@oneuptime/common 13.0.3 → 13.0.5

package/build/dist/Utils/SecurityEvent/Connectors/AwsSecurityHubNormalizer.js

@@ -0,0 +1,311 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readNumber, readString, readStringArray, readValue, } from "../NormalizerHelpers";
+/*
+ * AWS Security Hub finding (AWS Security Finding Format, ASFF) -> OCSF
+ * Compliance Finding (class 2003) when the finding carries a Compliance
+ * object (a control check), otherwise Detection Finding (class 2004).
+ *
+ * The payload shape is the AwsSecurityFinding object returned by
+ * GetFindings, i.e. ASFF:
+ * https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format-syntax.html
+ * Fields read here, with their documented values:
+ *  - Id (product-specific finding id, an ARN for AWS-generated findings),
+ *    GeneratorId, ProductArn, ProductName, CompanyName, AwsAccountId, Region
+ *  - CreatedAt / UpdatedAt / FirstObservedAt / LastObservedAt (ISO 8601)
+ *  - Severity.Label: INFORMATIONAL | LOW | MEDIUM | HIGH | CRITICAL;
+ *    Severity.Normalized 0..100 maps to those labels as 0, 1-39, 40-69,
+ *    70-89, 90-100 (API reference, Severity)
+ *  - Types[]: "{namespace}/{category}/{classifier}"; the TTPs namespace's
+ *    categories align with the MITRE ATT&CK enterprise tactics
+ *    (asff-required-attributes, Types)
+ *  - Compliance.Status: PASSED | WARNING | FAILED | NOT_AVAILABLE
+ *  - Workflow.Status: NEW | NOTIFIED | RESOLVED | SUPPRESSED; the retired
+ *    WorkflowState is read as a fallback
+ *  - Resources[]: Type, Id, Region, Tags, Details
+ *  - Network (retired but still delivered): SourceIpV4/V6,
+ *    DestinationIpV4/V6, DestinationPort, Source/DestinationDomain
+ *  - Process: Name, Path; Malware[]: Name, Path; ThreatIntelIndicators[]:
+ *    Type, Value; UserDefinedFields
+ *
+ * Pure and isomorphic on purpose — this file imports only from
+ * Common/Types and Common/Utils so it runs unchanged in the server, in
+ * tests and in the browser if the dashboard ever previews raw findings.
+ */
+export const AWS_SECURITY_HUB_DETECTION_CLASS_UID = 2004;
+export const AWS_SECURITY_HUB_DETECTION_CLASS_NAME = "Detection Finding";
+export const AWS_SECURITY_HUB_COMPLIANCE_CLASS_UID = 2003;
+export const AWS_SECURITY_HUB_COMPLIANCE_CLASS_NAME = "Compliance Finding";
+/*
+ * ASFF's TTPs categories are MITRE ATT&CK enterprise tactic names;
+ * NormalizedSecurityEvent.mitreTactics stores ATT&CK ids ("TA0001") so
+ * rows from every source join on the same key. Keyed by the name with
+ * everything but letters removed, lowercased.
+ */
+export const AWS_SECURITY_HUB_TACTIC_IDS = {
+    reconnaissance: "TA0043",
+    resourcedevelopment: "TA0042",
+    initialaccess: "TA0001",
+    execution: "TA0002",
+    persistence: "TA0003",
+    privilegeescalation: "TA0004",
+    defenseevasion: "TA0005",
+    credentialaccess: "TA0006",
+    discovery: "TA0007",
+    lateralmovement: "TA0008",
+    collection: "TA0009",
+    exfiltration: "TA0010",
+    commandandcontrol: "TA0011",
+    impact: "TA0040",
+};
+const TTPS_NAMESPACE = "TTPs";
+function definition() {
+    const found = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.AwsSecurityHub);
+    if (!found) {
+        /*
+         * The catalog is a static list that always carries this provider; the
+         * throw only exists so a future catalog edit cannot silently attribute
+         * events to an empty vendor and break the dedupe scope.
+         */
+        throw new Error("AWS Security Hub is missing from SecurityEventConnectorCatalog.");
+    }
+    return found;
+}
+function isObject(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function objectArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter(isObject);
+}
+function uniqueNonEmpty(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        const trimmed = value.trim();
+        if (!trimmed || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        result.push(trimmed);
+    }
+    return result;
+}
+function mapTactic(name) {
+    const key = name.replace(/[^A-Za-z]/g, "").toLowerCase();
+    return AWS_SECURITY_HUB_TACTIC_IDS[key] || name.trim();
+}
+/*
+ * Severity from Label, then from the deprecated Normalized score using
+ * the documented ranges, then Unknown. Label is what Security Hub itself
+ * populates on every finding, so the score path only serves partner
+ * products that sent a score alone.
+ */
+function severityOf(raw) {
+    const fromLabel = normalizeOcsfSeverity(readString(raw, "Severity.Label"));
+    if (fromLabel) {
+        return fromLabel;
+    }
+    const normalized = readNumber(raw, "Severity.Normalized");
+    if (normalized === null || normalized < 0) {
+        return OcsfSeverity.Unknown;
+    }
+    if (normalized === 0) {
+        return OcsfSeverity.Informational;
+    }
+    if (normalized < 40) {
+        return OcsfSeverity.Low;
+    }
+    if (normalized < 70) {
+        return OcsfSeverity.Medium;
+    }
+    if (normalized < 90) {
+        return OcsfSeverity.High;
+    }
+    return OcsfSeverity.Critical;
+}
+/*
+ * Types entries under the TTPs namespace: "TTPs/{tactic}/{classifier}".
+ * The tactic maps to its ATT&CK id. The classifier is the product's own
+ * technique-level label (GuardDuty's "UnauthorizedAccess:EC2-SSHBruteForce",
+ * for example) rather than an ATT&CK technique id — ASFF defines no
+ * classifiers under TTPs — so it is kept verbatim: it is still the most
+ * specific "what happened" the finding offers, and it is searchable.
+ */
+function mitreOf(types) {
+    const tactics = [];
+    const techniques = [];
+    for (const type of types) {
+        const segments = type.split("/").map((segment) => {
+            return segment.trim();
+        });
+        if (segments[0] !== TTPS_NAMESPACE) {
+            continue;
+        }
+        if (segments[1]) {
+            tactics.push(mapTactic(segments[1]));
+        }
+        if (segments[2]) {
+            techniques.push(segments.slice(2).join("/"));
+        }
+    }
+    return {
+        tactics: uniqueNonEmpty(tactics),
+        techniques: uniqueNonEmpty(techniques),
+    };
+}
+/*
+ * The identity behind a finding lives inside Resources[].Details: IAM
+ * findings carry AwsIamAccessKey (PrincipalName / UserName) or AwsIamUser
+ * (UserName), EC2 findings carry the instance id as the resource Id. The
+ * first match wins; most findings name one resource.
+ */
+function principalOf(resources) {
+    let user = "";
+    let host = "";
+    for (const resource of resources) {
+        if (!user) {
+            user =
+                readString(resource, "Details.AwsIamAccessKey.PrincipalName") ||
+                    readString(resource, "Details.AwsIamAccessKey.UserName") ||
+                    readString(resource, "Details.AwsIamUser.UserName");
+        }
+        if (!host && readString(resource, "Type") === "AwsEc2Instance") {
+            const id = readString(resource, "Id");
+            const index = id.lastIndexOf("/");
+            host = index === -1 ? id : id.substring(index + 1);
+        }
+    }
+    return { user, host };
+}
+export default class AwsSecurityHubNormalizer {
+    /*
+     * A record is an ASFF finding when it carries a finding Id together
+     * with at least one of the other required top-level attributes
+     * (ProductArn, AwsAccountId, CreatedAt). Anything else — an error
+     * envelope that slipped into a page, a bare string — is rejected rather
+     * than turned into a meaningless row.
+     */
+    static isRecognized(raw) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+            return false;
+        }
+        if (!readString(raw, "Id")) {
+            return false;
+        }
+        return Boolean(readString(raw, "ProductArn") ||
+            readString(raw, "AwsAccountId") ||
+            readString(raw, "CreatedAt"));
+    }
+    static isComplianceFinding(raw) {
+        const compliance = readValue(raw, "Compliance");
+        return isObject(compliance) && Object.keys(compliance).length > 0;
+    }
+    static normalize(raw) {
+        const catalog = definition();
+        const title = readString(raw, "Title");
+        const description = readString(raw, "Description");
+        /*
+         * Creation time is the poll basis, so it is also the row's time: the
+         * finding's own observation window (FirstObservedAt) can be hours or
+         * days earlier and is kept in attributes for anyone who needs it.
+         */
+        const time = parseEventTime(readValue(raw, "CreatedAt")) ||
+            parseEventTime(readValue(raw, "UpdatedAt")) ||
+            parseEventTime(readValue(raw, "FirstObservedAt"));
+        // Id is stable across every GetFindings call, so it is the dedupe key.
+        const eventUid = readString(raw, "Id") || contentHashEventUid(raw);
+        const isCompliance = AwsSecurityHubNormalizer.isComplianceFinding(raw);
+        const classUid = isCompliance
+            ? AWS_SECURITY_HUB_COMPLIANCE_CLASS_UID
+            : AWS_SECURITY_HUB_DETECTION_CLASS_UID;
+        const className = isCompliance
+            ? AWS_SECURITY_HUB_COMPLIANCE_CLASS_NAME
+            : AWS_SECURITY_HUB_DETECTION_CLASS_NAME;
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(classUid);
+        const severityName = severityOf(raw);
+        const mitre = mitreOf(readStringArray(raw, "Types"));
+        const resources = objectArray(readValue(raw, "Resources"));
+        const resourceIds = resources.map((resource) => {
+            return readString(resource, "Id");
+        });
+        const principal = principalOf(resources);
+        const sourceIp = readString(raw, "Network.SourceIpV4") ||
+            readString(raw, "Network.SourceIpV6");
+        const destinationIp = readString(raw, "Network.DestinationIpV4") ||
+            readString(raw, "Network.DestinationIpV6");
+        const destinationPort = readNumber(raw, "Network.DestinationPort");
+        const sourceDomain = readString(raw, "Network.SourceDomain");
+        const destinationDomain = readString(raw, "Network.DestinationDomain");
+        const processName = readString(raw, "Process.Name");
+        const processPath = readString(raw, "Process.Path");
+        const malwareNames = objectArray(readValue(raw, "Malware")).map((malware) => {
+            return readString(malware, "Name") || readString(malware, "Path");
+        });
+        const indicatorValues = objectArray(readValue(raw, "ThreatIntelIndicators")).map((indicator) => {
+            return readString(indicator, "Value");
+        });
+        const accountId = readString(raw, "AwsAccountId");
+        /*
+         * Workflow.Status is the investigation state a person manages;
+         * the retired WorkflowState is read when a partner product still
+         * sends only that. RecordState (ACTIVE/ARCHIVED) is not a status of
+         * the activity and stays in attributes.
+         */
+        const statusName = readString(raw, "Workflow.Status") || readString(raw, "WorkflowState");
+        const message = title ||
+            description ||
+            (isCompliance
+                ? "AWS Security Hub control finding"
+                : "AWS Security Hub finding");
+        return {
+            time: time || new Date(),
+            eventUid,
+            categoryUid,
+            categoryName,
+            classUid,
+            className,
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName,
+            message,
+            vendorName: catalog.vendorName,
+            productName: catalog.productName,
+            ruleId: readString(raw, "GeneratorId"),
+            ruleName: title,
+            mitreTactics: mitre.tactics,
+            mitreTechniques: mitre.techniques,
+            principalUser: principal.user,
+            principalHost: "",
+            principalIp: sourceIp,
+            principalProcess: processName || processPath,
+            targetUser: "",
+            targetHost: principal.host,
+            targetIp: destinationIp,
+            targetPort: destinationPort !== null && destinationPort > 0
+                ? Math.floor(destinationPort)
+                : 0,
+            targetResource: resourceIds[0] || "",
+            observables: buildObservables([
+                principal.user,
+                principal.host,
+                sourceIp,
+                destinationIp,
+                sourceDomain,
+                destinationDomain,
+                ...resourceIds,
+                accountId,
+                processName,
+                ...malwareNames,
+                ...indicatorValues,
+            ]),
+            attributes: flattenPayload(raw),
+        };
+    }
+}
+//# sourceMappingURL=AwsSecurityHubNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/AwsSecurityHubNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AwsSecurityHubNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/AwsSecurityHubNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,UAAU,EACV,eAAe,EACf,SAAS,GACV,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAW,IAAI,CAAC;AACjE,MAAM,CAAC,MAAM,qCAAqC,GAChD,mBAAmB,CAAC;AACtB,MAAM,CAAC,MAAM,qCAAqC,GAAW,IAAI,CAAC;AAClE,MAAM,CAAC,MAAM,sCAAsC,GACjD,oBAAoB,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,cAAc,EAAE,QAAQ;IACxB,mBAAmB,EAAE,QAAQ;IAC7B,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,QAAQ;IAC7B,cAAc,EAAE,QAAQ;IACxB,gBAAgB,EAAE,QAAQ;IAC1B,SAAS,EAAE,QAAQ;IACnB,eAAe,EAAE,QAAQ;IACzB,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,QAAQ;IAC3B,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,cAAc,GAAW,MAAM,CAAC;AAEtC,SAAS,UAAU;IACjB,MAAM,KAAK,GACT,mCAAmC,CACjC,8BAA8B,CAAC,cAAc,CAC9C,CAAC;IAEJ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX;;;;WAIG;QACH,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgB;IAChC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAgB;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAQ,KAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,MAAqB;IAC3C,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAW,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,GAAe;IACjC,MAAM,SAAS,GAAwB,qBAAqB,CAC1D,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAClC,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAkB,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAEzE,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC,aAAa,CAAC;IACpC,CAAC;IAED,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,GAAG,CAAC;IAC1B,CAAC;IAED,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACpB,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,OAAO,YAAY,CAAC,QAAQ,CAAC;AAC/B,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,KAAoB;IACnC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAkB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAe,EAAE,EAAE;YACtE,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;QAChC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC;KACvC,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,SAA4B;IAC/C,IAAI,IAAI,GAAW,EAAE,CAAC;IACtB,IAAI,IAAI,GAAW,EAAE,CAAC;IAEtB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI;gBACF,UAAU,CAAC,QAAQ,EAAE,uCAAuC,CAAC;oBAC7D,UAAU,CAAC,QAAQ,EAAE,kCAAkC,CAAC;oBACxD,UAAU,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC/D,MAAM,EAAE,GAAW,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAW,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAE1C,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,wBAAwB;IAC3C;;;;;;OAMG;IACI,MAAM,CAAC,YAAY,CAAC,GAAe;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CACZ,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC;YAC3B,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC;YAC/B,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAC/B,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,mBAAmB,CAAC,GAAe;QAC/C,MAAM,UAAU,GAAc,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAE3D,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,GAAe;QACrC,MAAM,OAAO,GAAqC,UAAU,EAAE,CAAC;QAE/D,MAAM,KAAK,GAAW,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAE3D;;;;WAIG;QACH,MAAM,IAAI,GACR,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3C,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3C,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAEpD,uEAAuE;QACvE,MAAM,QAAQ,GAAW,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE3E,MAAM,YAAY,GAChB,wBAAwB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAW,YAAY;YACnC,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,oCAAoC,CAAC;QACzC,MAAM,SAAS,GAAW,YAAY;YACpC,CAAC,CAAC,sCAAsC;YACxC,CAAC,CAAC,qCAAqC,CAAC;QAC1C,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAExE,MAAM,YAAY,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAoB,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAEtE,MAAM,SAAS,GAAsB,WAAW,CAC9C,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAC5B,CAAC;QACF,MAAM,WAAW,GAAkB,SAAS,CAAC,GAAG,CAC9C,CAAC,QAAoB,EAAU,EAAE;YAC/B,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC,CACF,CAAC;QACF,MAAM,SAAS,GAAsB,WAAW,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC;YACrC,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACxC,MAAM,aAAa,GACjB,UAAU,CAAC,GAAG,EAAE,yBAAyB,CAAC;YAC1C,UAAU,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC7C,MAAM,eAAe,GAAkB,UAAU,CAC/C,GAAG,EACH,yBAAyB,CAC1B,CAAC;QACF,MAAM,YAAY,GAAW,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAW,UAAU,CAC1C,GAAG,EACH,2BAA2B,CAC5B,CAAC;QAEF,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAkB,WAAW,CAC7C,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAC1B,CAAC,GAAG,CAAC,CAAC,OAAmB,EAAU,EAAE;YACpC,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAkB,WAAW,CAChD,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC,CACxC,CAAC,GAAG,CAAC,CAAC,SAAqB,EAAU,EAAE;YACtC,OAAO,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAW,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE1D;;;;;WAKG;QACH,MAAM,UAAU,GACd,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAEzE,MAAM,OAAO,GACX,KAAK;YACL,WAAW;YACX,CAAC,YAAY;gBACX,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,0BAA0B,CAAC,CAAC;QAElC,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU;YACV,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC;YACtC,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK,CAAC,OAAO;YAC3B,eAAe,EAAE,KAAK,CAAC,UAAU;YACjC,aAAa,EAAE,SAAS,CAAC,IAAI;YAC7B,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,WAAW,IAAI,WAAW;YAC5C,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,SAAS,CAAC,IAAI;YAC1B,QAAQ,EAAE,aAAa;YACvB,UAAU,EACR,eAAe,KAAK,IAAI,IAAI,eAAe,GAAG,CAAC;gBAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;gBAC7B,CAAC,CAAC,CAAC;YACP,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,SAAS,CAAC,IAAI;gBACd,SAAS,CAAC,IAAI;gBACd,QAAQ;gBACR,aAAa;gBACb,YAAY;gBACZ,iBAAiB;gBACjB,GAAG,WAAW;gBACd,SAAS;gBACT,WAAW;gBACX,GAAG,YAAY;gBACf,GAAG,eAAe;aACnB,CAAC;YACF,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC;SAChC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/Connectors/CrowdStrikeFalconNormalizer.js

@@ -0,0 +1,150 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import { DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readNumber, readString, readValue, } from "../NormalizerHelpers";
+/*
+ * CrowdStrike Falcon alert (Alerts API, PostEntitiesAlertsV2 resource)
+ * -> OCSF Detection Finding (class 2004).
+ *
+ * The payload shape is the `resources[]` element of
+ * POST /alerts/entities/alerts/v2 (PostEntitiesAlertsV2 on
+ * https://developer.crowdstrike.com/api-reference/collections/alerts/).
+ * Field names follow the alert entity schema on that page and the sample
+ * event in Elastic's CrowdStrike integration (crowdstrike.alert data
+ * stream, https://www.elastic.co/docs/reference/integrations/crowdstrike):
+ * composite_id, id, display_name/name, description, severity (0-100) +
+ * severity_name, status, tactic/tactic_id, technique/technique_id,
+ * created_timestamp, timestamp, updated_timestamp, product, type,
+ * device.{hostname, local_ip, external_ip, platform_name}, user_name,
+ * user_id, filename, cmdline, sha256, falcon_host_link, pattern_id.
+ *
+ * Pure and isomorphic: only Common/Types and Common/Utils imports, so the
+ * same code is unit-testable without a server and reusable from the UI.
+ */
+/*
+ * Vendor/product attribution is read from the catalog rather than retyped:
+ * the poller dedupes on exactly these two values, and a typo here would
+ * silently split one connection's events into two dedupe scopes.
+ */
+const DEFINITION = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.CrowdStrikeFalcon);
+const VENDOR_NAME = (DEFINITION === null || DEFINITION === void 0 ? void 0 : DEFINITION.vendorName) || "CrowdStrike";
+const PRODUCT_NAME = (DEFINITION === null || DEFINITION === void 0 ? void 0 : DEFINITION.productName) || "Falcon";
+/*
+ * Falcon's numeric severity is 0-100 and its severity_name is derived from
+ * it in 20-point bands (the Elastic sample carries severity 30 with
+ * severity_name "low"). severity_name is authoritative when present; the
+ * bands are only the fallback for a payload that carries the number alone.
+ */
+function severityFromNumeric(severity) {
+    if (severity === null) {
+        return null;
+    }
+    if (severity < 20) {
+        return OcsfSeverity.Informational;
+    }
+    if (severity < 40) {
+        return OcsfSeverity.Low;
+    }
+    if (severity < 60) {
+        return OcsfSeverity.Medium;
+    }
+    if (severity < 80) {
+        return OcsfSeverity.High;
+    }
+    return OcsfSeverity.Critical;
+}
+class CrowdStrikeFalconNormalizer {
+    /*
+     * A Falcon alert always carries composite_id (the Alerts API's primary
+     * key). Older shapes carry `id` plus at least one alert-specific marker;
+     * anything else is not an alert and must be counted as rejected rather
+     * than stored as an empty finding.
+     */
+    static isRecognized(raw) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+            return false;
+        }
+        if (readString(raw, "composite_id")) {
+            return true;
+        }
+        if (!readString(raw, "id")) {
+            return false;
+        }
+        return Boolean(readString(raw, "created_timestamp") ||
+            readString(raw, "severity_name") ||
+            readString(raw, "tactic") ||
+            readString(raw, "pattern_id"));
+    }
+    static normalize(raw) {
+        const severityName = normalizeOcsfSeverity(readString(raw, "severity_name")) ||
+            severityFromNumeric(readNumber(raw, "severity")) ||
+            OcsfSeverity.Unknown;
+        /*
+         * Time is the alert's CREATION time on purpose: the poll window is on
+         * created_timestamp, and a finding row dated by the underlying
+         * activity (`timestamp`) can be hours older than the window that
+         * imported it. The activity time stays queryable in attributes.
+         */
+        const time = parseEventTime(readValue(raw, "created_timestamp")) ||
+            parseEventTime(readValue(raw, "timestamp")) ||
+            parseEventTime(readValue(raw, "updated_timestamp"));
+        const displayName = readString(raw, "display_name");
+        const name = readString(raw, "name");
+        const description = readString(raw, "description");
+        const ruleName = displayName || name;
+        const hostname = readString(raw, "device.hostname");
+        const localIp = readString(raw, "device.local_ip");
+        const externalIp = readString(raw, "device.external_ip");
+        const userName = readString(raw, "user_name");
+        const filename = readString(raw, "filename");
+        const cmdline = readString(raw, "cmdline");
+        const sha256 = readString(raw, "sha256");
+        const tacticId = readString(raw, "tactic_id");
+        const techniqueId = readString(raw, "technique_id");
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        return {
+            time: time || new Date(),
+            eventUid: readString(raw, "composite_id") ||
+                readString(raw, "id") ||
+                contentHashEventUid(raw),
+            categoryUid,
+            categoryName,
+            classUid: DETECTION_FINDING_CLASS_UID,
+            className: DETECTION_FINDING_CLASS_NAME,
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: readString(raw, "status"),
+            message: description || ruleName || "CrowdStrike Falcon alert",
+            vendorName: VENDOR_NAME,
+            productName: PRODUCT_NAME,
+            ruleId: readString(raw, "pattern_id"),
+            ruleName,
+            mitreTactics: tacticId ? [tacticId] : [],
+            mitreTechniques: techniqueId ? [techniqueId] : [],
+            principalUser: userName,
+            principalHost: hostname,
+            principalIp: localIp,
+            principalProcess: filename || cmdline,
+            targetUser: "",
+            targetHost: "",
+            targetIp: "",
+            targetPort: 0,
+            targetResource: "",
+            observables: buildObservables([
+                hostname,
+                localIp,
+                externalIp,
+                userName,
+                sha256,
+            ]),
+            attributes: flattenPayload(raw),
+        };
+    }
+}
+CrowdStrikeFalconNormalizer.vendorName = VENDOR_NAME;
+CrowdStrikeFalconNormalizer.productName = PRODUCT_NAME;
+export default CrowdStrikeFalconNormalizer;
+//# sourceMappingURL=CrowdStrikeFalconNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/CrowdStrikeFalconNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CrowdStrikeFalconNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/CrowdStrikeFalconNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,wDAAwD,CAAC;AAChE,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,MAAM,UAAU,GACd,mCAAmC,CACjC,8BAA8B,CAAC,iBAAiB,CACjD,CAAC;AAEJ,MAAM,WAAW,GAAW,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,KAAI,aAAa,CAAC;AACpE,MAAM,YAAY,GAAW,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,WAAW,KAAI,QAAQ,CAAC;AAEjE;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,QAAuB;IAClD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC,aAAa,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC,GAAG,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,OAAO,YAAY,CAAC,QAAQ,CAAC;AAC/B,CAAC;AAED,MAAqB,2BAA2B;IAI9C;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,GAAe;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CACZ,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC;YAClC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;YACzB,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAChC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,GAAe;QACrC,MAAM,YAAY,GAChB,qBAAqB,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YACvD,mBAAmB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChD,YAAY,CAAC,OAAO,CAAC;QAEvB;;;;;WAKG;QACH,MAAM,IAAI,GACR,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACnD,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC3C,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAEtD,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAW,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAW,WAAW,IAAI,IAAI,CAAC;QAE7C,MAAM,QAAQ,GAAW,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAW,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAW,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAW,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAW,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,GAAW,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,MAAM,GAAW,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAW,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE5D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EACN,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC/B,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;gBACrB,mBAAmB,CAAC,GAAG,CAAC;YAC1B,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,4BAA4B;YACvC,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;YACrC,OAAO,EAAE,WAAW,IAAI,QAAQ,IAAI,0BAA0B;YAC9D,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,YAAY;YACzB,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC;YACrC,QAAQ;YACR,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACjD,aAAa,EAAE,QAAQ;YACvB,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,OAAO;YACpB,gBAAgB,EAAE,QAAQ,IAAI,OAAO;YACrC,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,QAAQ;gBACR,OAAO;gBACP,UAAU;gBACV,QAAQ;gBACR,MAAM;aACP,CAAC;YACF,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC;SAChC,CAAC;IACJ,CAAC;;AAzGsB,sCAAU,GAAW,WAAW,CAAC;AACjC,uCAAW,GAAW,YAAY,CAAC;eAFvC,2BAA2B"}