@oneuptime/common 13.0.3 → 13.0.5

package/Models/DatabaseModels/Index.ts

@@ -126,6 +126,8 @@ import LogDropFilter from "./LogDropFilter";
 import DetectionRule from "./DetectionRule";
 import GoogleSecOpsConnection from "./GoogleSecOpsConnection";
 import GoogleSecOpsConnectionRun from "./GoogleSecOpsConnectionRun";
+import SecurityEventConnection from "./SecurityEventConnection";
+import SecurityEventConnectionRun from "./SecurityEventConnectionRun";
 import ThreatIntelFeed from "./ThreatIntelFeed";
 import LogScrubRule from "./LogScrubRule";
 import MetricPipelineRule from "./MetricPipelineRule";
@@ -502,6 +504,8 @@ const AllModelTypes: Array<{
   DetectionRule,
   GoogleSecOpsConnection,
   GoogleSecOpsConnectionRun,
+  SecurityEventConnection,
+  SecurityEventConnectionRun,
   ThreatIntelFeed,
   LogScrubRule,
   MetricPipelineRule,

package/Models/DatabaseModels/RumApplication.ts

@@ -1102,7 +1102,7 @@ export default class RumApplication extends BaseModel {
     type: TableColumnType.JSON,
     title: "Session Replay Allowed Origins",
     description:
-      "Exact browser origins (scheme + host + port) allowed to upload session replay chunks for this application. Empty (the default) accepts any origin. Once you list an origin this becomes a strict allowlist: anything unlisted, and any request with no Origin header, is refused.",
+      "Browser origins (scheme + host + port) and exact React Native app identities (app:// followed by the Android package or iOS bundle id) allowed to upload replays for this application. Empty (the default) accepts any sender. Web origins may use one leading host wildcard; app:// identities never allow wildcards. Once populated, browsers must send a listed Origin and native recorders without Origin must send a listed app identity.",
   })
   @Column({
     type: ColumnType.JSON,

package/Models/DatabaseModels/SecurityEventConnection.ts

@@ -0,0 +1,457 @@
+import Project from "./Project";
+import User from "./User";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import Route from "../../Types/API/Route";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import TableBillingAccessControl from "../../Types/Database/AccessControl/TableBillingAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import EnableDocumentation from "../../Types/Database/EnableDocumentation";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import TenantColumn from "../../Types/Database/TenantColumn";
+import IconProp from "../../Types/Icon/IconProp";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import { JSONObject } from "../../Types/JSON";
+import { PlanType } from "../../Types/Billing/SubscriptionPlan";
+import SecurityEventConnectorProvider from "../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+
+/*
+ * Same access split as GoogleSecOpsConnection: connecting a source means
+ * holding a credential that reads someone's security product, so it stays
+ * on the Admin tiers plus SecurityAdmin; every Security tier can read the
+ * connection's health. The credential column itself is write-only.
+ */
+const adminPermissions: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+];
+
+const readPermissions: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
+];
+
+/*
+ * One managed pull connection to a security product (Microsoft Sentinel,
+ * Defender XDR, CrowdStrike Falcon, Splunk, Elastic Security, AWS
+ * Security Hub, Okta ...). The provider decides which keys `config` and
+ * `secrets` carry — see SecurityEventConnectorCatalog — and which server
+ * connector polls it. A Workers cron polls each enabled connection on its
+ * interval, by the source's record CREATION time, and ingests the records
+ * as normalized security events.
+ */
+@EnableDocumentation()
+@TableBillingAccessControl({
+  create: PlanType.Free,
+  read: PlanType.Free,
+  update: PlanType.Free,
+  delete: PlanType.Free,
+})
+@TenantColumn("projectId")
+@CrudApiEndpoint(new Route("/security-event-connection"))
+@Entity({
+  name: "SecurityEventConnection",
+})
+@TableMetadata({
+  tableName: "SecurityEventConnection",
+  singularName: "Security Event Connection",
+  pluralName: "Security Event Connections",
+  icon: IconProp.ShieldCheck,
+  tableDescription:
+    "Managed connections to SIEM, EDR, cloud security and identity products. Records are polled on an interval and ingested as security events.",
+})
+@TableAccessControl({
+  create: adminPermissions,
+  read: readPermissions,
+  delete: adminPermissions,
+  update: adminPermissions,
+})
+export default class SecurityEventConnection extends BaseModel {
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "Relation to the project this connection belongs to.",
+  })
+  @ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "projectId" })
+  public project?: Project = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    canReadOnRelationQuery: true,
+    title: "Project ID",
+    description: "ID of the project this connection belongs to.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public projectId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Name,
+    canReadOnRelationQuery: true,
+    title: "Name",
+    description: "Friendly name for this connection.",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.Name,
+    length: ColumnLength.Name,
+  })
+  public name?: string = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "Description",
+    description: "What this connection imports and why.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+  })
+  public description?: string = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    required: true,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Provider",
+    description:
+      "Which security product this connection polls, e.g. 'microsoft-sentinel' or 'crowdstrike-falcon'. Fixed once created.",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public provider?: SecurityEventConnectorProvider = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.JSON,
+    title: "Configuration",
+    description:
+      "Provider-specific, non-secret settings such as tenant, workspace, region or base URL. Keys are defined by the provider catalog.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: true,
+  })
+  public config?: JSONObject = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: [],
+    update: adminPermissions,
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.VeryLongText,
+    encrypted: true,
+    title: "Credentials",
+    description:
+      "Provider-specific secrets (client secret, API token, secret access key) as a JSON object. Encrypted at rest and never returned by the API.",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.VeryLongText,
+  })
+  public secrets?: string = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @Index()
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "Enabled",
+    description: "Whether this connection is polled on its schedule.",
+    defaultValue: true,
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.Boolean,
+    default: true,
+  })
+  public isEnabled?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @TableColumn({
+    title: "Poll Interval (Minutes)",
+    required: true,
+    type: TableColumnType.Number,
+    canReadOnRelationQuery: true,
+    description: "How often new records are polled, in minutes.",
+    defaultValue: 5,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 5,
+  })
+  public pollIntervalInMinutes?: number = undefined;
+
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @TableColumn({
+    type: TableColumnType.Boolean,
+    required: true,
+    title: "Alerting Records Only",
+    description:
+      "For providers that distinguish alerting from non-alerting records: import only the alerting ones.",
+    defaultValue: true,
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Boolean, nullable: false, default: true })
+  public alertingOnly?: boolean = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Successful Poll",
+    description:
+      "When a complete poll last finished successfully, including an empty result.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Date, nullable: true })
+  public lastSuccessfulPollAt?: Date = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Event Imported",
+    description:
+      "When a new security event was last imported from this connection.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Date, nullable: true })
+  public lastEventIngestedAt?: Date = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "Last Poll Result",
+    description:
+      "The latest scheduled or on-demand poll result with counts and warnings.",
+  })
+  @Column({ type: ColumnType.JSON, nullable: true })
+  public lastPollResult?: JSONObject = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    title: "Last Polled At",
+    required: false,
+    type: TableColumnType.Date,
+    canReadOnRelationQuery: true,
+    description:
+      "When this connection was last polled. Null means it has never run.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastPolledAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    title: "Cursor",
+    required: false,
+    type: TableColumnType.LongText,
+    canReadOnRelationQuery: true,
+    description:
+      "Poll cursor: the end of the last completely processed creation-time window, as an ISO string.",
+  })
+  @Column({
+    type: ColumnType.LongText,
+    nullable: true,
+    length: ColumnLength.LongText,
+  })
+  public cursor?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    title: "Last Error",
+    required: false,
+    type: TableColumnType.VeryLongText,
+    canReadOnRelationQuery: true,
+    description:
+      "The most recent poll error with credentials redacted, if any. Cleared on the next successful poll.",
+  })
+  @Column({
+    type: ColumnType.VeryLongText,
+    nullable: true,
+  })
+  public lastError?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "createdByUserId",
+    type: TableColumnType.Entity,
+    modelType: User,
+    title: "Created By User",
+    description: "Relation to the user who created this connection.",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "createdByUserId" })
+  public createdByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Created By User ID",
+    description: "ID of the user who created this connection.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public createdByUserId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "deletedByUserId",
+    type: TableColumnType.Entity,
+    modelType: User,
+    title: "Deleted By User",
+    description: "Relation to the user who deleted this connection.",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "deletedByUserId" })
+  public deletedByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: readPermissions,
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Deleted By User ID",
+    description: "ID of the user who deleted this connection.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public deletedByUserId?: ObjectID = undefined;
+}