@oneuptime/common 13.0.4 → 13.0.6

package/build/dist/Server/Utils/SecurityEvent/Connectors/Splunk/SplunkConnector.js

@@ -0,0 +1,379 @@
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import SecurityEventConnectorProvider from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import SplunkNormalizer from "../../../../../Utils/SecurityEvent/Connectors/SplunkNormalizer";
+import { parseEventTime } from "../../../../../Utils/SecurityEvent/NormalizerHelpers";
+import DataSourceHttpFetch from "../../../DataSource/HttpFetch";
+import { redactLogString } from "../../../LogRedaction";
+import ConnectorErrorMessage from "../../ConnectorErrorMessage";
+import { makeCheck, readSettingString, } from "../Types";
+import SplunkClient, { SPLUNK_DEFAULT_SEARCH, } from "./SplunkClient";
+const DAY_IN_MS = 24 * 60 * 60 * 1000;
+export default class SplunkConnector {
+    constructor(transport) {
+        this.provider = SecurityEventConnectorProvider.SplunkEnterpriseSecurity;
+        this.transport =
+            transport ||
+                ((request) => {
+                    return DataSourceHttpFetch.fetch(request);
+                });
+    }
+    static getDefinition() {
+        const definition = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.SplunkEnterpriseSecurity);
+        if (!definition) {
+            throw new BadDataException("Splunk Enterprise Security is missing from the connector catalog.");
+        }
+        return definition;
+    }
+    static fieldTitle(key) {
+        const definition = this.getDefinition();
+        const field = [
+            ...definition.configFields,
+            ...definition.secretFields,
+        ].find((candidate) => {
+            return candidate.key === key;
+        });
+        return (field === null || field === void 0 ? void 0 : field.title) || key;
+    }
+    /*
+     * Shape checks the form can act on. URL and search syntax are delegated
+     * to the client's normalizers so the message here and the request
+     * later agree on what is acceptable.
+     */
+    static parseSettings(settings) {
+        const rawUrl = readSettingString(settings.config, "url");
+        const rawSearch = readSettingString(settings.config, "searchString") ||
+            SPLUNK_DEFAULT_SEARCH;
+        const username = readSettingString(settings.config, "username");
+        const apiToken = readSettingString(settings.secrets, "apiToken");
+        const password = readSettingString(settings.secrets, "password");
+        if (!rawUrl) {
+            throw new BadDataException(`${this.fieldTitle("url")} is required.`);
+        }
+        const url = SplunkClient.normalizeBaseUrl(rawUrl);
+        const searchString = SplunkClient.normalizeSearchString(rawSearch);
+        if (!apiToken) {
+            if (!username && !password) {
+                throw new BadDataException(`Provide an ${this.fieldTitle("apiToken")}, or a ${this.fieldTitle("username")} and ${this.fieldTitle("password")}.`);
+            }
+            if (!username) {
+                throw new BadDataException(`${this.fieldTitle("username")} is required when a ${this.fieldTitle("password")} is set.`);
+            }
+            if (!password) {
+                throw new BadDataException(`${this.fieldTitle("password")} is required when a ${this.fieldTitle("username")} is set and no ${this.fieldTitle("apiToken")} is given.`);
+            }
+        }
+        return { url, searchString, username, apiToken, password };
+    }
+    validateSettings(settings) {
+        SplunkConnector.parseSettings(settings);
+    }
+    buildClient(parsed, requestTimeoutInMs) {
+        return new SplunkClient({
+            url: parsed.url,
+            apiToken: parsed.apiToken || undefined,
+            username: parsed.apiToken ? undefined : parsed.username,
+            password: parsed.apiToken ? undefined : parsed.password,
+            searchString: parsed.searchString,
+            transport: this.transport,
+            requestTimeoutInMs,
+        });
+    }
+    /*
+     * Three provider checks, in dependency order. Each later check is
+     * skipped rather than failed when an earlier one fails, so the report
+     * names one root cause instead of three symptoms of it.
+     */
+    async testConnection(settings, options) {
+        const checks = [];
+        let parsed;
+        let startedAtMs = Date.now();
+        try {
+            parsed = SplunkConnector.parseSettings(settings);
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Splunk",
+                status: "fail",
+                startedAtMs,
+                message: redactLogString(ConnectorErrorMessage.toMessage(error)),
+                remediation: "Correct the highlighted setting and test again. Nothing was contacted.",
+            }));
+            return checks;
+        }
+        const client = this.buildClient(parsed, options.requestTimeoutInMs);
+        try {
+            const context = await client.getCurrentContext();
+            const roles = context.roles.length
+                ? context.roles.join(", ")
+                : "no roles reported";
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Splunk",
+                status: "pass",
+                startedAtMs,
+                message: `Splunk accepted the ${parsed.apiToken ? "authentication token" : "username and password"} as user ${context.username || "(unknown)"} with roles: ${roles}.`,
+                details: {
+                    username: context.username,
+                    roles: context.roles,
+                    hasSearchCapability: context.capabilities.includes("search"),
+                },
+            }));
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Splunk",
+                status: "fail",
+                startedAtMs,
+                message: redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false })),
+                remediation: SplunkConnector.authenticationRemediation(ConnectorErrorMessage.toMessage(error, { truncate: false })),
+            }));
+            checks.push(SplunkConnector.skipped("read-permission", "Run the search on Splunk", "Skipped because authentication failed."));
+            checks.push(SplunkConnector.skipped("detections-available", "Notable events available to import", "Skipped because authentication failed."));
+            return checks;
+        }
+        const now = new Date();
+        const dayAgo = new Date(now.getTime() - DAY_IN_MS);
+        const weekAgo = new Date(now.getTime() - 7 * DAY_IN_MS);
+        startedAtMs = Date.now();
+        try {
+            /*
+             * Any row proves the search runs; sorting a whole day on the search
+             * head just to pick which one would make the test slow on a busy
+             * index.
+             */
+            const probe = await client.exportSearch({
+                startTime: dayAgo,
+                endTime: now,
+                maxResults: 1,
+                oldestFirst: false,
+            });
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Run the search on Splunk",
+                status: "pass",
+                startedAtMs,
+                message: `Splunk ran "${parsed.searchString}" through the ${probe.apiVersion === "v2" ? "search/v2/jobs/export" : "deprecated search/jobs/export"} endpoint (${probe.results.length} record${probe.results.length === 1 ? "" : "s"} returned for a one-record probe over the last 24 hours).`,
+                details: { apiVersion: probe.apiVersion },
+            }));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false }));
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Run the search on Splunk",
+                status: "fail",
+                startedAtMs,
+                message,
+                remediation: SplunkConnector.readRemediation(message),
+            }));
+            checks.push(SplunkConnector.skipped("detections-available", "Notable events available to import", "Skipped because the search check failed."));
+            return checks;
+        }
+        startedAtMs = Date.now();
+        try {
+            const last24h = await client.countSearch({
+                startTime: dayAgo,
+                endTime: now,
+            });
+            const last7d = await client.countSearch({
+                startTime: weekAgo,
+                endTime: now,
+            });
+            const nothing = last24h.count === 0 && last7d.count === 0;
+            checks.push(makeCheck(Object.assign(Object.assign({ key: "detections-available", name: "Notable events available to import", status: nothing ? "warn" : "pass", startedAtMs, message: nothing
+                    ? `No records matched "${parsed.searchString}" in the last 7 days. Polling will import new notable events as Splunk creates them.`
+                    : `${last24h.count} record${last24h.count === 1 ? "" : "s"} created in the last 24 hours and ${last7d.count} in the last 7 days.` }, (nothing
+                ? {
+                    remediation: "Confirm in Splunk that the search returns results over the last 7 days (Incident Review for notable events). A search head where Enterprise Security has not created notables produces none; check that the correlation searches are enabled and that the user's role can read the searched index.",
+                }
+                : {})), { details: {
+                    createdLast24h: last24h.count,
+                    createdLast7d: last7d.count,
+                    hasMoreLast24h: false,
+                    hasMoreLast7d: false,
+                } })));
+        }
+        catch (error) {
+            const message = redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false }));
+            checks.push(makeCheck({
+                key: "detections-available",
+                name: "Notable events available to import",
+                status: "fail",
+                startedAtMs,
+                message,
+                remediation: SplunkConnector.readRemediation(message),
+            }));
+        }
+        return checks;
+    }
+    static skipped(key, name, message) {
+        return makeCheck({
+            key,
+            name,
+            status: "skip",
+            startedAtMs: Date.now(),
+            message,
+        });
+    }
+    /*
+     * Remediation keyed off the HTTP status the client put in the message,
+     * so the check tells the reader what to change instead of quoting
+     * Splunk.
+     */
+    static authenticationRemediation(message) {
+        if (message.includes("(HTTP 401)")) {
+            return "Create a new authentication token in Splunk (Settings > Tokens > New Token) for a user whose role can search the notable index, confirm token authentication is enabled on the search head, and update the connection's credentials. For username and password, check both against Splunk Web.";
+        }
+        if (message.includes("(HTTP 404)") ||
+            message.includes("not newline-delimited JSON") ||
+            message.includes("non-JSON body")) {
+            return "Point the Splunk management URL at the search head's management port (usually https://<host>:8089) with no path. Splunk Web on port 8000 does not serve the REST API.";
+        }
+        if (message.includes("did not complete")) {
+            return "Splunk did not answer in time or could not be reached. Check that the OneUptime API and worker processes can open a connection to the management port, that the certificate is trusted, and — for OneUptime Cloud — that the search head is reachable from the internet (private addresses are refused).";
+        }
+        return "Read the message prefix to see which step failed, then follow the troubleshooting section of the Splunk Enterprise Security integration docs.";
+    }
+    static readRemediation(message) {
+        if (message.includes("(HTTP 403)")) {
+            return "Give the token's user a role with the search capability and read access to the searched index (srchIndexesAllowed includes notable, or the role inherits ess_analyst / ess_user in Splunk Enterprise Security).";
+        }
+        if (message.includes("(HTTP 401)")) {
+            return "Splunk stopped accepting the credentials between the first request and the search. The token may have just expired; create a new one and update the connection's credentials.";
+        }
+        if (message.includes("(HTTP 400)") ||
+            message.includes("rejected by Splunk")) {
+            return "Fix the Search setting: it must be a filter such as index=notable without earliest, latest or a leading pipe. Run the same SPL in Splunk Web to see the parser's error.";
+        }
+        if (message.includes("(HTTP 429)")) {
+            return "Splunk is throttling this user. Wait and test again; scheduled polls retry automatically.";
+        }
+        if (message.includes("did not complete")) {
+            return "Splunk did not answer in time. A search over the notable index that takes longer than the request timeout is usually a search head under load or a Search that scans a large index; narrow the Search.";
+        }
+        return SplunkConnector.authenticationRemediation(message);
+    }
+    /*
+     * Read every record created in the window within the request and
+     * event budgets, oldest first. A budget hit returns complete=false with
+     * a warning and the resume point; nothing is silently dropped.
+     */
+    async fetchEvents(settings, window, options) {
+        const parsed = SplunkConnector.parseSettings(settings);
+        const client = this.buildClient(parsed, options.requestTimeoutInMs);
+        const warnings = [];
+        let complete = true;
+        /*
+         * One export covers the window; the v1 fallback is the only way it
+         * becomes two. A request budget below that cannot read anything, so
+         * it is reported rather than exceeded.
+         */
+        if (options.maxRequests < 1) {
+            return {
+                events: [],
+                fetchedCount: 0,
+                rejectedCount: 0,
+                failedCount: 0,
+                complete: false,
+                requestCount: 0,
+                warnings: [
+                    "The request budget for this run is zero, so the window was not read.",
+                ],
+                samples: [],
+            };
+        }
+        const exported = await client.exportSearch({
+            startTime: window.startTime,
+            endTime: window.endTime,
+            maxResults: options.maxEvents,
+            // A capped read must keep the oldest rows, or it can never resume.
+            oldestFirst: true,
+        });
+        let resumeAfter = undefined;
+        if (exported.truncated) {
+            complete = false;
+            resumeAfter = SplunkConnector.lastReadTime(exported.results, window);
+            warnings.push(resumeAfter
+                ? `Stopped after collecting ${exported.results.length} records; the window holds more. Records are read oldest first, and the last one read was created at ${resumeAfter.toISOString()}, where the next poll can resume.`
+                : `Stopped after collecting ${exported.results.length} records; the window holds more, and no record read carried a _time to resume from.`);
+        }
+        if (exported.apiVersion === "v1") {
+            warnings.push("Splunk answered 404 for search/v2/jobs/export, so the deprecated search/jobs/export endpoint was used. Upgrade the search head to Splunk 9.0.1 or later; the v1 endpoint is disabled in current releases.");
+        }
+        if (client.getRequestCount() > options.maxRequests) {
+            warnings.push(`The v1 fallback took ${client.getRequestCount()} requests against a budget of ${options.maxRequests}.`);
+        }
+        const events = [];
+        const samples = [];
+        let rejectedCount = 0;
+        let failedCount = 0;
+        for (const raw of exported.results) {
+            if (!SplunkNormalizer.isRecognized(raw)) {
+                rejectedCount++;
+                continue;
+            }
+            try {
+                const normalized = SplunkNormalizer.normalize(raw);
+                events.push(normalized);
+                if (samples.length < options.sampleLimit) {
+                    samples.push(SplunkConnector.toSample(raw, normalized));
+                }
+            }
+            catch (_a) {
+                failedCount++;
+            }
+        }
+        return {
+            events,
+            fetchedCount: exported.results.length,
+            rejectedCount,
+            failedCount,
+            complete,
+            requestCount: client.getRequestCount(),
+            warnings,
+            samples,
+            resumeAfter,
+        };
+    }
+    /*
+     * The `_time` of the last row read. The export is sorted ascending, so
+     * every row created strictly before it inside the window has been read.
+     * Rows are scanned from the end because sort places a row without a
+     * readable `_time` last; a time past the window end means the rows are
+     * not ordered the way the resume point assumes, so none is reported and
+     * the poller narrows the window instead of trusting it.
+     */
+    static lastReadTime(rows, window) {
+        for (let index = rows.length - 1; index >= 0; index--) {
+            const row = rows[index];
+            const time = row
+                ? parseEventTime(row["_time"])
+                : null;
+            if (!time) {
+                continue;
+            }
+            return time.getTime() > window.endTime.getTime() ? undefined : time;
+        }
+        return undefined;
+    }
+    /*
+     * For a notable, `_time` is its creation time. `orig_time` (when a
+     * correlation search carried it over from the matched event) is the
+     * closest thing to the activity's own time; the normalized time is
+     * used otherwise so the sample always has both stamps.
+     */
+    static toSample(raw, normalized) {
+        const activityTime = parseEventTime(raw["orig_time"]);
+        return {
+            id: normalized.eventUid,
+            title: normalized.message,
+            severity: normalized.severityName,
+            createdTime: normalized.time.toISOString(),
+            eventTime: (activityTime || normalized.time).toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=SplunkConnector.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/Splunk/SplunkConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SplunkConnector.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/Splunk/SplunkConnector.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAO/E,OAAO,8BAA8B,MAAM,8EAA8E,CAAC;AAC1H,OAAO,EAEL,mCAAmC,GACpC,MAAM,6EAA6E,CAAC;AACrF,OAAO,gBAAgB,MAAM,gEAAgE,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AACtF,OAAO,mBAGN,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,qBAAqB,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAQL,SAAS,EACT,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,YAAY,EAAE,EACnB,qBAAqB,GAItB,MAAM,gBAAgB,CAAC;AAkCxB,MAAM,SAAS,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,MAAM,CAAC,OAAO,OAAO,eAAe;IAMlC,YAAmB,SAA0C;QALtD,aAAQ,GACb,8BAA8B,CAAC,wBAAwB,CAAC;QAKxD,IAAI,CAAC,SAAS;YACZ,SAAS;gBACT,CAAC,CAAC,OAA8B,EAAmC,EAAE;oBACnE,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,MAAM,CAAC,aAAa;QAC1B,MAAM,UAAU,GACd,mCAAmC,CACjC,8BAA8B,CAAC,wBAAwB,CACxD,CAAC;QAEJ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,GAAW;QACnC,MAAM,UAAU,GAAqC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAkC;YAC3C,GAAG,UAAU,CAAC,YAAY;YAC1B,GAAG,UAAU,CAAC,YAAY;SAC3B,CAAC,IAAI,CAAC,CAAC,SAA0B,EAAW,EAAE;YAC7C,OAAO,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,KAAI,GAAG,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,aAAa,CAC1B,QAAmC;QAEnC,MAAM,MAAM,GAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,SAAS,GACb,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;YAClD,qBAAqB,CAAC;QACxB,MAAM,QAAQ,GAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAW,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAW,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,GAAG,GAAW,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAW,YAAY,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAE3E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,gBAAgB,CACxB,cAAc,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CACrH,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uBAAuB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAC3F,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,uBAAuB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAC1I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,CAAC;IAEM,gBAAgB,CAAC,QAAmC;QACzD,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAEO,WAAW,CACjB,MAAsB,EACtB,kBAA0B;QAE1B,OAAO,IAAI,YAAY,CAAC;YACtB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;YACvD,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,cAAc,CACzB,QAAmC,EACnC,OAA6B;QAE7B,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,IAAI,MAAsB,CAAC;QAC3B,IAAI,WAAW,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,eAAe,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChE,WAAW,EACT,wEAAwE;aAC3E,CAAC,CACH,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAiB,IAAI,CAAC,WAAW,CAC3C,MAAM,EACN,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,OAAO,GAAyB,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,KAAK,GAAW,OAAO,CAAC,KAAK,CAAC,MAAM;gBACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1B,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,YAAY,OAAO,CAAC,QAAQ,IAAI,WAAW,gBAAgB,KAAK,GAAG;gBACrK,OAAO,EAAE;oBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC7D;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,eAAe,CACtB,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D;gBACD,WAAW,EAAE,eAAe,CAAC,yBAAyB,CACpD,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D;aACF,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,eAAe,CAAC,OAAO,CACrB,iBAAiB,EACjB,0BAA0B,EAC1B,wCAAwC,CACzC,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,eAAe,CAAC,OAAO,CACrB,sBAAsB,EACtB,oCAAoC,EACpC,wCAAwC,CACzC,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAE9D,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH;;;;eAIG;YACH,MAAM,KAAK,GAAuB,MAAM,MAAM,CAAC,YAAY,CAAC;gBAC1D,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;gBACZ,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,eAAe,MAAM,CAAC,YAAY,iBAAiB,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,+BAA+B,cAAc,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,2DAA2D;gBAC7R,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;aAC1C,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO;gBACP,WAAW,EAAE,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC;aACtD,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,eAAe,CAAC,OAAO,CACrB,sBAAsB,EACtB,oCAAoC,EACpC,0CAA0C,CAC3C,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAgB,MAAM,MAAM,CAAC,WAAW,CAAC;gBACpD,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;YACH,MAAM,MAAM,GAAgB,MAAM,MAAM,CAAC,WAAW,CAAC;gBACnD,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;YACH,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC;YAEnE,MAAM,CAAC,IAAI,CACT,SAAS,+BACP,GAAG,EAAE,sBAAsB,EAC3B,IAAI,EAAE,oCAAoC,EAC1C,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACjC,WAAW,EACX,OAAO,EAAE,OAAO;oBACd,CAAC,CAAC,uBAAuB,MAAM,CAAC,YAAY,sFAAsF;oBAClI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,UAAU,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qCAAqC,MAAM,CAAC,KAAK,sBAAsB,IAChI,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,WAAW,EACT,oSAAoS;iBACvS;gBACH,CAAC,CAAC,EAAE,CAAC,KACP,OAAO,EAAE;oBACP,cAAc,EAAE,OAAO,CAAC,KAAK;oBAC7B,aAAa,EAAE,MAAM,CAAC,KAAK;oBAC3B,cAAc,EAAE,KAAK;oBACrB,aAAa,EAAE,KAAK;iBACrB,IACD,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAW,eAAe,CACrC,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,sBAAsB;gBAC3B,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO;gBACP,WAAW,EAAE,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC;aACtD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,GAAW,EACX,IAAY,EACZ,OAAe;QAEf,OAAO,SAAS,CAAC;YACf,GAAG;YACH,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,yBAAyB,CAAC,OAAe;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,gSAAgS,CAAC;QAC1S,CAAC;QAED,IACE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAC9C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EACjC,CAAC;YACD,OAAO,uKAAuK,CAAC;QACjL,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,OAAO,0SAA0S,CAAC;QACpT,CAAC;QAED,OAAO,+IAA+I,CAAC;IACzJ,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,OAAe;QAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,iNAAiN,CAAC;QAC3N,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,+KAA+K,CAAC;QACzL,CAAC;QAED,IACE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACtC,CAAC;YACD,OAAO,yKAAyK,CAAC;QACnL,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,OAAO,2FAA2F,CAAC;QACrG,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,OAAO,wMAAwM,CAAC;QAClN,CAAC;QAED,OAAO,eAAe,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,WAAW,CACtB,QAAmC,EACnC,MAA4B,EAC5B,OAA8B;QAE9B,MAAM,MAAM,GAAmB,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAiB,IAAI,CAAC,WAAW,CAC3C,MAAM,EACN,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QAEF,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,QAAQ,GAAY,IAAI,CAAC;QAE7B;;;;WAIG;QACH,IAAI,OAAO,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,WAAW,EAAE,CAAC;gBACd,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,CAAC;gBACf,QAAQ,EAAE;oBACR,sEAAsE;iBACvE;gBACD,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAuB,MAAM,MAAM,CAAC,YAAY,CAAC;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,mEAAmE;YACnE,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QAEH,IAAI,WAAW,GAAqB,SAAS,CAAC;QAE9C,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,QAAQ,GAAG,KAAK,CAAC;YACjB,WAAW,GAAG,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrE,QAAQ,CAAC,IAAI,CACX,WAAW;gBACT,CAAC,CAAC,4BAA4B,QAAQ,CAAC,OAAO,CAAC,MAAM,wGAAwG,WAAW,CAAC,WAAW,EAAE,mCAAmC;gBACzN,CAAC,CAAC,4BAA4B,QAAQ,CAAC,OAAO,CAAC,MAAM,qFAAqF,CAC7I,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CACX,2MAA2M,CAC5M,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CACX,wBAAwB,MAAM,CAAC,eAAe,EAAE,iCAAiC,OAAO,CAAC,WAAW,GAAG,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAmC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAmC,EAAE,CAAC;QACnD,IAAI,aAAa,GAAW,CAAC,CAAC;QAC9B,IAAI,WAAW,GAAW,CAAC,CAAC;QAE5B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,aAAa,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,UAAU,GACd,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAExB,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YAAC,WAAM,CAAC;gBACP,WAAW,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM;YACN,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;YACrC,aAAa;YACb,WAAW;YACX,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE;YACtC,QAAQ;YACR,OAAO;YACP,WAAW;SACZ,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,YAAY,CACzB,IAAuB,EACvB,MAA4B;QAE5B,KAAK,IAAI,KAAK,GAAW,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,MAAM,GAAG,GAA2B,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,IAAI,GAAgB,GAAG;gBAC3B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAc,CAAC;gBAC3C,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,QAAQ,CACrB,GAAe,EACf,UAAmC;QAEnC,MAAM,YAAY,GAAgB,cAAc,CAC9C,GAAG,CAAC,WAAW,CAAc,CAC9B,CAAC;QAEF,OAAO;YACL,EAAE,EAAE,UAAU,CAAC,QAAQ;YACvB,KAAK,EAAE,UAAU,CAAC,OAAO;YACzB,QAAQ,EAAE,UAAU,CAAC,YAAY;YACjC,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE;YAC1C,SAAS,EAAE,CAAC,YAAY,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/Utils/SecurityEvent/Connectors/Types.js

@@ -0,0 +1,122 @@
+export function toConnectorTestResult(value) {
+    return Array.isArray(value) ? { checks: value } : value;
+}
+/*
+ * The property attachConnectorChecks stores checks under. Kept on the
+ * original error object, not a wrapper, so the error's type and message
+ * (which the docs quote) reach the run unchanged.
+ */
+const CONNECTOR_CHECKS_PROPERTY = "oneuptimeConnectorChecks";
+export function attachConnectorChecks(error, checks) {
+    if (error && typeof error === "object") {
+        try {
+            Object.defineProperty(error, CONNECTOR_CHECKS_PROPERTY, {
+                value: checks,
+                enumerable: false,
+                configurable: true,
+                writable: true,
+            });
+        }
+        catch (_a) {
+            /*
+             * A frozen or non-extensible error cannot take the property. The
+             * checks only name the failing pass, so the connector still rethrows
+             * the original error rather than a TypeError about the property.
+             */
+        }
+    }
+    return error;
+}
+export function readConnectorChecks(error) {
+    if (!error || typeof error !== "object") {
+        return undefined;
+    }
+    const checks = error[CONNECTOR_CHECKS_PROPERTY];
+    return Array.isArray(checks)
+        ? checks
+        : undefined;
+}
+/*
+ * Stored beside the checks and for the same reason: on the original error,
+ * never a wrapper, so the error's type and message reach the run unchanged.
+ */
+const CONNECTOR_FETCH_SUMMARY_PROPERTY = "oneuptimeConnectorFetchSummary";
+export function attachConnectorFetchSummary(error, summary) {
+    if (error && typeof error === "object") {
+        try {
+            Object.defineProperty(error, CONNECTOR_FETCH_SUMMARY_PROPERTY, {
+                value: summary,
+                enumerable: false,
+                configurable: true,
+                writable: true,
+            });
+        }
+        catch (_a) {
+            /*
+             * A frozen or non-extensible error cannot take the property. The
+             * summary is diagnostics only, so the connector still rethrows the
+             * original error rather than a TypeError about the property.
+             */
+        }
+    }
+    return error;
+}
+function isNonNegativeCount(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+/*
+ * The summary attached to an error, or undefined. The property can be set
+ * by anything holding the error, so the shape is checked rather than
+ * trusted: a summary without an array of warnings or without both counts
+ * is ignored, non-string warnings are dropped, and details that are not an
+ * object are left out. The result is a copy, so a caller appending to its
+ * warnings never changes what the error carries.
+ */
+export function readConnectorFetchSummary(error) {
+    if (!error || typeof error !== "object") {
+        return undefined;
+    }
+    const stored = error[CONNECTOR_FETCH_SUMMARY_PROPERTY];
+    if (!stored || typeof stored !== "object" || Array.isArray(stored)) {
+        return undefined;
+    }
+    const candidate = stored;
+    if (!Array.isArray(candidate["warnings"]) ||
+        !isNonNegativeCount(candidate["requestCount"]) ||
+        !isNonNegativeCount(candidate["fetchedCount"])) {
+        return undefined;
+    }
+    const details = candidate["details"];
+    return Object.assign({ warnings: candidate["warnings"].filter((warning) => {
+            return typeof warning === "string";
+        }), requestCount: candidate["requestCount"], fetchedCount: candidate["fetchedCount"] }, (details && typeof details === "object" && !Array.isArray(details)
+        ? { details: details }
+        : {}));
+}
+/*
+ * Small helpers shared by connectors so their checks read alike.
+ */
+export function readSettingString(source, key) {
+    const value = source[key];
+    if (value === null || value === undefined) {
+        return "";
+    }
+    return String(value).trim();
+}
+export function readSettingBoolean(source, key, fallback) {
+    const value = source[key];
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (value === "true") {
+        return true;
+    }
+    if (value === "false") {
+        return false;
+    }
+    return fallback;
+}
+export function makeCheck(data) {
+    return Object.assign(Object.assign({ key: data.key, name: data.name, status: data.status, durationMs: Math.max(0, Date.now() - data.startedAtMs), message: data.message }, (data.remediation ? { remediation: data.remediation } : {})), (data.details ? { details: data.details } : {}));
+}
+//# sourceMappingURL=Types.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/Types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Types.js","sourceRoot":"","sources":["../../../../../../Server/Utils/SecurityEvent/Connectors/Types.ts"],"names":[],"mappings":"AA8NA,MAAM,UAAU,qBAAqB,CACnC,KAA0D;IAE1D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,yBAAyB,GAAW,0BAA0B,CAAC;AAErE,MAAM,UAAU,qBAAqB,CACnC,KAAQ,EACR,MAAqC;IAErC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,yBAAyB,EAAE;gBACtD,KAAK,EAAE,MAAM;gBACb,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,IAAI;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP;;;;eAIG;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAa,KAAiC,CACxD,yBAAyB,CAC1B,CAAC;IAEF,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAE,MAAwC;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAoBD;;;GAGG;AACH,MAAM,gCAAgC,GACpC,gCAAgC,CAAC;AAEnC,MAAM,UAAU,2BAA2B,CACzC,KAAQ,EACR,OAAqC;IAErC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,gCAAgC,EAAE;gBAC7D,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,IAAI;gBAClB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACP;;;;eAIG;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAa,KAAiC,CACxD,gCAAgC,CACjC,CAAC;IAEF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAA4B,MAAiC,CAAC;IAE7E,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,kBAAkB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC9C,CAAC,kBAAkB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAY,SAAS,CAAC,SAAS,CAAC,CAAC;IAE9C,uBACE,QAAQ,EAAG,SAAS,CAAC,UAAU,CAAoB,CAAC,MAAM,CACxD,CAAC,OAAgB,EAAqB,EAAE;YACtC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC;QACrC,CAAC,CACF,EACD,YAAY,EAAE,SAAS,CAAC,cAAc,CAAC,EACvC,YAAY,EAAE,SAAS,CAAC,cAAc,CAAC,IACpC,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAqB,EAAE;QACpC,CAAC,CAAC,EAAE,CAAC,EACP;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAY,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAkB,EAClB,GAAW,EACX,QAAiB;IAEjB,MAAM,KAAK,GAAY,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAQzB;IACC,qCACE,GAAG,EAAE,IAAI,CAAC,GAAG,EACb,IAAI,EAAE,IAAI,CAAC,IAAI,EACf,MAAM,EAAE,IAAI,CAAC,MAAM,EACnB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,EACtD,OAAO,EAAE,IAAI,CAAC,OAAO,IAClB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC3D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClD;AACJ,CAAC"}

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js

@@ -94,7 +94,7 @@ export default class DetectionRuleEvaluator {
                 logger.error(error);
                 /*
                  * Best-effort bookkeeping, guarded for the same reason as the
-                 * SecOps poller's: one rule whose error will not store must not
+                 * connection poller's: one rule whose error will not store must not
                  * throw its way out of this loop and stop every other rule in
                  * the project from being evaluated. ClickHouse errors echo the
                  * failing query back, so they are the long ones.

package/build/dist/Server/Utils/SecurityEvent/SecurityEventDedupe.js

@@ -0,0 +1,52 @@
+import TableColumnType from "../../../Types/AnalyticsDatabase/TableColumnType";
+import SecurityEventService from "../../Services/SecurityEventService";
+import { getClickhouseClusterName, getClickhouseDatabaseName, getStorageTableName, } from "../AnalyticsDatabase/ClusterConfig";
+import { getQuerySettings } from "../AnalyticsDatabase/QuerySettingsHelper";
+import { SQL } from "../AnalyticsDatabase/Statement";
+export const SECURITY_EVENT_DEDUPE_CHUNK_SIZE = 1000;
+export const SECURITY_EVENT_DEDUPE_TIME_LIMIT_MS = 2 * 60 * 1000;
+/*
+ * Which stored eventUids already exist for one source in one project.
+ *
+ * ClickHouse does not deduplicate eventUid, so every managed connector
+ * looks up before it inserts, under a per-source lock. This is a
+ * correctness lookup, not a dashboard query: a partial result on timeout
+ * or a lagging replica would create duplicates, so it reads every replica
+ * and fails closed on an unavailable shard. Shared by the Security Event
+ * Connections poller and its connection test, for every provider including
+ * Google SecOps, so the two cannot drift.
+ */
+export default class SecurityEventDedupe {
+    static async findExistingEventUids(data) {
+        const existing = new Set();
+        const startedMs = Date.now();
+        for (let offset = 0; offset < data.ids.length; offset += SECURITY_EVENT_DEDUPE_CHUNK_SIZE) {
+            if (Date.now() - startedMs >= SECURITY_EVENT_DEDUPE_TIME_LIMIT_MS) {
+                throw new Error("Duplicate lookup exceeded its time limit. Retry a smaller import window.");
+            }
+            const statement = SQL `SELECT DISTINCT eventUid FROM clusterAllReplicas(
+        ${{ type: TableColumnType.Text, value: getClickhouseClusterName() }},
+        ${{ type: TableColumnType.Text, value: getClickhouseDatabaseName() }},
+        ${{ type: TableColumnType.Text, value: getStorageTableName(SecurityEventService.model.tableName) }}
+      ) WHERE projectId = ${{ type: TableColumnType.ObjectID, value: data.projectId }}
+        AND vendorName = ${{ type: TableColumnType.Text, value: data.vendorName }}
+        AND productName = ${{ type: TableColumnType.Text, value: data.productName }}
+        AND eventUid IN ${{ type: TableColumnType.ArrayText, value: data.ids.slice(offset, offset + SECURITY_EVENT_DEDUPE_CHUNK_SIZE) }}`;
+            statement.append(getQuerySettings({
+                maxExecutionTimeInSeconds: 30,
+                timeoutOverflowMode: "throw",
+                boundScanMemory: true,
+                additionalSettings: { skip_unavailable_shards: 0 },
+            }));
+            const response = await SecurityEventService.executeQuery(statement);
+            const result = await response.json();
+            for (const row of result.data) {
+                if (typeof row["eventUid"] === "string") {
+                    existing.add(row["eventUid"]);
+                }
+            }
+        }
+        return existing;
+    }
+}
+//# sourceMappingURL=SecurityEventDedupe.js.map

package/build/dist/Server/Utils/SecurityEvent/SecurityEventDedupe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityEventDedupe.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/SecurityEventDedupe.ts"],"names":[],"mappings":"AACA,OAAO,eAAe,MAAM,kDAAkD,CAAC;AAG/E,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAa,MAAM,gCAAgC,CAAC;AAEhE,MAAM,CAAC,MAAM,gCAAgC,GAAW,IAAI,CAAC;AAC7D,MAAM,CAAC,MAAM,mCAAmC,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,OAAO,mBAAmB;IAC/B,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAKzC;QACC,MAAM,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;QACxC,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAErC,KACE,IAAI,MAAM,GAAW,CAAC,EACtB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EACxB,MAAM,IAAI,gCAAgC,EAC1C,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,mCAAmC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAc,GAAG,CAAA;UAC5B,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE;UACjE,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE;UAClE,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;4BAC9E,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;2BAC1D,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE;4BACrD,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;0BACzD,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAAC,EAAE,EAAE,CAAC;YAEpI,SAAS,CAAC,MAAM,CACd,gBAAgB,CAAC;gBACf,yBAAyB,EAAE,EAAE;gBAC7B,mBAAmB,EAAE,OAAO;gBAC5B,eAAe,EAAE,IAAI;gBACrB,kBAAkB,EAAE,EAAE,uBAAuB,EAAE,CAAC,EAAE;aACnD,CAAC,CACH,CAAC;YAEF,MAAM,QAAQ,GACZ,MAAM,oBAAoB,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,MAAM,GACV,MAAM,QAAQ,CAAC,IAAI,EAAc,CAAC;YAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACxC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/build/dist/Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelFeedPoller.js

@@ -52,7 +52,7 @@ export const TAXII_PAGE_SIZE = 500;
 export const MAX_PAGES_PER_POLL = 10;
 /*
  * Overlap when falling back to a time-based cursor, so objects added
- * while the poll ran are never skipped (GoogleSecOpsPoller precedent).
+ * while the poll ran are never skipped (as the connection poller does).
  */
 const CURSOR_OVERLAP_IN_MINUTES = 1;
 /*
@@ -108,7 +108,7 @@ export default class ThreatIntelFeedPoller {
                 /*
                  * Best-effort bookkeeping that must never take the loop down
                  * with it — the ConnectorErrorMessage discipline shared with the
-                 * SecOps poller and the detection engine. The saved page token is
+                 * connection poller and the detection engine. The saved page token is
                  * cleared too: a failing fetch is how an expired token surfaces,
                  * and the added_after cursor restarts the window cleanly.
                  */