@oneuptime/common 12.0.15 → 12.0.17

package/Tests/Types/SecurityEvent/OcsfEventClass.test.ts

@@ -0,0 +1,105 @@
+import { describe, expect, test } from "@jest/globals";
+import {
+  OcsfCategory,
+  OcsfCategoryId,
+  OcsfEventClassProps,
+  OcsfEventClasses,
+  ocsfCategoryForClassUid,
+  ocsfEventClassByUid,
+} from "../../../Types/SecurityEvent/OcsfEventClass";
+
+/*
+ * Every normalizer stamps classUid/className/categoryUid/categoryName from
+ * this table, and the SIEM UI groups events by those columns. Two things
+ * must never regress: a class uid always lands in the category OCSF says it
+ * belongs to (floor(uid/1000), except extension classes like 201001 which
+ * are curated by hand), and an unknown uid degrades to a sensible category
+ * instead of being dropped — the schema grows faster than our curated
+ * subset, so "unknown class" is an expected steady state, not an error.
+ */
+describe("OcsfEventClass", () => {
+  describe("ocsfEventClassByUid", () => {
+    test.each<[number, string, OcsfCategory]>([
+      [0, "Base Event", OcsfCategory.Uncategorized],
+      [1007, "Process Activity", OcsfCategory.SystemActivity],
+      [2004, "Detection Finding", OcsfCategory.Findings],
+      [3002, "Authentication", OcsfCategory.IdentityAndAccessManagement],
+      [4003, "DNS Activity", OcsfCategory.NetworkActivity],
+      [5002, "Device Config State", OcsfCategory.Discovery],
+      [6003, "API Activity", OcsfCategory.ApplicationActivity],
+      [201001, "Registry Key Activity", OcsfCategory.SystemActivity],
+    ])(
+      "uid %i -> %s in %s",
+      (uid: number, name: string, category: OcsfCategory) => {
+        const cls: OcsfEventClassProps | undefined = ocsfEventClassByUid(uid);
+
+        expect(cls).toBeDefined();
+        expect(cls?.name).toBe(name);
+        expect(cls?.category).toBe(category);
+      },
+    );
+
+    test.each<[number]>([[1234], [3999], [99999], [-1]])(
+      "unknown uid %i -> undefined",
+      (uid: number) => {
+        expect(ocsfEventClassByUid(uid)).toBeUndefined();
+      },
+    );
+  });
+
+  describe("ocsfCategoryForClassUid", () => {
+    test("known class uses its curated category", () => {
+      expect(ocsfCategoryForClassUid(3002)).toEqual({
+        categoryUid: 3,
+        categoryName: "Identity & Access Management",
+      });
+    });
+
+    test("unknown uid in a known category range derives the category", () => {
+      expect(ocsfCategoryForClassUid(4999)).toEqual({
+        categoryUid: 4,
+        categoryName: "Network Activity",
+      });
+
+      expect(ocsfCategoryForClassUid(2999)).toEqual({
+        categoryUid: 2,
+        categoryName: "Findings",
+      });
+    });
+
+    test("unknown uid outside every category range -> Uncategorized", () => {
+      expect(ocsfCategoryForClassUid(9999)).toEqual({
+        categoryUid: 0,
+        categoryName: "Uncategorized",
+      });
+    });
+
+    test("uid 0 (Base Event) -> Uncategorized, not a derived guess", () => {
+      expect(ocsfCategoryForClassUid(0)).toEqual({
+        categoryUid: 0,
+        categoryName: "Uncategorized",
+      });
+    });
+
+    /*
+     * The Windows extension class does NOT follow floor(uid/1000): 201001
+     * would derive to nothing sensible, so the curated entry must win and
+     * put registry events under System Activity.
+     */
+    test("windows extension class 201001 -> System Activity", () => {
+      expect(ocsfCategoryForClassUid(201001)).toEqual({
+        categoryUid: 1,
+        categoryName: "System Activity",
+      });
+    });
+
+    test("every curated class resolves to its own category", () => {
+      for (const cls of OcsfEventClasses) {
+        expect(ocsfCategoryForClassUid(cls.uid)).toEqual({
+          categoryUid: OcsfCategoryId[cls.category],
+          categoryName: cls.category,
+        });
+      }
+    });
+  });
+});

package/Tests/Types/SecurityEvent/OcsfSeverity.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, test } from "@jest/globals";
+import OcsfSeverity, {
+  OcsfSeverityId,
+  normalizeOcsfSeverity,
+  ocsfSeverityFromId,
+} from "../../../Types/SecurityEvent/OcsfSeverity";
+
+/*
+ * A SecurityEvent row stores severity twice: as text (severityName) and as a
+ * number (severityId), and every writer promises the pair agrees. Filters
+ * compare against the numeric id while the UI shows the text, so a drifting
+ * map would make a row claim "Critical" while filtering as something else and
+ * nobody would see an error. These tests pin the id map, the id -> name
+ * reverse lookup, and the alias table that grades foreign dialect severities
+ * (UDM security_result, syslog levels) — the exact strings the normalizers
+ * depend on to grade events consistently.
+ */
+describe("OcsfSeverity", () => {
+  describe("OcsfSeverityId matches the OCSF severity_id values", () => {
+    test.each<[OcsfSeverity, number]>([
+      [OcsfSeverity.Unknown, 0],
+      [OcsfSeverity.Informational, 1],
+      [OcsfSeverity.Low, 2],
+      [OcsfSeverity.Medium, 3],
+      [OcsfSeverity.High, 4],
+      [OcsfSeverity.Critical, 5],
+      [OcsfSeverity.Fatal, 6],
+      [OcsfSeverity.Other, 99],
+    ])("%s -> %i", (severity: OcsfSeverity, expected: number) => {
+      expect(OcsfSeverityId[severity]).toBe(expected);
+    });
+
+    test("every enum member has an id", () => {
+      for (const severity of Object.values(OcsfSeverity)) {
+        expect(OcsfSeverityId[severity]).toBeDefined();
+      }
+    });
+  });
+
+  describe("ocsfSeverityFromId reverses the id map", () => {
+    test("round-trips every enum member", () => {
+      for (const severity of Object.values(OcsfSeverity)) {
+        expect(ocsfSeverityFromId(OcsfSeverityId[severity])).toBe(severity);
+      }
+    });
+
+    test.each<[number]>([[7], [42], [-1], [100], [98]])(
+      "unknown id %i -> Unknown",
+      (id: number) => {
+        expect(ocsfSeverityFromId(id)).toBe(OcsfSeverity.Unknown);
+      },
+    );
+  });
+
+  describe("normalizeOcsfSeverity grades the dialects we ingest", () => {
+    // UDM security_result severities.
+    test.each<[string, OcsfSeverity]>([
+      ["EMERGENCY", OcsfSeverity.Fatal],
+      ["ALERT", OcsfSeverity.Critical],
+      ["CRITICAL", OcsfSeverity.Critical],
+      ["ERROR", OcsfSeverity.Medium],
+      ["HIGH", OcsfSeverity.High],
+      ["MEDIUM", OcsfSeverity.Medium],
+      ["LOW", OcsfSeverity.Low],
+      ["INFORMATIONAL", OcsfSeverity.Informational],
+      ["NONE", OcsfSeverity.Informational],
+      ["UNKNOWN_SEVERITY", OcsfSeverity.Unknown],
+      ["UNKNOWN", OcsfSeverity.Unknown],
+    ])("UDM %s -> %s", (input: string, expected: OcsfSeverity) => {
+      expect(normalizeOcsfSeverity(input)).toBe(expected);
+    });
+
+    /*
+     * Syslog levels. ERR is the interesting one: it is severity 3 in syslog
+     * but grades as OCSF Medium here, matching how ERROR is graded — the two
+     * spellings of the same level must not diverge.
+     */
+    test.each<[string, OcsfSeverity]>([
+      ["DEBUG", OcsfSeverity.Informational],
+      ["INFO", OcsfSeverity.Informational],
+      ["NOTICE", OcsfSeverity.Informational],
+      ["WARNING", OcsfSeverity.Low],
+      ["WARN", OcsfSeverity.Low],
+      ["ERR", OcsfSeverity.Medium],
+      ["CRIT", OcsfSeverity.Critical],
+    ])("syslog %s -> %s", (input: string, expected: OcsfSeverity) => {
+      expect(normalizeOcsfSeverity(input)).toBe(expected);
+    });
+
+    test.each<[string, OcsfSeverity]>([
+      ["high", OcsfSeverity.High],
+      ["Critical", OcsfSeverity.Critical],
+      ["  low  ", OcsfSeverity.Low],
+      ["moderate", OcsfSeverity.Medium],
+      ["severe", OcsfSeverity.High],
+      ["fatal", OcsfSeverity.Fatal],
+    ])(
+      "case-insensitive and trimmed: %s -> %s",
+      (input: string, expected: OcsfSeverity) => {
+        expect(normalizeOcsfSeverity(input)).toBe(expected);
+      },
+    );
+
+    test.each<[string]>([[""], ["   "], ["nonsense"], ["P1"], ["3"], ["Sev1"]])(
+      "unrecognised %s -> null rather than a guess",
+      (input: string) => {
+        expect(normalizeOcsfSeverity(input)).toBeNull();
+      },
+    );
+  });
+});