist/UI/Components/Dictionary/DictionaryFilterOperator.js +47 -0
  624. package/build/dist/UI/Components/Dictionary/DictionaryFilterOperator.js.map +1 -1
  625. package/build/dist/UI/Components/DuplicateModel/DuplicateModel.js +8 -0
  626. package/build/dist/UI/Components/DuplicateModel/DuplicateModel.js.map +1 -1
  627. package/build/dist/UI/Components/Forms/ModelForm.js +40 -1
  628. package/build/dist/UI/Components/Forms/ModelForm.js.map +1 -1
  629. package/build/dist/UI/Components/List/ListRow.js +4 -1
  630. package/build/dist/UI/Components/List/ListRow.js.map +1 -1
  631. package/build/dist/UI/Components/LogsViewer/components/ActiveFilterChips.js +32 -7
  632. package/build/dist/UI/Components/LogsViewer/components/ActiveFilterChips.js.map +1 -1
  633. package/build/dist/UI/Components/LogsViewer/components/LogsFacetSidebar.js +2 -17
  634. package/build/dist/UI/Components/LogsViewer/components/LogsFacetSidebar.js.map +1 -1
  635. package/build/dist/UI/Components/LogsViewer/components/SavedViewsDropdown.js +93 -4
  636. package/build/dist/UI/Components/LogsViewer/components/SavedViewsDropdown.js.map +1 -1
  637. package/build/dist/UI/Components/ModelDelete/ModelDelete.js +13 -0
  638. package/build/dist/UI/Components/ModelDelete/ModelDelete.js.map +1 -1
  639. package/build/dist/UI/Components/ModelDetail/CardModelDetail.js +27 -11
  640. package/build/dist/UI/Components/ModelDetail/CardModelDetail.js.map +1 -1
  641. package/build/dist/UI/Components/ModelList/ModelList.js +13 -2
  642. package/build/dist/UI/Components/ModelList/ModelList.js.map +1 -1
  643. package/build/dist/UI/Components/ModelList/StaticModelList.js +4 -1
  644. package/build/dist/UI/Components/ModelList/StaticModelList.js.map +1 -1
  645. package/build/dist/UI/Components/ModelTable/BaseModelTable.js +101 -40
  646. package/build/dist/UI/Components/ModelTable/BaseModelTable.js.map +1 -1
  647. package/build/dist/UI/Components/ModelTable/ModelTable.js +9 -7
  648. package/build/dist/UI/Components/ModelTable/ModelTable.js.map +1 -1
  649. package/build/dist/UI/Components/ModelTable/TableView.js +32 -4
  650. package/build/dist/UI/Components/ModelTable/TableView.js.map +1 -1
  651. package/build/dist/UI/Components/MoreMenu/MoreMenuItem.js +19 -2
  652. package/build/dist/UI/Components/MoreMenu/MoreMenuItem.js.map +1 -1
  653. package/build/dist/UI/Components/OrderedStatesList/Item.js +4 -1
  654. package/build/dist/UI/Components/OrderedStatesList/Item.js.map +1 -1
  655. package/build/dist/UI/Components/OrderedStatesList/OrderedStatesList.js +33 -32
  656. package/build/dist/UI/Components/OrderedStatesList/OrderedStatesList.js.map +1 -1
  657. package/build/dist/UI/Components/ResetObjectID/ResetObjectID.js +8 -0
  658. package/build/dist/UI/Components/ResetObjectID/ResetObjectID.js.map +1 -1
  659. package/build/dist/UI/Components/SavedViews/SavedViewsFacetSection.js +98 -0
  660. package/build/dist/UI/Components/SavedViews/SavedViewsFacetSection.js.map +1 -0
  661. package/build/dist/UI/Components/SavedViews/SavedViewsList.js +99 -0
  662. package/build/dist/UI/Components/SavedViews/SavedViewsList.js.map +1 -0
  663. package/build/dist/UI/Components/SavedViews/SavedViewsSearchInput.js +17 -0
  664. package/build/dist/UI/Components/SavedViews/SavedViewsSearchInput.js.map +1 -0
  665. package/build/dist/UI/Components/SavedViews/SavedViewsShowMoreButton.js +15 -0
  666. package/build/dist/UI/Components/SavedViews/SavedViewsShowMoreButton.js.map +1 -0
  667. package/build/dist/UI/Components/Table/TableRow.js +8 -2
  668. package/build/dist/UI/Components/Table/TableRow.js.map +1 -1
  669. package/build/dist/UI/Components/TelemetryViewer/components/SavedViewsDropdown.js +93 -4
  670. package/build/dist/UI/Components/TelemetryViewer/components/SavedViewsDropdown.js.map +1 -1
  671. package/build/dist/UI/Types/UseComponentOutsideClick.js +39 -0
  672. package/build/dist/UI/Types/UseComponentOutsideClick.js.map +1 -1
  673. package/build/dist/UI/Utils/PermissionGate.js +164 -0
  674. package/build/dist/UI/Utils/PermissionGate.js.map +1 -0
  675. package/build/dist/Utils/Dashboard/Components/DashboardSecurityEventsFlowComponent.js +70 -0
  676. package/build/dist/Utils/Dashboard/Components/DashboardSecurityEventsFlowComponent.js.map +1 -0
  677. package/build/dist/Utils/Dashboard/Components/DashboardSecurityEventsListComponent.js +92 -0
  678. package/build/dist/Utils/Dashboard/Components/DashboardSecurityEventsListComponent.js.map +1 -0
  679. package/build/dist/Utils/Dashboard/Components/Index.js +8 -0
  680. package/build/dist/Utils/Dashboard/Components/Index.js.map +1 -1
  681. package/build/dist/Utils/Measurement/MeasurementEvaluator.js +210 -0
  682. package/build/dist/Utils/Measurement/MeasurementEvaluator.js.map +1 -0
  683. package/build/dist/Utils/Monitor/MonitorSummarySnapshotUtil.js +1 -0
  684. package/build/dist/Utils/Monitor/MonitorSummarySnapshotUtil.js.map +1 -1
  685. package/build/dist/Utils/Monitor/NetworkDeviceLinkRuleUtil.js +51 -10
  686. package/build/dist/Utils/Monitor/NetworkDeviceLinkRuleUtil.js.map +1 -1
  687. package/build/dist/Utils/NetworkDevice/DeviceHealthStateUtil.js +108 -0
  688. package/build/dist/Utils/NetworkDevice/DeviceHealthStateUtil.js.map +1 -0
  689. package/build/dist/Utils/SecurityEvent/GenericNormalizer.js +176 -0
  690. package/build/dist/Utils/SecurityEvent/GenericNormalizer.js.map +1 -0
  691. package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js +146 -0
  692. package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js.map +1 -0
  693. package/build/dist/Utils/SecurityEvent/NormalizerHelpers.js +196 -0
  694. package/build/dist/Utils/SecurityEvent/NormalizerHelpers.js.map +1 -0
  695. package/build/dist/Utils/SecurityEvent/OcsfNormalizer.js +136 -0
  696. package/build/dist/Utils/SecurityEvent/OcsfNormalizer.js.map +1 -0
  697. package/build/dist/Utils/SecurityEvent/SecurityEventNormalizer.js +64 -0
  698. package/build/dist/Utils/SecurityEvent/SecurityEventNormalizer.js.map +1 -0
  699. package/build/dist/Utils/SecurityEvent/Sigma/SigmaRuleParser.js +388 -0
  700. package/build/dist/Utils/SecurityEvent/Sigma/SigmaRuleParser.js.map +1 -0
  701. package/build/dist/Utils/SecurityEvent/UdmNormalizer.js +328 -0
  702. package/build/dist/Utils/SecurityEvent/UdmNormalizer.js.map +1 -0
  703. package/build/dist/Utils/Telemetry/CrossSignalScope.js +29 -7
  704. package/build/dist/Utils/Telemetry/CrossSignalScope.js.map +1 -1
  705. package/build/dist/Utils/Telemetry/LogErrorPattern.js +284 -0
  706. package/build/dist/Utils/Telemetry/LogErrorPattern.js.map +1 -0
  707. package/package.json +3 -1
@@ -0,0 +1,493 @@
1
+ import BadDataException from "../../../../Types/Exception/BadDataException";
2
+ import TableColumnType from "../../../../Types/AnalyticsDatabase/TableColumnType";
3
+ import SigmaRuleParser from "../../../../Utils/SecurityEvent/Sigma/SigmaRuleParser";
4
+ import { SQL, Statement } from "../../AnalyticsDatabase/Statement";
5
+ /*
6
+ * Sigma rule -> ClickHouse boolean expression over the SecurityEvent
7
+ * table.
8
+ *
9
+ * Every user-controlled value is bound as a typed query parameter through
10
+ * Statement — nothing from the rule is ever concatenated into SQL text.
11
+ * Column references come exclusively from the fixed maps below, so a
12
+ * hostile field name can at worst address an attributes[] key.
13
+ *
14
+ * Sigma matching is case-insensitive by default (ILIKE); the `cased`
15
+ * modifier switches to exact matching. Sigma wildcards (* ?) translate to
16
+ * LIKE wildcards (% _), with LIKE metacharacters in literal text escaped.
17
+ */
18
+ const TEXT_COLUMNS = new Set([
19
+ "eventUid",
20
+ "categoryName",
21
+ "className",
22
+ "activityName",
23
+ "severityName",
24
+ "statusName",
25
+ "message",
26
+ "vendorName",
27
+ "productName",
28
+ "ruleId",
29
+ "ruleName",
30
+ "principalUser",
31
+ "principalHost",
32
+ "principalIp",
33
+ "principalProcess",
34
+ "targetUser",
35
+ "targetHost",
36
+ "targetIp",
37
+ "targetResource",
38
+ ]);
39
+ const NUMBER_COLUMNS = new Set([
40
+ "categoryUid",
41
+ "classUid",
42
+ "severityId",
43
+ "targetPort",
44
+ ]);
45
+ const ARRAY_COLUMNS = new Set([
46
+ "mitreTactics",
47
+ "mitreTechniques",
48
+ "observables",
49
+ ]);
50
+ /*
51
+ * Common Sigma field spellings -> SecurityEvent columns. Lowercased keys.
52
+ * Anything that resolves to none of these becomes an attributes[] lookup
53
+ * under its original spelling — which is exactly the flattened source
54
+ * payload key, so rules written against raw UDM/OCSF field paths work.
55
+ */
56
+ const FIELD_ALIASES = {
57
+ user: "principalUser",
58
+ username: "principalUser",
59
+ "user.name": "principalUser",
60
+ targetuser: "targetUser",
61
+ target_user: "targetUser",
62
+ host: "principalHost",
63
+ hostname: "principalHost",
64
+ computer: "principalHost",
65
+ computername: "principalHost",
66
+ "host.name": "principalHost",
67
+ targethost: "targetHost",
68
+ target_host: "targetHost",
69
+ src_ip: "principalIp",
70
+ source_ip: "principalIp",
71
+ sourceip: "principalIp",
72
+ sourceaddress: "principalIp",
73
+ "source.ip": "principalIp",
74
+ dst_ip: "targetIp",
75
+ destination_ip: "targetIp",
76
+ destinationip: "targetIp",
77
+ destinationaddress: "targetIp",
78
+ "destination.ip": "targetIp",
79
+ target_ip: "targetIp",
80
+ dst_port: "targetPort",
81
+ destination_port: "targetPort",
82
+ destinationport: "targetPort",
83
+ target_port: "targetPort",
84
+ commandline: "principalProcess",
85
+ command_line: "principalProcess",
86
+ cmdline: "principalProcess",
87
+ processcommandline: "principalProcess",
88
+ "process.command_line": "principalProcess",
89
+ image: "principalProcess",
90
+ msg: "message",
91
+ };
92
+ export function resolveSigmaField(field) {
93
+ const lowered = field.toLowerCase();
94
+ const aliased = FIELD_ALIASES[lowered];
95
+ const canonical = aliased ||
96
+ [...TEXT_COLUMNS, ...NUMBER_COLUMNS, ...ARRAY_COLUMNS].find((column) => {
97
+ return column.toLowerCase() === lowered;
98
+ });
99
+ if (canonical) {
100
+ if (NUMBER_COLUMNS.has(canonical)) {
101
+ return { kind: "numberColumn", column: canonical };
102
+ }
103
+ if (ARRAY_COLUMNS.has(canonical)) {
104
+ return { kind: "arrayColumn", column: canonical };
105
+ }
106
+ return { kind: "textColumn", column: canonical };
107
+ }
108
+ return { kind: "attribute", attributeKey: field };
109
+ }
110
+ /*
111
+ * Sigma pattern -> LIKE pattern. Sigma: `*` any run, `?` one char, `\`
112
+ * escapes. LIKE: `%` any run, `_` one char, `\` escapes.
113
+ */
114
+ export function sigmaPatternToLike(value) {
115
+ let pattern = "";
116
+ let hasWildcard = false;
117
+ let index = 0;
118
+ while (index < value.length) {
119
+ const char = value[index];
120
+ if (char === "\\" && index + 1 < value.length) {
121
+ const next = value[index + 1];
122
+ // Escaped sigma wildcard or backslash -> literal char, LIKE-escaped.
123
+ pattern += escapeLikeLiteral(next);
124
+ index += 2;
125
+ continue;
126
+ }
127
+ if (char === "*") {
128
+ pattern += "%";
129
+ hasWildcard = true;
130
+ }
131
+ else if (char === "?") {
132
+ pattern += "_";
133
+ hasWildcard = true;
134
+ }
135
+ else {
136
+ pattern += escapeLikeLiteral(char);
137
+ }
138
+ index++;
139
+ }
140
+ return { pattern, hasWildcard };
141
+ }
142
+ function escapeLikeLiteral(char) {
143
+ if (char === "%" || char === "_" || char === "\\") {
144
+ return `\\${char}`;
145
+ }
146
+ return char;
147
+ }
148
+ function textParam(value) {
149
+ return SQL `${{ type: TableColumnType.Text, value: value }}`;
150
+ }
151
+ /*
152
+ * Numeric literals bind as Decimal (ClickHouse `Double`) rather than Number
153
+ * (`Int32`). Sigma rules routinely carry fractional thresholds — a
154
+ * `|gte: 0.5` on an attribute compiles to a toFloat64OrNull comparison, and
155
+ * an Int32 bind cannot parse `0.5`, failing the whole query at runtime.
156
+ * Double represents every Int32 exactly, so the integer cases (port numbers,
157
+ * severity ids, `1 of them` quantifiers) are unaffected.
158
+ */
159
+ function numberParam(value) {
160
+ return SQL `${{ type: TableColumnType.Decimal, value: value }}`;
161
+ }
162
+ function group(inner) {
163
+ const statement = SQL `(`;
164
+ statement.append(inner);
165
+ statement.append(")");
166
+ return statement;
167
+ }
168
+ function joinStatements(parts, separator) {
169
+ const statement = new Statement();
170
+ parts.forEach((part, index) => {
171
+ if (index > 0) {
172
+ statement.append(separator);
173
+ }
174
+ statement.append(group(part));
175
+ });
176
+ return statement;
177
+ }
178
+ /*
179
+ * SQL expression for one Sigma field reference — a bare column for the
180
+ * fixed column sets, an attributes[] lookup otherwise. Used by the
181
+ * detection engine to build GROUP BY expressions from a rule's
182
+ * groupByField.
183
+ */
184
+ export function buildSigmaFieldExpression(field) {
185
+ const resolved = resolveSigmaField(field);
186
+ if (resolved.kind === "attribute") {
187
+ const statement = SQL `attributes[`;
188
+ statement.append(textParam(resolved.attributeKey));
189
+ statement.append("]");
190
+ return statement;
191
+ }
192
+ if (resolved.kind === "numberColumn") {
193
+ return new Statement([`toString(${resolved.column})`], []);
194
+ }
195
+ if (resolved.kind === "arrayColumn") {
196
+ return new Statement([`arrayStringConcat(${resolved.column}, ',')`], []);
197
+ }
198
+ return new Statement([resolved.column], []);
199
+ }
200
+ export default class SigmaClickhouseCompiler {
201
+ /*
202
+ * Compile a rule (or raw YAML) into a boolean SQL expression. The
203
+ * result is a fragment — the caller wraps it with projectId and time
204
+ * window predicates.
205
+ */
206
+ static compileYaml(ruleYaml) {
207
+ return this.compile(SigmaRuleParser.parse(ruleYaml));
208
+ }
209
+ static compile(rule) {
210
+ return this.compileConditionNode(rule.condition, rule.selections);
211
+ }
212
+ static compileConditionNode(node, selections) {
213
+ switch (node.kind) {
214
+ case "selection": {
215
+ const selection = selections.find((candidate) => {
216
+ return candidate.name === node.name;
217
+ });
218
+ if (!selection) {
219
+ throw new BadDataException(`Sigma compiler: unknown selection "${node.name}".`);
220
+ }
221
+ return group(this.compileSelection(selection));
222
+ }
223
+ case "and": {
224
+ return joinStatements(node.children.map((child) => {
225
+ return this.compileConditionNode(child, selections);
226
+ }), " AND ");
227
+ }
228
+ case "or": {
229
+ return joinStatements(node.children.map((child) => {
230
+ return this.compileConditionNode(child, selections);
231
+ }), " OR ");
232
+ }
233
+ case "not": {
234
+ const statement = SQL `NOT `;
235
+ statement.append(group(this.compileConditionNode(node.child, selections)));
236
+ return statement;
237
+ }
238
+ case "of": {
239
+ const matchedNames = SigmaRuleParser.matchSelectionNames(node.pattern, selections.map((selection) => {
240
+ return selection.name;
241
+ }));
242
+ const compiled = matchedNames.map((name) => {
243
+ return this.compileConditionNode({ kind: "selection", name }, selections);
244
+ });
245
+ if (compiled.length === 0) {
246
+ throw new BadDataException(`Sigma compiler: pattern "${node.pattern}" matches no selection.`);
247
+ }
248
+ if (node.quantifier === "any") {
249
+ return joinStatements(compiled, " OR ");
250
+ }
251
+ if (node.quantifier === "all") {
252
+ return joinStatements(compiled, " AND ");
253
+ }
254
+ /*
255
+ * `N of x*`: count the true branches. toUInt8 over each boolean,
256
+ * summed, compared to the threshold.
257
+ */
258
+ const statement = SQL `(`;
259
+ compiled.forEach((part, index) => {
260
+ if (index > 0) {
261
+ statement.append(" + ");
262
+ }
263
+ statement.append("toUInt8(");
264
+ statement.append(group(part));
265
+ statement.append(")");
266
+ });
267
+ statement.append(") >= ");
268
+ statement.append(numberParam(node.quantifier));
269
+ return statement;
270
+ }
271
+ default: {
272
+ throw new BadDataException("Sigma compiler: unknown condition node.");
273
+ }
274
+ }
275
+ }
276
+ static compileSelection(selection) {
277
+ if (selection.keywords.length > 0) {
278
+ // Keywords match the event message, OR semantics.
279
+ return joinStatements(selection.keywords.map((keyword) => {
280
+ const { pattern } = sigmaPatternToLike(keyword);
281
+ const statement = SQL `message ILIKE `;
282
+ statement.append(textParam(`%${pattern}%`));
283
+ return statement;
284
+ }), " OR ");
285
+ }
286
+ // Field maps OR together; fields inside one map AND together.
287
+ return joinStatements(selection.fieldMaps.map((requirements) => {
288
+ return joinStatements(requirements.map((requirement) => {
289
+ return this.compileRequirement(requirement);
290
+ }), " AND ");
291
+ }), " OR ");
292
+ }
293
+ static compileRequirement(requirement) {
294
+ const resolved = resolveSigmaField(requirement.field);
295
+ const isAll = requirement.modifiers.includes("all");
296
+ let values = requirement.values;
297
+ /*
298
+ * windash: Windows tools accept both `-flag` and `/flag`; match both
299
+ * spellings for every value.
300
+ */
301
+ if (requirement.modifiers.includes("windash")) {
302
+ const expanded = [];
303
+ for (const value of values) {
304
+ const text = String(value);
305
+ expanded.push(text);
306
+ if (text.includes("-")) {
307
+ expanded.push(text.replace(/-/g, "/"));
308
+ }
309
+ }
310
+ values = expanded;
311
+ }
312
+ const parts = values.map((value) => {
313
+ return this.compileSingleValue(resolved, requirement, value);
314
+ });
315
+ return joinStatements(parts, isAll ? " AND " : " OR ");
316
+ }
317
+ static fieldExpression(resolved) {
318
+ if (resolved.kind === "attribute") {
319
+ const statement = SQL `attributes[`;
320
+ statement.append(textParam(resolved.attributeKey));
321
+ statement.append("]");
322
+ return statement;
323
+ }
324
+ // Column names come from the fixed sets above — never user input.
325
+ return new Statement([resolved.column], []);
326
+ }
327
+ static compileSingleValue(resolved, requirement, value) {
328
+ const modifiers = requirement.modifiers;
329
+ const fieldExpr = this.fieldExpression(resolved);
330
+ // null: the field is absent.
331
+ if (value === null) {
332
+ if (resolved.kind === "attribute") {
333
+ const statement = SQL `NOT mapContains(attributes, `;
334
+ statement.append(textParam(resolved.attributeKey));
335
+ statement.append(")");
336
+ return statement;
337
+ }
338
+ if (resolved.kind === "numberColumn") {
339
+ const statement = new Statement();
340
+ statement.append(fieldExpr);
341
+ statement.append(" = 0");
342
+ return statement;
343
+ }
344
+ const statement = new Statement();
345
+ statement.append(fieldExpr);
346
+ statement.append(" = ''");
347
+ return statement;
348
+ }
349
+ // exists modifier: value is true/false.
350
+ if (modifiers.includes("exists")) {
351
+ const wantsExists = value === true || value === "true";
352
+ if (resolved.kind === "attribute") {
353
+ const statement = wantsExists
354
+ ? SQL `mapContains(attributes, `
355
+ : SQL `NOT mapContains(attributes, `;
356
+ statement.append(textParam(resolved.attributeKey));
357
+ statement.append(")");
358
+ return statement;
359
+ }
360
+ const statement = new Statement();
361
+ statement.append(fieldExpr);
362
+ statement.append(wantsExists ? " != ''" : " = ''");
363
+ return statement;
364
+ }
365
+ // Regular expression matching.
366
+ if (modifiers.includes("re")) {
367
+ const statement = SQL `match(`;
368
+ statement.append(this.asStringExpression(resolved, fieldExpr));
369
+ statement.append(", ");
370
+ statement.append(textParam(String(value)));
371
+ statement.append(")");
372
+ return statement;
373
+ }
374
+ // CIDR matching on IP-carrying fields.
375
+ if (modifiers.includes("cidr")) {
376
+ const statement = SQL `isIPAddressInRange(`;
377
+ statement.append(this.asStringExpression(resolved, fieldExpr));
378
+ statement.append(", ");
379
+ statement.append(textParam(String(value)));
380
+ statement.append(")");
381
+ return statement;
382
+ }
383
+ // Numeric comparisons.
384
+ const comparison = modifiers.includes("gt")
385
+ ? ">"
386
+ : modifiers.includes("gte")
387
+ ? ">="
388
+ : modifiers.includes("lt")
389
+ ? "<"
390
+ : modifiers.includes("lte")
391
+ ? "<="
392
+ : null;
393
+ if (comparison) {
394
+ const numeric = Number(value);
395
+ if (!Number.isFinite(numeric)) {
396
+ throw new BadDataException(`Sigma compiler: field "${requirement.field}" uses a numeric comparison with non-numeric value "${String(value)}".`);
397
+ }
398
+ const statement = new Statement();
399
+ if (resolved.kind === "numberColumn") {
400
+ statement.append(fieldExpr);
401
+ }
402
+ else {
403
+ statement.append("toFloat64OrNull(");
404
+ statement.append(this.asStringExpression(resolved, fieldExpr));
405
+ statement.append(")");
406
+ }
407
+ statement.append(` ${comparison} `);
408
+ statement.append(numberParam(numeric));
409
+ return statement;
410
+ }
411
+ // Array columns: membership (or fuzzy membership with contains).
412
+ if (resolved.kind === "arrayColumn") {
413
+ if (modifiers.includes("contains")) {
414
+ const { pattern } = sigmaPatternToLike(String(value));
415
+ const statement = new Statement();
416
+ statement.append(`arrayExists(x -> x ILIKE `);
417
+ statement.append(textParam(`%${pattern}%`));
418
+ statement.append(`, ${resolved.column})`);
419
+ return statement;
420
+ }
421
+ const statement = new Statement([`has(${resolved.column}, `]);
422
+ statement.append(textParam(String(value)));
423
+ statement.append(")");
424
+ return statement;
425
+ }
426
+ // Numeric column with a plain numeric value: numeric equality.
427
+ if (resolved.kind === "numberColumn" &&
428
+ typeof value === "number" &&
429
+ !modifiers.includes("contains") &&
430
+ !modifiers.includes("startswith") &&
431
+ !modifiers.includes("endswith")) {
432
+ const statement = new Statement();
433
+ statement.append(fieldExpr);
434
+ statement.append(" = ");
435
+ statement.append(numberParam(value));
436
+ return statement;
437
+ }
438
+ // String matching: equality/contains/startswith/endswith.
439
+ const caseSensitive = modifiers.includes("cased");
440
+ const raw = String(value);
441
+ const { pattern, hasWildcard } = sigmaPatternToLike(raw);
442
+ let likePattern = pattern;
443
+ if (modifiers.includes("contains")) {
444
+ likePattern = `%${pattern}%`;
445
+ }
446
+ else if (modifiers.includes("startswith")) {
447
+ likePattern = `${pattern}%`;
448
+ }
449
+ else if (modifiers.includes("endswith")) {
450
+ likePattern = `%${pattern}`;
451
+ }
452
+ else if (!hasWildcard) {
453
+ /*
454
+ * Plain equality, no wildcards: use = for exact matching, or
455
+ * case-folded = for the default case-insensitive semantics. Cheaper
456
+ * than LIKE and keeps bloom-filter indexes usable for the cased
457
+ * variant.
458
+ */
459
+ const statement = new Statement();
460
+ if (caseSensitive) {
461
+ statement.append(this.asStringExpression(resolved, fieldExpr));
462
+ statement.append(" = ");
463
+ statement.append(textParam(raw));
464
+ return statement;
465
+ }
466
+ statement.append("lowerUTF8(");
467
+ statement.append(this.asStringExpression(resolved, fieldExpr));
468
+ statement.append(") = ");
469
+ statement.append(textParam(raw.toLowerCase()));
470
+ return statement;
471
+ }
472
+ const statement = new Statement();
473
+ statement.append(this.asStringExpression(resolved, fieldExpr));
474
+ statement.append(caseSensitive ? " LIKE " : " ILIKE ");
475
+ statement.append(textParam(likePattern));
476
+ return statement;
477
+ }
478
+ /*
479
+ * Wrap number columns in toString so string operators apply; text
480
+ * expressions pass through.
481
+ */
482
+ static asStringExpression(resolved, fieldExpr) {
483
+ if (resolved.kind === "numberColumn") {
484
+ const statement = new Statement();
485
+ statement.append("toString(");
486
+ statement.append(fieldExpr);
487
+ statement.append(")");
488
+ return statement;
489
+ }
490
+ return fieldExpr;
491
+ }
492
+ }
493
+ //# sourceMappingURL=SigmaClickhouseCompiler.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"SigmaClickhouseCompiler.js","sourceRoot":"","sources":["../../../../../../Server/Utils/SecurityEvent/Sigma/SigmaClickhouseCompiler.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAE5E,OAAO,eAAe,MAAM,qDAAqD,CAAC;AAMlF,OAAO,eAAe,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AAEH,MAAM,YAAY,GAAgB,IAAI,GAAG,CAAS;IAChD,UAAU;IACV,cAAc;IACd,WAAW;IACX,cAAc;IACd,cAAc;IACd,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,UAAU;IACV,eAAe;IACf,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAS;IAClD,aAAa;IACb,UAAU;IACV,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAS;IACjD,cAAc;IACd,iBAAiB;IACjB,aAAa;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,YAAY;IACzB,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,eAAe;IACzB,QAAQ,EAAE,eAAe;IACzB,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,YAAY;IACzB,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAE,UAAU;IAClB,cAAc,EAAE,UAAU;IAC1B,aAAa,EAAE,UAAU;IACzB,kBAAkB,EAAE,UAAU;IAC9B,gBAAgB,EAAE,UAAU;IAC5B,SAAS,EAAE,UAAU;IACrB,QAAQ,EAAE,YAAY;IACtB,gBAAgB,EAAE,YAAY;IAC9B,eAAe,EAAE,YAAY;IAC7B,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,kBAAkB;IAC/B,YAAY,EAAE,kBAAkB;IAChC,OAAO,EAAE,kBAAkB;IAC3B,kBAAkB,EAAE,kBAAkB;IACtC,sBAAsB,EAAE,kBAAkB;IAC1C,KAAK,EAAE,kBAAkB;IACzB,GAAG,EAAE,SAAS;CACf,CAAC;AAQF,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAW,KAAK,CAAC,WAAW,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAuB,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GACb,OAAO;QACP,CAAC,GAAG,YAAY,EAAE,GAAG,cAAc,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CACzD,CAAC,MAAc,EAAW,EAAE;YAC1B,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;QAC1C,CAAC,CACF,CAAC;IAEJ,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAI9C,IAAI,OAAO,GAAW,EAAE,CAAC;IACzB,IAAI,WAAW,GAAY,KAAK,CAAC;IACjC,IAAI,KAAK,GAAW,CAAC,CAAC;IAEtB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAW,KAAK,CAAC,KAAK,CAAE,CAAC;QAEnC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAW,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;YACvC,qEAAqE;YACrE,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO,IAAI,GAAG,CAAC;YACf,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO,IAAI,GAAG,CAAC;YACf,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,EAAE,CAAC;IACV,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,KAAK,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,GAAG,CAAA,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,GAAG,CAAA,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,KAAgB;IAC7B,MAAM,SAAS,GAAc,GAAG,CAAA,GAAG,CAAC;IACpC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAuB,EAAE,SAAiB;IAChE,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;IAE7C,KAAK,CAAC,OAAO,CAAC,CAAC,IAAe,EAAE,KAAa,EAAQ,EAAE;QACrD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAEzD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAc,GAAG,CAAA,aAAa,CAAC;QAC9C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACnD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACrC,OAAO,IAAI,SAAS,CAAC,CAAC,YAAY,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,IAAI,SAAS,CAAC,CAAC,qBAAqB,QAAQ,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,uBAAuB;IAC1C;;;;OAIG;IACI,MAAM,CAAC,WAAW,CAAC,QAAgB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IAEM,MAAM,CAAC,OAAO,CAAC,IAAe;QACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAEO,MAAM,CAAC,oBAAoB,CACjC,IAAwB,EACxB,UAAiC;QAEjC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,SAAS,GAA+B,UAAU,CAAC,IAAI,CAC3D,CAAC,SAAyB,EAAW,EAAE;oBACrC,OAAO,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;gBACtC,CAAC,CACF,CAAC;gBAEF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,IAAI,CAAC,IAAI,IAAI,CACpD,CAAC;gBACJ,CAAC;gBAED,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,OAAO,cAAc,CACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAyB,EAAa,EAAE;oBACzD,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBACtD,CAAC,CAAC,EACF,OAAO,CACR,CAAC;YACJ,CAAC;YAED,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,OAAO,cAAc,CACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAyB,EAAa,EAAE;oBACzD,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBACtD,CAAC,CAAC,EACF,MAAM,CACP,CAAC;YACJ,CAAC;YAED,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,SAAS,GAAc,GAAG,CAAA,MAAM,CAAC;gBACvC,SAAS,CAAC,MAAM,CACd,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CACzD,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,MAAM,YAAY,GAAkB,eAAe,CAAC,mBAAmB,CACrE,IAAI,CAAC,OAAO,EACZ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAyB,EAAU,EAAE;oBACnD,OAAO,SAAS,CAAC,IAAI,CAAC;gBACxB,CAAC,CAAC,CACH,CAAC;gBAEF,MAAM,QAAQ,GAAqB,YAAY,CAAC,GAAG,CACjD,CAAC,IAAY,EAAa,EAAE;oBAC1B,OAAO,IAAI,CAAC,oBAAoB,CAC9B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAC3B,UAAU,CACX,CAAC;gBACJ,CAAC,CACF,CAAC;gBAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CACxB,4BAA4B,IAAI,CAAC,OAAO,yBAAyB,CAClE,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;oBAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1C,CAAC;gBAED,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;oBAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC3C,CAAC;gBAED;;;mBAGG;gBACH,MAAM,SAAS,GAAc,GAAG,CAAA,GAAG,CAAC;gBACpC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAe,EAAE,KAAa,EAAQ,EAAE;oBACxD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBACd,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC1B,CAAC;oBACD,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;oBAC7B,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC9B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC,CAAC,CAAC;gBACH,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1B,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC/C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,SAAyB;QACvD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,kDAAkD;YAClD,OAAO,cAAc,CACnB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAAa,EAAE;gBACpD,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAc,GAAG,CAAA,gBAAgB,CAAC;gBACjD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;gBAC5C,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,EACF,MAAM,CACP,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,OAAO,cAAc,CACnB,SAAS,CAAC,SAAS,CAAC,GAAG,CACrB,CAAC,YAA0C,EAAa,EAAE;YACxD,OAAO,cAAc,CACnB,YAAY,CAAC,GAAG,CACd,CAAC,WAAkC,EAAa,EAAE;gBAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC9C,CAAC,CACF,EACD,OAAO,CACR,CAAC;QACJ,CAAC,CACF,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAC/B,WAAkC;QAElC,MAAM,QAAQ,GAAkB,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,KAAK,GAAY,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE7D,IAAI,MAAM,GAAqB,WAAW,CAAC,MAAM,CAAC;QAElD;;;WAGG;QACH,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAqB,EAAE,CAAC;YACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;QAED,MAAM,KAAK,GAAqB,MAAM,CAAC,GAAG,CACxC,CAAC,KAAgB,EAAa,EAAE;YAC9B,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC,CACF,CAAC;QAEF,OAAO,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,QAAuB;QACpD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,SAAS,GAAc,GAAG,CAAA,aAAa,CAAC;YAC9C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YACnD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,kEAAkE;QAClE,OAAO,IAAI,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAC/B,QAAuB,EACvB,WAAkC,EAClC,KAAgB;QAEhB,MAAM,SAAS,GAAkB,WAAW,CAAC,SAAS,CAAC;QACvD,MAAM,SAAS,GAAc,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAE5D,6BAA6B;QAC7B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAc,GAAG,CAAA,8BAA8B,CAAC;gBAC/D,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;gBACnD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;gBAC7C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;YAC7C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wCAAwC;QACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,WAAW,GAAY,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;YAEhE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAc,WAAW;oBACtC,CAAC,CAAC,GAAG,CAAA,0BAA0B;oBAC/B,CAAC,CAAC,GAAG,CAAA,8BAA8B,CAAC;gBACtC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;gBACnD,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;YAC7C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+BAA+B;QAC/B,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAc,GAAG,CAAA,QAAQ,CAAC;YACzC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/D,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3C,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,uCAAuC;QACvC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAc,GAAG,CAAA,qBAAqB,CAAC;YACtD,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/D,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3C,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,uBAAuB;QACvB,MAAM,UAAU,GAAkB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxD,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACzB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACxB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;wBACzB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,IAAI,CAAC;QAEf,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAEtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,gBAAgB,CACxB,0BAA0B,WAAW,CAAC,KAAK,uDAAuD,MAAM,CAAC,KAAK,CAAC,IAAI,CACpH,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;YAE7C,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACrC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBAC/D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAED,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;YACpC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,iEAAiE;QACjE,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;gBAC7C,SAAS,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;gBAC9C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;gBAC5C,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAc,IAAI,SAAS,CAAC,CAAC,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YACzE,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3C,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+DAA+D;QAC/D,IACE,QAAQ,CAAC,IAAI,KAAK,cAAc;YAChC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC/B,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;YACjC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC/B,CAAC;YACD,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;YAC7C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACrC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,0DAA0D;QAC1D,MAAM,aAAa,GAAY,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,WAAW,GAAW,OAAO,CAAC;QAElC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,WAAW,GAAG,IAAI,OAAO,GAAG,CAAC;QAC/B,CAAC;aAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,WAAW,GAAG,GAAG,OAAO,GAAG,CAAC;QAC9B,CAAC;aAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,WAAW,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxB;;;;;eAKG;YACH,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;YAE7C,IAAI,aAAa,EAAE,CAAC;gBAClB,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBAC/D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACjC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/B,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/D,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;QAC7C,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,kBAAkB,CAC/B,QAAuB,EACvB,SAAoB;QAEpB,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,MAAM,SAAS,GAAc,IAAI,SAAS,EAAE,CAAC;YAC7C,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9B,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}