@oneuptime/common 13.0.4 → 13.0.5

package/Server/Infrastructure/Postgres/SchemaMigrations/1792700000000-AddSecurityEventConnections.ts

@@ -0,0 +1,99 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddSecurityEventConnections1792700000000
+  implements MigrationInterface
+{
+  public name: string = "AddSecurityEventConnections1792700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "SecurityEventConnection" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(50) NOT NULL, "description" character varying(500), "provider" character varying(100) NOT NULL, "config" jsonb, "secrets" text NOT NULL, "isEnabled" boolean NOT NULL DEFAULT true, "pollIntervalInMinutes" integer NOT NULL DEFAULT '5', "alertingOnly" boolean NOT NULL DEFAULT true, "lastSuccessfulPollAt" TIMESTAMP WITH TIME ZONE, "lastEventIngestedAt" TIMESTAMP WITH TIME ZONE, "lastPollResult" jsonb, "lastPolledAt" TIMESTAMP WITH TIME ZONE, "cursor" character varying(500), "lastError" text, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_0f0e1fe86bb4ce002fb97c6761f" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_15f2e2db3f5815c70153c91f73" ON "SecurityEventConnection" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6d59362e6f5d25392ebf5929fa" ON "SecurityEventConnection" ("provider") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_7a7edb50ab8639c78b7eafe75d" ON "SecurityEventConnection" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "SecurityEventConnectionRun" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "securityEventConnectionId" uuid NOT NULL, "requestedByUserId" uuid, "type" character varying(100) NOT NULL, "status" character varying(100) NOT NULL, "startedAt" TIMESTAMP WITH TIME ZONE, "completedAt" TIMESTAMP WITH TIME ZONE, "request" jsonb, "result" jsonb, "error" text, CONSTRAINT "PK_301dc1b8ac49703ea45746d5fcf" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b2f765ef1b178c3570d34805bb" ON "SecurityEventConnectionRun" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_42c40181bd64962779ed8ae537" ON "SecurityEventConnectionRun" ("securityEventConnectionId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_137b78490b6f7b138e9aee63f2" ON "SecurityEventConnectionRun" ("requestedByUserId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_ceb2cebdcc946927dd10419bc9" ON "SecurityEventConnectionRun" ("projectId", "securityEventConnectionId", "createdAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnection" ADD CONSTRAINT "FK_15f2e2db3f5815c70153c91f738" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnection" ADD CONSTRAINT "FK_a1c9e6213897547fbbfcc557180" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnection" ADD CONSTRAINT "FK_760637b50c4a45db4c77f50597b" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnectionRun" ADD CONSTRAINT "FK_b2f765ef1b178c3570d34805bbe" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnectionRun" ADD CONSTRAINT "FK_42c40181bd64962779ed8ae5370" FOREIGN KEY ("securityEventConnectionId") REFERENCES "SecurityEventConnection"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnectionRun" ADD CONSTRAINT "FK_137b78490b6f7b138e9aee63f20" FOREIGN KEY ("requestedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnectionRun" DROP CONSTRAINT "FK_137b78490b6f7b138e9aee63f20"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnectionRun" DROP CONSTRAINT "FK_42c40181bd64962779ed8ae5370"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnectionRun" DROP CONSTRAINT "FK_b2f765ef1b178c3570d34805bbe"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnection" DROP CONSTRAINT "FK_760637b50c4a45db4c77f50597b"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnection" DROP CONSTRAINT "FK_a1c9e6213897547fbbfcc557180"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "SecurityEventConnection" DROP CONSTRAINT "FK_15f2e2db3f5815c70153c91f738"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ceb2cebdcc946927dd10419bc9"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_137b78490b6f7b138e9aee63f2"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_42c40181bd64962779ed8ae537"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b2f765ef1b178c3570d34805bb"`,
+    );
+    await queryRunner.query(`DROP TABLE "SecurityEventConnectionRun"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_7a7edb50ab8639c78b7eafe75d"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6d59362e6f5d25392ebf5929fa"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_15f2e2db3f5815c70153c91f73"`,
+    );
+    await queryRunner.query(`DROP TABLE "SecurityEventConnection"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -1,6 +1,7 @@
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
+import { AddSecurityEventConnections1792700000000 } from "./1792700000000-AddSecurityEventConnections";
 import { AddSloBurnRateRuleIncidents1792400000000 } from "./1792400000000-AddSloBurnRateRuleIncidents";
 import { AddUserWebAuthnPurpose1792200000000 } from "./1792200000000-AddUserWebAuthnPurpose";
 import InitialMigration from "./1717605043663-InitialMigration";
@@ -1178,4 +1179,5 @@ export default [
   AddSloBurnRateRuleIncidents1792400000000,
   AddConfigurableRuleCriteria1792500000000,
   AddIncomingCallPolicyPhoneNumbers1792600000000,
+  AddSecurityEventConnections1792700000000,
 ];

package/Server/Middleware/TelemetryIngest.ts

@@ -3,6 +3,11 @@ import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException
 import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
 import ProductType from "../../Types/MeteredPlan/ProductType";
 import ObjectID from "../../Types/ObjectID";
+import {
+  SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER,
+  SESSION_REPLAY_RECORDER_KIND_HEADER,
+  parseSessionReplayRecorderKindHeader,
+} from "../../Types/Rum/SessionReplay";
 import TelemetryIngestionKeyPolicy, {
   DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE,
 } from "../../Types/Telemetry/TelemetryIngestionKeyPolicy";
@@ -40,6 +45,14 @@ export interface TelemetryRequest extends ExpressRequest {
    * further into the system than it needs to go.
    */
   ingestionKeyPolicy: TelemetryIngestionKeyPolicy;
+
+  /*
+   * The identity already used to authorize a public ingestion key. Session
+   * replay's application-level allowlist must consume this exact value rather
+   * than re-reading Origin and disagreeing with the outer guard. For native
+   * replay this is a synthesized, normalized app:// origin.
+   */
+  resolvedClientOrigin?: string;
 }
 
 /*
@@ -105,6 +118,81 @@ type TelemetryIngestMiddlewareFunction = (
   next: NextFunction,
 ) => Promise<void>;
 
+interface ResolveTelemetryClientOriginOptions {
+  req: ExpressRequest;
+  surface: TelemetryIngestSurface | null;
+  isBrowserKey: boolean;
+}
+
+/*
+ * Resolve the client identity used by a Browser/public ingestion key.
+ *
+ * A real Origin always wins, including on a request that also carries mobile
+ * headers. Browsers attach Origin themselves and page JavaScript cannot
+ * remove or replace it, so permitting a header-selected fallback in that
+ * case would let a web page choose the weaker native identity path.
+ *
+ * Native applications do not have that browser-controlled header. Only the
+ * session replay surface, only an exact rn-view-tree kind, only a Browser key
+ * and only a validated package/bundle id receive the app:// fallback. Server
+ * keys retain their historical behaviour and never need to invent an origin.
+ */
+export function resolveTelemetryClientOrigin(
+  options: ResolveTelemetryClientOriginOptions,
+): string | undefined {
+  const hasStandardOriginHeader: boolean = Object.prototype.hasOwnProperty.call(
+    options.req.headers,
+    "origin",
+  );
+  const standardOrigin: string | undefined = headerValueToString(
+    options.req.headers["origin"],
+  );
+
+  if (hasStandardOriginHeader) {
+    /*
+     * A blank/malformed-but-present Origin is still authoritative: it must be
+     * refused as missing, never replaced with caller-selected mobile headers.
+     * app:// is never accepted from this caller-controlled header either. It
+     * is an internal authorization identity that may only be synthesized by
+     * the origin-less native replay branch below after all mobile headers and
+     * the ingest surface have been validated.
+     */
+    if (
+      standardOrigin &&
+      OriginAllowList.normalizeOrigin(standardOrigin).startsWith("app://")
+    ) {
+      return "";
+    }
+
+    return standardOrigin || "";
+  }
+
+  if (
+    !options.isBrowserKey ||
+    options.surface !== TelemetryIngestSurface.SessionReplay
+  ) {
+    return undefined;
+  }
+
+  const recorderKind: string | null = parseSessionReplayRecorderKindHeader(
+    options.req.headers[SESSION_REPLAY_RECORDER_KIND_HEADER],
+  );
+
+  if (recorderKind !== "rn-view-tree") {
+    return undefined;
+  }
+
+  const mobileAppIdentifier: string | undefined = headerValueToString(
+    options.req.headers[SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER],
+  );
+
+  if (!mobileAppIdentifier) {
+    return undefined;
+  }
+
+  return OriginAllowList.getMobileAppOrigin(mobileAppIdentifier);
+}
+
 export default class TelemetryIngest {
   /*
    * Build the ingest guard for one named surface.
@@ -293,6 +381,17 @@ export default class TelemetryIngest {
       const isBrowserKey: boolean =
         policy.keyType === TelemetryIngestionKeyType.Browser;
 
+      const resolvedClientOrigin: string | undefined =
+        resolveTelemetryClientOrigin({
+          req: req,
+          surface: surface,
+          isBrowserKey: isBrowserKey,
+        });
+
+      if (resolvedClientOrigin !== undefined) {
+        (req as TelemetryRequest).resolvedClientOrigin = resolvedClientOrigin;
+      }
+
       if (isBrowserKey) {
         /*
          * Surface allowlist. `surface === null` (the legacy alias) is not in
@@ -318,7 +417,7 @@ export default class TelemetryIngest {
         }
 
         const originRefusalMessage: string | null =
-          TelemetryIngest.getOriginRefusalMessage(req, policy);
+          TelemetryIngest.getOriginRefusalMessage(resolvedClientOrigin, policy);
 
         if (originRefusalMessage) {
           return Response.sendErrorResponse(
@@ -494,13 +593,9 @@ export default class TelemetryIngest {
    * telemetry, and the kill switch ends it outright.
    */
   private static getOriginRefusalMessage(
-    req: ExpressRequest,
+    origin: string | undefined,
     policy: TelemetryIngestionKeyPolicy,
   ): string | null {
-    const origin: string | undefined = headerValueToString(
-      req.headers["origin"],
-    );
-
     if (!origin) {
       /*
        * Say the header is missing rather than echoing an empty string into

package/Server/Services/ExceptionAggregationService.ts

@@ -14,6 +14,7 @@ import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import { getResourceFacetServiceTypeMap } from "../../Types/Telemetry/ResourceFacetCatalog";
 
 export interface HistogramBucket {
   time: string;
@@ -68,23 +69,13 @@ export class ExceptionAggregationService {
   ]);
   /*
    * Virtual facet keys — same scheme as TraceAggregationService /
-   * LogAggregationService. The `primaryEntityId` slot is reused for host /
-   * docker host / k8s cluster ids, disambiguated by the `primaryEntityType`
-   * discriminator column on each ExceptionInstance row.
+   * LogAggregationService. The `primaryEntityId` slot is reused for every
+   * non-Service resource id (host / docker host / k8s cluster / ... — one
+   * entry per ResourceFacetCatalog type), disambiguated by the
+   * `primaryEntityType` discriminator column on each ExceptionInstance row.
    */
   private static readonly RESOURCE_FACET_KEYS: Map<string, ServiceType> =
-    new Map([
-      ["hostId", ServiceType.Host],
-      ["dockerHostId", ServiceType.DockerHost],
-      ["podmanHostId", ServiceType.PodmanHost],
-      ["kubernetesClusterId", ServiceType.KubernetesCluster],
-      ["proxmoxClusterId", ServiceType.ProxmoxCluster],
-      ["vmwareVCenterId", ServiceType.VMwareVCenter],
-      ["cephClusterId", ServiceType.CephCluster],
-      ["serverlessFunctionId", ServiceType.ServerlessFunction],
-      ["cloudResourceId", ServiceType.CloudResource],
-      ["rumApplicationId", ServiceType.RealUserMonitor],
-    ]);
+    getResourceFacetServiceTypeMap();
   private static readonly ATTRIBUTE_KEY_PATTERN: RegExp = /^[a-zA-Z0-9._:/-]+$/;
   private static readonly MAX_FACET_KEY_LENGTH: number = 256;
 
@@ -224,7 +215,7 @@ export class ExceptionAggregationService {
       /*
        * Virtual facet — group primaryEntityId values whose row carries the
        * matching ServiceType discriminator (Host / DockerHost /
-       * KubernetesCluster).
+       * KubernetesCluster / ... — see ResourceFacetCatalog).
        */
       statement.append(
         SQL`SELECT toString(primaryEntityId) AS val, count() AS cnt FROM ${ExceptionAggregationService.TABLE_NAME}`,

package/Server/Services/GoogleSecOpsConnectionService.ts

@@ -22,6 +22,21 @@ export class Service extends DatabaseService<Model> {
     serviceAccountJson?: string | undefined;
     pollIntervalInMinutes?: number | undefined;
     includeNonAlertingDetections?: boolean | undefined;
+  }): void {
+    Service.validateSettings(data);
+  }
+
+  /*
+   * The same rules, callable without a row: the synchronous connection
+   * test validates settings the person has not saved yet, and must reject
+   * exactly what create/update would reject.
+   */
+  public static validateSettings(data: {
+    region?: string | undefined;
+    instanceResourceName?: string | undefined;
+    serviceAccountJson?: string | undefined;
+    pollIntervalInMinutes?: number | undefined;
+    includeNonAlertingDetections?: boolean | undefined;
   }): void {
     if (
       data.includeNonAlertingDetections !== undefined &&

package/Server/Services/Index.ts

@@ -335,6 +335,8 @@ import AlertSeverityService from "./AlertSeverityService";
 import DetectionRuleService from "./DetectionRuleService";
 import GoogleSecOpsConnectionService from "./GoogleSecOpsConnectionService";
 import GoogleSecOpsConnectionRunService from "./GoogleSecOpsConnectionRunService";
+import SecurityEventConnectionService from "./SecurityEventConnectionService";
+import SecurityEventConnectionRunService from "./SecurityEventConnectionRunService";
 import ThreatIntelFeedService from "./ThreatIntelFeedService";
 import ThreatIntelIndicatorService from "./ThreatIntelIndicatorService";
 import AlertNoteTemplateService from "./AlertNoteTemplateService";
@@ -766,6 +768,8 @@ const services: Array<BaseService> = [
   DetectionRuleService,
   GoogleSecOpsConnectionService,
   GoogleSecOpsConnectionRunService,
+  SecurityEventConnectionService,
+  SecurityEventConnectionRunService,
   ThreatIntelFeedService,
   AlertNoteTemplateService,
   AlertFeedService,

package/Server/Services/InventoryItemService.ts

@@ -498,9 +498,37 @@ export class InventoryItemService extends DatabaseService<Model> {
       }
     }
 
+    for (const key of this.dependencyDisplayNameOrderByType[
+      entity.entityType
+    ] || []) {
+      if (id[key]) {
+        return id[key]!;
+      }
+    }
+
     return this.deriveFallbackDisplayName(entity);
   }
 
+  /*
+   * Dependency endpoints have composite identities in which the most
+   * recognisable part is not a `*.name` key: a database reads best as its
+   * namespace ("orders"), then the host it lives on, and only as a last
+   * resort as its engine ("postgresql" is shared by every Postgres a project
+   * calls). Remote endpoints read best as the service name their callers gave
+   * them, then their host.
+   */
+  private static readonly dependencyDisplayNameOrderByType: Partial<
+    Record<EntityType, Array<string>>
+  > = {
+    [EntityType.Database]: ["db.namespace", "server.address", "db.system.name"],
+    [EntityType.RemoteService]: [
+      "peer.service",
+      "server.address",
+      "rpc.service",
+      "messaging.system",
+    ],
+  };
+
   /** The generic display-name algorithm used before type-aware K8s names. */
   private static deriveFallbackDisplayName(entity: ExtractedEntity): string {
     const id: Record<string, string> = entity.identifyingAttributes || {};

package/Server/Services/LogAggregationService.ts

@@ -15,6 +15,7 @@ import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import { getResourceFacetServiceTypeMap } from "../../Types/Telemetry/ResourceFacetCatalog";
 import {
   appendResourceScopeFilters,
   ResourceEntityScope,
@@ -55,8 +56,9 @@ export interface HistogramRequest {
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
   /*
-   * Resource-facet selections (Kubernetes cluster / host / docker host /
-   * podman host) already resolved to their entity keys. One scope per
+   * Resource-facet selections (host / Kubernetes cluster / Proxmox
+   * cluster / ... — any ResourceFacetCatalog type) already resolved to
+   * their entity keys and resource attributes. One scope per
    * facet: the branches inside a scope OR (a row proves membership either
    * by being primary-keyed on the resource or by carrying its entity key),
    * and the scopes AND with each other so two facets intersect. See
@@ -86,8 +88,9 @@ export interface FacetRequest {
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
   /*
-   * Resource-facet selections (Kubernetes cluster / host / docker host /
-   * podman host) already resolved to their entity keys. One scope per
+   * Resource-facet selections (host / Kubernetes cluster / Proxmox
+   * cluster / ... — any ResourceFacetCatalog type) already resolved to
+   * their entity keys and resource attributes. One scope per
    * facet: the branches inside a scope OR (a row proves membership either
    * by being primary-keyed on the resource or by carrying its entity key),
    * and the scopes AND with each other so two facets intersect. See
@@ -116,8 +119,9 @@ export interface AnalyticsRequest {
   aggregationField?: string | undefined;
   serviceIds?: Array<ObjectID> | undefined;
   /*
-   * Resource-facet selections (Kubernetes cluster / host / docker host /
-   * podman host) already resolved to their entity keys. One scope per
+   * Resource-facet selections (host / Kubernetes cluster / Proxmox
+   * cluster / ... — any ResourceFacetCatalog type) already resolved to
+   * their entity keys and resource attributes. One scope per
    * facet: the branches inside a scope OR (a row proves membership either
    * by being primary-keyed on the resource or by carrying its entity key),
    * and the scopes AND with each other so two facets intersect. See
@@ -265,24 +269,14 @@ export class LogAggregationService {
   /*
    * Virtual facet keys that don't correspond to real ClickHouse columns —
    * they all read out of `primaryEntityId` filtered by `primaryEntityType`.
-   * The discriminator was added so host / docker host / k8s cluster
-   * telemetry could reuse the `primaryEntityId` slot instead of synthesising
-   * phantom Service rows; these facets surface each resource type
-   * independently.
+   * The discriminator was added so resource telemetry (host / docker host /
+   * k8s cluster / proxmox / ...) could reuse the `primaryEntityId` slot
+   * instead of synthesising phantom Service rows; these facets surface each
+   * resource type independently. One entry per ResourceFacetCatalog
+   * resource type, so every type the explorers offer is counted.
    */
   private static readonly RESOURCE_FACET_KEYS: Map<string, ServiceType> =
-    new Map([
-      ["hostId", ServiceType.Host],
-      ["dockerHostId", ServiceType.DockerHost],
-      ["podmanHostId", ServiceType.PodmanHost],
-      ["kubernetesClusterId", ServiceType.KubernetesCluster],
-      ["proxmoxClusterId", ServiceType.ProxmoxCluster],
-      ["vmwareVCenterId", ServiceType.VMwareVCenter],
-      ["cephClusterId", ServiceType.CephCluster],
-      ["serverlessFunctionId", ServiceType.ServerlessFunction],
-      ["cloudResourceId", ServiceType.CloudResource],
-      ["rumApplicationId", ServiceType.RealUserMonitor],
-    ]);
+    getResourceFacetServiceTypeMap();
   private static readonly ATTRIBUTE_KEY_PATTERN: RegExp = /^[a-zA-Z0-9._:/-]+$/;
   private static readonly MAX_FACET_KEY_LENGTH: number = 256;
   /*
@@ -443,7 +437,7 @@ export class LogAggregationService {
       /*
        * Virtual facet — group primaryEntityId values whose row carries the
        * matching ServiceType discriminator (Host / DockerHost /
-       * KubernetesCluster).
+       * KubernetesCluster / ... — see ResourceFacetCatalog).
        */
       statement.append(
         SQL`SELECT toString(primaryEntityId) AS val, count() AS cnt FROM ${LogAggregationService.TABLE_NAME}`,

package/Server/Services/MetricAggregationService.ts

@@ -12,6 +12,7 @@ import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import { getResourceFacetServiceTypeMap } from "../../Types/Telemetry/ResourceFacetCatalog";
 
 export interface FacetValue {
   value: string;
@@ -85,8 +86,8 @@ export interface MetricForTraceItem {
  * Facet aggregation for the Metrics page sidebar. Same shape as
  * TraceAggregationService / LogAggregationService — per-facet GROUP BY on
  * the analytics table, with a `primaryEntityType` discriminator that lets
- * the `primaryEntityId` column carry Host / DockerHost / KubernetesCluster
- * ids for the corresponding virtual facets.
+ * the `primaryEntityId` column carry Host / DockerHost / KubernetesCluster /
+ * ... ids (one virtual facet per ResourceFacetCatalog resource type).
  */
 export class MetricAggregationService {
   private static readonly DEFAULT_FACET_LIMIT: number = 500;
@@ -98,18 +99,7 @@ export class MetricAggregationService {
     "name",
   ]);
   private static readonly RESOURCE_FACET_KEYS: Map<string, ServiceType> =
-    new Map([
-      ["hostId", ServiceType.Host],
-      ["dockerHostId", ServiceType.DockerHost],
-      ["podmanHostId", ServiceType.PodmanHost],
-      ["kubernetesClusterId", ServiceType.KubernetesCluster],
-      ["proxmoxClusterId", ServiceType.ProxmoxCluster],
-      ["vmwareVCenterId", ServiceType.VMwareVCenter],
-      ["cephClusterId", ServiceType.CephCluster],
-      ["serverlessFunctionId", ServiceType.ServerlessFunction],
-      ["cloudResourceId", ServiceType.CloudResource],
-      ["rumApplicationId", ServiceType.RealUserMonitor],
-    ]);
+    getResourceFacetServiceTypeMap();
   private static readonly ATTRIBUTE_KEY_PATTERN: RegExp = /^[a-zA-Z0-9._:/-]+$/;
   private static readonly MAX_FACET_KEY_LENGTH: number = 256;
   /**

package/Server/Services/SecurityEventConnectionRunService.ts

@@ -0,0 +1,10 @@
+import Model from "../../Models/DatabaseModels/SecurityEventConnectionRun";
+import DatabaseService from "./DatabaseService";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+
+export default new Service();