@oneuptime/common 12.0.25 → 12.0.26

package/Server/Utils/SecurityEvent/SecurityEventAlerting.ts

@@ -0,0 +1,318 @@
+import Alert from "../../../Models/DatabaseModels/Alert";
+import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import ObjectID from "../../../Types/ObjectID";
+import AlertService from "../../Services/AlertService";
+import AlertSeverityService from "../../Services/AlertSeverityService";
+import IncidentService from "../../Services/IncidentService";
+import IncidentSeverityService from "../../Services/IncidentSeverityService";
+import logger from "../Logger";
+
+/*
+ * The alert/incident plumbing every security-event detection source
+ * shares — extracted from DetectionRuleEvaluator so the threat-intel
+ * matcher (and any future source) opens alerts through the exact same
+ * dedupe and severity machinery instead of a drifting copy.
+ *
+ * Semantics preserved from the Sigma engine:
+ *  - one open alert/incident per fingerprint: dedupe is a findBy scoped
+ *    to THIS source's candidate fingerprints against unresolved state,
+ *    never a scan of every open alert;
+ *  - per-item try/catch on create, so one failing create cannot sink the
+ *    rest of the batch (incident creates are heavy and consume
+ *    user-visible incident numbers);
+ *  - severity precedence: explicit id (validated to belong to the
+ *    project), else name match on the source's severity label, else rank
+ *    (severe sources get the project's most severe, others the least).
+ */
+
+export interface AlertableMatch {
+  // Stable dedupe key, e.g. "detection-rule:<id>:<hash>".
+  fingerprint: string;
+  title: string;
+  description: string;
+  rootCause: string;
+}
+
+export async function openDedupedAlerts(data: {
+  projectId: ObjectID;
+  alertSeverityId: ObjectID;
+  matches: Array<AlertableMatch>;
+  // Prefix for create-failure log lines, e.g. "DetectionRuleEvaluator: rule <id>".
+  logLabel: string;
+}): Promise<number> {
+  const fingerprints: Array<string> = data.matches.map(
+    (match: AlertableMatch): string => {
+      return match.fingerprint;
+    },
+  );
+
+  const openAlerts: Array<Alert> = await AlertService.findBy({
+    query: {
+      projectId: data.projectId,
+      seriesFingerprint: new Includes(fingerprints),
+      currentAlertState: {
+        isResolvedState: false,
+      },
+    },
+    select: {
+      _id: true,
+      seriesFingerprint: true,
+    },
+    skip: 0,
+    limit: LIMIT_PER_PROJECT,
+    props: {
+      isRoot: true,
+    },
+  });
+
+  const openFingerprints: Set<string> = new Set<string>(
+    openAlerts
+      .map((alert: Alert): string => {
+        return alert.seriesFingerprint || "";
+      })
+      .filter((fingerprint: string): boolean => {
+        return Boolean(fingerprint);
+      }),
+  );
+
+  let created: number = 0;
+
+  for (const match of data.matches) {
+    if (openFingerprints.has(match.fingerprint)) {
+      continue;
+    }
+
+    const alert: Alert = new Alert();
+    alert.projectId = data.projectId;
+    alert.title = match.title;
+    alert.description = match.description;
+    alert.alertSeverityId = data.alertSeverityId;
+    alert.seriesFingerprint = match.fingerprint;
+    alert.isCreatedAutomatically = true;
+    alert.rootCause = match.rootCause;
+
+    try {
+      await AlertService.create({
+        data: alert,
+        props: {
+          isRoot: true,
+        },
+      });
+      created++;
+    } catch (error) {
+      logger.error(`${data.logLabel}: failed creating alert:`);
+      logger.error(error);
+    }
+  }
+
+  return created;
+}
+
+/*
+ * The incident twin. Dedupe runs BEFORE create — incident numbers are
+ * user-visible and consumed per create — and each create is individually
+ * guarded because IncidentService.onBeforeCreate throws when the project
+ * has no "created" incident state, which cannot be pre-checked the way
+ * an empty severity list can.
+ */
+export async function openDedupedIncidents(data: {
+  projectId: ObjectID;
+  incidentSeverityId: ObjectID;
+  matches: Array<AlertableMatch>;
+  logLabel: string;
+}): Promise<number> {
+  const fingerprints: Array<string> = data.matches.map(
+    (match: AlertableMatch): string => {
+      return match.fingerprint;
+    },
+  );
+
+  const openIncidents: Array<Incident> = await IncidentService.findBy({
+    query: {
+      projectId: data.projectId,
+      seriesFingerprint: new Includes(fingerprints),
+      currentIncidentState: {
+        isResolvedState: false,
+      },
+    },
+    select: {
+      _id: true,
+      seriesFingerprint: true,
+    },
+    skip: 0,
+    limit: LIMIT_PER_PROJECT,
+    props: {
+      isRoot: true,
+    },
+  });
+
+  const openFingerprints: Set<string> = new Set<string>(
+    openIncidents
+      .map((incident: Incident): string => {
+        return incident.seriesFingerprint || "";
+      })
+      .filter((fingerprint: string): boolean => {
+        return Boolean(fingerprint);
+      }),
+  );
+
+  let created: number = 0;
+
+  for (const match of data.matches) {
+    if (openFingerprints.has(match.fingerprint)) {
+      continue;
+    }
+
+    const incident: Incident = new Incident();
+    incident.projectId = data.projectId;
+    incident.title = match.title;
+    incident.description = match.description;
+    incident.incidentSeverityId = data.incidentSeverityId;
+    incident.seriesFingerprint = match.fingerprint;
+    incident.isCreatedAutomatically = true;
+    incident.rootCause = match.rootCause;
+
+    try {
+      await IncidentService.create({
+        data: incident,
+        props: {
+          isRoot: true,
+        },
+      });
+      created++;
+    } catch (error) {
+      logger.error(`${data.logLabel}: failed creating incident:`);
+      logger.error(error);
+    }
+  }
+
+  return created;
+}
+
+/*
+ * The precedence logic both severity resolvers share. Severities arrive
+ * sorted by order ascending — lowest order is most severe, per the
+ * model's own convention — so "most severe" is the first element and
+ * "least severe" the last. An explicit id that is not in the list
+ * (deleted, or belonging to another project) falls through silently
+ * rather than failing the source.
+ */
+export function pickSeverityByPrecedence<
+  TSeverity extends {
+    id?: ObjectID | null | undefined;
+    name?: string | undefined;
+  },
+>(data: {
+  severities: Array<TSeverity>;
+  explicitSeverityId: ObjectID | undefined;
+  // Matched case-insensitively against project severity names.
+  severityLabel: string;
+  // Severe sources rank to the project's most severe severity.
+  isSevere: boolean;
+}): ObjectID | null {
+  const { severities, explicitSeverityId, severityLabel, isSevere } = data;
+
+  if (severities.length === 0) {
+    return null;
+  }
+
+  if (explicitSeverityId) {
+    const explicit: TSeverity | undefined = severities.find(
+      (severity: TSeverity): boolean => {
+        return severity.id?.toString() === explicitSeverityId.toString();
+      },
+    );
+
+    if (explicit && explicit.id) {
+      return explicit.id;
+    }
+  }
+
+  const nameMatch: TSeverity | undefined = severities.find(
+    (severity: TSeverity): boolean => {
+      return (
+        (severity.name || "").toLowerCase() === severityLabel.toLowerCase()
+      );
+    },
+  );
+
+  if (nameMatch && nameMatch.id) {
+    return nameMatch.id;
+  }
+
+  const chosen: TSeverity = isSevere
+    ? severities[0]!
+    : severities[severities.length - 1]!;
+
+  return chosen.id || null;
+}
+
+export async function resolveAlertSeverityIdForProject(data: {
+  projectId: ObjectID;
+  explicitSeverityId: ObjectID | undefined;
+  severityLabel: string;
+  isSevere: boolean;
+}): Promise<ObjectID | null> {
+  const severities: Array<AlertSeverity> = await AlertSeverityService.findBy({
+    query: {
+      projectId: data.projectId,
+    },
+    select: {
+      _id: true,
+      name: true,
+    },
+    sort: {
+      order: SortOrder.Ascending,
+    },
+    skip: 0,
+    limit: LIMIT_PER_PROJECT,
+    props: {
+      isRoot: true,
+    },
+  });
+
+  return pickSeverityByPrecedence({
+    severities,
+    explicitSeverityId: data.explicitSeverityId,
+    severityLabel: data.severityLabel,
+    isSevere: data.isSevere,
+  });
+}
+
+export async function resolveIncidentSeverityIdForProject(data: {
+  projectId: ObjectID;
+  explicitSeverityId: ObjectID | undefined;
+  severityLabel: string;
+  isSevere: boolean;
+}): Promise<ObjectID | null> {
+  const severities: Array<IncidentSeverity> =
+    await IncidentSeverityService.findBy({
+      query: {
+        projectId: data.projectId,
+      },
+      select: {
+        _id: true,
+        name: true,
+      },
+      sort: {
+        order: SortOrder.Ascending,
+      },
+      skip: 0,
+      limit: LIMIT_PER_PROJECT,
+      props: {
+        isRoot: true,
+      },
+    });
+
+  return pickSeverityByPrecedence({
+    severities,
+    explicitSeverityId: data.explicitSeverityId,
+    severityLabel: data.severityLabel,
+    isSevere: data.isSevere,
+  });
+}

package/Server/Utils/SecurityEvent/ThreatIntel/TaxiiClient.ts

@@ -0,0 +1,199 @@
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import Dictionary from "../../../../Types/Dictionary";
+import { JSONArray, JSONObject, JSONValue } from "../../../../Types/JSON";
+import DataSourceHttpFetch, {
+  DataSourceHttpRequest,
+  DataSourceHttpResponse,
+} from "../../DataSource/HttpFetch";
+
+/*
+ * Minimal TAXII 2.1 client for the threat-intel feed poller: fetch pages
+ * of STIX objects from one collection's /objects/ endpoint.
+ *
+ * A TAXII server URL is tenant-chosen, so — unlike the Google SecOps
+ * client, whose host is derived from a validated region — every request
+ * goes through DataSourceHttpFetch: the EgressGuard validates and PINS
+ * the resolved addresses (no SSRF, no DNS-rebind window), redirects are
+ * refused, and response size and wall-clock are capped.
+ *
+ * The transport is injectable so unit tests exercise the real request
+ * construction and response parsing against fixtures.
+ */
+
+export type TaxiiFetchLike = (
+  request: DataSourceHttpRequest,
+) => Promise<DataSourceHttpResponse>;
+
+export interface TaxiiObjectsPage {
+  objects: Array<JSONObject>;
+  // TAXII envelope `more`: further pages exist.
+  more: boolean;
+  // TAXII envelope `next`: opaque token for the next page, when `more`.
+  next: string | null;
+  /*
+   * The X-TAXII-Date-Added-Last response header: the date_added of the
+   * newest object in this page — the correct added_after cursor for the
+   * next poll.
+   */
+  dateAddedLast: string | null;
+}
+
+export const TAXII_MEDIA_TYPE: string = "application/taxii+json;version=2.1";
+export const TAXII_REQUEST_TIMEOUT_IN_MS: number = 60 * 1000;
+export const TAXII_DATE_ADDED_LAST_HEADER: string = "x-taxii-date-added-last";
+
+export default class TaxiiClient {
+  private apiRootUrl: string;
+  private collectionId: string;
+  private apiToken: string | undefined;
+  private basicAuthUsername: string | undefined;
+  private basicAuthPassword: string | undefined;
+  private fetchImplementation: TaxiiFetchLike;
+
+  public constructor(data: {
+    apiRootUrl: string;
+    collectionId: string;
+    apiToken?: string | undefined;
+    basicAuthUsername?: string | undefined;
+    basicAuthPassword?: string | undefined;
+    fetchImplementation?: TaxiiFetchLike | undefined;
+  }) {
+    TaxiiClient.validateApiRootUrl(data.apiRootUrl);
+    TaxiiClient.validateCollectionId(data.collectionId);
+
+    this.apiRootUrl = data.apiRootUrl.endsWith("/")
+      ? data.apiRootUrl
+      : `${data.apiRootUrl}/`;
+    this.collectionId = data.collectionId;
+    this.apiToken = data.apiToken || undefined;
+    this.basicAuthUsername = data.basicAuthUsername || undefined;
+    this.basicAuthPassword = data.basicAuthPassword || undefined;
+    this.fetchImplementation =
+      data.fetchImplementation ||
+      ((request: DataSourceHttpRequest): Promise<DataSourceHttpResponse> => {
+        return DataSourceHttpFetch.fetch(request);
+      });
+  }
+
+  public static validateApiRootUrl(url: string): void {
+    let parsed: URL;
+
+    try {
+      parsed = new URL(url || "");
+    } catch {
+      throw new BadDataException(
+        "TAXII API root must be a valid URL, e.g. https://taxii.example.com/api1/",
+      );
+    }
+
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new BadDataException("TAXII API root must be an http(s) URL.");
+    }
+
+    if (parsed.search || parsed.hash) {
+      throw new BadDataException(
+        "TAXII API root must not carry a query string or fragment.",
+      );
+    }
+  }
+
+  public static validateCollectionId(collectionId: string): void {
+    const collectionIdRegex: RegExp = /^[A-Za-z0-9._~-]{1,256}$/;
+
+    if (!collectionIdRegex.test(collectionId || "")) {
+      throw new BadDataException(
+        "Collection ID must be a plain TAXII collection identifier (letters, digits, dot, dash, underscore).",
+      );
+    }
+  }
+
+  /*
+   * Bearer token wins, else HTTP basic — the same precedence as the Data
+   * Source connectors' buildAuthHeaders. Anonymous collections get only
+   * the TAXII Accept header.
+   */
+  public buildHeaders(): Dictionary<string> {
+    const headers: Dictionary<string> = {
+      Accept: TAXII_MEDIA_TYPE,
+    };
+
+    if (this.apiToken) {
+      headers["Authorization"] = `Bearer ${this.apiToken}`;
+    } else if (this.basicAuthUsername || this.basicAuthPassword) {
+      const encoded: string = Buffer.from(
+        `${this.basicAuthUsername || ""}:${this.basicAuthPassword || ""}`,
+      ).toString("base64");
+      headers["Authorization"] = `Basic ${encoded}`;
+    }
+
+    return headers;
+  }
+
+  public buildObjectsUrl(params: {
+    limit: number;
+    addedAfter?: string | undefined;
+    next?: string | undefined;
+  }): string {
+    const searchParams: URLSearchParams = new URLSearchParams();
+
+    searchParams.set("match[type]", "indicator");
+    searchParams.set("limit", String(params.limit));
+
+    if (params.addedAfter) {
+      searchParams.set("added_after", params.addedAfter);
+    }
+
+    if (params.next) {
+      searchParams.set("next", params.next);
+    }
+
+    return `${this.apiRootUrl}collections/${this.collectionId}/objects/?${searchParams.toString()}`;
+  }
+
+  public async fetchIndicatorObjects(params: {
+    limit: number;
+    addedAfter?: string | undefined;
+    next?: string | undefined;
+  }): Promise<TaxiiObjectsPage> {
+    const response: DataSourceHttpResponse = await this.fetchImplementation({
+      method: "GET",
+      url: this.buildObjectsUrl(params),
+      headers: this.buildHeaders(),
+      timeoutInMs: TAXII_REQUEST_TIMEOUT_IN_MS,
+      egressOptions: {
+        targetLabel: "TAXII server",
+      },
+    });
+
+    const envelope: JSONValue = response.bodyJson as JSONValue;
+
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+      throw new BadDataException(
+        "TAXII server returned a non-envelope body from the objects endpoint.",
+      );
+    }
+
+    const asObject: JSONObject = envelope as JSONObject;
+
+    const objects: Array<JSONObject> = Array.isArray(asObject["objects"])
+      ? ((asObject["objects"] as JSONArray).filter(
+          (item: JSONValue): boolean => {
+            return (
+              typeof item === "object" && item !== null && !Array.isArray(item)
+            );
+          },
+        ) as Array<JSONObject>)
+      : [];
+
+    const next: string =
+      typeof asObject["next"] === "string" ? (asObject["next"] as string) : "";
+
+    return {
+      objects,
+      more: asObject["more"] === true,
+      next: next || null,
+      dateAddedLast:
+        (response.headers || {})[TAXII_DATE_ADDED_LAST_HEADER] || null,
+    };
+  }
+}