@oneuptime/common 13.0.4 → 13.0.6

package/build/dist/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdrNormalizer.js

@@ -0,0 +1,405 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import { DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readString, readStringArray, readValue, } from "../NormalizerHelpers";
+/*
+ * Microsoft Graph security `alert` (alerts_v2) -> OCSF Detection Finding
+ * (class 2004).
+ *
+ * Field contract:
+ * https://learn.microsoft.com/en-us/graph/api/resources/security-alert
+ * https://learn.microsoft.com/en-us/graph/api/resources/security-alertevidence
+ *
+ * The alert row itself carries rule-ish metadata (title, severity,
+ * status, category, mitreTechniques); the entities live in `evidence[]`,
+ * each item typed by `@odata.type` (deviceEvidence, userEvidence,
+ * ipEvidence, fileEvidence, processEvidence, urlEvidence, ...). Mining
+ * those into principal/target columns and the observables array is what
+ * makes a Defender alert joinable to the host and user it fired on.
+ *
+ * Pure and isomorphic: no server imports.
+ */
+// Evidence items and observable values are bounded so one alert cannot bloat a row.
+const MAX_EVIDENCE_ITEMS = 100;
+const MAX_OBSERVABLES = 200;
+/*
+ * Defender's kill-chain categories are MITRE ATT&CK tactic names without
+ * spaces. Only names that ARE tactics map; Defender also emits
+ * categories such as Malware, Ransomware or SuspiciousActivity, which are
+ * left to the attributes rather than invented into a tactic id.
+ * https://attack.mitre.org/tactics/enterprise/
+ */
+const TACTIC_ID_BY_NAME = {
+    reconnaissance: "TA0043",
+    resourcedevelopment: "TA0042",
+    initialaccess: "TA0001",
+    execution: "TA0002",
+    persistence: "TA0003",
+    privilegeescalation: "TA0004",
+    defenseevasion: "TA0005",
+    credentialaccess: "TA0006",
+    discovery: "TA0007",
+    lateralmovement: "TA0008",
+    collection: "TA0009",
+    commandandcontrol: "TA0011",
+    exfiltration: "TA0010",
+    impact: "TA0040",
+};
+/*
+ * OCSF Detection Finding status_id names for Graph alertStatus values
+ * (unknown, new, inProgress, resolved).
+ */
+const STATUS_NAME_BY_GRAPH_STATUS = {
+    unknown: "Unknown",
+    new: "New",
+    inprogress: "In Progress",
+    resolved: "Resolved",
+};
+/*
+ * evidenceRole values that put an entity on the actor side versus the
+ * target side of the finding. Anything else (contextual, scanned,
+ * loaded, ...) is only an observable.
+ */
+const PRINCIPAL_ROLES = ["source", "attacker", "compromised"];
+const TARGET_ROLES = [
+    "destination",
+    "attacked",
+    "created",
+    "added",
+    "edited",
+    "scanned",
+];
+function isObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+/*
+ * "@odata.type" contains a dot, so the dot-path helpers would look for
+ * item["@odata"]["type"]; the key is read directly instead.
+ */
+function odataTypeOf(item) {
+    const raw = item["@odata.type"];
+    return typeof raw === "string" ? raw : "";
+}
+function evidenceType(item) {
+    const odataType = odataTypeOf(item);
+    const lastDot = odataType.lastIndexOf(".");
+    return (lastDot >= 0 ? odataType.slice(lastDot + 1) : odataType).toLowerCase();
+}
+function lowerRoles(item) {
+    return readStringArray(item, "roles").map((role) => {
+        return role.toLowerCase();
+    });
+}
+/*
+ * A user account rendered the way an analyst would search for it: the
+ * UPN when Entra knows it, otherwise DOMAIN\account, otherwise whatever
+ * name the sensor had.
+ */
+function userAccountValue(account) {
+    if (!account) {
+        return "";
+    }
+    const upn = readString(account, "userPrincipalName");
+    if (upn) {
+        return upn;
+    }
+    const accountName = readString(account, "accountName");
+    const domainName = readString(account, "domainName");
+    if (accountName && domainName) {
+        return `${domainName}\\${accountName}`;
+    }
+    return accountName || readString(account, "displayName");
+}
+function fileObservables(file) {
+    if (!file) {
+        return [];
+    }
+    return [
+        readString(file, "sha256"),
+        readString(file, "sha1"),
+        readString(file, "fileName"),
+    ];
+}
+function summarizeEvidence(payload) {
+    const summary = {
+        hosts: [],
+        users: [],
+        ips: [],
+        processes: [],
+        resources: [],
+        observables: [],
+    };
+    const evidence = readValue(payload, "evidence");
+    if (!Array.isArray(evidence)) {
+        return summary;
+    }
+    for (const raw of evidence.slice(0, MAX_EVIDENCE_ITEMS)) {
+        if (!isObject(raw)) {
+            continue;
+        }
+        const item = raw;
+        const type = evidenceType(item);
+        const roles = lowerRoles(item);
+        switch (type) {
+            case "deviceevidence": {
+                const host = readString(item, "deviceDnsName") || readString(item, "hostName");
+                if (host) {
+                    summary.hosts.push({ value: host, roles });
+                }
+                summary.observables.push(host, readString(item, "hostName"));
+                for (const ip of readStringArray(item, "ipInterfaces")) {
+                    summary.observables.push(ip);
+                }
+                const loggedOn = readValue(item, "loggedOnUsers");
+                if (Array.isArray(loggedOn)) {
+                    for (const user of loggedOn) {
+                        if (isObject(user)) {
+                            const value = userAccountValue(user);
+                            summary.observables.push(value);
+                            summary.users.push({ value, roles: [] });
+                        }
+                    }
+                }
+                break;
+            }
+            case "userevidence": {
+                const account = readValue(item, "userAccount");
+                const value = userAccountValue(isObject(account) ? account : null);
+                if (value) {
+                    summary.users.push({ value, roles });
+                    summary.observables.push(value, isObject(account) ? readString(account, "userPrincipalName") : "", isObject(account) ? readString(account, "accountName") : "");
+                }
+                break;
+            }
+            case "ipevidence": {
+                const ip = readString(item, "ipAddress");
+                if (ip) {
+                    summary.ips.push({ value: ip, roles });
+                    summary.observables.push(ip);
+                }
+                break;
+            }
+            case "processevidence": {
+                const imageFile = readValue(item, "imageFile");
+                const image = isObject(imageFile) ? imageFile : null;
+                const commandLine = readString(item, "processCommandLine");
+                const imageName = image ? readString(image, "fileName") : "";
+                const value = commandLine || imageName;
+                if (value) {
+                    summary.processes.push({ value, roles });
+                }
+                summary.observables.push(imageName, ...fileObservables(image));
+                const parent = readValue(item, "parentProcessImageFile");
+                summary.observables.push(...fileObservables(isObject(parent) ? parent : null));
+                const account = readValue(item, "userAccount");
+                const user = userAccountValue(isObject(account) ? account : null);
+                if (user) {
+                    summary.users.push({ value: user, roles: [] });
+                    summary.observables.push(user);
+                }
+                break;
+            }
+            case "fileevidence": {
+                const details = readValue(item, "fileDetails");
+                summary.observables.push(...fileObservables(isObject(details) ? details : null));
+                break;
+            }
+            case "urlevidence": {
+                const url = readString(item, "url");
+                summary.observables.push(url);
+                if (url) {
+                    summary.resources.push(url);
+                }
+                break;
+            }
+            case "mailboxevidence": {
+                // https://learn.microsoft.com/en-us/graph/api/resources/security-mailboxevidence
+                const address = readString(item, "primaryAddress");
+                const account = readValue(item, "userAccount");
+                const user = userAccountValue(isObject(account) ? account : null) ||
+                    readString(item, "upn");
+                summary.observables.push(address, readString(item, "upn"), user);
+                if (address) {
+                    summary.resources.push(address);
+                }
+                if (user) {
+                    summary.users.push({ value: user, roles });
+                }
+                break;
+            }
+            case "azureresourceevidence": {
+                const resourceId = readString(item, "resourceId");
+                summary.observables.push(resourceId, readString(item, "resourceName"));
+                if (resourceId) {
+                    summary.resources.push(resourceId);
+                }
+                break;
+            }
+            case "amazonresourceevidence": {
+                const resourceId = readString(item, "amazonResourceId");
+                summary.observables.push(resourceId, readString(item, "resourceName"));
+                if (resourceId) {
+                    summary.resources.push(resourceId);
+                }
+                break;
+            }
+            case "googlecloudresourceevidence": {
+                const resourceName = readString(item, "resourceName");
+                summary.observables.push(resourceName);
+                if (resourceName) {
+                    summary.resources.push(resourceName);
+                }
+                break;
+            }
+            case "dnsevidence": {
+                summary.observables.push(readString(item, "domainName"));
+                break;
+            }
+            case "cloudapplicationevidence": {
+                summary.observables.push(readString(item, "displayName"));
+                break;
+            }
+            case "oauthapplicationevidence":
+            case "serviceprincipalevidence": {
+                summary.observables.push(readString(item, "appId"), readString(item, "displayName"), readString(item, "servicePrincipalName"));
+                break;
+            }
+            default: {
+                /*
+                 * Every evidence type inherits the base shape; unknown derived
+                 * types still contribute the identifiers most of them carry.
+                 */
+                summary.observables.push(readString(item, "ipAddress"), readString(item, "url"), readString(item, "deviceDnsName"), readString(item, "hostName"), readString(item, "domainName"));
+                const account = readValue(item, "userAccount");
+                summary.observables.push(userAccountValue(isObject(account) ? account : null));
+                break;
+            }
+        }
+    }
+    return summary;
+}
+function hasRole(entity, roles) {
+    return entity.roles.some((role) => {
+        return roles.includes(role);
+    });
+}
+/*
+ * The actor is the first entity Defender marked as source / attacker /
+ * compromised, else the first entity of that kind at all; the target is
+ * the first entity with a target-side role that is not the actor.
+ */
+function pickPrincipal(entities) {
+    var _a;
+    const explicit = entities.find((entity) => {
+        return hasRole(entity, PRINCIPAL_ROLES);
+    });
+    return ((_a = (explicit || entities[0])) === null || _a === void 0 ? void 0 : _a.value) || "";
+}
+function pickTarget(entities, principal) {
+    const explicit = entities.find((entity) => {
+        return entity.value !== principal && hasRole(entity, TARGET_ROLES);
+    });
+    return (explicit === null || explicit === void 0 ? void 0 : explicit.value) || "";
+}
+function mapTactics(payload) {
+    const names = [
+        ...readStringArray(payload, "categories"),
+        readString(payload, "category"),
+    ];
+    const tactics = [];
+    for (const name of names) {
+        const key = name.toLowerCase().replace(/[^a-z]/g, "");
+        const id = TACTIC_ID_BY_NAME[key];
+        if (id && !tactics.includes(id)) {
+            tactics.push(id);
+        }
+    }
+    return tactics;
+}
+function mapTechniques(payload) {
+    const techniques = [];
+    for (const technique of readStringArray(payload, "mitreTechniques")) {
+        const trimmed = technique.trim().toUpperCase();
+        if (trimmed && !techniques.includes(trimmed)) {
+            techniques.push(trimmed);
+        }
+    }
+    return techniques;
+}
+export default class MicrosoftDefenderXdrNormalizer {
+    /*
+     * A Graph security alert always carries a string `id` and
+     * `createdDateTime`; the @odata.type is present on list responses but
+     * not on every re-serialized copy, so it is accepted rather than
+     * required.
+     */
+    static isRecognized(payload) {
+        if (!isObject(payload)) {
+            return false;
+        }
+        const id = readString(payload, "id");
+        if (!id) {
+            return false;
+        }
+        const odataType = odataTypeOf(payload).toLowerCase();
+        if (odataType.endsWith("microsoft.graph.security.alert")) {
+            return true;
+        }
+        return Boolean(readString(payload, "createdDateTime") &&
+            (readString(payload, "title") ||
+                readString(payload, "severity") ||
+                readString(payload, "serviceSource") ||
+                readString(payload, "alertWebUrl")));
+    }
+    static normalize(payload) {
+        var _a;
+        const definition = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.MicrosoftDefenderXdr);
+        const severityName = normalizeOcsfSeverity(readString(payload, "severity")) ||
+            OcsfSeverity.Unknown;
+        const time = (_a = parseEventTime(readValue(payload, "firstActivityDateTime"))) !== null && _a !== void 0 ? _a : parseEventTime(readValue(payload, "createdDateTime"));
+        const evidence = summarizeEvidence(payload);
+        const principalHost = pickPrincipal(evidence.hosts);
+        const principalUser = pickPrincipal(evidence.users);
+        const principalIp = pickPrincipal(evidence.ips);
+        const principalProcess = pickPrincipal(evidence.processes);
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
+        const title = readString(payload, "title");
+        const status = readString(payload, "status").toLowerCase();
+        return {
+            time: time || new Date(),
+            eventUid: readString(payload, "id") || contentHashEventUid(payload),
+            categoryUid,
+            categoryName,
+            classUid: DETECTION_FINDING_CLASS_UID,
+            className: DETECTION_FINDING_CLASS_NAME,
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: STATUS_NAME_BY_GRAPH_STATUS[status] || "",
+            message: title ||
+                readString(payload, "description") ||
+                "Microsoft Defender XDR alert",
+            vendorName: (definition === null || definition === void 0 ? void 0 : definition.vendorName) || "Microsoft",
+            productName: (definition === null || definition === void 0 ? void 0 : definition.productName) || "Microsoft Defender XDR",
+            ruleId: readString(payload, "detectorId") ||
+                readString(payload, "alertPolicyId"),
+            ruleName: title,
+            mitreTactics: mapTactics(payload),
+            mitreTechniques: mapTechniques(payload),
+            principalUser,
+            principalHost,
+            principalIp,
+            principalProcess,
+            targetUser: pickTarget(evidence.users, principalUser),
+            targetHost: pickTarget(evidence.hosts, principalHost),
+            targetIp: pickTarget(evidence.ips, principalIp),
+            targetPort: 0,
+            targetResource: evidence.resources[0] || "",
+            observables: buildObservables(evidence.observables).slice(0, MAX_OBSERVABLES),
+            attributes: flattenPayload(payload),
+        };
+    }
+}
+//# sourceMappingURL=MicrosoftDefenderXdrNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/MicrosoftDefenderXdrNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrosoftDefenderXdrNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/MicrosoftDefenderXdrNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,wDAAwD,CAAC;AAChE,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,SAAS,GACV,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,oFAAoF;AACpF,MAAM,kBAAkB,GAAW,GAAG,CAAC;AACvC,MAAM,eAAe,GAAW,GAAG,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAA2B;IAChD,cAAc,EAAE,QAAQ;IACxB,mBAAmB,EAAE,QAAQ;IAC7B,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,QAAQ;IAC7B,cAAc,EAAE,QAAQ;IACxB,gBAAgB,EAAE,QAAQ;IAC1B,SAAS,EAAE,QAAQ;IACnB,eAAe,EAAE,QAAQ;IACzB,UAAU,EAAE,QAAQ;IACpB,iBAAiB,EAAE,QAAQ;IAC3B,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,2BAA2B,GAA2B;IAC1D,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,eAAe,GAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAC7E,MAAM,YAAY,GAAkB;IAClC,aAAa;IACb,UAAU;IACV,SAAS;IACT,OAAO;IACP,QAAQ;IACR,SAAS;CACV,CAAC;AAgBF,SAAS,QAAQ,CAAC,KAA4B;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,GAAG,GAAc,IAAI,CAAC,aAAa,CAAc,CAAC;IAExD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,MAAM,SAAS,GAAW,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAW,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEnD,OAAO,CACL,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC,WAAW,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB;IAClC,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE;QACjE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAA0B;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAW,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAE7D,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAW,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAW,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE7D,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;QAC9B,OAAO,GAAG,UAAU,KAAK,WAAW,EAAE,CAAC;IACzC,CAAC;IAED,OAAO,WAAW,IAAI,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC1B,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmB;IAC5C,MAAM,OAAO,GAAoB;QAC/B,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,GAAG,EAAE,EAAE;QACP,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,MAAM,QAAQ,GAAc,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,GAAgB,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAe,GAAiB,CAAC;QAC3C,MAAM,IAAI,GAAW,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAkB,UAAU,CAAC,IAAI,CAAC,CAAC;QAE9C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,IAAI,GACR,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAEpE,IAAI,IAAI,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBAED,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;gBAE7D,KAAK,MAAM,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;oBACvD,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/B,CAAC;gBAED,MAAM,QAAQ,GAAc,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;gBAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;wBAC5B,IAAI,QAAQ,CAAC,IAAiB,CAAC,EAAE,CAAC;4BAChC,MAAM,KAAK,GAAW,gBAAgB,CAAC,IAAkB,CAAC,CAAC;4BAC3D,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BAChC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;wBAC3C,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,MAAM;YACR,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAc,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC1D,MAAM,KAAK,GAAW,gBAAgB,CACpC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACnC,CAAC;gBAEF,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrC,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,KAAK,EACL,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,EACjE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAC5D,CAAC;gBACJ,CAAC;gBAED,MAAM;YACR,CAAC;YAED,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,EAAE,GAAW,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAEjD,IAAI,EAAE,EAAE,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;oBACvC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/B,CAAC;gBAED,MAAM;YACR,CAAC;YAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,SAAS,GAAc,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC1D,MAAM,KAAK,GAAsB,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxE,MAAM,WAAW,GAAW,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAW,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,KAAK,GAAW,WAAW,IAAI,SAAS,CAAC;gBAE/C,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBAED,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;gBAE/D,MAAM,MAAM,GAAc,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;gBACpE,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CACrD,CAAC;gBAEF,MAAM,OAAO,GAAc,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC1D,MAAM,IAAI,GAAW,gBAAgB,CACnC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACnC,CAAC;gBAEF,IAAI,IAAI,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC/C,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC;gBAED,MAAM;YACR,CAAC;YAED,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAc,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC1D,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CACvD,CAAC;gBACF,MAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,GAAG,GAAW,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC5C,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,iFAAiF;gBACjF,MAAM,OAAO,GAAW,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAc,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC1D,MAAM,IAAI,GACR,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpD,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1B,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBACjE,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;gBACD,IAAI,IAAI,EAAE,CAAC;oBACT,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,uBAAuB,CAAC,CAAC,CAAC;gBAC7B,MAAM,UAAU,GAAW,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC1D,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;gBACvE,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,wBAAwB,CAAC,CAAC,CAAC;gBAC9B,MAAM,UAAU,GAAW,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;gBAChE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;gBACvE,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,6BAA6B,CAAC,CAAC,CAAC;gBACnC,MAAM,YAAY,GAAW,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC9D,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvC,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;gBACzD,MAAM;YACR,CAAC;YAED,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC1D,MAAM;YACR,CAAC;YAED,KAAK,0BAA0B,CAAC;YAChC,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EACzB,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,EAC/B,UAAU,CAAC,IAAI,EAAE,sBAAsB,CAAC,CACzC,CAAC;gBACF,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR;;;mBAGG;gBACH,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,EAC7B,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EACvB,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,EACjC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,EAC5B,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAC/B,CAAC;gBACF,MAAM,OAAO,GAAc,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC1D,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CACrD,CAAC;gBACF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,MAAsB,EAAE,KAAoB;IAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE;QACjD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAA+B;;IACpD,MAAM,QAAQ,GAA+B,QAAQ,CAAC,IAAI,CACxD,CAAC,MAAsB,EAAW,EAAE;QAClC,OAAO,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1C,CAAC,CACF,CAAC;IAEF,OAAO,CAAA,MAAA,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,0CAAE,KAAK,KAAI,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CACjB,QAA+B,EAC/B,SAAiB;IAEjB,MAAM,QAAQ,GAA+B,QAAQ,CAAC,IAAI,CACxD,CAAC,MAAsB,EAAW,EAAE;QAClC,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,KAAK,GAAkB;QAC3B,GAAG,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;QACzC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC;KAChC,CAAC;IACF,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAW,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,EAAE,GAAuB,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEtD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAAmB;IACxC,MAAM,UAAU,GAAkB,EAAE,CAAC;IAErC,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACpE,MAAM,OAAO,GAAW,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,8BAA8B;IACjD;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,OAAmB;QAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,EAAE,GAAW,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE7C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAW,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAE7D,IAAI,SAAS,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CACZ,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC;YACpC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC3B,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC;gBAC/B,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC;gBACpC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CACxC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,UAAU,GACd,mCAAmC,CACjC,8BAA8B,CAAC,oBAAoB,CACpD,CAAC;QAEJ,MAAM,YAAY,GAChB,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtD,YAAY,CAAC,OAAO,CAAC;QAEvB,MAAM,IAAI,GACR,MAAA,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC,mCAC3D,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAoB,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE7D,MAAM,aAAa,GAAW,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAW,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,gBAAgB,GAAW,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAEnE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,KAAK,GAAW,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAW,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnE,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,4BAA4B;YACvC,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE;YACrD,OAAO,EACL,KAAK;gBACL,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC;gBAClC,8BAA8B;YAChC,UAAU,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,UAAU,KAAI,WAAW;YACjD,WAAW,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,WAAW,KAAI,wBAAwB;YAChE,MAAM,EACJ,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC;gBACjC,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC;YACtC,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC;YACjC,eAAe,EAAE,aAAa,CAAC,OAAO,CAAC;YACvC,aAAa;YACb,aAAa;YACb,WAAW;YACX,gBAAgB;YAChB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;YACrD,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;YACrD,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;YAC/C,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CACvD,CAAC,EACD,eAAe,CAChB;YACD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/Connectors/MicrosoftSentinelNormalizer.js

@@ -0,0 +1,212 @@
+import OcsfSeverity, { OcsfSeverityId, normalizeOcsfSeverity, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
+import SecurityEventConnectorProvider from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime, readString, readStringArray, readValue, } from "../NormalizerHelpers";
+/*
+ * Microsoft Sentinel incident (Azure Resource Manager
+ * Microsoft.SecurityInsights/incidents resource) -> OCSF Incident Finding
+ * (class 2005).
+ *
+ * The payload shape is the `Incident` object of the Sentinel REST API:
+ * https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list
+ * (api-version 2024-03-01). Everything the connector needs is under
+ * `properties`: title, severity (High/Medium/Low/Informational), status
+ * (New/Active/Closed), createdTimeUtc, owner and additionalData.tactics.
+ *
+ * Pure and isomorphic on purpose — this file imports only from
+ * Common/Types and Common/Utils so it runs unchanged in the server, in
+ * tests and in the browser if the dashboard ever previews raw incidents.
+ */
+export const MICROSOFT_SENTINEL_INCIDENT_CLASS_UID = 2005;
+export const MICROSOFT_SENTINEL_INCIDENT_CLASS_NAME = "Incident Finding";
+export const MICROSOFT_SENTINEL_INCIDENT_RESOURCE_TYPE = "Microsoft.SecurityInsights/incidents";
+/*
+ * Sentinel reports tactics by their ATT&CK name (the `AttackTactic` enum
+ * on the incidents API), while NormalizedSecurityEvent.mitreTactics
+ * stores ATT&CK ids ("TA0003") so rows from every source join on the same
+ * key. Enterprise ATT&CK ids for the fourteen enterprise tactics; the two
+ * ICS tactics carry their ICS ids; PreAttack has no id in the current
+ * matrix and keeps its name, which is still searchable.
+ */
+export const MICROSOFT_SENTINEL_TACTIC_IDS = {
+    reconnaissance: "TA0043",
+    resourcedevelopment: "TA0042",
+    initialaccess: "TA0001",
+    execution: "TA0002",
+    persistence: "TA0003",
+    privilegeescalation: "TA0004",
+    defenseevasion: "TA0005",
+    credentialaccess: "TA0006",
+    discovery: "TA0007",
+    lateralmovement: "TA0008",
+    collection: "TA0009",
+    exfiltration: "TA0010",
+    commandandcontrol: "TA0011",
+    impact: "TA0040",
+    impairprocesscontrol: "TA0106",
+    inhibitresponsefunction: "TA0107",
+};
+function definition() {
+    const found = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.MicrosoftSentinel);
+    if (!found) {
+        /*
+         * The catalog is a static list that always carries this provider; the
+         * throw only exists so a future catalog edit cannot silently attribute
+         * events to an empty vendor and break the dedupe scope.
+         */
+        throw new Error("Microsoft Sentinel is missing from SecurityEventConnectorCatalog.");
+    }
+    return found;
+}
+/*
+ * Analytic rule ids arrive as full ARM resource ids
+ * (".../alertRules/{guid}"). The trailing segment is the rule's own id and
+ * is what a person recognizes from the Sentinel UI.
+ */
+function lastPathSegment(value) {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    const index = trimmed.lastIndexOf("/");
+    return index === -1 ? trimmed : trimmed.substring(index + 1);
+}
+function mapTactic(name) {
+    const key = name.replace(/[^A-Za-z]/g, "").toLowerCase();
+    return MICROSOFT_SENTINEL_TACTIC_IDS[key] || name.trim();
+}
+function uniqueNonEmpty(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        const trimmed = value.trim();
+        if (!trimmed || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        result.push(trimmed);
+    }
+    return result;
+}
+export default class MicrosoftSentinelNormalizer {
+    /*
+     * A record is a Sentinel incident when it says so (`type`) or when it has
+     * the incident property bag: a `properties` object carrying the
+     * creation time and a title or incident number. Anything else — an ARM
+     * error envelope that slipped into a page, a bare string — is rejected
+     * rather than turned into a meaningless row.
+     */
+    static isRecognized(raw) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+            return false;
+        }
+        const type = readString(raw, "type");
+        if (type.toLowerCase() ===
+            MICROSOFT_SENTINEL_INCIDENT_RESOURCE_TYPE.toLowerCase()) {
+            return true;
+        }
+        const properties = readValue(raw, "properties");
+        if (!properties ||
+            typeof properties !== "object" ||
+            Array.isArray(properties)) {
+            return false;
+        }
+        const hasCreatedTime = Boolean(readString(raw, "properties.createdTimeUtc"));
+        const hasIdentity = Boolean(readString(raw, "properties.title") ||
+            readString(raw, "properties.incidentNumber"));
+        return hasCreatedTime && hasIdentity;
+    }
+    static normalize(raw) {
+        const catalog = definition();
+        const title = readString(raw, "properties.title");
+        const description = readString(raw, "properties.description");
+        const incidentNumber = readString(raw, "properties.incidentNumber");
+        /*
+         * Creation time is the poll basis, so it is also the row's time: the
+         * incident's own activity window (firstActivityTimeUtc) can be hours
+         * or days earlier and is kept in attributes for anyone who needs it.
+         */
+        const time = parseEventTime(readValue(raw, "properties.createdTimeUtc")) ||
+            parseEventTime(readValue(raw, "properties.lastModifiedTimeUtc"));
+        /*
+         * `name` is the incident GUID and is stable across every list call, so
+         * it is the dedupe key. The ARM `id` ends in the same GUID and is the
+         * fallback; a payload with neither gets a content hash.
+         */
+        const eventUid = readString(raw, "name") ||
+            lastPathSegment(readString(raw, "id")) ||
+            contentHashEventUid(raw);
+        const severityName = normalizeOcsfSeverity(readString(raw, "properties.severity")) ||
+            OcsfSeverity.Unknown;
+        const { categoryUid, categoryName } = ocsfCategoryForClassUid(MICROSOFT_SENTINEL_INCIDENT_CLASS_UID);
+        const relatedRuleIds = readStringArray(raw, "properties.relatedAnalyticRuleIds");
+        const tactics = uniqueNonEmpty(readStringArray(raw, "properties.additionalData.tactics").map((tactic) => {
+            return mapTactic(tactic);
+        }));
+        /*
+         * IncidentAdditionalData documents only `tactics` for api-version
+         * 2024-03-01 (and the 2025-09-01 reference lists no `techniques`
+         * either). The key is still read defensively: it costs nothing, and an
+         * api-version that adds ATT&CK technique ids would then flow through
+         * instead of being flattened to tactics alone. Absent, it stays empty.
+         */
+        const techniques = uniqueNonEmpty(readStringArray(raw, "properties.additionalData.techniques"));
+        const ownerUpn = readString(raw, "properties.owner.userPrincipalName");
+        const ownerEmail = readString(raw, "properties.owner.email");
+        const ownerObjectId = readString(raw, "properties.owner.objectId");
+        const labelNames = [];
+        const labels = readValue(raw, "properties.labels");
+        if (Array.isArray(labels)) {
+            for (const label of labels) {
+                if (label && typeof label === "object" && !Array.isArray(label)) {
+                    const labelName = readString(label, "labelName");
+                    if (labelName) {
+                        labelNames.push(labelName);
+                    }
+                }
+                else if (typeof label === "string") {
+                    labelNames.push(label);
+                }
+            }
+        }
+        const message = title ||
+            description ||
+            (incidentNumber
+                ? `Microsoft Sentinel incident ${incidentNumber}`
+                : "Microsoft Sentinel incident");
+        return {
+            time: time || new Date(),
+            eventUid,
+            categoryUid,
+            categoryName,
+            classUid: MICROSOFT_SENTINEL_INCIDENT_CLASS_UID,
+            className: MICROSOFT_SENTINEL_INCIDENT_CLASS_NAME,
+            activityName: "Create",
+            severityId: OcsfSeverityId[severityName],
+            severityName,
+            statusName: readString(raw, "properties.status"),
+            message,
+            vendorName: catalog.vendorName,
+            productName: catalog.productName,
+            ruleId: relatedRuleIds[0] ? lastPathSegment(relatedRuleIds[0]) : "",
+            ruleName: title,
+            mitreTactics: tactics,
+            mitreTechniques: techniques,
+            principalUser: ownerUpn || ownerEmail,
+            principalHost: "",
+            principalIp: "",
+            principalProcess: "",
+            targetUser: "",
+            targetHost: "",
+            targetIp: "",
+            targetPort: 0,
+            targetResource: readString(raw, "properties.incidentUrl"),
+            observables: buildObservables([
+                ownerUpn,
+                ownerEmail,
+                ownerObjectId,
+                ...labelNames,
+            ]),
+            attributes: flattenPayload(raw),
+        };
+    }
+}
+//# sourceMappingURL=MicrosoftSentinelNormalizer.js.map

package/build/dist/Utils/SecurityEvent/Connectors/MicrosoftSentinelNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrosoftSentinelNormalizer.js","sourceRoot":"","sources":["../../../../../Utils/SecurityEvent/Connectors/MicrosoftSentinelNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,8BAA8B,MAAM,wEAAwE,CAAC;AACpH,OAAO,EAEL,mCAAmC,GACpC,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,SAAS,GACV,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,qCAAqC,GAAW,IAAI,CAAC;AAClE,MAAM,CAAC,MAAM,sCAAsC,GACjD,kBAAkB,CAAC;AACrB,MAAM,CAAC,MAAM,yCAAyC,GACpD,sCAAsC,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA2B;IACnE,cAAc,EAAE,QAAQ;IACxB,mBAAmB,EAAE,QAAQ;IAC7B,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,QAAQ;IAC7B,cAAc,EAAE,QAAQ;IACxB,gBAAgB,EAAE,QAAQ;IAC1B,SAAS,EAAE,QAAQ;IACnB,eAAe,EAAE,QAAQ;IACzB,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,QAAQ;IAC3B,MAAM,EAAE,QAAQ;IAChB,oBAAoB,EAAE,QAAQ;IAC9B,uBAAuB,EAAE,QAAQ;CAClC,CAAC;AAEF,SAAS,UAAU;IACjB,MAAM,KAAK,GACT,mCAAmC,CACjC,8BAA8B,CAAC,iBAAiB,CACjD,CAAC;IAEJ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX;;;;WAIG;QACH,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAW,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAE/C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAW,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,OAAO,6BAA6B,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAAqB;IAC3C,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,2BAA2B;IAC9C;;;;;;OAMG;IACI,MAAM,CAAC,YAAY,CAAC,GAAe;QACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAW,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE7C,IACE,IAAI,CAAC,WAAW,EAAE;YAClB,yCAAyC,CAAC,WAAW,EAAE,EACvD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAc,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAE3D,IACE,CAAC,UAAU;YACX,OAAO,UAAU,KAAK,QAAQ;YAC9B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAY,OAAO,CACrC,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAC7C,CAAC;QACF,MAAM,WAAW,GAAY,OAAO,CAClC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC;YACjC,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAC/C,CAAC;QAEF,OAAO,cAAc,IAAI,WAAW,CAAC;IACvC,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,GAAe;QACrC,MAAM,OAAO,GAAqC,UAAU,EAAE,CAAC;QAE/D,MAAM,KAAK,GAAW,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAW,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,cAAc,GAAW,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;QAE5E;;;;WAIG;QACH,MAAM,IAAI,GACR,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAC3D,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,CAAC;QAEnE;;;;WAIG;QACH,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;YACvB,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAE3B,MAAM,YAAY,GAChB,qBAAqB,CAAC,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC7D,YAAY,CAAC,OAAO,CAAC;QAEvB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,qCAAqC,CACtC,CAAC;QAEF,MAAM,cAAc,GAAkB,eAAe,CACnD,GAAG,EACH,mCAAmC,CACpC,CAAC;QAEF,MAAM,OAAO,GAAkB,cAAc,CAC3C,eAAe,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAC3D,CAAC,MAAc,EAAU,EAAE;YACzB,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC,CACF,CACF,CAAC;QAEF;;;;;;WAMG;QACH,MAAM,UAAU,GAAkB,cAAc,CAC9C,eAAe,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAC7D,CAAC;QAEF,MAAM,QAAQ,GAAW,UAAU,CACjC,GAAG,EACH,oCAAoC,CACrC,CAAC;QACF,MAAM,UAAU,GAAW,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACrE,MAAM,aAAa,GAAW,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAkB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAc,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAE9D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,KAAK,IAAI,MAA0B,EAAE,CAAC;gBAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChE,MAAM,SAAS,GAAW,UAAU,CAClC,KAAmB,EACnB,WAAW,CACZ,CAAC;oBAEF,IAAI,SAAS,EAAE,CAAC;wBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GACX,KAAK;YACL,WAAW;YACX,CAAC,cAAc;gBACb,CAAC,CAAC,+BAA+B,cAAc,EAAE;gBACjD,CAAC,CAAC,6BAA6B,CAAC,CAAC;QAErC,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,qCAAqC;YAC/C,SAAS,EAAE,sCAAsC;YACjD,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC;YAChD,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YACnE,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,OAAO;YACrB,eAAe,EAAE,UAAU;YAC3B,aAAa,EAAE,QAAQ,IAAI,UAAU;YACrC,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,gBAAgB,EAAE,EAAE;YACpB,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC;YACzD,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,QAAQ;gBACR,UAAU;gBACV,aAAa;gBACb,GAAG,UAAU;aACd,CAAC;YACF,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC;SAChC,CAAC;IACJ,CAAC;CACF"}