@oneuptime/common 12.0.15 → 12.0.17

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js

@@ -0,0 +1,600 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import DetectionRule from "../../../Models/DatabaseModels/DetectionRule";
+import Alert from "../../../Models/DatabaseModels/Alert";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import OneUptimeDate from "../../../Types/Date";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import OcsfSeverity, { OcsfSeverityId, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import { SigmaLevel } from "../../../Types/SecurityEvent/SigmaRule";
+import { DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, DETECTION_GROUP_VALUE_ATTRIBUTE, DETECTION_MATCH_COUNT_ATTRIBUTE, DETECTION_RULE_ID_ATTRIBUTE, DETECTION_RULE_NAME_ATTRIBUTE, DETECTION_SIGMA_ID_ATTRIBUTE, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
+import SigmaRuleParser from "../../../Utils/SecurityEvent/Sigma/SigmaRuleParser";
+import MetricSeriesFingerprint from "../../../Utils/Metrics/MetricSeriesFingerprint";
+import AlertService from "../../Services/AlertService";
+import AlertSeverityService from "../../Services/AlertSeverityService";
+import IncidentService from "../../Services/IncidentService";
+import IncidentSeverityService from "../../Services/IncidentSeverityService";
+import DetectionRuleService from "../../Services/DetectionRuleService";
+import OTelIngestService from "../../Services/OpenTelemetryIngestService";
+import SecurityEventService from "../../Services/SecurityEventService";
+import { resolveTelemetryRetentionInDays } from "../../../Types/Telemetry/TelemetryRetentionConfig";
+import logger from "../Logger";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+import SigmaClickhouseCompiler, { buildSigmaFieldExpression, } from "./Sigma/SigmaClickhouseCompiler";
+import { buildSecurityEventDbRow } from "./SecurityEventRow";
+const DETECTIONS_SERVICE_NAME = "OneUptime Detections";
+/*
+ * Cap on how far back one evaluation may scan, whatever lastEvaluatedAt
+ * says — a rule re-enabled after a month must not trigger a month-long
+ * table scan.
+ */
+const MAX_LOOKBACK_IN_MINUTES = 24 * 60;
+// One alert per distinct group value per cycle, at most.
+const MAX_GROUPS_PER_EVALUATION = 100;
+const SIGMA_LEVEL_TO_OCSF = {
+    [SigmaLevel.Informational]: OcsfSeverity.Informational,
+    [SigmaLevel.Low]: OcsfSeverity.Low,
+    [SigmaLevel.Medium]: OcsfSeverity.Medium,
+    [SigmaLevel.High]: OcsfSeverity.High,
+    [SigmaLevel.Critical]: OcsfSeverity.Critical,
+};
+/*
+ * The detections-as-code engine: every minute, evaluate due Sigma rules
+ * against the SecurityEvent table; matches open deduped alerts and write
+ * Detection Finding rows back into the events table.
+ */
+export default class DetectionRuleEvaluator {
+    static async evaluateAllDueRules() {
+        var _a;
+        const rules = await DetectionRuleService.findBy({
+            query: {
+                isEnabled: true,
+            },
+            select: {
+                _id: true,
+                projectId: true,
+                name: true,
+                description: true,
+                sigmaRuleYaml: true,
+                evaluationIntervalInMinutes: true,
+                groupByField: true,
+                shouldCreateAlert: true,
+                shouldWriteDetectionFinding: true,
+                shouldCreateIncident: true,
+                alertSeverityId: true,
+                incidentSeverityId: true,
+                lastEvaluatedAt: true,
+            },
+            skip: 0,
+            limit: LIMIT_MAX,
+            props: {
+                isRoot: true,
+            },
+        });
+        const now = OneUptimeDate.getCurrentDate();
+        for (const rule of rules) {
+            const intervalInMinutes = Math.max(1, rule.evaluationIntervalInMinutes || 1);
+            if (rule.lastEvaluatedAt) {
+                const dueAt = OneUptimeDate.addRemoveMinutes(rule.lastEvaluatedAt, intervalInMinutes);
+                if (OneUptimeDate.isAfter(dueAt, now)) {
+                    continue;
+                }
+            }
+            try {
+                await this.evaluateRule(rule);
+            }
+            catch (error) {
+                logger.error(`DetectionRuleEvaluator: error evaluating rule ${(_a = rule.id) === null || _a === void 0 ? void 0 : _a.toString()}:`);
+                logger.error(error);
+                if (rule.id) {
+                    await DetectionRuleService.updateOneById({
+                        id: rule.id,
+                        data: {
+                            lastEvaluatedAt: OneUptimeDate.getCurrentDate(),
+                            lastError: error instanceof Error ? error.message : String(error),
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                }
+            }
+        }
+    }
+    static async evaluateRule(rule) {
+        if (!rule.id || !rule.projectId || !rule.sigmaRuleYaml) {
+            throw new Error("Detection rule is missing id, projectId, or YAML.");
+        }
+        const parsedRule = SigmaRuleParser.parse(rule.sigmaRuleYaml);
+        const whereFragment = SigmaClickhouseCompiler.compile(parsedRule);
+        const endTime = OneUptimeDate.getCurrentDate();
+        const intervalInMinutes = Math.max(1, rule.evaluationIntervalInMinutes || 1);
+        const earliestAllowed = OneUptimeDate.addRemoveMinutes(endTime, -MAX_LOOKBACK_IN_MINUTES);
+        let startTime = rule.lastEvaluatedAt
+            ? rule.lastEvaluatedAt
+            : OneUptimeDate.addRemoveMinutes(endTime, -intervalInMinutes);
+        if (OneUptimeDate.isBefore(startTime, earliestAllowed)) {
+            startTime = earliestAllowed;
+        }
+        const groupByExpression = rule.groupByField
+            ? buildSigmaFieldExpression(rule.groupByField)
+            : null;
+        const groups = await SecurityEventService.findDetectionMatches({
+            projectId: rule.projectId,
+            startTime,
+            endTime,
+            whereFragment,
+            groupByExpression,
+            maxGroups: MAX_GROUPS_PER_EVALUATION,
+        });
+        const matchedGroups = groups.filter((row) => {
+            return row.matchCount > 0;
+        });
+        let alertsCreated = 0;
+        let incidentsCreated = 0;
+        let findingsWritten = 0;
+        let totalMatches = 0;
+        for (const matchGroup of matchedGroups) {
+            totalMatches += matchGroup.matchCount;
+        }
+        if (matchedGroups.length > 0) {
+            if (rule.shouldCreateAlert !== false) {
+                alertsCreated = await this.openAlertsForMatches({
+                    rule,
+                    parsedRule,
+                    matchedGroups,
+                    startTime,
+                    endTime,
+                });
+            }
+            /*
+             * === true, not !== false like the alert gate: incidents are the
+             * heavy machinery (on-call, SLAs, status pages), and the column
+             * defaults to false — a rule fetched without the column selected
+             * must read as off, never as "probably on".
+             */
+            if (rule.shouldCreateIncident === true) {
+                incidentsCreated = await this.openIncidentsForMatches({
+                    rule,
+                    parsedRule,
+                    matchedGroups,
+                    startTime,
+                    endTime,
+                });
+            }
+            if (rule.shouldWriteDetectionFinding !== false) {
+                findingsWritten = await this.writeDetectionFindings({
+                    rule,
+                    parsedRule,
+                    matchedGroups,
+                });
+            }
+        }
+        await DetectionRuleService.updateOneById({
+            id: rule.id,
+            data: Object.assign({ lastEvaluatedAt: endTime, lastError: null }, (matchedGroups.length > 0 ? { lastMatchAt: endTime } : {})),
+            props: {
+                isRoot: true,
+            },
+        });
+        return {
+            ruleId: rule.id.toString(),
+            matchedGroups: matchedGroups.length,
+            totalMatches,
+            alertsCreated,
+            incidentsCreated,
+            findingsWritten,
+            error: null,
+        };
+    }
+    static async openAlertsForMatches(data) {
+        var _a, _b;
+        const { rule, parsedRule, matchedGroups } = data;
+        const projectId = rule.projectId;
+        const alertSeverityId = await this.resolveAlertSeverityId({
+            projectId,
+            rule,
+            parsedRule,
+        });
+        if (!alertSeverityId) {
+            logger.warn(`DetectionRuleEvaluator: project ${projectId.toString()} has no alert severities; skipping alert creation for rule ${(_a = rule.id) === null || _a === void 0 ? void 0 : _a.toString()}.`);
+            return 0;
+        }
+        /*
+         * Dedupe: one open alert per (rule, group value). Fingerprints are
+         * stable across cycles, so a still-firing rule updates nothing and a
+         * resolved alert can re-open as a fresh one.
+         */
+        const fingerprints = matchedGroups.map((matchGroup) => {
+            return this.buildFingerprint(rule.id, matchGroup.groupValue);
+        });
+        /*
+         * Scoped to THIS rule's candidate fingerprints (≤ MAX_GROUPS_PER_
+         * EVALUATION), not a scan of every open alert: a project with more
+         * open alerts than LIMIT_PER_PROJECT would otherwise age still-open
+         * detections out of the fetched window and re-open them every cycle.
+         */
+        const openAlerts = await AlertService.findBy({
+            query: {
+                projectId,
+                seriesFingerprint: new Includes(fingerprints),
+                currentAlertState: {
+                    isResolvedState: false,
+                },
+            },
+            select: {
+                _id: true,
+                seriesFingerprint: true,
+            },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: {
+                isRoot: true,
+            },
+        });
+        const openFingerprints = new Set(openAlerts
+            .map((alert) => {
+            return alert.seriesFingerprint || "";
+        })
+            .filter((fingerprint) => {
+            return Boolean(fingerprint);
+        }));
+        let created = 0;
+        for (let index = 0; index < matchedGroups.length; index++) {
+            const matchGroup = matchedGroups[index];
+            const fingerprint = fingerprints[index];
+            if (openFingerprints.has(fingerprint)) {
+                continue;
+            }
+            const alert = new Alert();
+            alert.projectId = projectId;
+            alert.title = this.buildMatchTitle(rule, matchGroup);
+            alert.description = this.buildMatchDescription({
+                rule,
+                parsedRule,
+                matchGroup,
+                startTime: data.startTime,
+                endTime: data.endTime,
+            });
+            alert.alertSeverityId = alertSeverityId;
+            alert.seriesFingerprint = fingerprint;
+            alert.isCreatedAutomatically = true;
+            alert.rootCause = `Sigma detection rule "${rule.name}" matched security events.`;
+            try {
+                await AlertService.create({
+                    data: alert,
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                created++;
+            }
+            catch (error) {
+                logger.error(`DetectionRuleEvaluator: failed creating alert for rule ${(_b = rule.id) === null || _b === void 0 ? void 0 : _b.toString()}:`);
+                logger.error(error);
+            }
+        }
+        return created;
+    }
+    /*
+     * The incident twin of openAlertsForMatches: same fingerprint, same
+     * title and description, deduped against the project's UNRESOLVED
+     * incidents the same way alerts dedupe against open alerts. Kept as a
+     * separate method rather than a parameterized one because the two
+     * models genuinely differ where it matters — severity comes from
+     * IncidentSeverity, and IncidentService.create is far heavier
+     * (workspace channels, SLAs, on-call execution), so each create is
+     * wrapped so one failing project cannot sink the whole rule.
+     *
+     * Detection incidents carry no monitors, so monitor-driven auto-resolve
+     * never touches them: the fingerprint dedupe is the only thing keeping
+     * a still-firing rule from stacking incidents. Dedupe must therefore
+     * run BEFORE create — incident numbers are user-visible and consumed
+     * per create.
+     */
+    static async openIncidentsForMatches(data) {
+        var _a, _b;
+        const { rule, parsedRule, matchedGroups } = data;
+        const projectId = rule.projectId;
+        const incidentSeverityId = await this.resolveIncidentSeverityId({
+            projectId,
+            rule,
+            parsedRule,
+        });
+        if (!incidentSeverityId) {
+            logger.warn(`DetectionRuleEvaluator: project ${projectId.toString()} has no incident severities; skipping incident creation for rule ${(_a = rule.id) === null || _a === void 0 ? void 0 : _a.toString()}.`);
+            return 0;
+        }
+        const fingerprints = matchedGroups.map((matchGroup) => {
+            return this.buildFingerprint(rule.id, matchGroup.groupValue);
+        });
+        /*
+         * Same fingerprint-scoped dedupe as the alert path — and it matters
+         * more here: a missed fingerprint re-fires IncidentService.create's
+         * whole side-effect train and burns a user-visible incident number.
+         */
+        const openIncidents = await IncidentService.findBy({
+            query: {
+                projectId,
+                seriesFingerprint: new Includes(fingerprints),
+                currentIncidentState: {
+                    isResolvedState: false,
+                },
+            },
+            select: {
+                _id: true,
+                seriesFingerprint: true,
+            },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: {
+                isRoot: true,
+            },
+        });
+        const openFingerprints = new Set(openIncidents
+            .map((incident) => {
+            return incident.seriesFingerprint || "";
+        })
+            .filter((fingerprint) => {
+            return Boolean(fingerprint);
+        }));
+        let created = 0;
+        for (let index = 0; index < matchedGroups.length; index++) {
+            const matchGroup = matchedGroups[index];
+            const fingerprint = fingerprints[index];
+            if (openFingerprints.has(fingerprint)) {
+                continue;
+            }
+            const incident = new Incident();
+            incident.projectId = projectId;
+            incident.title = this.buildMatchTitle(rule, matchGroup);
+            incident.description = this.buildMatchDescription({
+                rule,
+                parsedRule,
+                matchGroup,
+                startTime: data.startTime,
+                endTime: data.endTime,
+            });
+            incident.incidentSeverityId = incidentSeverityId;
+            incident.seriesFingerprint = fingerprint;
+            incident.isCreatedAutomatically = true;
+            incident.rootCause = `Sigma detection rule "${rule.name}" matched security events.`;
+            try {
+                /*
+                 * Per-incident try/catch, like the alert path — but here it also
+                 * guards IncidentService.onBeforeCreate, which throws when the
+                 * project has no "created" incident state. That cannot be
+                 * pre-checked the way an empty severity list can.
+                 */
+                await IncidentService.create({
+                    data: incident,
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                created++;
+            }
+            catch (error) {
+                logger.error(`DetectionRuleEvaluator: failed creating incident for rule ${(_b = rule.id) === null || _b === void 0 ? void 0 : _b.toString()}:`);
+                logger.error(error);
+            }
+        }
+        return created;
+    }
+    static buildMatchTitle(rule, matchGroup) {
+        return matchGroup.groupValue
+            ? `[Detection] ${rule.name} — ${matchGroup.groupValue}`
+            : `[Detection] ${rule.name}`;
+    }
+    static buildMatchDescription(data) {
+        const { rule, parsedRule, matchGroup } = data;
+        const descriptionParts = [];
+        if (rule.description || parsedRule.description) {
+            descriptionParts.push(rule.description || parsedRule.description);
+        }
+        descriptionParts.push(`Detection rule matched ${matchGroup.matchCount} security event${matchGroup.matchCount === 1 ? "" : "s"} between ${OneUptimeDate.getDateAsFormattedString(data.startTime)} and ${OneUptimeDate.getDateAsFormattedString(data.endTime)}.`);
+        if (matchGroup.sampleMessage) {
+            descriptionParts.push(`Sample event: ${matchGroup.sampleMessage}`);
+        }
+        if (matchGroup.sampleObservables.length > 0) {
+            descriptionParts.push(`Observables: ${matchGroup.sampleObservables.slice(0, 20).join(", ")}`);
+        }
+        return descriptionParts.join("\n\n");
+    }
+    static async writeDetectionFindings(data) {
+        const { rule, parsedRule, matchedGroups } = data;
+        const projectId = rule.projectId;
+        const serviceMetadata = await OTelIngestService.telemetryServiceFromName({
+            serviceName: DETECTIONS_SERVICE_NAME,
+            projectId,
+        });
+        const retentionDays = resolveTelemetryRetentionInDays({
+            pillar: "securityEvents",
+            serviceConfig: serviceMetadata.serviceRetentionConfig,
+            serviceRetentionInDays: serviceMetadata.serviceRetentionInDays,
+            projectConfig: serviceMetadata.projectRetentionConfig,
+            projectRetentionInDays: serviceMetadata.projectRetentionInDays,
+        });
+        const severityName = SIGMA_LEVEL_TO_OCSF[parsedRule.level] || OcsfSeverity.Medium;
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        const rows = matchedGroups.map((matchGroup) => {
+            const normalized = {
+                time: OneUptimeDate.getCurrentDate(),
+                eventUid: `detection:${rule.id.toString()}:${this.buildFingerprint(rule.id, matchGroup.groupValue)}:${OneUptimeDate.getCurrentDateAsUnixNano()}`,
+                categoryUid,
+                categoryName,
+                classUid: DETECTION_FINDING_CLASS_UID,
+                className: DETECTION_FINDING_CLASS_NAME,
+                activityName: "Create",
+                severityId: OcsfSeverityId[severityName],
+                severityName,
+                statusName: "New",
+                message: matchGroup.groupValue
+                    ? `Detection: ${rule.name} — ${matchGroup.groupValue} (${matchGroup.matchCount} events)`
+                    : `Detection: ${rule.name} (${matchGroup.matchCount} events)`,
+                vendorName: "OneUptime",
+                productName: "OneUptime Detections",
+                ruleId: rule.id.toString(),
+                ruleName: rule.name || parsedRule.title,
+                mitreTactics: parsedRule.mitreTactics,
+                mitreTechniques: parsedRule.mitreTechniques,
+                principalUser: "",
+                principalHost: "",
+                principalIp: "",
+                principalProcess: "",
+                targetUser: "",
+                targetHost: "",
+                targetIp: "",
+                targetPort: 0,
+                targetResource: "",
+                observables: matchGroup.groupValue
+                    ? [
+                        matchGroup.groupValue,
+                        ...matchGroup.sampleObservables.filter((observable) => {
+                            return observable !== matchGroup.groupValue;
+                        }),
+                    ]
+                    : matchGroup.sampleObservables,
+                attributes: Object.assign(Object.assign({ [DETECTION_RULE_ID_ATTRIBUTE]: rule.id.toString(), [DETECTION_RULE_NAME_ATTRIBUTE]: rule.name || parsedRule.title, [DETECTION_MATCH_COUNT_ATTRIBUTE]: String(matchGroup.matchCount) }, (matchGroup.groupValue
+                    ? { [DETECTION_GROUP_VALUE_ATTRIBUTE]: matchGroup.groupValue }
+                    : {})), (parsedRule.id
+                    ? { [DETECTION_SIGMA_ID_ATTRIBUTE]: parsedRule.id }
+                    : {})),
+            };
+            return buildSecurityEventDbRow({
+                normalized,
+                projectId,
+                serviceMetadata,
+                retentionDays,
+            });
+        });
+        await SecurityEventService.insertJsonRows(rows);
+        return rows.length;
+    }
+    static buildFingerprint(ruleId, groupValue) {
+        return `detection-rule:${ruleId.toString()}:${MetricSeriesFingerprint.computeFingerprint({
+            groupValue: groupValue || "",
+        })}`;
+    }
+    /*
+     * Alert severity precedence: the rule's explicit severity (validated to
+     * belong to this project), else a project severity whose name matches
+     * the Sigma level, else severity by rank — critical/high map to the
+     * project's most severe (lowest order), everything else to the least
+     * severe. Returns null only when the project has no severities at all.
+     */
+    static async resolveAlertSeverityId(data) {
+        const severities = await AlertSeverityService.findBy({
+            query: {
+                projectId: data.projectId,
+            },
+            select: {
+                _id: true,
+                name: true,
+            },
+            sort: {
+                order: SortOrder.Ascending,
+            },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: {
+                isRoot: true,
+            },
+        });
+        return this.pickSeverityByPrecedence({
+            severities,
+            explicitSeverityId: data.rule.alertSeverityId,
+            level: data.parsedRule.level,
+        });
+    }
+    /*
+     * Incident severity precedence, identical in shape to the alert
+     * resolver: the rule's explicit incident severity (validated to belong
+     * to this project — IncidentService.onBeforeCreate rejects cross-project
+     * ids with a thrown exception, so pre-validating here keeps a stale id
+     * a soft fallback instead of a hard failure), else a name match on the
+     * Sigma level, else severity by rank. Null only when the project has no
+     * incident severities at all.
+     */
+    static async resolveIncidentSeverityId(data) {
+        const severities = await IncidentSeverityService.findBy({
+            query: {
+                projectId: data.projectId,
+            },
+            select: {
+                _id: true,
+                name: true,
+            },
+            sort: {
+                order: SortOrder.Ascending,
+            },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: {
+                isRoot: true,
+            },
+        });
+        return this.pickSeverityByPrecedence({
+            severities,
+            explicitSeverityId: data.rule.incidentSeverityId,
+            level: data.parsedRule.level,
+        });
+    }
+    /*
+     * The precedence logic both resolvers share. Severities arrive sorted
+     * by order ascending — lowest order is most severe, per the model's
+     * own convention — so "most severe" is the first element and "least
+     * severe" the last. An explicit id that is not in the list (deleted, or
+     * belonging to another project) falls through silently rather than
+     * failing the rule.
+     */
+    static pickSeverityByPrecedence(data) {
+        const { severities, explicitSeverityId, level } = data;
+        if (severities.length === 0) {
+            return null;
+        }
+        if (explicitSeverityId) {
+            const explicit = severities.find((severity) => {
+                var _a;
+                return ((_a = severity.id) === null || _a === void 0 ? void 0 : _a.toString()) === explicitSeverityId.toString();
+            });
+            if (explicit && explicit.id) {
+                return explicit.id;
+            }
+        }
+        const nameMatch = severities.find((severity) => {
+            return (severity.name || "").toLowerCase() === level.toLowerCase();
+        });
+        if (nameMatch && nameMatch.id) {
+            return nameMatch.id;
+        }
+        const isSevere = level === SigmaLevel.Critical || level === SigmaLevel.High;
+        const chosen = isSevere
+            ? severities[0]
+            : severities[severities.length - 1];
+        return chosen.id || null;
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], DetectionRuleEvaluator, "evaluateAllDueRules", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [DetectionRule]),
+    __metadata("design:returntype", Promise)
+], DetectionRuleEvaluator, "evaluateRule", null);
+//# sourceMappingURL=DetectionRuleEvaluator.js.map

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DetectionRuleEvaluator.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,aAAa,MAAM,8CAA8C,CAAC;AACzE,OAAO,KAAK,MAAM,sCAAsC,CAAC;AAEzD,OAAO,QAAQ,MAAM,yCAAyC,CAAC;AAE/D,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAEhD,OAAO,SAAS,MAAM,uCAAuC,CAAC;AAC9D,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAG5D,OAAO,YAAY,EAAE,EACnB,cAAc,GACf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAkB,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,eAAe,MAAM,oDAAoD,CAAC;AACjF,OAAO,uBAAuB,MAAM,gDAAgD,CAAC;AACrF,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,eAAe,MAAM,gCAAgC,CAAC;AAC7D,OAAO,uBAAuB,MAAM,wCAAwC,CAAC;AAC7E,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,iBAEN,MAAM,2CAA2C,CAAC;AACnD,OAAO,oBAEN,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,OAAO,uBAAuB,EAAE,EAC9B,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,uBAAuB,GAAW,sBAAsB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,uBAAuB,GAAW,EAAE,GAAG,EAAE,CAAC;AAEhD,yDAAyD;AACzD,MAAM,yBAAyB,GAAW,GAAG,CAAC;AAE9C,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,aAAa;IACtD,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG;IAClC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM;IACxC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI;IACpC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,QAAQ;CAC7C,CAAC;AAYF;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,sBAAsB;IAErB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB;;QACrC,MAAM,KAAK,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI;aAChB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,IAAI;gBACnB,2BAA2B,EAAE,IAAI;gBACjC,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,IAAI;gBACvB,2BAA2B,EAAE,IAAI;gBACjC,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,IAAI;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,IAAI;aACtB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;YAEF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAS,aAAa,CAAC,gBAAgB,CAChD,IAAI,CAAC,eAAe,EACpB,iBAAiB,CAClB,CAAC;gBAEF,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,iDAAiD,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACxE,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAEpB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,oBAAoB,CAAC,aAAa,CAAC;wBACvC,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,IAAI,EAAE;4BACJ,eAAe,EAAE,aAAa,CAAC,cAAc,EAAE;4BAC/C,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;yBAClE;wBACD,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,YAAY,CAC9B,IAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAc,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxE,MAAM,aAAa,GACjB,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;QAEF,MAAM,eAAe,GAAS,aAAa,CAAC,gBAAgB,CAC1D,OAAO,EACP,CAAC,uBAAuB,CACzB,CAAC;QAEF,IAAI,SAAS,GAAS,IAAI,CAAC,eAAe;YACxC,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;YACvD,SAAS,GAAG,eAAe,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAqB,IAAI,CAAC,YAAY;YAC3D,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,MAAM,GACV,MAAM,oBAAoB,CAAC,oBAAoB,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,OAAO;YACP,aAAa;YACb,iBAAiB;YACjB,SAAS,EAAE,yBAAyB;SACrC,CAAC,CAAC;QAEL,MAAM,aAAa,GAA+B,MAAM,CAAC,MAAM,CAC7D,CAAC,GAAwB,EAAW,EAAE;YACpC,OAAO,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,GAAW,CAAC,CAAC;QAC9B,IAAI,gBAAgB,GAAW,CAAC,CAAC;QACjC,IAAI,eAAe,GAAW,CAAC,CAAC;QAChC,IAAI,YAAY,GAAW,CAAC,CAAC;QAE7B,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;YACvC,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC;QACxC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBACrC,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC9C,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED;;;;;eAKG;YACH,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACvC,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC;oBACpD,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC;gBAC/C,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;oBAClD,IAAI;oBACJ,UAAU;oBACV,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,CAAC,aAAa,CAAC;YACvC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,kBACF,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,IAAyB,IACjC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE;YAC1B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY;YACZ,aAAa;YACb,gBAAgB;YAChB,eAAe;YACf,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAMzC;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GAAoB,MAAM,IAAI,CAAC,sBAAsB,CAAC;YACzE,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,8DAA8D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAC5I,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED;;;;WAIG;QACH,MAAM,YAAY,GAAkB,aAAa,CAAC,GAAG,CACnD,CAAC,UAA+B,EAAU,EAAE;YAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAChE,CAAC,CACF,CAAC;QAEF;;;;;WAKG;QACH,MAAM,UAAU,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;YACzD,KAAK,EAAE;gBACL,SAAS;gBACT,iBAAiB,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC;gBAC7C,iBAAiB,EAAE;oBACjB,eAAe,EAAE,KAAK;iBACvB;aACF;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,iBAAiB,EAAE,IAAI;aACxB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAC3C,UAAU;aACP,GAAG,CAAC,CAAC,KAAY,EAAU,EAAE;YAC5B,OAAO,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACvC,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,WAAmB,EAAW,EAAE;YACvC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,OAAO,GAAW,CAAC,CAAC;QAExB,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,UAAU,GAAwB,aAAa,CAAC,KAAK,CAAE,CAAC;YAC9D,MAAM,WAAW,GAAW,YAAY,CAAC,KAAK,CAAE,CAAC;YAEjD,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAU,IAAI,KAAK,EAAE,CAAC;YACjC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC5B,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrD,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,qBAAqB,CAAC;gBAC7C,IAAI;gBACJ,UAAU;gBACV,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,KAAK,CAAC,eAAe,GAAG,eAAe,CAAC;YACxC,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC;YACtC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC;YACpC,KAAK,CAAC,SAAS,GAAG,yBAAyB,IAAI,CAAC,IAAI,4BAA4B,CAAC;YAEjF,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,MAAM,CAAC;oBACxB,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,0DAA0D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACjF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAM5C;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC;YACnC,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEL,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,oEAAoE,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAClJ,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,YAAY,GAAkB,aAAa,CAAC,GAAG,CACnD,CAAC,UAA+B,EAAU,EAAE;YAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QAChE,CAAC,CACF,CAAC;QAEF;;;;WAIG;QACH,MAAM,aAAa,GAAoB,MAAM,eAAe,CAAC,MAAM,CAAC;YAClE,KAAK,EAAE;gBACL,SAAS;gBACT,iBAAiB,EAAE,IAAI,QAAQ,CAAC,YAAY,CAAC;gBAC7C,oBAAoB,EAAE;oBACpB,eAAe,EAAE,KAAK;iBACvB;aACF;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,iBAAiB,EAAE,IAAI;aACxB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAgB,IAAI,GAAG,CAC3C,aAAa;aACV,GAAG,CAAC,CAAC,QAAkB,EAAU,EAAE;YAClC,OAAO,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAC1C,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,WAAmB,EAAW,EAAE;YACvC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,OAAO,GAAW,CAAC,CAAC;QAExB,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,MAAM,UAAU,GAAwB,aAAa,CAAC,KAAK,CAAE,CAAC;YAC9D,MAAM,WAAW,GAAW,YAAY,CAAC,KAAK,CAAE,CAAC;YAEjD,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAa,IAAI,QAAQ,EAAE,CAAC;YAC1C,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;YAC/B,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACxD,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,qBAAqB,CAAC;gBAChD,IAAI;gBACJ,UAAU;gBACV,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,QAAQ,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACjD,QAAQ,CAAC,iBAAiB,GAAG,WAAW,CAAC;YACzC,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAC;YACvC,QAAQ,CAAC,SAAS,GAAG,yBAAyB,IAAI,CAAC,IAAI,4BAA4B,CAAC;YAEpF,IAAI,CAAC;gBACH;;;;;mBAKG;gBACH,MAAM,eAAe,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,6DAA6D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACpF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,eAAe,CAC5B,IAAmB,EACnB,UAA+B;QAE/B,OAAO,UAAU,CAAC,UAAU;YAC1B,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,EAAE;YACvD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,IAMpC;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,gBAAgB,GAAkB,EAAE,CAAC;QAE3C,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,gBAAgB,CAAC,IAAI,CACnB,0BAA0B,UAAU,CAAC,UAAU,kBAC7C,UAAU,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,YAAY,aAAa,CAAC,wBAAwB,CAChD,IAAI,CAAC,SAAS,CACf,QAAQ,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CACjE,CAAC;QAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,gBAAgB,CAAC,IAAI,CACnB,gBAAgB,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GACnB,MAAM,iBAAiB,CAAC,wBAAwB,CAAC;YAC/C,WAAW,EAAE,uBAAuB;YACpC,SAAS;SACV,CAAC,CAAC;QAEL,MAAM,aAAa,GAAW,+BAA+B,CAAC;YAC5D,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;YAC9D,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;SAC/D,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC;QAE/D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,IAAI,GAAsB,aAAa,CAAC,GAAG,CAC/C,CAAC,UAA+B,EAAc,EAAE;YAC9C,MAAM,UAAU,GAA4B;gBAC1C,IAAI,EAAE,aAAa,CAAC,cAAc,EAAE;gBACpC,QAAQ,EAAE,aAAa,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,gBAAgB,CACjE,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,UAAU,CACtB,IAAI,aAAa,CAAC,wBAAwB,EAAE,EAAE;gBAC/C,WAAW;gBACX,YAAY;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,4BAA4B;gBACvC,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;gBACxC,YAAY;gBACZ,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,UAAU,CAAC,UAAU;oBAC5B,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,UAAU;oBACxF,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,UAAU,UAAU;gBAC/D,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,sBAAsB;gBACnC,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE;gBAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK;gBACvC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,aAAa,EAAE,EAAE;gBACjB,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;gBACf,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,UAAU,CAAC,UAAU;oBAChC,CAAC,CAAC;wBACE,UAAU,CAAC,UAAU;wBACrB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CACpC,CAAC,UAAkB,EAAW,EAAE;4BAC9B,OAAO,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC;wBAC9C,CAAC,CACF;qBACF;oBACH,CAAC,CAAC,UAAU,CAAC,iBAAiB;gBAChC,UAAU,gCACR,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,EAClD,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,EAC9D,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAC7D,CAAC,UAAU,CAAC,UAAU;oBACvB,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,UAAU,CAAC,EAAE;oBACf,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC,CACR;aACF,CAAC;YAEF,OAAO,uBAAuB,CAAC;gBAC7B,UAAU;gBACV,SAAS;gBACT,eAAe;gBACf,aAAa;aACd,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,MAAM,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAC7B,MAAgB,EAChB,UAAkB;QAElB,OAAO,kBAAkB,MAAM,CAAC,QAAQ,EAAE,IAAI,uBAAuB,CAAC,kBAAkB,CACtF;YACE,UAAU,EAAE,UAAU,IAAI,EAAE;SAC7B,CACF,EAAE,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,MAAM,UAAU,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;YACzE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;aACX;YACD,IAAI,EAAE;gBACJ,KAAK,EAAE,SAAS,CAAC,SAAS;aAC3B;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,wBAAwB,CAAC;YACnC,UAAU;YACV,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC7C,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAI9C;QACC,MAAM,UAAU,GACd,MAAM,uBAAuB,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;aACX;YACD,IAAI,EAAE;gBACJ,KAAK,EAAE,SAAS,CAAC,SAAS;aAC3B;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,OAAO,IAAI,CAAC,wBAAwB,CAAC;YACnC,UAAU;YACV,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;SAC7B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,wBAAwB,CAKrC,IAID;QACC,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,QAAQ,GAA0B,UAAU,CAAC,IAAI,CACrD,CAAC,QAAmB,EAAW,EAAE;;gBAC/B,OAAO,CAAA,MAAA,QAAQ,CAAC,EAAE,0CAAE,QAAQ,EAAE,MAAK,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YACnE,CAAC,CACF,CAAC;YAEF,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAC5B,OAAO,QAAQ,CAAC,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAA0B,UAAU,CAAC,IAAI,CACtD,CAAC,QAAmB,EAAW,EAAE;YAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACrE,CAAC,CACF,CAAC;QAEF,IAAI,SAAS,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GACZ,KAAK,KAAK,UAAU,CAAC,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC;QAE7D,MAAM,MAAM,GAAc,QAAQ;YAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE;YAChB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAEvC,OAAO,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC;IAC3B,CAAC;CACF;AA/sBqB;IADnB,WAAW,EAAE;;;;uDAqEb;AAGmB;IADnB,WAAW,EAAE;;qCAEN,aAAa;;gDAmHpB"}