@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Utils/SecurityEvent/Connectors/SplunkNormalizer.js

@@ -0,0 +1,348 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import { DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, } from "../NormalizerHelpers";
+/*
+ * Splunk Enterprise Security notable event (one `result` row of a JSON
+ * export over index=notable) -> OCSF Detection Finding (class 2004).
+ *
+ * Field contract, from Splunk's developer documentation on notable events
+ * (https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/notableeventsplunkes/usingnotableeventsinsearch):
+ * every indexed notable carries `_time`, `host`, `source`, `sourcetype`
+ * plus the correlation search fields `rule_name` and `severity`; the
+ * stash fields `orig_sid` / `orig_rid` identify the search run; and
+ * `event_id` is "Assigned at search time by the `notable` macro" — so a
+ * plain index=notable read may not carry it, which is why the uid falls
+ * back to Splunk's own bucket/offset identity and then to a content hash.
+ * `urgency` is one of informational, low, medium, high, critical
+ * (https://help.splunk.com/en/splunk-enterprise-security-7/user-guide/7.3/incident-review/how-urgency-is-assigned-to-notable-events-in-splunk-enterprise-security);
+ * `status_label` is "The short form description of the notable event
+ * status". `rule_title` / `rule_description` are the notable's title and
+ * description; `src`, `dest`, `user`, `src_user`, `dest_user` are the CIM
+ * entity fields correlation searches populate; MITRE annotations arrive
+ * as `annotations.mitre_attack` (technique ids such as T1078) and the
+ * expanded `annotations.mitre_attack.mitre_technique_id` /
+ * `annotations.mitre_attack.mitre_tactic` fields
+ * (https://help.splunk.com/en/splunk-enterprise-security-7/risk-based-alerting/7.3/identify-threat/how-risk-annotations-provide-additional-context-in-splunk-enterprise-security).
+ *
+ * Splunk keys are flat strings that may themselves contain dots
+ * ("annotations.mitre_attack" is one field, not a nested object), and a
+ * multivalue field is exported as a JSON array. Fields are therefore read
+ * by exact key, never by dot path.
+ *
+ * Pure and isomorphic: no server imports.
+ */
+const MAX_OBSERVABLES = 200;
+/*
+ * Default Splunk ES review statuses (reviewstatuses.conf ships these
+ * numeric ids). Used only when the export carries the numeric `status`
+ * but not the label the `notable` macro would have added.
+ */
+const STATUS_LABEL_BY_ID = {
+    "0": "Unassigned",
+    "1": "New",
+    "2": "In Progress",
+    "3": "Pending",
+    "4": "Resolved",
+    "5": "Closed",
+};
+/*
+ * MITRE ATT&CK enterprise tactics by name, for annotations that carry the
+ * tactic as prose ("Initial Access") rather than its id.
+ * https://attack.mitre.org/tactics/enterprise/
+ */
+const TACTIC_ID_BY_NAME = {
+    reconnaissance: "TA0043",
+    resourcedevelopment: "TA0042",
+    initialaccess: "TA0001",
+    execution: "TA0002",
+    persistence: "TA0003",
+    privilegeescalation: "TA0004",
+    defenseevasion: "TA0005",
+    credentialaccess: "TA0006",
+    discovery: "TA0007",
+    lateralmovement: "TA0008",
+    collection: "TA0009",
+    commandandcontrol: "TA0011",
+    exfiltration: "TA0010",
+    impact: "TA0040",
+};
+const TECHNIQUE_ID_REGEX = /^T\d{4}(?:\.\d{3})?$/;
+const TACTIC_ID_REGEX = /^TA\d{4}$/;
+const IPV4_REGEX = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$/;
+// Loose IPv6: hex groups and colons, at least two colons; enough to tell an address from a hostname.
+const IPV6_REGEX = /^[0-9a-fA-F:]*:[0-9a-fA-F:]*:[0-9a-fA-F:.]*$/;
+function isObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+/*
+ * Read a Splunk field by its exact key. A multivalue field is a JSON
+ * array; the first scalar wins for single-valued columns.
+ */
+function field(payload, key) {
+    const value = payload[key];
+    if (value === null || value === undefined) {
+        return "";
+    }
+    if (Array.isArray(value)) {
+        const first = value.find((item) => {
+            return item !== null && item !== undefined && typeof item !== "object";
+        });
+        return first === undefined ? "" : String(first).trim();
+    }
+    if (typeof value === "object") {
+        return "";
+    }
+    return String(value).trim();
+}
+/*
+ * Every scalar of a field, splitting comma-joined strings too: ES
+ * annotations are stored as JSON in savedsearches.conf and surface as
+ * either an array or a single joined string depending on the search.
+ */
+function fieldValues(payload, key) {
+    const value = payload[key];
+    if (value === null || value === undefined) {
+        return [];
+    }
+    if (Array.isArray(value)) {
+        return value
+            .filter((item) => {
+            return item !== null && item !== undefined && typeof item !== "object";
+        })
+            .map((item) => {
+            return String(item).trim();
+        })
+            .filter((item) => {
+            return item.length > 0;
+        });
+    }
+    if (typeof value === "object") {
+        return [];
+    }
+    return String(value)
+        .split(",")
+        .map((item) => {
+        return item.trim();
+    })
+        .filter((item) => {
+        return item.length > 0;
+    });
+}
+function firstField(payload, keys) {
+    for (const key of keys) {
+        const value = field(payload, key);
+        if (value) {
+            return value;
+        }
+    }
+    return "";
+}
+export function isIpAddress(value) {
+    const trimmed = (value || "").trim();
+    if (!trimmed) {
+        return false;
+    }
+    return IPV4_REGEX.test(trimmed) || IPV6_REGEX.test(trimmed);
+}
+/*
+ * CIM `src` / `dest` hold "the host, IP or name"; `src_ip` / `dest_ip`
+ * are always addresses. The address column gets the explicit IP field,
+ * else `src`/`dest` when it looks like one; the host column gets
+ * `src_host`/`dest_host`, else `src`/`dest` when it does not.
+ */
+function pickEndpoint(payload, generic, ipKey, hostKeys) {
+    const genericValue = field(payload, generic);
+    const explicitIp = field(payload, ipKey);
+    const explicitHost = firstField(payload, hostKeys);
+    let ip = explicitIp;
+    let host = explicitHost;
+    if (genericValue) {
+        if (isIpAddress(genericValue)) {
+            ip = ip || genericValue;
+        }
+        else {
+            host = host || genericValue;
+        }
+    }
+    return { ip, host };
+}
+function mapTechniques(payload) {
+    const candidates = [
+        ...fieldValues(payload, "annotations.mitre_attack"),
+        ...fieldValues(payload, "annotations.mitre_attack.mitre_technique_id"),
+        ...fieldValues(payload, "mitre_technique_id"),
+        ...fieldValues(payload, "mitre_technique"),
+    ];
+    const techniques = [];
+    for (const candidate of candidates) {
+        const id = candidate.toUpperCase();
+        if (TECHNIQUE_ID_REGEX.test(id) && !techniques.includes(id)) {
+            techniques.push(id);
+        }
+    }
+    return techniques;
+}
+function mapTactics(payload) {
+    const candidates = [
+        ...fieldValues(payload, "annotations.mitre_attack.mitre_tactic_id"),
+        ...fieldValues(payload, "annotations.mitre_attack.mitre_tactic"),
+        ...fieldValues(payload, "mitre_tactic_id"),
+        ...fieldValues(payload, "mitre_tactic"),
+        // The technique list may carry tactic ids too; harmless to scan.
+        ...fieldValues(payload, "annotations.mitre_attack"),
+    ];
+    const tactics = [];
+    for (const candidate of candidates) {
+        const upper = candidate.toUpperCase();
+        let id = "";
+        if (TACTIC_ID_REGEX.test(upper)) {
+            id = upper;
+        }
+        else {
+            const key = candidate.toLowerCase().replace(/[^a-z]/g, "");
+            id = TACTIC_ID_BY_NAME[key] || "";
+        }
+        if (id && !tactics.includes(id)) {
+            tactics.push(id);
+        }
+    }
+    return tactics;
+}
+/*
+ * The notable's own identity. `event_id` when the `notable` macro (or
+ * the correlation search's eval) supplied it; else Splunk's bucket +
+ * offset pair, which uniquely names an indexed event and survives
+ * re-reads of the same window; else a hash of the row.
+ */
+function eventUid(payload) {
+    const eventId = field(payload, "event_id");
+    if (eventId) {
+        return eventId;
+    }
+    const bucket = field(payload, "_bkt");
+    const offset = field(payload, "_cd");
+    if (bucket && offset) {
+        return `splunk:${bucket}:${offset}`;
+    }
+    return contentHashEventUid(payload);
+}
+function statusName(payload) {
+    const label = firstField(payload, [
+        "status_label",
+        "status_description",
+    ]);
+    if (label) {
+        return label;
+    }
+    const status = field(payload, "status");
+    return STATUS_LABEL_BY_ID[status] || status;
+}
+export default class SplunkNormalizer {
+    /*
+     * A row from a Splunk export always carries `_time`; a notable also
+     * names its correlation search. Anything without either is not an
+     * event Splunk produced, so it is rejected rather than hashed into a
+     * row with nothing in it.
+     */
+    static isRecognized(payload) {
+        if (!isObject(payload)) {
+            return false;
+        }
+        return Boolean(field(payload, "_time") ||
+            field(payload, "event_id") ||
+            field(payload, "rule_name") ||
+            field(payload, "search_name"));
+    }
+    static normalize(payload) {
+        const definition = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.SplunkEnterpriseSecurity);
+        /*
+         * Urgency is what Incident Review shows and already folds in asset
+         * and identity priority; the raw correlation-search severity is the
+         * fallback. "unknown" maps to Unknown rather than to null.
+         */
+        const severityName = normalizeOcsfSeverity(field(payload, "urgency")) ||
+            normalizeOcsfSeverity(field(payload, "severity")) ||
+            OcsfSeverity.Unknown;
+        /*
+         * `_time` of a notable is when the correlation search created it; the
+         * export renders it as ISO 8601 with offset, an epoch string appears
+         * when a search reformats it. Both parse.
+         */
+        const time = parseEventTime(payload["_time"]);
+        const ruleName = firstField(payload, [
+            "rule_name",
+            "search_name",
+            "source",
+        ]);
+        const source = pickEndpoint(payload, "src", "src_ip", [
+            "src_host",
+            "src_nt_host",
+        ]);
+        const destination = pickEndpoint(payload, "dest", "dest_ip", [
+            "dest_host",
+            "dest_nt_host",
+        ]);
+        const principalUser = firstField(payload, ["user", "src_user"]);
+        const targetUser = field(payload, "dest_user");
+        const principalProcess = firstField(payload, [
+            "process",
+            "process_name",
+            "parent_process",
+        ]);
+        const targetPort = Number(field(payload, "dest_port"));
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        return {
+            time: time || new Date(),
+            eventUid: eventUid(payload),
+            categoryUid,
+            categoryName,
+            classUid: DETECTION_FINDING_CLASS_UID,
+            className: DETECTION_FINDING_CLASS_NAME,
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: statusName(payload),
+            message: firstField(payload, ["rule_title", "rule_description"]) ||
+                ruleName ||
+                "Splunk Enterprise Security notable event",
+            vendorName: (definition === null || definition === void 0 ? void 0 : definition.vendorName) || "Splunk",
+            productName: (definition === null || definition === void 0 ? void 0 : definition.productName) || "Splunk Enterprise Security",
+            // The correlation search name is the stable rule identity in Splunk.
+            ruleId: firstField(payload, ["search_name", "source", "rule_name"]),
+            ruleName,
+            mitreTactics: mapTactics(payload),
+            mitreTechniques: mapTechniques(payload),
+            principalUser,
+            principalHost: source.host,
+            principalIp: source.ip,
+            principalProcess,
+            targetUser,
+            targetHost: destination.host,
+            targetIp: destination.ip,
+            targetPort: Number.isFinite(targetPort) && targetPort > 0 ? targetPort : 0,
+            targetResource: firstField(payload, ["file_path", "url", "risk_object"]),
+            observables: buildObservables([
+                principalUser,
+                field(payload, "src_user"),
+                targetUser,
+                source.host,
+                destination.host,
+                source.ip,
+                destination.ip,
+                field(payload, "dvc"),
+                field(payload, "host"),
+                field(payload, "file_hash"),
+                field(payload, "file_name"),
+                field(payload, "url"),
+                field(payload, "domain"),
+                field(payload, "query"),
+                field(payload, "risk_object"),
+            ]).slice(0, MAX_OBSERVABLES),
+            attributes: flattenPayload(payload),
+        };
+    }
+}
+//# sourceMappingURL=SplunkNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/SplunkNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SplunkNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/SplunkNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,wDAAwD,CAAC;AAChE,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,GACf,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,eAAe,GAAW,GAAG,CAAC;AAEpC;;;;GAIG;AACH,MAAM,kBAAkB,GAA2B;IACjD,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAA2B;IAChD,cAAc,EAAE,QAAQ;IACxB,mBAAmB,EAAE,QAAQ;IAC7B,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,QAAQ;IAC7B,cAAc,EAAE,QAAQ;IACxB,gBAAgB,EAAE,QAAQ;IAC1B,SAAS,EAAE,QAAQ;IACnB,eAAe,EAAE,QAAQ;IACzB,UAAU,EAAE,QAAQ;IACpB,iBAAiB,EAAE,QAAQ;IAC3B,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,kBAAkB,GAAW,sBAAsB,CAAC;AAC1D,MAAM,eAAe,GAAW,WAAW,CAAC;AAE5C,MAAM,UAAU,GACd,qEAAqE,CAAC;AACxE,qGAAqG;AACrG,MAAM,UAAU,GAAW,8CAA8C,CAAC;AAE1E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,KAAK,CAAC,OAAmB,EAAE,GAAW;IAC7C,MAAM,KAAK,GAAc,OAAO,CAAC,GAAG,CAAc,CAAC;IAEnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAA0B,KAAK,CAAC,IAAI,CAC7C,CAAC,IAAe,EAAW,EAAE;YAC3B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,CAAC,CACF,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAmB,EAAE,GAAW;IACnD,MAAM,KAAK,GAAc,OAAO,CAAC,GAAG,CAAc,CAAC;IAEnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,IAAe,EAAW,EAAE;YACnC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAe,EAAU,EAAE;YAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;YAChC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE;QAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAChC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB,EAAE,IAAmB;IAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAW,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE1C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAOD;;;;;GAKG;AACH,SAAS,YAAY,CACnB,OAAmB,EACnB,OAAe,EACf,KAAa,EACb,QAAuB;IAEvB,MAAM,YAAY,GAAW,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAW,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,YAAY,GAAW,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAE3D,IAAI,EAAE,GAAW,UAAU,CAAC;IAC5B,IAAI,IAAI,GAAW,YAAY,CAAC;IAEhC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,EAAE,GAAG,EAAE,IAAI,YAAY,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,IAAI,YAAY,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,OAAmB;IACxC,MAAM,UAAU,GAAkB;QAChC,GAAG,WAAW,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACnD,GAAG,WAAW,CAAC,OAAO,EAAE,6CAA6C,CAAC;QACtE,GAAG,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC;QAC7C,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;KAC3C,CAAC;IACF,MAAM,UAAU,GAAkB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,EAAE,GAAW,SAAS,CAAC,WAAW,EAAE,CAAC;QAE3C,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5D,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,UAAU,GAAkB;QAChC,GAAG,WAAW,CAAC,OAAO,EAAE,0CAA0C,CAAC;QACnE,GAAG,WAAW,CAAC,OAAO,EAAE,uCAAuC,CAAC;QAChE,GAAG,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;QAC1C,GAAG,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC;QACvC,iEAAiE;QACjE,GAAG,WAAW,CAAC,OAAO,EAAE,0BAA0B,CAAC;KACpD,CAAC;IACF,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAW,SAAS,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,EAAE,GAAW,EAAE,CAAC;QAEpB,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,EAAE,GAAG,KAAK,CAAC;QACb,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAW,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnE,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,OAAmB;IACnC,MAAM,OAAO,GAAW,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEnD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAW,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAW,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE7C,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO,UAAU,MAAM,IAAI,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,KAAK,GAAW,UAAU,CAAC,OAAO,EAAE;QACxC,cAAc;QACd,oBAAoB;KACrB,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAW,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhD,OAAO,kBAAkB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACnC;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,OAAmB;QAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CACZ,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;YACrB,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;YAC1B,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;YAC3B,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAChC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;QACzC,MAAM,UAAU,GACd,mCAAmC,CACjC,8BAA8B,CAAC,wBAAwB,CACxD,CAAC;QAEJ;;;;WAIG;QACH,MAAM,YAAY,GAChB,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChD,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,YAAY,CAAC,OAAO,CAAC;QAEvB;;;;WAIG;QACH,MAAM,IAAI,GAAgB,cAAc,CAAC,OAAO,CAAC,OAAO,CAAc,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAW,UAAU,CAAC,OAAO,EAAE;YAC3C,WAAW;YACX,aAAa;YACb,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,MAAM,GAAa,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC9D,UAAU;YACV,aAAa;SACd,CAAC,CAAC;QACH,MAAM,WAAW,GAAa,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE;YACrE,WAAW;YACX,cAAc;SACf,CAAC,CAAC;QAEH,MAAM,aAAa,GAAW,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACxE,MAAM,UAAU,GAAW,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAW,UAAU,CAAC,OAAO,EAAE;YACnD,SAAS;YACT,cAAc;YACd,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,UAAU,GAAW,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAE/D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC;YAC3B,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,4BAA4B;YACvC,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;YAC/B,OAAO,EACL,UAAU,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBACvD,QAAQ;gBACR,0CAA0C;YAC5C,UAAU,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,KAAI,QAAQ;YAC9C,WAAW,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,WAAW,KAAI,4BAA4B;YACpE,qEAAqE;YACrE,MAAM,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YACnE,QAAQ;YACR,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC;YACjC,eAAe,EAAE,aAAa,CAAC,OAAO,CAAC;YACvC,aAAa;YACb,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,gBAAgB;YAChB,UAAU;YACV,UAAU,EAAE,WAAW,CAAC,IAAI;YAC5B,QAAQ,EAAE,WAAW,CAAC,EAAE;YACxB,UAAU,EACR,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChE,cAAc,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACxE,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,aAAa;gBACb,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;gBAC1B,UAAU;gBACV,MAAM,CAAC,IAAI;gBACX,WAAW,CAAC,IAAI;gBAChB,MAAM,CAAC,EAAE;gBACT,WAAW,CAAC,EAAE;gBACd,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC;gBACrB,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;gBACtB,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;gBAC3B,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;gBAC3B,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC;gBACrB,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC;gBACxB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;gBACvB,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC;aAC9B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAC5B,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js

@@ -6,12 +6,21 @@ import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime,
  * Google SecOps (Chronicle) detection/alert payload -> a Detection Finding
  * (OCSF class 2004).
  *
- * This is the shape a SecOps SOAR playbook webhook or the detections
- * stream (legacyStreamDetectionAlerts) delivers: rule metadata in a
- * `detection` array plus the matched UDM events in `collectionElements`.
- * The matched sample events are run through the UDM entity extraction so
- * the finding row inherits their observables — that is what makes a
- * detection joinable to the hosts/users it fired on.
+ * This is the shape a SecOps SOAR playbook webhook, the detections stream
+ * (legacyStreamDetectionAlerts), the alerts view (legacyFetchAlertsView)
+ * and the detections search (legacySearchDetections) all deliver: a
+ * Collection with rule metadata in a `detection` array plus the matched
+ * UDM events in `collectionElements`. The matched sample events are run
+ * through the UDM entity extraction so the finding row inherits their
+ * observables — that is what makes a detection joinable to the hosts/users
+ * it fired on.
+ *
+ * Not every Collection is a rule detection. Google documents six types
+ * (https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/Collection):
+ * RULE_DETECTION, GCTI_FINDING, TELEMETRY_ALERT, UPPERCASE_ALERT,
+ * MACHINE_INTELLIGENCE_ALERT and SOAR_ALERT. Only the first carries rule
+ * metadata; the others still have an id, timestamps, tags and (for SOAR)
+ * the originating system, which is enough for a finding row.
  */
 const DETECTION_FINDING_CLASS_UID = 2004;
 /*
@@ -20,6 +29,19 @@ const DETECTION_FINDING_CLASS_UID = 2004;
  * entities involved without turning one finding row into a megabyte.
  */
 const MAX_SAMPLE_EVENTS = 25;
+/*
+ * Every documented Collection.type. A payload carrying one of these and a
+ * string id is a Google SecOps record even when it has no `detection`
+ * entry — telemetry alerts and SOAR alerts never do.
+ */
+const COLLECTION_TYPES = [
+    "RULE_DETECTION",
+    "GCTI_FINDING",
+    "TELEMETRY_ALERT",
+    "UPPERCASE_ALERT",
+    "MACHINE_INTELLIGENCE_ALERT",
+    "SOAR_ALERT",
+];
 function collectSampleEvents(payload) {
     var _a;
     const events = [];
@@ -64,13 +86,81 @@ function readDetectionEntry(payload) {
     }
     return null;
 }
+function readCollectionType(payload) {
+    return readString(payload, "type").toUpperCase();
+}
+function readTags(payload) {
+    const tags = readValue(payload, "tags");
+    if (!Array.isArray(tags)) {
+        return [];
+    }
+    return tags.filter((tag) => {
+        return typeof tag === "string" && tag.trim() !== "";
+    });
+}
+/*
+ * A readable label for a Collection that carries no rule name: the SOAR
+ * source rule or system, then the tags Google set on the finding, then
+ * the type itself ("Google SecOps telemetry alert").
+ */
+function describeNonRuleCollection(payload) {
+    const sourceRule = readString(payload, "soarAlertMetadata.sourceRule") ||
+        readString(payload, "soar_alert_metadata.source_rule");
+    if (sourceRule) {
+        return sourceRule;
+    }
+    const sourceSystem = [
+        readString(payload, "soarAlertMetadata.vendor") ||
+            readString(payload, "soar_alert_metadata.vendor"),
+        readString(payload, "soarAlertMetadata.product") ||
+            readString(payload, "soar_alert_metadata.product"),
+        readString(payload, "soarAlertMetadata.sourceSystem") ||
+            readString(payload, "soar_alert_metadata.source_system"),
+    ]
+        .filter((part) => {
+        return part !== "";
+    })
+        .join(" ");
+    if (sourceSystem) {
+        return `${sourceSystem} alert`;
+    }
+    const tags = readTags(payload);
+    if (tags.length > 0) {
+        return tags.join(", ");
+    }
+    const type = readCollectionType(payload);
+    /*
+     * A rule detection with no rule detail keeps the generic label the
+     * ingest path has always produced; only the other types get named.
+     */
+    if (type && !type.includes("RULE_DETECTION")) {
+        return `Google SecOps ${type.toLowerCase().split("_").join(" ")}`;
+    }
+    return "";
+}
 export default class GoogleSecOpsAlertNormalizer {
     static isGoogleSecOpsAlert(payload) {
-        const type = readString(payload, "type").toUpperCase();
-        return Boolean(readDetectionEntry(payload) ||
+        const type = readCollectionType(payload);
+        /*
+         * The markers a rule detection carries. These are accepted with or
+         * without an id because the ingest endpoint's dialect detection has
+         * always recognized webhook bodies this way.
+         */
+        if (readDetectionEntry(payload) ||
             type.includes("RULE_DETECTION") ||
             readValue(payload, "collectionElements") ||
-            readValue(payload, "collection_elements"));
+            readValue(payload, "collection_elements")) {
+            return true;
+        }
+        /*
+         * The other documented Collection types have no detection entry. A
+         * string id is required alongside the type so an unrelated object that
+         * happens to carry a `type` key is still rejected.
+         */
+        const id = readValue(payload, "id");
+        return (typeof id === "string" &&
+            id.trim() !== "" &&
+            COLLECTION_TYPES.includes(type));
     }
     static normalize(payload) {
         var _a, _b, _c;
@@ -108,7 +198,10 @@ export default class GoogleSecOpsAlertNormalizer {
         const description = detection
             ? readString(detection, "description")
             : "";
-        const message = ruleName || description || "Google SecOps detection";
+        const message = ruleName ||
+            description ||
+            describeNonRuleCollection(payload) ||
+            "Google SecOps detection";
         return {
             time: time || new Date(),
             eventUid: readString(payload, "id") || contentHashEventUid(payload),

package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleSecOpsAlertNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;GAUG;AAEH,MAAM,2BAA2B,GAAW,IAAI,CAAC;AAEjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC,SAAS,mBAAmB,CAAC,OAAmB;;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,kBAAkB,GACtB,MAAA,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,mCACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAc,SAAS,CACrC,OAAqB,EACrB,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAc,SAAS,CAAC,SAAuB,EAAE,OAAO,CAAC,CAAC;YAErE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,SAAS,GAAc,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAc,SAAS,CAAC,CAAC,CAAc,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,2BAA2B;IACvC,MAAM,CAAC,mBAAmB,CAAC,OAAmB;QACnD,MAAM,IAAI,GAAW,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAE/D,OAAO,OAAO,CACZ,kBAAkB,CAAC,OAAO,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAC5C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,SAAS,GAAsB,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAW,SAAS;YAChC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAW,SAAS;YAC9B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/B,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC;gBACtC,UAAU,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,YAAY,GAChB,CAAC,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtD,YAAY,CAAC,OAAO,CAAC;QAEvB,MAAM,IAAI,GAAgB,cAAc,CACtC,MAAA,MAAA,MAAA,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,mCACpC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CACrC,CAAC;QAEF;;;;;WAKG;QACH,MAAM,YAAY,GAAsB,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAkB,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAmC,IAAI,CAAC;QAEvD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,UAAU,GACd,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC;YAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,WAAW,GAAW,SAAS;YACnC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GACX,QAAQ,IAAI,WAAW,IAAI,yBAAyB,CAAC;QAEvD,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,mBAAmB;YAC9B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EACR,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAC3C,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAC5C,EAAE;YACJ,OAAO;YACP,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,eAAe;YAC5B,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YACzD,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;YAC/D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvD,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACjD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;YAC7D,WAAW,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"GoogleSecOpsAlertNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,2BAA2B,GAAW,IAAI,CAAC;AAEjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,gBAAgB,GAAkB;IACtC,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,4BAA4B;IAC5B,YAAY;CACb,CAAC;AAEF,SAAS,mBAAmB,CAAC,OAAmB;;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,kBAAkB,GACtB,MAAA,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,mCACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAc,SAAS,CACrC,OAAqB,EACrB,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAc,SAAS,CAAC,SAAuB,EAAE,OAAO,CAAC,CAAC;YAErE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,SAAS,GAAc,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAc,SAAS,CAAC,CAAC,CAAc,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAmB;IACnC,MAAM,IAAI,GAAc,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAc,EAAW,EAAE;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC,CAAkB,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,OAAmB;IACpD,MAAM,UAAU,GACd,UAAU,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;IAEzD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,YAAY,GAAW;QAC3B,UAAU,CAAC,OAAO,EAAE,0BAA0B,CAAC;YAC7C,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC;YAC9C,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC;QACpD,UAAU,CAAC,OAAO,EAAE,gCAAgC,CAAC;YACnD,UAAU,CAAC,OAAO,EAAE,mCAAmC,CAAC;KAC3D;SACE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAChC,OAAO,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,GAAG,YAAY,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAkB,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAW,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD;;;OAGG;IACH,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,OAAO,iBAAiB,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,2BAA2B;IACvC,MAAM,CAAC,mBAAmB,CAAC,OAAmB;QACnD,MAAM,IAAI,GAAW,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjD;;;;WAIG;QACH,IACE,kBAAkB,CAAC,OAAO,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,MAAM,EAAE,GAAc,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE/C,OAAO,CACL,OAAO,EAAE,KAAK,QAAQ;YACtB,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAChB,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,SAAS,GAAsB,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAW,SAAS;YAChC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAW,SAAS;YAC9B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/B,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC;gBACtC,UAAU,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,YAAY,GAChB,CAAC,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtD,YAAY,CAAC,OAAO,CAAC;QAEvB,MAAM,IAAI,GAAgB,cAAc,CACtC,MAAA,MAAA,MAAA,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,mCACpC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CACrC,CAAC;QAEF;;;;;WAKG;QACH,MAAM,YAAY,GAAsB,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAkB,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAmC,IAAI,CAAC;QAEvD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,UAAU,GACd,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC;YAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,WAAW,GAAW,SAAS;YACnC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GACX,QAAQ;YACR,WAAW;YACX,yBAAyB,CAAC,OAAO,CAAC;YAClC,yBAAyB,CAAC;QAE5B,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,mBAAmB;YAC9B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EACR,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAC3C,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAC5C,EAAE;YACJ,OAAO;YACP,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,eAAe;YAC5B,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YACzD,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;YAC/D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvD,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACjD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;YAC7D,WAAW,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/Telemetry/CrossSignalScope.js

@@ -142,10 +142,12 @@ function resolveTimeWindow(scope) {
  *
  * Field support: serviceIds -> `primaryEntityId` filter tuple, severityTexts
  * -> `severityText` (canonicalized casing), traceIds -> `traceId`, spanIds
- * -> `spanId`, attributes -> `attributes.<key>` tuples, bodyContains ->
- * `body` (a contains-match chip), startTime+endTime -> `range=Custom` +
- * `start`/`end`. Every scope field is expressible in the logs grammar, so
- * `dropped` only ever reports a lone time endpoint.
+ * -> `spanId`, attributes -> `attributes.<key>` tuples (values escaped with
+ * the search grammar's buildSearchTokenValue, because the explorer re-parses
+ * a chip value as grammar), bodyContains -> `body` (a contains-match chip),
+ * startTime+endTime -> `range=Custom` + `start`/`end`. Every scope field is
+ * expressible in the logs grammar, so `dropped` only ever reports a lone
+ * time endpoint.
  */
 export function toLogsExplorerQueryParams(scope) {
     const params = {};
@@ -182,7 +184,16 @@ export function toLogsExplorerQueryParams(scope) {
         tuples.push(["spanId", spanIds]);
     }
     for (const [key, value] of sanitizeAttributeEntries(scope.attributes)) {
-        tuples.push([`attributes.${key}`, [value]]);
+        /*
+         * The logs explorer compiles an `attributes.<key>` chip through the
+         * search grammar (applyLogsFacetFiltersToQuery -> compileAttributeChipValues),
+         * exactly like a typed `@key:value`, so a raw `/api/*` arrived as a
+         * wildcard matching every path under /api and a raw `~internal` as a
+         * contains-match. Escaping with the grammar's own token builder makes the
+         * chip mean the literal value — the same treatment the traces serializer
+         * has always given its chips.
+         */
+        tuples.push([`attributes.${key}`, [buildSearchTokenValue(value)]]);
     }
     const bodyContains = sanitizeBodyContains(scope.bodyContains);
     if (bodyContains.length > 0) {

package/build/dist/Utils/Telemetry/CrossSignalScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"CrossSignalScope.js","sourceRoot":"","sources":["../../../../Utils/Telemetry/CrossSignalScope.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAE1B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,SAAS,MAAM,4BAA4B,CAAC;AACnD,OAAO,iBAAiB,EAAE,EACxB,sBAAsB,GAEvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAW,QAAQ,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,GAAW,GAAG,CAAC;AAoG5B;;;;GAIG;AACH,MAAM,sBAAsB,GAAuB;IACjD,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,sBAAsB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAiC;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,SAAS,GAAkB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAC/B,UAA0C;IAE1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAW,UAAU,CAAC,GAAG,CAAW,CAAC;QAEhD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CACtC,UAAqD;IAErD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAmC,EAAE,CAAC;IAEnD,KAAK,MAAM,QAAQ,IAAI,0BAA0B,EAAE,CAAC;QAClD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAkB,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,KAAuB;IAC1C,OAAO,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAQD;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,MAAM,QAAQ,GAAY,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,MAAM,GAAY,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAiB;YAClC,OAAO,EAAE,KAAK,CAAC,OAAe;YAC9B,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC;;;;OAIG;IACH,MAAM,MAAM,GAAmC,EAAE,CAAC;IAElD;;;OAGG;IACH,MAAM,cAAc,GAAkB,cAAc,CAClD,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE;QAChE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAkB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEnE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,+BAA+B,CAC9D,KAAK,CAAC,uBAAuB,CAC9B,EAAE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAkB,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAkB,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,YAAY,GAAW,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CAAC,KAAa;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAgC;IAEhC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,uEAAuE;IACvE,MAAM,YAAY,GAA4B,EAAE,CAAC;IAEjD,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,+BAA+B,CAC9D,KAAK,CAAC,uBAAuB,CAC9B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,UAAU,GAAkB,mBAAmB,CAAC,GAAG,CAAC;YACxD,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN;;;;;eAKG;YACH,YAAY,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,EAAE,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAkB,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAkB,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAgC,EAChC,UAAmB;IAEnB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAA0B;QACnC,UAAU,EAAE,UAAU,IAAI,EAAE;QAC5B,UAAU;KACX,CAAC;IAEF;;;OAGG;IACH,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,sBAAsB,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,MAAM,gBAAgB,GAAkB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,QAAQ,CAC/D,MAAM,CAAC,SAAS,CACjB,CAAC;QACF,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,QAAQ,CAC7D,MAAM,CAAC,OAAO,CACf,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,+BAA+B,CACtD,KAAK,CAAC,uBAAuB,CAC9B,EAAE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"CrossSignalScope.js","sourceRoot":"","sources":["../../../../Utils/Telemetry/CrossSignalScope.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAE1B,wBAAwB,GACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,SAAS,MAAM,4BAA4B,CAAC;AACnD,OAAO,iBAAiB,EAAE,EACxB,sBAAsB,GAEvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAW,QAAQ,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,GAAW,GAAG,CAAC;AAuG5B;;;;GAIG;AACH,MAAM,sBAAsB,GAAuB;IACjD,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,sBAAsB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAiC;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,SAAS,GAAkB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAC/B,UAA0C;IAE1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAW,UAAU,CAAC,GAAG,CAAW,CAAC;QAEhD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CACtC,UAAqD;IAErD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAmC,EAAE,CAAC;IAEnD,KAAK,MAAM,QAAQ,IAAI,0BAA0B,EAAE,CAAC;QAClD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAkB,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,KAAuB;IAC1C,OAAO,KAAK,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAQD;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,MAAM,QAAQ,GAAY,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,MAAM,GAAY,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAiB;YAClC,OAAO,EAAE,KAAK,CAAC,OAAe;YAC9B,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC;;;;OAIG;IACH,MAAM,MAAM,GAAmC,EAAE,CAAC;IAElD;;;OAGG;IACH,MAAM,cAAc,GAAkB,cAAc,CAClD,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE;QAChE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAkB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEnE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,+BAA+B,CAC9D,KAAK,CAAC,uBAAuB,CAC9B,EAAE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,QAAQ,GAAkB,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAkB,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE;;;;;;;;WAQG;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,YAAY,GAAW,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CAAC,KAAa;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAgC;IAEhC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,uEAAuE;IACvE,MAAM,YAAY,GAA4B,EAAE,CAAC;IAEjD,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,+BAA+B,CAC9D,KAAK,CAAC,uBAAuB,CAC9B,EAAE,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,UAAU,GAAkB,mBAAmB,CAAC,GAAG,CAAC;YACxD,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN;;;;;eAKG;YACH,YAAY,CAAC,IAAI,CAAC,CAAC,cAAc,GAAG,EAAE,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAkB,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAkB,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAErE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAgC,EAChC,UAAmB;IAEnB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAA0B;QACnC,UAAU,EAAE,UAAU,IAAI,EAAE;QAC5B,UAAU;KACX,CAAC;IAEF;;;OAGG;IACH,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,sBAAsB,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,MAAM,gBAAgB,GAAkB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,QAAQ,CAC/D,MAAM,CAAC,SAAS,CACjB,CAAC;QACF,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,QAAQ,CAC7D,MAAM,CAAC,OAAO,CACf,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,+BAA+B,CACtD,KAAK,CAAC,uBAAuB,CAC9B,EAAE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/build/dist/Utils/Telemetry/EntityRelationship.js

@@ -24,6 +24,13 @@ const RULES = {
     [`${EntityType.KubernetesPod}|${EntityType.KubernetesNode}`]: EntityRelationshipType.RunsOn,
     [`${EntityType.KubernetesPod}|${EntityType.KubernetesNamespace}`]: EntityRelationshipType.MemberOf,
     [`${EntityType.KubernetesPod}|${EntityType.KubernetesCluster}`]: EntityRelationshipType.MemberOf,
+    /*
+     * A pod reporting its deployment is one replica of it. Without this edge a
+     * workload's pods could only be grouped by the node they happen to run on,
+     * so a 12-replica deployment read as 12 unrelated pods scattered across
+     * nodes instead of one workload.
+     */
+    [`${EntityType.KubernetesPod}|${EntityType.KubernetesDeployment}`]: EntityRelationshipType.PartOf,
     [`${EntityType.KubernetesNode}|${EntityType.KubernetesCluster}`]: EntityRelationshipType.MemberOf,
     [`${EntityType.KubernetesNamespace}|${EntityType.KubernetesCluster}`]: EntityRelationshipType.MemberOf,
     [`${EntityType.KubernetesDeployment}|${EntityType.KubernetesNamespace}`]: EntityRelationshipType.MemberOf,