@oneuptime/common 12.0.15 → 12.0.17

package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceMeasurementAnchorType.js

@@ -0,0 +1,19 @@
+/*
+ * Where one end of a scheduled maintenance measurement is located in time.
+ *
+ * Maintenance is planned rather than detected, so the useful anchors are the
+ * planned window against what actually happened -- "did we start on time",
+ * "did we overrun" -- rather than an impact-onset timestamp.
+ */
+var ScheduledMaintenanceMeasurementAnchorType;
+(function (ScheduledMaintenanceMeasurementAnchorType) {
+    ScheduledMaintenanceMeasurementAnchorType["CreatedAt"] = "Created At";
+    // The planned window, as configured on the event.
+    ScheduledMaintenanceMeasurementAnchorType["ScheduledStartsAt"] = "Scheduled Starts At";
+    ScheduledMaintenanceMeasurementAnchorType["ScheduledEndsAt"] = "Scheduled Ends At";
+    ScheduledMaintenanceMeasurementAnchorType["TimelineStart"] = "Timeline Start";
+    ScheduledMaintenanceMeasurementAnchorType["StateEntered"] = "State Entered";
+    ScheduledMaintenanceMeasurementAnchorType["StateRoleEntered"] = "State Role Entered";
+})(ScheduledMaintenanceMeasurementAnchorType || (ScheduledMaintenanceMeasurementAnchorType = {}));
+export default ScheduledMaintenanceMeasurementAnchorType;
+//# sourceMappingURL=ScheduledMaintenanceMeasurementAnchorType.js.map

package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceMeasurementAnchorType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScheduledMaintenanceMeasurementAnchorType.js","sourceRoot":"","sources":["../../../../Types/ScheduledMaintenance/ScheduledMaintenanceMeasurementAnchorType.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,IAAK,yCAUJ;AAVD,WAAK,yCAAyC;IAC5C,qEAAwB,CAAA;IAExB,kDAAkD;IAClD,sFAAyC,CAAA;IACzC,kFAAqC,CAAA;IAErC,6EAAgC,CAAA;IAChC,2EAA8B,CAAA;IAC9B,oFAAuC,CAAA;AACzC,CAAC,EAVI,yCAAyC,KAAzC,yCAAyC,QAU7C;AAED,eAAe,yCAAyC,CAAC"}

package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceStateRole.js

@@ -0,0 +1,17 @@
+/*
+ * The roles a ScheduledMaintenanceState can carry, mirroring
+ * isScheduledState / isOngoingState / isEndedState / isResolvedState.
+ *
+ * Note this vocabulary differs from incidents and alerts -- which is exactly
+ * why measurement definitions resolve endpoints per domain rather than
+ * assuming one shared created/acknowledged/resolved triple.
+ */
+var ScheduledMaintenanceStateRole;
+(function (ScheduledMaintenanceStateRole) {
+    ScheduledMaintenanceStateRole["Scheduled"] = "Scheduled";
+    ScheduledMaintenanceStateRole["Ongoing"] = "Ongoing";
+    ScheduledMaintenanceStateRole["Ended"] = "Ended";
+    ScheduledMaintenanceStateRole["Resolved"] = "Resolved";
+})(ScheduledMaintenanceStateRole || (ScheduledMaintenanceStateRole = {}));
+export default ScheduledMaintenanceStateRole;
+//# sourceMappingURL=ScheduledMaintenanceStateRole.js.map

package/build/dist/Types/ScheduledMaintenance/ScheduledMaintenanceStateRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScheduledMaintenanceStateRole.js","sourceRoot":"","sources":["../../../../Types/ScheduledMaintenance/ScheduledMaintenanceStateRole.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,IAAK,6BAKJ;AALD,WAAK,6BAA6B;IAChC,wDAAuB,CAAA;IACvB,oDAAmB,CAAA;IACnB,gDAAe,CAAA;IACf,sDAAqB,CAAA;AACvB,CAAC,EALI,6BAA6B,KAA7B,6BAA6B,QAKjC;AAED,eAAe,6BAA6B,CAAC"}

package/build/dist/Types/SecurityEvent/DetectionFindingConstants.js

@@ -0,0 +1,18 @@
+/*
+ * The contract between the detection engine and everything that watches
+ * its output. writeDetectionFindings (DetectionRuleEvaluator) stamps every
+ * finding row with these class/attribute values, and the dashboard's
+ * "create a monitor from this rule" flow builds its filters from the same
+ * constants — one source, so a renamed attribute cannot silently orphan
+ * every monitor built on it.
+ */
+// OCSF Findings class the engine writes matches back as.
+export const DETECTION_FINDING_CLASS_UID = 2004;
+export const DETECTION_FINDING_CLASS_NAME = "Detection Finding";
+// Flattened attributes carried by every Detection Finding row.
+export const DETECTION_RULE_ID_ATTRIBUTE = "oneuptime.detection.rule_id";
+export const DETECTION_RULE_NAME_ATTRIBUTE = "oneuptime.detection.rule_name";
+export const DETECTION_MATCH_COUNT_ATTRIBUTE = "oneuptime.detection.match_count";
+export const DETECTION_GROUP_VALUE_ATTRIBUTE = "oneuptime.detection.group_value";
+export const DETECTION_SIGMA_ID_ATTRIBUTE = "oneuptime.detection.sigma_id";
+//# sourceMappingURL=DetectionFindingConstants.js.map

package/build/dist/Types/SecurityEvent/DetectionFindingConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DetectionFindingConstants.js","sourceRoot":"","sources":["../../../../Types/SecurityEvent/DetectionFindingConstants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,2BAA2B,GAAW,IAAI,CAAC;AACxD,MAAM,CAAC,MAAM,4BAA4B,GAAW,mBAAmB,CAAC;AAExE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GACtC,6BAA6B,CAAC;AAChC,MAAM,CAAC,MAAM,6BAA6B,GACxC,+BAA+B,CAAC;AAClC,MAAM,CAAC,MAAM,+BAA+B,GAC1C,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,+BAA+B,GAC1C,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,4BAA4B,GACvC,8BAA8B,CAAC"}

package/build/dist/Types/SecurityEvent/NormalizedSecurityEvent.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=NormalizedSecurityEvent.js.map

package/build/dist/Types/SecurityEvent/NormalizedSecurityEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NormalizedSecurityEvent.js","sourceRoot":"","sources":["../../../../Types/SecurityEvent/NormalizedSecurityEvent.ts"],"names":[],"mappings":""}

package/build/dist/Types/SecurityEvent/OcsfEventClass.js

@@ -0,0 +1,181 @@
+/*
+ * OCSF event classes and categories — the curated subset OneUptime maps
+ * ingested security events onto.
+ *
+ * OCSF groups event classes into categories (System Activity, Findings,
+ * IAM, Network Activity, Discovery, Application Activity). Each class has a
+ * stable uid; category uid is floor(class_uid / 1000). Events whose source
+ * dialect has no OCSF equivalent keep class uid 0 with a source-derived
+ * class name, so nothing is dropped just because it does not map.
+ *
+ * https://schema.ocsf.io/classes
+ */
+export var OcsfCategory;
+(function (OcsfCategory) {
+    OcsfCategory["Uncategorized"] = "Uncategorized";
+    OcsfCategory["SystemActivity"] = "System Activity";
+    OcsfCategory["Findings"] = "Findings";
+    OcsfCategory["IdentityAndAccessManagement"] = "Identity & Access Management";
+    OcsfCategory["NetworkActivity"] = "Network Activity";
+    OcsfCategory["Discovery"] = "Discovery";
+    OcsfCategory["ApplicationActivity"] = "Application Activity";
+})(OcsfCategory || (OcsfCategory = {}));
+export const OcsfCategoryId = {
+    [OcsfCategory.Uncategorized]: 0,
+    [OcsfCategory.SystemActivity]: 1,
+    [OcsfCategory.Findings]: 2,
+    [OcsfCategory.IdentityAndAccessManagement]: 3,
+    [OcsfCategory.NetworkActivity]: 4,
+    [OcsfCategory.Discovery]: 5,
+    [OcsfCategory.ApplicationActivity]: 6,
+};
+/*
+ * Class uids come from the OCSF schema. The Windows extension's Registry
+ * Key Activity (201001) is included because Google SecOps UDM registry
+ * events are common in the wild.
+ */
+export const OcsfEventClasses = [
+    { uid: 0, name: "Base Event", category: OcsfCategory.Uncategorized },
+    // System Activity (1xxx)
+    {
+        uid: 1001,
+        name: "File System Activity",
+        category: OcsfCategory.SystemActivity,
+    },
+    {
+        uid: 1005,
+        name: "Module Activity",
+        category: OcsfCategory.SystemActivity,
+    },
+    {
+        uid: 1006,
+        name: "Scheduled Job Activity",
+        category: OcsfCategory.SystemActivity,
+    },
+    {
+        uid: 1007,
+        name: "Process Activity",
+        category: OcsfCategory.SystemActivity,
+    },
+    // Findings (2xxx)
+    {
+        uid: 2002,
+        name: "Vulnerability Finding",
+        category: OcsfCategory.Findings,
+    },
+    { uid: 2003, name: "Compliance Finding", category: OcsfCategory.Findings },
+    { uid: 2004, name: "Detection Finding", category: OcsfCategory.Findings },
+    { uid: 2005, name: "Incident Finding", category: OcsfCategory.Findings },
+    // Identity & Access Management (3xxx)
+    {
+        uid: 3001,
+        name: "Account Change",
+        category: OcsfCategory.IdentityAndAccessManagement,
+    },
+    {
+        uid: 3002,
+        name: "Authentication",
+        category: OcsfCategory.IdentityAndAccessManagement,
+    },
+    {
+        uid: 3003,
+        name: "Authorize Session",
+        category: OcsfCategory.IdentityAndAccessManagement,
+    },
+    {
+        uid: 3004,
+        name: "Entity Management",
+        category: OcsfCategory.IdentityAndAccessManagement,
+    },
+    {
+        uid: 3005,
+        name: "User Access Management",
+        category: OcsfCategory.IdentityAndAccessManagement,
+    },
+    {
+        uid: 3006,
+        name: "Group Management",
+        category: OcsfCategory.IdentityAndAccessManagement,
+    },
+    // Network Activity (4xxx)
+    {
+        uid: 4001,
+        name: "Network Activity",
+        category: OcsfCategory.NetworkActivity,
+    },
+    { uid: 4002, name: "HTTP Activity", category: OcsfCategory.NetworkActivity },
+    { uid: 4003, name: "DNS Activity", category: OcsfCategory.NetworkActivity },
+    { uid: 4004, name: "DHCP Activity", category: OcsfCategory.NetworkActivity },
+    { uid: 4005, name: "RDP Activity", category: OcsfCategory.NetworkActivity },
+    { uid: 4006, name: "SMB Activity", category: OcsfCategory.NetworkActivity },
+    { uid: 4007, name: "SSH Activity", category: OcsfCategory.NetworkActivity },
+    { uid: 4008, name: "FTP Activity", category: OcsfCategory.NetworkActivity },
+    {
+        uid: 4009,
+        name: "Email Activity",
+        category: OcsfCategory.NetworkActivity,
+    },
+    // Discovery (5xxx)
+    {
+        uid: 5001,
+        name: "Device Inventory Info",
+        category: OcsfCategory.Discovery,
+    },
+    {
+        uid: 5002,
+        name: "Device Config State",
+        category: OcsfCategory.Discovery,
+    },
+    // Application Activity (6xxx)
+    {
+        uid: 6001,
+        name: "Web Resources Activity",
+        category: OcsfCategory.ApplicationActivity,
+    },
+    {
+        uid: 6002,
+        name: "Application Lifecycle",
+        category: OcsfCategory.ApplicationActivity,
+    },
+    {
+        uid: 6003,
+        name: "API Activity",
+        category: OcsfCategory.ApplicationActivity,
+    },
+    // Windows extension.
+    {
+        uid: 201001,
+        name: "Registry Key Activity",
+        category: OcsfCategory.SystemActivity,
+    },
+];
+export function ocsfEventClassByUid(uid) {
+    return OcsfEventClasses.find((cls) => {
+        return cls.uid === uid;
+    });
+}
+export function ocsfCategoryForClassUid(uid) {
+    const cls = ocsfEventClassByUid(uid);
+    if (cls) {
+        return {
+            categoryUid: OcsfCategoryId[cls.category],
+            categoryName: cls.category,
+        };
+    }
+    /*
+     * Unknown class uid — derive the category from the uid's thousands digit
+     * when it lands on a known category, otherwise Uncategorized.
+     */
+    const derived = Math.floor(uid / 1000);
+    const entries = Object.entries(OcsfCategoryId);
+    for (const [name, value] of entries) {
+        if (value === derived && value !== 0) {
+            return { categoryUid: value, categoryName: name };
+        }
+    }
+    return {
+        categoryUid: OcsfCategoryId[OcsfCategory.Uncategorized],
+        categoryName: OcsfCategory.Uncategorized,
+    };
+}
+//# sourceMappingURL=OcsfEventClass.js.map

package/build/dist/Types/SecurityEvent/OcsfEventClass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OcsfEventClass.js","sourceRoot":"","sources":["../../../../Types/SecurityEvent/OcsfEventClass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,YAQX;AARD,WAAY,YAAY;IACtB,+CAA+B,CAAA;IAC/B,kDAAkC,CAAA;IAClC,qCAAqB,CAAA;IACrB,4EAA4D,CAAA;IAC5D,oDAAoC,CAAA;IACpC,uCAAuB,CAAA;IACvB,4DAA4C,CAAA;AAC9C,CAAC,EARW,YAAY,KAAZ,YAAY,QAQvB;AAED,MAAM,CAAC,MAAM,cAAc,GAAiC;IAC1D,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;IAC/B,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;IAChC,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC,YAAY,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAC7C,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;IACjC,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;IAC3B,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAE,CAAC;CACtC,CAAC;AAQF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA+B;IAC1D,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,aAAa,EAAE;IAEpE,yBAAyB;IACzB;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,YAAY,CAAC,cAAc;KACtC;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,YAAY,CAAC,cAAc;KACtC;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,YAAY,CAAC,cAAc;KACtC;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,YAAY,CAAC,cAAc;KACtC;IAED,kBAAkB;IAClB;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,YAAY,CAAC,QAAQ;KAChC;IACD,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC1E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;IACzE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;IAExE,sCAAsC;IACtC;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,YAAY,CAAC,2BAA2B;KACnD;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,YAAY,CAAC,2BAA2B;KACnD;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,YAAY,CAAC,2BAA2B;KACnD;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,YAAY,CAAC,2BAA2B;KACnD;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,YAAY,CAAC,2BAA2B;KACnD;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,YAAY,CAAC,2BAA2B;KACnD;IAED,0BAA0B;IAC1B;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,YAAY,CAAC,eAAe;KACvC;IACD,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC5E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC3E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC5E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC3E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC3E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC3E,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,eAAe,EAAE;IAC3E;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,YAAY,CAAC,eAAe;KACvC;IAED,mBAAmB;IACnB;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,YAAY,CAAC,SAAS;KACjC;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,YAAY,CAAC,SAAS;KACjC;IAED,8BAA8B;IAC9B;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,YAAY,CAAC,mBAAmB;KAC3C;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,YAAY,CAAC,mBAAmB;KAC3C;IACD;QACE,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,YAAY,CAAC,mBAAmB;KAC3C;IAED,qBAAqB;IACrB;QACE,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,YAAY,CAAC,cAAc;KACtC;CACF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,GAAW;IAEX,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAwB,EAAW,EAAE;QACjE,OAAO,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IAIjD,MAAM,GAAG,GAAoC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAEtE,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzC,YAAY,EAAE,GAAG,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,OAAO,GAAW,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAA4B,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAExE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,aAAa,CAAC;QACvD,YAAY,EAAE,YAAY,CAAC,aAAa;KACzC,CAAC;AACJ,CAAC"}

package/build/dist/Types/SecurityEvent/OcsfSeverity.js

@@ -0,0 +1,81 @@
+/*
+ * OCSF (Open Cybersecurity Schema Framework) severity levels.
+ *
+ * Security events are normalized to OCSF at ingest, whatever dialect they
+ * arrived in (Google SecOps UDM, native OCSF, generic JSON). The severity a
+ * row stores is always one of these names plus the matching numeric id —
+ * writers must take both from this file or a row will say one thing in its
+ * text and another in its number.
+ *
+ * https://schema.ocsf.io/ (severity_id on the base event class)
+ */
+var OcsfSeverity;
+(function (OcsfSeverity) {
+    OcsfSeverity["Unknown"] = "Unknown";
+    OcsfSeverity["Informational"] = "Informational";
+    OcsfSeverity["Low"] = "Low";
+    OcsfSeverity["Medium"] = "Medium";
+    OcsfSeverity["High"] = "High";
+    OcsfSeverity["Critical"] = "Critical";
+    OcsfSeverity["Fatal"] = "Fatal";
+    OcsfSeverity["Other"] = "Other";
+})(OcsfSeverity || (OcsfSeverity = {}));
+export const OcsfSeverityId = {
+    [OcsfSeverity.Unknown]: 0,
+    [OcsfSeverity.Informational]: 1,
+    [OcsfSeverity.Low]: 2,
+    [OcsfSeverity.Medium]: 3,
+    [OcsfSeverity.High]: 4,
+    [OcsfSeverity.Critical]: 5,
+    [OcsfSeverity.Fatal]: 6,
+    [OcsfSeverity.Other]: 99,
+};
+export function ocsfSeverityFromId(id) {
+    const entries = Object.entries(OcsfSeverityId);
+    for (const [name, value] of entries) {
+        if (value === id) {
+            return name;
+        }
+    }
+    return OcsfSeverity.Unknown;
+}
+/*
+ * Loose severity text -> OCSF severity. Accepts the dialects we ingest:
+ * UDM security_result severities (EMERGENCY/ALERT/CRITICAL/ERROR/HIGH/...),
+ * syslog-style levels, and common vendor strings. Returns null for anything
+ * unrecognised — callers decide the fallback, guessing here would silently
+ * misgrade events.
+ */
+export function normalizeOcsfSeverity(text) {
+    const normalized = (text || "").trim().toUpperCase();
+    if (!normalized) {
+        return null;
+    }
+    const aliases = {
+        UNKNOWN: OcsfSeverity.Unknown,
+        UNKNOWN_SEVERITY: OcsfSeverity.Unknown,
+        NONE: OcsfSeverity.Informational,
+        INFO: OcsfSeverity.Informational,
+        INFORMATION: OcsfSeverity.Informational,
+        INFORMATIONAL: OcsfSeverity.Informational,
+        NOTICE: OcsfSeverity.Informational,
+        DEBUG: OcsfSeverity.Informational,
+        LOW: OcsfSeverity.Low,
+        WARN: OcsfSeverity.Low,
+        WARNING: OcsfSeverity.Low,
+        MEDIUM: OcsfSeverity.Medium,
+        MODERATE: OcsfSeverity.Medium,
+        ERR: OcsfSeverity.Medium,
+        ERROR: OcsfSeverity.Medium,
+        HIGH: OcsfSeverity.High,
+        SEVERE: OcsfSeverity.High,
+        CRITICAL: OcsfSeverity.Critical,
+        CRIT: OcsfSeverity.Critical,
+        ALERT: OcsfSeverity.Critical,
+        FATAL: OcsfSeverity.Fatal,
+        EMERGENCY: OcsfSeverity.Fatal,
+    };
+    return aliases[normalized] || null;
+}
+export default OcsfSeverity;
+//# sourceMappingURL=OcsfSeverity.js.map

package/build/dist/Types/SecurityEvent/OcsfSeverity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OcsfSeverity.js","sourceRoot":"","sources":["../../../../Types/SecurityEvent/OcsfSeverity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,IAAK,YASJ;AATD,WAAK,YAAY;IACf,mCAAmB,CAAA;IACnB,+CAA+B,CAAA;IAC/B,2BAAW,CAAA;IACX,iCAAiB,CAAA;IACjB,6BAAa,CAAA;IACb,qCAAqB,CAAA;IACrB,+BAAe,CAAA;IACf,+BAAe,CAAA;AACjB,CAAC,EATI,YAAY,KAAZ,YAAY,QAShB;AAED,MAAM,CAAC,MAAM,cAAc,GAAiC;IAC1D,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACzB,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;IAC/B,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;IACrB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IACxB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACtB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE;CACzB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,MAAM,OAAO,GAA4B,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAExE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,IAAoB,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,UAAU,GAAW,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAiC;QAC5C,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,gBAAgB,EAAE,YAAY,CAAC,OAAO;QACtC,IAAI,EAAE,YAAY,CAAC,aAAa;QAChC,IAAI,EAAE,YAAY,CAAC,aAAa;QAChC,WAAW,EAAE,YAAY,CAAC,aAAa;QACvC,aAAa,EAAE,YAAY,CAAC,aAAa;QACzC,MAAM,EAAE,YAAY,CAAC,aAAa;QAClC,KAAK,EAAE,YAAY,CAAC,aAAa;QACjC,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,IAAI,EAAE,YAAY,CAAC,GAAG;QACtB,OAAO,EAAE,YAAY,CAAC,GAAG;QACzB,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,QAAQ,EAAE,YAAY,CAAC,MAAM;QAC7B,GAAG,EAAE,YAAY,CAAC,MAAM;QACxB,KAAK,EAAE,YAAY,CAAC,MAAM;QAC1B,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,MAAM,EAAE,YAAY,CAAC,IAAI;QACzB,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,IAAI,EAAE,YAAY,CAAC,QAAQ;QAC3B,KAAK,EAAE,YAAY,CAAC,QAAQ;QAC5B,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,SAAS,EAAE,YAAY,CAAC,KAAK;KAC9B,CAAC;IAEF,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC;AAED,eAAe,YAAY,CAAC"}

package/build/dist/Types/SecurityEvent/SecurityEventFormat.js

@@ -0,0 +1,21 @@
+/*
+ * Wire dialects the security-events ingest endpoint accepts. Clients can
+ * name the format explicitly (query param or header); when they do not,
+ * ingest sniffs it per event — see SecurityEventFormatDetector.
+ */
+var SecurityEventFormat;
+(function (SecurityEventFormat) {
+    // Native OCSF event JSON (class_uid / category_uid / severity_id ...).
+    SecurityEventFormat["Ocsf"] = "ocsf";
+    // Google SecOps / Chronicle UDM event JSON (metadata.event_type ...).
+    SecurityEventFormat["Udm"] = "udm";
+    /*
+     * Google SecOps detection/alert payloads — what a SOAR playbook webhook
+     * or the detections stream delivers (rule metadata + matched events).
+     */
+    SecurityEventFormat["GoogleSecOpsAlert"] = "google-secops-alert";
+    // Anything else — best-effort field mapping.
+    SecurityEventFormat["Generic"] = "generic";
+})(SecurityEventFormat || (SecurityEventFormat = {}));
+export default SecurityEventFormat;
+//# sourceMappingURL=SecurityEventFormat.js.map

package/build/dist/Types/SecurityEvent/SecurityEventFormat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityEventFormat.js","sourceRoot":"","sources":["../../../../Types/SecurityEvent/SecurityEventFormat.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,IAAK,mBAeJ;AAfD,WAAK,mBAAmB;IACtB,uEAAuE;IACvE,oCAAa,CAAA;IAEb,sEAAsE;IACtE,kCAAW,CAAA;IAEX;;;OAGG;IACH,gEAAyC,CAAA;IAEzC,6CAA6C;IAC7C,0CAAmB,CAAA;AACrB,CAAC,EAfI,mBAAmB,KAAnB,mBAAmB,QAevB;AAED,eAAe,mBAAmB,CAAC"}

package/build/dist/Types/SecurityEvent/SigmaRule.js

@@ -0,0 +1,16 @@
+/*
+ * Typed representation of a parsed Sigma rule — the subset OneUptime's
+ * detection engine evaluates. Produced by SigmaRuleParser, consumed by
+ * the ClickHouse compiler.
+ *
+ * https://sigmahq.io/docs/basics/rules.html
+ */
+export var SigmaLevel;
+(function (SigmaLevel) {
+    SigmaLevel["Informational"] = "informational";
+    SigmaLevel["Low"] = "low";
+    SigmaLevel["Medium"] = "medium";
+    SigmaLevel["High"] = "high";
+    SigmaLevel["Critical"] = "critical";
+})(SigmaLevel || (SigmaLevel = {}));
+//# sourceMappingURL=SigmaRule.js.map

package/build/dist/Types/SecurityEvent/SigmaRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SigmaRule.js","sourceRoot":"","sources":["../../../../Types/SecurityEvent/SigmaRule.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AAEH,MAAM,CAAN,IAAY,UAMX;AAND,WAAY,UAAU;IACpB,6CAA+B,CAAA;IAC/B,yBAAW,CAAA;IACX,+BAAiB,CAAA;IACjB,2BAAa,CAAA;IACb,mCAAqB,CAAA;AACvB,CAAC,EANW,UAAU,KAAV,UAAU,QAMrB"}

package/build/dist/Types/Telemetry/LlmConventions.js

@@ -56,12 +56,30 @@ export const LlmTotalTokenAttributeKeys = [
     "llm.token_count.total",
     "llm.usage.total_tokens",
 ];
-// Cost in USD. Only populated when the SDK reports it (no built-in pricing).
+/*
+ * Cost in USD. A reported cost always wins; when absent, ingest computes an
+ * estimate from token counts via Common/Types/Telemetry/LlmCostCatalog.ts.
+ */
 export const LlmCostAttributeKeys = [
     "gen_ai.usage.cost",
     "gen_ai.usage.cost_usd",
     "gen_ai.usage.total_cost",
     "llm.usage.total_cost",
+    // LiteLLM proxy: v1 otel callback / opt-in OTel v2 mode.
+    "gen_ai.cost.total_cost",
+    "litellm.cost.total",
+];
+/*
+ * Conversation / session id that groups the LLM calls of one user interaction
+ * across traces. gen_ai.conversation.id is the OTel semconv key; session.id is
+ * emitted by OpenInference and Langfuse-compatible SDKs; the traceloop
+ * association property is OpenLLMetry's spelling.
+ */
+export const LlmConversationIdAttributeKeys = [
+    "gen_ai.conversation.id",
+    "session.id",
+    "langfuse.session.id",
+    "traceloop.association.properties.session_id",
 ];
 export const LlmAgentNameAttributeKeys = [
     "gen_ai.agent.name",

package/build/dist/Types/Telemetry/LlmConventions.js.map

@@ -1 +1 @@
-{"version":3,"file":"LlmConventions.js","sourceRoot":"","sources":["../../../../Types/Telemetry/LlmConventions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,eAAe;IACf,sBAAsB;IACtB,YAAY;IACZ,cAAc;CACf,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAkB;IACtD,uBAAuB;IACvB,kBAAkB;IAClB,yBAAyB;CAC1B,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,4BAA4B,GAAkB;IACzD,sBAAsB;IACtB,gBAAgB;IAChB,mBAAmB;CACpB,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GAAkB;IAC1D,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,2BAA2B;IAC3B,4BAA4B;IAC5B,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAkB;IACxD,4BAA4B;IAC5B,gCAAgC;IAChC,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;CACzB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAkB;IACtD,mBAAmB;IACnB,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAkB;IACrD,kBAAkB;IAClB,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAkB;IACxD,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAkB;IACtD,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD,sBAAsB;IACtB,mBAAmB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAkB;IACzD,gCAAgC;IAChC,+BAA+B;IAC/B,4BAA4B;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkB;IAC1D,SAAS;IACT,MAAM;IACN,YAAY;CACb,CAAC;AAaF,MAAM,CAAC,MAAM,kCAAkC,GAC7C;IACE,+BAA+B;IAC/B,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IACzE,wCAAwC;IACxC;QACE,MAAM,EAAE,oBAAoB;QAC5B,aAAa,EAAE,iBAAiB;QAChC,UAAU,EAAE,cAAc;KAC3B;CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,sCAAsC,GACjD;IACE,mCAAmC;IACnC;QACE,MAAM,EAAE,mBAAmB;QAC3B,aAAa,EAAE,SAAS;QACxB,UAAU,EAAE,MAAM;KACnB;IACD,yCAAyC;IACzC;QACE,MAAM,EAAE,qBAAqB;QAC7B,aAAa,EAAE,iBAAiB;QAChC,UAAU,EAAE,cAAc;KAC3B;CACF,CAAC;AAEJ,gEAAgE;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,uBAAuB;IACvB,eAAe;IACf,aAAa;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAkB;IAC3D,wBAAwB;IACxB,mBAAmB;IACnB,cAAc;CACf,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAkB;IAChD,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAkB;IACpD,0BAA0B;IAC1B,eAAe;CAChB,CAAC"}
+{"version":3,"file":"LlmConventions.js","sourceRoot":"","sources":["../../../../Types/Telemetry/LlmConventions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,eAAe;IACf,sBAAsB;IACtB,YAAY;IACZ,cAAc;CACf,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAkB;IACtD,uBAAuB;IACvB,kBAAkB;IAClB,yBAAyB;CAC1B,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,4BAA4B,GAAkB;IACzD,sBAAsB;IACtB,gBAAgB;IAChB,mBAAmB;CACpB,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GAAkB;IAC1D,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,2BAA2B;IAC3B,4BAA4B;IAC5B,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAkB;IACxD,4BAA4B;IAC5B,gCAAgC;IAChC,4BAA4B;IAC5B,6BAA6B;CAC9B,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,2BAA2B;IAC3B,uBAAuB;IACvB,wBAAwB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,yDAAyD;IACzD,wBAAwB;IACxB,oBAAoB;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkB;IAC3D,wBAAwB;IACxB,YAAY;IACZ,qBAAqB;IACrB,6CAA6C;CAC9C,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAkB;IACtD,mBAAmB;IACnB,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAkB;IACrD,kBAAkB;IAClB,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAkB;IACxD,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAkB;IACtD,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD,sBAAsB;IACtB,mBAAmB;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAkB;IACzD,gCAAgC;IAChC,+BAA+B;IAC/B,4BAA4B;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAkB;IAC1D,SAAS;IACT,MAAM;IACN,YAAY;CACb,CAAC;AAaF,MAAM,CAAC,MAAM,kCAAkC,GAC7C;IACE,+BAA+B;IAC/B,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE;IACzE,wCAAwC;IACxC;QACE,MAAM,EAAE,oBAAoB;QAC5B,aAAa,EAAE,iBAAiB;QAChC,UAAU,EAAE,cAAc;KAC3B;CACF,CAAC;AAEJ,MAAM,CAAC,MAAM,sCAAsC,GACjD;IACE,mCAAmC;IACnC;QACE,MAAM,EAAE,mBAAmB;QAC3B,aAAa,EAAE,SAAS;QACxB,UAAU,EAAE,MAAM;KACnB;IACD,yCAAyC;IACzC;QACE,MAAM,EAAE,qBAAqB;QAC7B,aAAa,EAAE,iBAAiB;QAChC,UAAU,EAAE,cAAc;KAC3B;CACF,CAAC;AAEJ,gEAAgE;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,uBAAuB;IACvB,eAAe;IACf,aAAa;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAkB;IAC3D,wBAAwB;IACxB,mBAAmB;IACnB,cAAc;CACf,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAkB;IAChD,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAkB;IACpD,0BAA0B;IAC1B,eAAe;CAChB,CAAC"}