@oneuptime/common 12.0.15 → 12.0.16

package/build/dist/Utils/SecurityEvent/OcsfNormalizer.js

@@ -0,0 +1,136 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, ocsfSeverityFromId, } from "../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid, ocsfEventClassByUid, } from "../../Types/SecurityEvent/OcsfEventClass";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readNumber, readString, readValue, } from "./NormalizerHelpers";
+/*
+ * Native OCSF event JSON -> NormalizedSecurityEvent.
+ *
+ * OCSF is already our canonical shape, so this normalizer mostly lifts
+ * fields as-is, trusting the payload's class/category/severity ids but
+ * re-deriving names when the payload omits them. Unknown class uids are
+ * kept — the schema evolves faster than our curated subset and dropping
+ * events over an unknown uid would be wrong.
+ *
+ * https://schema.ocsf.io/
+ */
+export default class OcsfNormalizer {
+    static isOcsfEvent(payload) {
+        return readNumber(payload, "class_uid") !== null;
+    }
+    static normalize(payload) {
+        var _a, _b, _c, _d, _e;
+        const classUid = (_a = readNumber(payload, "class_uid")) !== null && _a !== void 0 ? _a : 0;
+        const knownClass = ocsfEventClassByUid(classUid);
+        const className = readString(payload, "class_name") ||
+            (knownClass ? knownClass.name : "Base Event");
+        const derivedCategory = ocsfCategoryForClassUid(classUid);
+        const categoryUid = (_b = readNumber(payload, "category_uid")) !== null && _b !== void 0 ? _b : derivedCategory.categoryUid;
+        const categoryName = readString(payload, "category_name") || derivedCategory.categoryName;
+        /*
+         * severity_id is authoritative when present; the severity text is a
+         * fallback for producers that only send the name.
+         */
+        const severityIdRaw = readNumber(payload, "severity_id");
+        const severityName = severityIdRaw !== null
+            ? ocsfSeverityFromId(severityIdRaw)
+            : normalizeOcsfSeverity(readString(payload, "severity")) ||
+                OcsfSeverity.Unknown;
+        const time = parseEventTime((_d = (_c = readValue(payload, "time")) !== null && _c !== void 0 ? _c : readValue(payload, "time_dt")) !== null && _d !== void 0 ? _d : readValue(payload, "metadata.logged_time"));
+        const mitreTactics = [];
+        const mitreTechniques = [];
+        const attacks = readValue(payload, "attacks");
+        if (Array.isArray(attacks)) {
+            for (const attack of attacks) {
+                if (typeof attack !== "object" || attack === null) {
+                    continue;
+                }
+                const tacticId = readString(attack, "tactic.uid") ||
+                    readString(attack, "tactic.id");
+                if (tacticId && !mitreTactics.includes(tacticId)) {
+                    mitreTactics.push(tacticId);
+                }
+                const techniqueId = readString(attack, "technique.uid") ||
+                    readString(attack, "technique.id");
+                if (techniqueId && !mitreTechniques.includes(techniqueId)) {
+                    mitreTechniques.push(techniqueId);
+                }
+            }
+        }
+        const principalUser = readString(payload, "actor.user.name") ||
+            readString(payload, "actor.user.email_addr");
+        const principalProcess = readString(payload, "actor.process.name") ||
+            readString(payload, "actor.process.cmd_line");
+        const principalHost = readString(payload, "src_endpoint.hostname") ||
+            readString(payload, "device.hostname");
+        const principalIp = readString(payload, "src_endpoint.ip") ||
+            readString(payload, "device.ip");
+        const targetUser = readString(payload, "user.name");
+        const targetHost = readString(payload, "dst_endpoint.hostname");
+        const targetIp = readString(payload, "dst_endpoint.ip");
+        const targetPort = (_e = readNumber(payload, "dst_endpoint.port")) !== null && _e !== void 0 ? _e : 0;
+        const targetResource = readString(payload, "resources.name") ||
+            readString(payload, "resources.uid") ||
+            readString(payload, "api.operation") ||
+            readString(payload, "http_request.url.hostname");
+        /*
+         * OCSF's own observables array carries pre-extracted values; merge
+         * them with the entity fields so the observables column is a superset.
+         */
+        const extraObservables = [];
+        const observablesArray = readValue(payload, "observables");
+        if (Array.isArray(observablesArray)) {
+            for (const observable of observablesArray) {
+                if (typeof observable !== "object" || observable === null) {
+                    continue;
+                }
+                const value = readString(observable, "value");
+                if (value) {
+                    extraObservables.push(value);
+                }
+            }
+        }
+        const message = readString(payload, "message") ||
+            readString(payload, "finding_info.title") ||
+            className;
+        return {
+            time: time || new Date(),
+            eventUid: readString(payload, "metadata.uid") || contentHashEventUid(payload),
+            categoryUid,
+            categoryName,
+            classUid,
+            className,
+            activityName: readString(payload, "activity_name"),
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: readString(payload, "status") || readString(payload, "disposition"),
+            message,
+            vendorName: readString(payload, "metadata.product.vendor_name"),
+            productName: readString(payload, "metadata.product.name"),
+            ruleId: readString(payload, "metadata.rule.uid") ||
+                readString(payload, "finding_info.uid"),
+            ruleName: readString(payload, "metadata.rule.name") ||
+                readString(payload, "finding_info.title"),
+            mitreTactics,
+            mitreTechniques,
+            principalUser,
+            principalHost,
+            principalIp,
+            principalProcess,
+            targetUser,
+            targetHost,
+            targetIp,
+            targetPort,
+            targetResource,
+            observables: buildObservables([
+                principalUser,
+                targetUser,
+                principalHost,
+                targetHost,
+                principalIp,
+                targetIp,
+                ...extraObservables,
+            ]),
+            attributes: flattenPayload(payload),
+        };
+    }
+}
+//# sourceMappingURL=OcsfNormalizer.js.map

package/build/dist/Utils/SecurityEvent/OcsfNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OcsfNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/OcsfNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAEL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,OAAO,cAAc;IAC1B,MAAM,CAAC,WAAW,CAAC,OAAmB;QAC3C,OAAO,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC;IACnD,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,QAAQ,GAAW,MAAA,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,mCAAI,CAAC,CAAC;QAC/D,MAAM,UAAU,GACd,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,SAAS,GACb,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC;YACjC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAEhD,MAAM,eAAe,GACnB,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,WAAW,GACf,MAAA,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,mCAAI,eAAe,CAAC,WAAW,CAAC;QACrE,MAAM,YAAY,GAChB,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC;QAEvE;;;WAGG;QACH,MAAM,aAAa,GAAkB,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACxE,MAAM,YAAY,GAChB,aAAa,KAAK,IAAI;YACpB,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC;YACnC,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACtD,YAAY,CAAC,OAAO,CAAC;QAE3B,MAAM,IAAI,GAAgB,cAAc,CACtC,MAAA,MAAA,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,mCACxB,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,mCAC7B,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAC7C,CAAC;QAEF,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,MAAM,eAAe,GAAkB,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAc,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBAClD,SAAS;gBACX,CAAC;gBAED,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAoB,EAAE,YAAY,CAAC;oBAC9C,UAAU,CAAC,MAAoB,EAAE,WAAW,CAAC,CAAC;gBAChD,IAAI,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9B,CAAC;gBAED,MAAM,WAAW,GACf,UAAU,CAAC,MAAoB,EAAE,eAAe,CAAC;oBACjD,UAAU,CAAC,MAAoB,EAAE,cAAc,CAAC,CAAC;gBACnD,IAAI,WAAW,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1D,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GACjB,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC;YACtC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QAE/C,MAAM,gBAAgB,GACpB,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACzC,UAAU,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QAEhD,MAAM,aAAa,GACjB,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;YAC5C,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAEzC,MAAM,WAAW,GACf,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC;YACtC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEnC,MAAM,UAAU,GAAW,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAW,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAW,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,UAAU,GAAW,MAAA,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,mCAAI,CAAC,CAAC;QAEzE,MAAM,cAAc,GAClB,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC;YACrC,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC;YACpC,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC;YACpC,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAEnD;;;WAGG;QACH,MAAM,gBAAgB,GAAkB,EAAE,CAAC;QAC3C,MAAM,gBAAgB,GAAc,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBAC1D,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAW,UAAU,CAAC,UAAwB,EAAE,OAAO,CAAC,CAAC;gBACpE,IAAI,KAAK,EAAE,CAAC;oBACV,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GACX,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC;YAC9B,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACzC,SAAS,CAAC;QAEZ,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EACN,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACrE,WAAW;YACX,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC;YAClD,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EACR,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;YACrE,OAAO;YACP,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,8BAA8B,CAAC;YAC/D,WAAW,EAAE,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;YACzD,MAAM,EACJ,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBACxC,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC;YACzC,QAAQ,EACN,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBACzC,UAAU,CAAC,OAAO,EAAE,oBAAoB,CAAC;YAC3C,YAAY;YACZ,eAAe;YACf,aAAa;YACb,aAAa;YACb,WAAW;YACX,gBAAgB;YAChB,UAAU;YACV,UAAU;YACV,QAAQ;YACR,UAAU;YACV,cAAc;YACd,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,aAAa;gBACb,UAAU;gBACV,aAAa;gBACb,UAAU;gBACV,WAAW;gBACX,QAAQ;gBACR,GAAG,gBAAgB;aACpB,CAAC;YACF,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/SecurityEventNormalizer.js

@@ -0,0 +1,64 @@
+import SecurityEventFormat from "../../Types/SecurityEvent/SecurityEventFormat";
+import GenericNormalizer from "./GenericNormalizer";
+import GoogleSecOpsAlertNormalizer from "./GoogleSecOpsAlertNormalizer";
+import OcsfNormalizer from "./OcsfNormalizer";
+import UdmNormalizer from "./UdmNormalizer";
+/*
+ * Entry point for security-event normalization: pick the dialect (caller
+ * can name it; otherwise sniff per event) and produce the canonical
+ * NormalizedSecurityEvent. Sniffing is per event, not per batch — one
+ * webhook can legitimately mix a detection alert with raw UDM events.
+ */
+export default class SecurityEventNormalizer {
+    static detectFormat(payload) {
+        if (OcsfNormalizer.isOcsfEvent(payload)) {
+            return SecurityEventFormat.Ocsf;
+        }
+        if (UdmNormalizer.isUdmEvent(payload)) {
+            return SecurityEventFormat.Udm;
+        }
+        if (GoogleSecOpsAlertNormalizer.isGoogleSecOpsAlert(payload)) {
+            return SecurityEventFormat.GoogleSecOpsAlert;
+        }
+        return SecurityEventFormat.Generic;
+    }
+    static parseFormat(value) {
+        const normalized = (value || "").trim().toLowerCase();
+        if (!normalized) {
+            return null;
+        }
+        const aliases = {
+            ocsf: SecurityEventFormat.Ocsf,
+            udm: SecurityEventFormat.Udm,
+            chronicle: SecurityEventFormat.Udm,
+            "google-secops": SecurityEventFormat.Udm,
+            "google-secops-alert": SecurityEventFormat.GoogleSecOpsAlert,
+            "secops-alert": SecurityEventFormat.GoogleSecOpsAlert,
+            detection: SecurityEventFormat.GoogleSecOpsAlert,
+            generic: SecurityEventFormat.Generic,
+        };
+        return aliases[normalized] || null;
+    }
+    static normalize(payload, format) {
+        if (!payload ||
+            typeof payload !== "object" ||
+            Array.isArray(payload) ||
+            Object.keys(payload).length === 0) {
+            return null;
+        }
+        const resolvedFormat = format || this.detectFormat(payload);
+        switch (resolvedFormat) {
+            case SecurityEventFormat.Ocsf:
+                return OcsfNormalizer.normalize(payload);
+            case SecurityEventFormat.Udm:
+                return UdmNormalizer.normalize(payload);
+            case SecurityEventFormat.GoogleSecOpsAlert:
+                return GoogleSecOpsAlertNormalizer.normalize(payload);
+            case SecurityEventFormat.Generic:
+                return GenericNormalizer.normalize(payload);
+            default:
+                return GenericNormalizer.normalize(payload);
+        }
+    }
+}
+//# sourceMappingURL=SecurityEventNormalizer.js.map

package/build/dist/Utils/SecurityEvent/SecurityEventNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityEventNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/SecurityEventNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,mBAAmB,MAAM,+CAA+C,CAAC;AAChF,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,2BAA2B,MAAM,+BAA+B,CAAC;AACxE,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,OAAO,OAAO,uBAAuB;IACnC,MAAM,CAAC,YAAY,CAAC,OAAmB;QAC5C,IAAI,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO,mBAAmB,CAAC,IAAI,CAAC;QAClC,CAAC;QAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,OAAO,mBAAmB,CAAC,GAAG,CAAC;QACjC,CAAC;QAED,IAAI,2BAA2B,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,mBAAmB,CAAC,iBAAiB,CAAC;QAC/C,CAAC;QAED,OAAO,mBAAmB,CAAC,OAAO,CAAC;IACrC,CAAC;IAEM,MAAM,CAAC,WAAW,CAAC,KAAa;QACrC,MAAM,UAAU,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE9D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAwC;YACnD,IAAI,EAAE,mBAAmB,CAAC,IAAI;YAC9B,GAAG,EAAE,mBAAmB,CAAC,GAAG;YAC5B,SAAS,EAAE,mBAAmB,CAAC,GAAG;YAClC,eAAe,EAAE,mBAAmB,CAAC,GAAG;YACxC,qBAAqB,EAAE,mBAAmB,CAAC,iBAAiB;YAC5D,cAAc,EAAE,mBAAmB,CAAC,iBAAiB;YACrD,SAAS,EAAE,mBAAmB,CAAC,iBAAiB;YAChD,OAAO,EAAE,mBAAmB,CAAC,OAAO;SACrC,CAAC;QAEF,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAEM,MAAM,CAAC,SAAS,CACrB,OAAmB,EACnB,MAAwC;QAExC,IACE,CAAC,OAAO;YACR,OAAO,OAAO,KAAK,QAAQ;YAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAClB,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEvC,QAAQ,cAAc,EAAE,CAAC;YACvB,KAAK,mBAAmB,CAAC,IAAI;gBAC3B,OAAO,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC3C,KAAK,mBAAmB,CAAC,GAAG;gBAC1B,OAAO,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC1C,KAAK,mBAAmB,CAAC,iBAAiB;gBACxC,OAAO,2BAA2B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxD,KAAK,mBAAmB,CAAC,OAAO;gBAC9B,OAAO,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC9C;gBACE,OAAO,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/Sigma/SigmaRuleParser.js

@@ -0,0 +1,388 @@
+import yaml from "js-yaml";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { SigmaLevel, } from "../../../Types/SecurityEvent/SigmaRule";
+/*
+ * Sigma YAML -> typed SigmaRule.
+ *
+ * Supports the boolean core of the Sigma spec: named selections (field
+ * maps with modifiers, keyword lists), and the condition grammar
+ * (and/or/not, parentheses, `N of x*` / `all of x*` / `any of them`).
+ * Aggregation expressions (`| count() ...`) are rejected with a clear
+ * error rather than silently ignored — a rule that parses is a rule the
+ * engine evaluates faithfully.
+ */
+const SUPPORTED_MODIFIERS = new Set([
+    "contains",
+    "startswith",
+    "endswith",
+    "all",
+    "re",
+    "cased",
+    "gt",
+    "gte",
+    "lt",
+    "lte",
+    "cidr",
+    "exists",
+    "windash",
+]);
+const WHITESPACE_REGEX = /\s/;
+const COUNT_REGEX = /^\d+$/;
+const TACTIC_TAG_REGEX = /^ta\d{4}$/i;
+const TECHNIQUE_TAG_REGEX = /^t\d{4}(\.\d{3})?$/i;
+function tokenizeCondition(condition) {
+    const tokens = [];
+    let current = "";
+    const flush = () => {
+        if (current) {
+            tokens.push({ kind: "word", value: current });
+            current = "";
+        }
+    };
+    for (const char of condition) {
+        if (char === "(") {
+            flush();
+            tokens.push({ kind: "lparen" });
+        }
+        else if (char === ")") {
+            flush();
+            tokens.push({ kind: "rparen" });
+        }
+        else if (WHITESPACE_REGEX.test(char)) {
+            flush();
+        }
+        else {
+            current += char;
+        }
+    }
+    flush();
+    return tokens;
+}
+class ConditionParser {
+    constructor(tokens) {
+        this.tokens = tokens;
+        this.position = 0;
+    }
+    parse() {
+        const node = this.parseOr();
+        if (this.position < this.tokens.length) {
+            throw new BadDataException(`Sigma condition: unexpected token after end of expression (near "${this.describeCurrent()}").`);
+        }
+        return node;
+    }
+    parseOr() {
+        const children = [this.parseAnd()];
+        while (this.isWord("or")) {
+            this.position++;
+            children.push(this.parseAnd());
+        }
+        if (children.length === 1) {
+            return children[0];
+        }
+        return { kind: "or", children };
+    }
+    parseAnd() {
+        const children = [this.parseNot()];
+        while (this.isWord("and")) {
+            this.position++;
+            children.push(this.parseNot());
+        }
+        if (children.length === 1) {
+            return children[0];
+        }
+        return { kind: "and", children };
+    }
+    parseNot() {
+        if (this.isWord("not")) {
+            this.position++;
+            return { kind: "not", child: this.parseNot() };
+        }
+        return this.parsePrimary();
+    }
+    parsePrimary() {
+        var _a;
+        const token = this.tokens[this.position];
+        if (!token) {
+            throw new BadDataException("Sigma condition: unexpected end of expression.");
+        }
+        if (token.kind === "lparen") {
+            this.position++;
+            const inner = this.parseOr();
+            if (((_a = this.tokens[this.position]) === null || _a === void 0 ? void 0 : _a.kind) !== "rparen") {
+                throw new BadDataException("Sigma condition: missing closing parenthesis.");
+            }
+            this.position++;
+            return inner;
+        }
+        if (token.kind === "rparen") {
+            throw new BadDataException("Sigma condition: unexpected closing parenthesis.");
+        }
+        const word = token.value;
+        // Quantifier: `1 of x*`, `all of them`, `any of selection*`.
+        const lowered = word.toLowerCase();
+        const isCount = COUNT_REGEX.test(word);
+        if (isCount || lowered === "all" || lowered === "any") {
+            const next = this.tokens[this.position + 1];
+            if (next && next.kind === "word" && next.value.toLowerCase() === "of") {
+                const patternToken = this.tokens[this.position + 2];
+                if (!patternToken || patternToken.kind !== "word") {
+                    throw new BadDataException(`Sigma condition: "${word} of" must be followed by a selection pattern or "them".`);
+                }
+                this.position += 3;
+                const quantifier = isCount
+                    ? Number(word)
+                    : lowered;
+                return {
+                    kind: "of",
+                    quantifier,
+                    pattern: patternToken.value,
+                };
+            }
+            if (isCount) {
+                throw new BadDataException(`Sigma condition: bare number "${word}" — expected "${word} of <pattern>".`);
+            }
+        }
+        this.position++;
+        return { kind: "selection", name: word };
+    }
+    isWord(value) {
+        const token = this.tokens[this.position];
+        return Boolean(token && token.kind === "word" && token.value.toLowerCase() === value);
+    }
+    describeCurrent() {
+        const token = this.tokens[this.position];
+        if (!token) {
+            return "end";
+        }
+        if (token.kind === "word") {
+            return token.value;
+        }
+        return token.kind === "lparen" ? "(" : ")";
+    }
+}
+function parseFieldRequirement(key, rawValue) {
+    const parts = key.split("|");
+    const field = (parts[0] || "").trim();
+    if (!field) {
+        throw new BadDataException(`Sigma detection: empty field name in "${key}".`);
+    }
+    const modifiers = parts.slice(1).map((part) => {
+        return part.trim().toLowerCase();
+    });
+    for (const modifier of modifiers) {
+        if (!SUPPORTED_MODIFIERS.has(modifier)) {
+            throw new BadDataException(`Sigma detection: unsupported field modifier "${modifier}" on "${key}". Supported: ${Array.from(SUPPORTED_MODIFIERS).join(", ")}.`);
+        }
+    }
+    const values = Array.isArray(rawValue)
+        ? rawValue
+        : [rawValue];
+    if (values.length === 0) {
+        throw new BadDataException(`Sigma detection: field "${key}" has an empty value list.`);
+    }
+    for (const value of values) {
+        if (value !== null && typeof value === "object") {
+            throw new BadDataException(`Sigma detection: field "${key}" has a nested object value — only scalars, lists of scalars, and null are supported.`);
+        }
+    }
+    return { field, modifiers, values };
+}
+function parseSelection(name, rawValue) {
+    // Map: fields AND together.
+    if (rawValue !== null &&
+        typeof rawValue === "object" &&
+        !Array.isArray(rawValue)) {
+        const requirements = [];
+        for (const key of Object.keys(rawValue)) {
+            requirements.push(parseFieldRequirement(key, rawValue[key]));
+        }
+        if (requirements.length === 0) {
+            throw new BadDataException(`Sigma detection: selection "${name}" is empty.`);
+        }
+        return { name, fieldMaps: [requirements], keywords: [] };
+    }
+    if (Array.isArray(rawValue)) {
+        if (rawValue.length === 0) {
+            throw new BadDataException(`Sigma detection: selection "${name}" is an empty list.`);
+        }
+        const isMapList = rawValue.every((item) => {
+            return item !== null && typeof item === "object" && !Array.isArray(item);
+        });
+        if (isMapList) {
+            // List of maps: maps OR together, fields inside a map AND.
+            const fieldMaps = [];
+            for (const item of rawValue) {
+                const requirements = [];
+                for (const key of Object.keys(item)) {
+                    requirements.push(parseFieldRequirement(key, item[key]));
+                }
+                if (requirements.length > 0) {
+                    fieldMaps.push(requirements);
+                }
+            }
+            return { name, fieldMaps, keywords: [] };
+        }
+        const isScalarList = rawValue.every((item) => {
+            return item === null || typeof item !== "object";
+        });
+        if (isScalarList) {
+            // Keyword list: matched against the event message, OR semantics.
+            return {
+                name,
+                fieldMaps: [],
+                keywords: rawValue.map((item) => {
+                    return String(item);
+                }),
+            };
+        }
+        throw new BadDataException(`Sigma detection: selection "${name}" mixes maps and scalars — use either a field map list or a keyword list.`);
+    }
+    throw new BadDataException(`Sigma detection: selection "${name}" must be a map or a list.`);
+}
+function extractMitre(tags) {
+    const tactics = [];
+    const techniques = [];
+    for (const tag of tags) {
+        const normalized = tag.toLowerCase();
+        if (!normalized.startsWith("attack.")) {
+            continue;
+        }
+        const remainder = tag.slice("attack.".length);
+        if (TACTIC_TAG_REGEX.test(remainder)) {
+            const tactic = remainder.toUpperCase();
+            if (!tactics.includes(tactic)) {
+                tactics.push(tactic);
+            }
+        }
+        else if (TECHNIQUE_TAG_REGEX.test(remainder)) {
+            const technique = remainder.toUpperCase();
+            if (!techniques.includes(technique)) {
+                techniques.push(technique);
+            }
+        }
+    }
+    return { tactics, techniques };
+}
+export default class SigmaRuleParser {
+    static parse(ruleYaml) {
+        if (!ruleYaml || !ruleYaml.trim()) {
+            throw new BadDataException("Sigma rule: YAML is empty.");
+        }
+        let loaded;
+        try {
+            loaded = yaml.load(ruleYaml);
+        }
+        catch (error) {
+            throw new BadDataException(`Sigma rule: invalid YAML — ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!loaded || typeof loaded !== "object" || Array.isArray(loaded)) {
+            throw new BadDataException("Sigma rule: YAML must be a mapping.");
+        }
+        const doc = loaded;
+        const detection = doc["detection"];
+        if (!detection ||
+            typeof detection !== "object" ||
+            Array.isArray(detection)) {
+            throw new BadDataException("Sigma rule: a `detection` mapping is required.");
+        }
+        const detectionObject = detection;
+        const conditionRaw = detectionObject["condition"];
+        if (typeof conditionRaw !== "string" || !conditionRaw.trim()) {
+            throw new BadDataException("Sigma rule: `detection.condition` must be a non-empty string.");
+        }
+        if (conditionRaw.includes("|")) {
+            throw new BadDataException("Sigma rule: aggregation expressions (`| count() ...`) are not supported. Use a plain boolean condition.");
+        }
+        const selections = [];
+        for (const key of Object.keys(detectionObject)) {
+            if (key === "condition" || key === "timeframe") {
+                continue;
+            }
+            selections.push(parseSelection(key, detectionObject[key]));
+        }
+        if (selections.length === 0) {
+            throw new BadDataException("Sigma rule: `detection` must contain at least one selection.");
+        }
+        const condition = new ConditionParser(tokenizeCondition(conditionRaw)).parse();
+        // Every referenced selection must exist.
+        this.validateConditionReferences(condition, selections);
+        const levelRaw = String(doc["level"] || "medium").toLowerCase();
+        const level = Object.values(SigmaLevel).includes(levelRaw)
+            ? levelRaw
+            : SigmaLevel.Medium;
+        const tags = Array.isArray(doc["tags"])
+            ? doc["tags"].map((tag) => {
+                return String(tag);
+            })
+            : [];
+        const { tactics, techniques } = extractMitre(tags);
+        const logsource = {};
+        const logsourceRaw = doc["logsource"];
+        if (logsourceRaw &&
+            typeof logsourceRaw === "object" &&
+            !Array.isArray(logsourceRaw)) {
+            for (const key of Object.keys(logsourceRaw)) {
+                logsource[key] = String(logsourceRaw[key]);
+            }
+        }
+        return {
+            title: String(doc["title"] || "Untitled Sigma Rule"),
+            id: String(doc["id"] || ""),
+            description: String(doc["description"] || ""),
+            level,
+            status: String(doc["status"] || ""),
+            tags,
+            mitreTactics: tactics,
+            mitreTechniques: techniques,
+            logsource,
+            selections,
+            condition,
+        };
+    }
+    static validateConditionReferences(node, selections) {
+        const names = selections.map((selection) => {
+            return selection.name;
+        });
+        const visit = (current) => {
+            if (current.kind === "selection") {
+                if (!names.includes(current.name)) {
+                    throw new BadDataException(`Sigma condition: unknown selection "${current.name}". Known selections: ${names.join(", ")}.`);
+                }
+                return;
+            }
+            if (current.kind === "of") {
+                if (current.pattern.toLowerCase() === "them") {
+                    return;
+                }
+                const matches = SigmaRuleParser.matchSelectionNames(current.pattern, names);
+                if (matches.length === 0) {
+                    throw new BadDataException(`Sigma condition: pattern "${current.pattern}" matches no selection. Known selections: ${names.join(", ")}.`);
+                }
+                return;
+            }
+            if (current.kind === "not") {
+                visit(current.child);
+                return;
+            }
+            for (const child of current.children) {
+                visit(child);
+            }
+        };
+        visit(node);
+    }
+    static matchSelectionNames(pattern, names) {
+        if (pattern.toLowerCase() === "them") {
+            return [...names];
+        }
+        if (pattern.endsWith("*")) {
+            const prefix = pattern.slice(0, -1);
+            return names.filter((name) => {
+                return name.startsWith(prefix);
+            });
+        }
+        return names.filter((name) => {
+            return name === pattern;
+        });
+    }
+}
+//# sourceMappingURL=SigmaRuleParser.js.map

package/build/dist/Utils/SecurityEvent/Sigma/SigmaRuleParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SigmaRuleParser.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Sigma/SigmaRuleParser.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AAGzE,OAAkB,EAGhB,UAAU,GAEX,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;GASG;AAEH,MAAM,mBAAmB,GAAgB,IAAI,GAAG,CAAS;IACvD,UAAU;IACV,YAAY;IACZ,UAAU;IACV,KAAK;IACL,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,MAAM;IACN,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAW,IAAI,CAAC;AACtC,MAAM,WAAW,GAAW,OAAO,CAAC;AACpC,MAAM,gBAAgB,GAAW,YAAY,CAAC;AAC9C,MAAM,mBAAmB,GAAW,qBAAqB,CAAC;AAO1D,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAW,EAAE,CAAC;IAEzB,MAAM,KAAK,GAAe,GAAS,EAAE;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,KAAK,EAAE,CAAC;IAER,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,eAAe;IAGnB,YAA2B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;QAFvC,aAAQ,GAAW,CAAC,CAAC;IAEqB,CAAC;IAE5C,KAAK;QACV,MAAM,IAAI,GAAuB,IAAI,CAAC,OAAO,EAAE,CAAC;QAEhD,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CACxB,oEAAoE,IAAI,CAAC,eAAe,EAAE,KAAK,CAChG,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO;QACb,MAAM,QAAQ,GAA8B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE9D,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAEO,QAAQ;QACd,MAAM,QAAQ,GAA8B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE9D,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;IAEO,QAAQ;QACd,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEO,YAAY;;QAClB,MAAM,KAAK,GAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAuB,IAAI,CAAC,OAAO,EAAE,CAAC;YAEjD,IAAI,CAAA,MAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0CAAE,IAAI,MAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,CAChD,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAW,KAAK,CAAC,KAAK,CAAC;QAEjC,6DAA6D;QAC7D,MAAM,OAAO,GAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAY,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,OAAO,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtD,MAAM,IAAI,GAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAE/D,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBACtE,MAAM,YAAY,GAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;gBAEvE,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAClD,MAAM,IAAI,gBAAgB,CACxB,qBAAqB,IAAI,yDAAyD,CACnF,CAAC;gBACJ,CAAC;gBAED,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAEnB,MAAM,UAAU,GAA2B,OAAO;oBAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;oBACd,CAAC,CAAE,OAAyB,CAAC;gBAE/B,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,UAAU;oBACV,OAAO,EAAE,YAAY,CAAC,KAAK;iBAC5B,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,IAAI,iBAAiB,IAAI,iBAAiB,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,MAAM,KAAK,GAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,OAAO,OAAO,CACZ,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CACtE,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,KAAK,GAAsB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,GAAW,EACX,QAAmB;IAEnB,MAAM,KAAK,GAAkB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,GAAG,IAAI,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAkB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE;QACnE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,QAAQ,SAAS,GAAG,iBAAiB,KAAK,CAAC,IAAI,CAC7F,mBAAmB,CACpB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAqB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtD,CAAC,CAAE,QAA6B;QAChC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,2BAA2B,GAAG,4BAA4B,CAC3D,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,gBAAgB,CACxB,2BAA2B,GAAG,uFAAuF,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAmB;IACvD,4BAA4B;IAC5B,IACE,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACxB,CAAC;QACD,MAAM,YAAY,GAAiC,EAAE,CAAC;QAEtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAsB,CAAC,EAAE,CAAC;YACtD,YAAY,CAAC,IAAI,CACf,qBAAqB,CAAC,GAAG,EAAG,QAAuB,CAAC,GAAG,CAAc,CAAC,CACvE,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,IAAI,aAAa,CACjD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,IAAI,qBAAqB,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAe,EAAW,EAAE;YACrE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACd,2DAA2D;YAC3D,MAAM,SAAS,GAAwC,EAAE,CAAC;YAE1D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAiC,EAAE,CAAC;gBAEtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAkB,CAAC,EAAE,CAAC;oBAClD,YAAY,CAAC,IAAI,CACf,qBAAqB,CAAC,GAAG,EAAG,IAAmB,CAAC,GAAG,CAAc,CAAC,CACnE,CAAC;gBACJ,CAAC;gBAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,YAAY,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAe,EAAW,EAAE;YACxE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YACjB,iEAAiE;YACjE,OAAO;gBACL,IAAI;gBACJ,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAe,EAAU,EAAE;oBACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,IAAI,2EAA2E,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,gBAAgB,CACxB,+BAA+B,IAAI,4BAA4B,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IAIvC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAkB,EAAE,CAAC;IAErC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAW,GAAG,CAAC,WAAW,EAAE,CAAC;QAE7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAW,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAEtD,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,GAAW,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAW,SAAS,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,eAAe;IAC3B,MAAM,CAAC,KAAK,CAAC,QAAgB;QAClC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,8BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,GAAG,GAAe,MAAoB,CAAC;QAE7C,MAAM,SAAS,GAAc,GAAG,CAAC,WAAW,CAAc,CAAC;QAE3D,IACE,CAAC,SAAS;YACV,OAAO,SAAS,KAAK,QAAQ;YAC7B,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAe,SAAuB,CAAC;QAE5D,MAAM,YAAY,GAAc,eAAe,CAAC,WAAW,CAAc,CAAC;QAE1E,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,gBAAgB,CACxB,+DAA+D,CAChE,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACxB,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAuB,IAAI,eAAe,CACvD,iBAAiB,CAAC,YAAY,CAAC,CAChC,CAAC,KAAK,EAAE,CAAC;QAEV,yCAAyC;QACzC,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAW,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACxE,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,CAAC,UAAU,CACzB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAClB,CAAC,CAAE,QAAuB;YAC1B,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAEtB,MAAM,IAAI,GAAkB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC,CAAE,GAAG,CAAC,MAAM,CAAsB,CAAC,GAAG,CAAC,CAAC,GAAc,EAAU,EAAE;gBAC/D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAuB,EAAE,CAAC;QACzC,MAAM,YAAY,GAAc,GAAG,CAAC,WAAW,CAAc,CAAC;QAE9D,IACE,YAAY;YACZ,OAAO,YAAY,KAAK,QAAQ;YAChC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAC5B,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAA0B,CAAC,EAAE,CAAC;gBAC1D,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAE,YAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC;YACpD,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI;YACJ,YAAY,EAAE,OAAO;YACrB,eAAe,EAAE,UAAU;YAC3B,SAAS;YACT,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,2BAA2B,CACxC,IAAwB,EACxB,UAAiC;QAEjC,MAAM,KAAK,GAAkB,UAAU,CAAC,GAAG,CACzC,CAAC,SAAyB,EAAU,EAAE;YACpC,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC,CACF,CAAC;QAEF,MAAM,KAAK,GAA0C,CACnD,OAA2B,EACrB,EAAE;YACR,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,OAAO,CAAC,IAAI,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/F,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBAED,MAAM,OAAO,GAAkB,eAAe,CAAC,mBAAmB,CAChE,OAAO,CAAC,OAAO,EACf,KAAK,CACN,CAAC;gBAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,IAAI,gBAAgB,CACxB,6BAA6B,OAAO,CAAC,OAAO,6CAA6C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7G,CAAC;gBACJ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC3B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrC,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,mBAAmB,CAC/B,OAAe,EACf,KAAoB;QAEpB,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;QACpB,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;gBAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;YAC5C,OAAO,IAAI,KAAK,OAAO,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}