@oneuptime/common 12.0.25 → 12.0.27

package/build/dist/Models/DatabaseModels/ThreatIntelFeed.js

@@ -0,0 +1,800 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import Project from "./Project";
+import User from "./User";
+import AlertSeverity from "./AlertSeverity";
+import IncidentSeverity from "./IncidentSeverity";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import Route from "../../Types/API/Route";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import TableBillingAccessControl from "../../Types/Database/AccessControl/TableBillingAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import EnableDocumentation from "../../Types/Database/EnableDocumentation";
+import EnableWorkflow from "../../Types/Database/EnableWorkflow";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import TenantColumn from "../../Types/Database/TenantColumn";
+import IconProp from "../../Types/Icon/IconProp";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import { PlanType } from "../../Types/Billing/SubscriptionPlan";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+const createPermissions = [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.CreateProjectThreatIntelFeed,
+];
+const readPermissions = [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.Viewer,
+    Permission.TelemetryAdmin,
+    Permission.TelemetryMember,
+    Permission.TelemetryViewer,
+    Permission.ReadProjectThreatIntelFeed,
+];
+const updatePermissions = [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.EditProjectThreatIntelFeed,
+];
+/*
+ * A TAXII 2.1 threat-intelligence feed subscription: one collection on
+ * one TAXII server, polled on an interval. STIX indicator objects are
+ * parsed into normalized IOC rows (the ThreatIntelIndicator ClickHouse
+ * table); a matcher cron then joins recent security events against the
+ * active indicators, and matches open deduped alerts and write Threat
+ * Intel finding rows — the same downstream machinery as Sigma detection
+ * rules.
+ */
+let ThreatIntelFeed = class ThreatIntelFeed extends BaseModel {
+    constructor() {
+        super(...arguments);
+        this.project = undefined;
+        this.projectId = undefined;
+        this.name = undefined;
+        this.description = undefined;
+        this.apiRootUrl = undefined;
+        this.collectionId = undefined;
+        this.apiToken = undefined;
+        this.basicAuthUsername = undefined;
+        this.basicAuthPassword = undefined;
+        this.isEnabled = undefined;
+        this.pollIntervalInMinutes = undefined;
+        this.minimumConfidence = undefined;
+        this.shouldCreateAlert = undefined;
+        this.shouldWriteDetectionFinding = undefined;
+        /*
+         * Default FALSE, same reasoning as DetectionRule.shouldCreateIncident:
+         * incidents are the heavy machinery (on-call, SLAs, status pages), and
+         * a freshly subscribed public feed must not open one per matched
+         * indicator unless somebody chose that. The matcher gates on === true.
+         */
+        this.shouldCreateIncident = undefined;
+        this.alertSeverity = undefined;
+        this.alertSeverityId = undefined;
+        this.incidentSeverity = undefined;
+        this.incidentSeverityId = undefined;
+        /*
+         * Poller-owned state. Written only by the Workers cron.
+         */
+        this.lastPolledAt = undefined;
+        this.cursor = undefined;
+        this.nextPageToken = undefined;
+        this.lastPollSummary = undefined;
+        this.lastError = undefined;
+        /*
+         * Matcher-owned state. Written only by the indicator-match cron, kept
+         * separate from the poller's columns so a broken TAXII server and a
+         * broken match query are distinguishable at a glance.
+         */
+        this.lastEvaluatedAt = undefined;
+        this.lastMatchAt = undefined;
+        this.lastMatchError = undefined;
+        this.createdByUser = undefined;
+        this.createdByUserId = undefined;
+        this.deletedByUser = undefined;
+        this.deletedByUserId = undefined;
+    }
+};
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        manyToOneRelationColumn: "projectId",
+        type: TableColumnType.Entity,
+        modelType: Project,
+        title: "Project",
+        description: "Relation to the project this feed belongs to.",
+    }),
+    ManyToOne(() => {
+        return Project;
+    }, {
+        eager: false,
+        nullable: true,
+        onDelete: "CASCADE",
+        orphanedRowAction: "nullify",
+    }),
+    JoinColumn({ name: "projectId" }),
+    __metadata("design:type", Project)
+], ThreatIntelFeed.prototype, "project", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: [],
+    }),
+    Index(),
+    TableColumn({
+        type: TableColumnType.ObjectID,
+        required: true,
+        canReadOnRelationQuery: true,
+        title: "Project ID",
+        description: "ID of the project this feed belongs to.",
+    }),
+    Column({
+        type: ColumnType.ObjectID,
+        nullable: false,
+        transformer: ObjectID.getDatabaseTransformer(),
+    }),
+    __metadata("design:type", ObjectID)
+], ThreatIntelFeed.prototype, "projectId", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: true,
+        type: TableColumnType.Name,
+        canReadOnRelationQuery: true,
+        title: "Name",
+        description: "Friendly name for this feed, e.g. 'Corporate MISP'.",
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.Name,
+        length: ColumnLength.Name,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "name", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: false,
+        type: TableColumnType.LongText,
+        title: "Description",
+        description: "What this feed carries and why it is subscribed.",
+    }),
+    Column({
+        nullable: true,
+        type: ColumnType.LongText,
+        length: ColumnLength.LongText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "description", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: true,
+        type: TableColumnType.LongText,
+        canReadOnRelationQuery: true,
+        title: "TAXII API Root URL",
+        description: "The TAXII 2.1 API root, e.g. https://taxii.example.com/api1/. Collections are addressed beneath it.",
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.LongText,
+        length: ColumnLength.LongText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "apiRootUrl", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: true,
+        type: TableColumnType.ShortText,
+        canReadOnRelationQuery: true,
+        title: "Collection ID",
+        description: "ID of the TAXII collection to poll for indicator objects.",
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.ShortText,
+        length: ColumnLength.ShortText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "collectionId", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: [],
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: false,
+        type: TableColumnType.VeryLongText,
+        encrypted: true,
+        title: "API Token",
+        description: "Bearer token for token-authenticated collections. Encrypted at rest and never returned by the API. Leave empty for anonymous or basic-auth collections.",
+    }),
+    Column({
+        nullable: true,
+        type: ColumnType.VeryLongText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "apiToken", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: false,
+        type: TableColumnType.ShortText,
+        title: "Basic Auth Username",
+        description: "Username for basic-auth collections. Leave empty for anonymous or token-authenticated collections.",
+    }),
+    Column({
+        nullable: true,
+        type: ColumnType.ShortText,
+        length: ColumnLength.ShortText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "basicAuthUsername", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: [],
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: false,
+        type: TableColumnType.VeryLongText,
+        encrypted: true,
+        title: "Basic Auth Password",
+        description: "Password for basic-auth collections. Encrypted at rest and never returned by the API.",
+    }),
+    Column({
+        nullable: true,
+        type: ColumnType.VeryLongText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "basicAuthPassword", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    Index(),
+    TableColumn({
+        required: true,
+        type: TableColumnType.Boolean,
+        canReadOnRelationQuery: true,
+        title: "Enabled",
+        description: "Whether this feed is polled and matched.",
+        defaultValue: true,
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.Boolean,
+        default: true,
+    }),
+    __metadata("design:type", Boolean)
+], ThreatIntelFeed.prototype, "isEnabled", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        title: "Poll Interval (Minutes)",
+        required: true,
+        type: TableColumnType.Number,
+        canReadOnRelationQuery: true,
+        description: "How often the collection is polled for new indicators.",
+        defaultValue: 60,
+        isDefaultValueColumn: true,
+    }),
+    Column({
+        type: ColumnType.Number,
+        nullable: false,
+        default: 60,
+    }),
+    __metadata("design:type", Number)
+], ThreatIntelFeed.prototype, "pollIntervalInMinutes", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        title: "Minimum Confidence",
+        required: true,
+        type: TableColumnType.Number,
+        canReadOnRelationQuery: true,
+        description: "Skip indicators whose STIX confidence is below this (0-100). 0 ingests everything; indicators that carry no confidence always pass.",
+        defaultValue: 0,
+        isDefaultValueColumn: true,
+    }),
+    Column({
+        type: ColumnType.Number,
+        nullable: false,
+        default: 0,
+    }),
+    __metadata("design:type", Number)
+], ThreatIntelFeed.prototype, "minimumConfidence", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: true,
+        type: TableColumnType.Boolean,
+        canReadOnRelationQuery: true,
+        title: "Create Alerts",
+        description: "Whether indicator matches open OneUptime alerts.",
+        defaultValue: true,
+        isDefaultValueColumn: true,
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.Boolean,
+        default: true,
+    }),
+    __metadata("design:type", Boolean)
+], ThreatIntelFeed.prototype, "shouldCreateAlert", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: true,
+        type: TableColumnType.Boolean,
+        canReadOnRelationQuery: true,
+        title: "Write Threat Intel Findings",
+        description: "Whether matches also write a Detection Finding security event back into the events table.",
+        defaultValue: true,
+        isDefaultValueColumn: true,
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.Boolean,
+        default: true,
+    }),
+    __metadata("design:type", Boolean)
+], ThreatIntelFeed.prototype, "shouldWriteDetectionFinding", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        required: true,
+        type: TableColumnType.Boolean,
+        canReadOnRelationQuery: true,
+        title: "Create Incidents",
+        description: "Whether matches also open OneUptime incidents. Off by default: incidents drive on-call, SLAs and status pages, so opt in per feed.",
+        defaultValue: false,
+        isDefaultValueColumn: true,
+    }),
+    Column({
+        nullable: false,
+        type: ColumnType.Boolean,
+        default: false,
+    }),
+    __metadata("design:type", Boolean)
+], ThreatIntelFeed.prototype, "shouldCreateIncident", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        manyToOneRelationColumn: "alertSeverityId",
+        type: TableColumnType.Entity,
+        modelType: AlertSeverity,
+        title: "Alert Severity",
+        description: "Severity of alerts opened by this feed. Defaults from the indicator's STIX confidence, mapped onto this project's severities, when unset.",
+    }),
+    ManyToOne(() => {
+        return AlertSeverity;
+    }, {
+        eager: false,
+        nullable: true,
+        onDelete: "SET NULL",
+        orphanedRowAction: "nullify",
+    }),
+    JoinColumn({ name: "alertSeverityId" }),
+    __metadata("design:type", AlertSeverity)
+], ThreatIntelFeed.prototype, "alertSeverity", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        type: TableColumnType.ObjectID,
+        title: "Alert Severity ID",
+        description: "ID of the alert severity for alerts opened by this feed.",
+    }),
+    Column({
+        type: ColumnType.ObjectID,
+        nullable: true,
+        transformer: ObjectID.getDatabaseTransformer(),
+    }),
+    __metadata("design:type", ObjectID)
+], ThreatIntelFeed.prototype, "alertSeverityId", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        manyToOneRelationColumn: "incidentSeverityId",
+        type: TableColumnType.Entity,
+        modelType: IncidentSeverity,
+        title: "Incident Severity",
+        description: "Severity of incidents opened by this feed. Defaults from the indicator's STIX confidence, mapped onto this project's incident severities, when unset.",
+    }),
+    ManyToOne(() => {
+        return IncidentSeverity;
+    }, {
+        eager: false,
+        nullable: true,
+        onDelete: "SET NULL",
+        orphanedRowAction: "nullify",
+    }),
+    JoinColumn({ name: "incidentSeverityId" }),
+    __metadata("design:type", IncidentSeverity)
+], ThreatIntelFeed.prototype, "incidentSeverity", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        update: updatePermissions,
+    }),
+    TableColumn({
+        type: TableColumnType.ObjectID,
+        title: "Incident Severity ID",
+        description: "ID of the incident severity for incidents opened by this feed.",
+    }),
+    Column({
+        type: ColumnType.ObjectID,
+        nullable: true,
+        transformer: ObjectID.getDatabaseTransformer(),
+    }),
+    __metadata("design:type", ObjectID)
+], ThreatIntelFeed.prototype, "incidentSeverityId", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Last Polled At",
+        required: false,
+        type: TableColumnType.Date,
+        canReadOnRelationQuery: true,
+        description: "When this feed was last polled. Null means it has never run.",
+    }),
+    Column({
+        type: ColumnType.Date,
+        nullable: true,
+    }),
+    __metadata("design:type", Date)
+], ThreatIntelFeed.prototype, "lastPolledAt", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Cursor",
+        required: false,
+        type: TableColumnType.LongText,
+        canReadOnRelationQuery: true,
+        description: "Poll cursor: the TAXII added_after timestamp already ingested, as an ISO string.",
+    }),
+    Column({
+        type: ColumnType.LongText,
+        nullable: true,
+        length: ColumnLength.LongText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "cursor", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Next Page Token",
+        required: false,
+        /*
+         * Unbounded: TAXII next tokens are opaque and some servers encode
+         * whole query state into them.
+         */
+        type: TableColumnType.VeryLongText,
+        canReadOnRelationQuery: true,
+        description: "Resume token for a poll that ended mid-pagination on a server that sends no X-TAXII-Date-Added-Last header. Cleared once the collection drains or the cursor advances.",
+    }),
+    Column({
+        type: ColumnType.VeryLongText,
+        nullable: true,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "nextPageToken", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Last Poll Summary",
+        required: false,
+        type: TableColumnType.LongText,
+        canReadOnRelationQuery: true,
+        description: "What the most recent successful poll did: objects fetched, indicators ingested, unsupported patterns skipped.",
+    }),
+    Column({
+        type: ColumnType.LongText,
+        nullable: true,
+        length: ColumnLength.LongText,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "lastPollSummary", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Last Error",
+        required: false,
+        /*
+         * Unbounded text, not LongText's varchar(500): a TAXII server failure
+         * is a prefix plus up to 500 characters of echoed response body,
+         * which overflows 500 — the exact failure mode documented on
+         * GoogleSecOpsConnection.lastError. The poller still clamps what it
+         * stores.
+         */
+        type: TableColumnType.VeryLongText,
+        canReadOnRelationQuery: true,
+        description: "The most recent poll error, if any. Cleared on the next successful poll.",
+    }),
+    Column({
+        type: ColumnType.VeryLongText,
+        nullable: true,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "lastError", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Last Evaluated At",
+        required: false,
+        type: TableColumnType.Date,
+        canReadOnRelationQuery: true,
+        description: "When the matcher last evaluated security events against this feed's indicators. Null means it has never run.",
+    }),
+    Column({
+        type: ColumnType.Date,
+        nullable: true,
+    }),
+    __metadata("design:type", Date)
+], ThreatIntelFeed.prototype, "lastEvaluatedAt", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Last Match At",
+        required: false,
+        type: TableColumnType.Date,
+        canReadOnRelationQuery: true,
+        description: "When this feed's indicators most recently matched security events. Null means they never have.",
+    }),
+    Column({
+        type: ColumnType.Date,
+        nullable: true,
+    }),
+    __metadata("design:type", Date)
+], ThreatIntelFeed.prototype, "lastMatchAt", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        title: "Last Match Error",
+        required: false,
+        /*
+         * Unbounded for the same reason as lastError: ClickHouse errors echo
+         * the failing query back, which overflows a varchar(500).
+         */
+        type: TableColumnType.VeryLongText,
+        canReadOnRelationQuery: true,
+        description: "The most recent matcher error, if any. Cleared on the next successful evaluation.",
+    }),
+    Column({
+        type: ColumnType.VeryLongText,
+        nullable: true,
+    }),
+    __metadata("design:type", String)
+], ThreatIntelFeed.prototype, "lastMatchError", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        manyToOneRelationColumn: "createdByUserId",
+        type: TableColumnType.Entity,
+        modelType: User,
+        title: "Created By User",
+        description: "Relation to the user who created this feed.",
+    }),
+    ManyToOne(() => {
+        return User;
+    }, {
+        eager: false,
+        nullable: true,
+        onDelete: "SET NULL",
+        orphanedRowAction: "nullify",
+    }),
+    JoinColumn({ name: "createdByUserId" }),
+    __metadata("design:type", User)
+], ThreatIntelFeed.prototype, "createdByUser", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        type: TableColumnType.ObjectID,
+        title: "Created By User ID",
+        description: "ID of the user who created this feed.",
+    }),
+    Column({
+        type: ColumnType.ObjectID,
+        nullable: true,
+        transformer: ObjectID.getDatabaseTransformer(),
+    }),
+    __metadata("design:type", ObjectID)
+], ThreatIntelFeed.prototype, "createdByUserId", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        manyToOneRelationColumn: "deletedByUserId",
+        type: TableColumnType.Entity,
+        modelType: User,
+        title: "Deleted By User",
+        description: "Relation to the user who deleted this feed.",
+    }),
+    ManyToOne(() => {
+        return User;
+    }, {
+        eager: false,
+        nullable: true,
+        onDelete: "SET NULL",
+        orphanedRowAction: "nullify",
+    }),
+    JoinColumn({ name: "deletedByUserId" }),
+    __metadata("design:type", User)
+], ThreatIntelFeed.prototype, "deletedByUser", void 0);
+__decorate([
+    ColumnAccessControl({
+        create: [],
+        read: readPermissions,
+        update: [],
+    }),
+    TableColumn({
+        type: TableColumnType.ObjectID,
+        title: "Deleted By User ID",
+        description: "ID of the user who deleted this feed.",
+    }),
+    Column({
+        type: ColumnType.ObjectID,
+        nullable: true,
+        transformer: ObjectID.getDatabaseTransformer(),
+    }),
+    __metadata("design:type", ObjectID)
+], ThreatIntelFeed.prototype, "deletedByUserId", void 0);
+ThreatIntelFeed = __decorate([
+    EnableDocumentation(),
+    EnableWorkflow({
+        create: true,
+        delete: true,
+        update: true,
+        read: true,
+    }),
+    TableBillingAccessControl({
+        create: PlanType.Free,
+        read: PlanType.Free,
+        update: PlanType.Free,
+        delete: PlanType.Free,
+    }),
+    TenantColumn("projectId"),
+    CrudApiEndpoint(new Route("/threat-intel-feed")),
+    Entity({
+        name: "ThreatIntelFeed",
+    }),
+    TableMetadata({
+        tableName: "ThreatIntelFeed",
+        singularName: "Threat Intel Feed",
+        pluralName: "Threat Intel Feeds",
+        icon: IconProp.ShieldCheck,
+        tableDescription: "STIX/TAXII 2.1 threat-intelligence feeds. Indicators are polled on an interval and matched against incoming security events.",
+    }),
+    TableAccessControl({
+        create: createPermissions,
+        read: readPermissions,
+        delete: [
+            Permission.ProjectOwner,
+            Permission.ProjectAdmin,
+            Permission.DeleteProjectThreatIntelFeed,
+        ],
+        update: updatePermissions,
+    })
+], ThreatIntelFeed);
+export default ThreatIntelFeed;
+//# sourceMappingURL=ThreatIntelFeed.js.map