@oneuptime/common 13.0.7 → 14.0.0

package/build/dist/Server/Utils/Realtime.js

@@ -21,6 +21,19 @@ import EventName from "../../Types/Realtime/EventName";
 import CookieUtil from "./Cookie";
 import UserPermissionUtil from "./UserPermission/UserPermission";
 import CaptureSpan from "./Telemetry/CaptureSpan";
+// What became of one ListenToModelEvent request.
+export var ListenToModelEventOutcome;
+(function (ListenToModelEventOutcome) {
+    ListenToModelEventOutcome["Joined"] = "Joined";
+    // No access token, or one that no longer decodes. The client was told.
+    ListenToModelEventOutcome["AuthenticationRequired"] = "AuthenticationRequired";
+    // A valid session without access to this tenant or model.
+    ListenToModelEventOutcome["NotAuthorized"] = "NotAuthorized";
+    // The request itself was malformed.
+    ListenToModelEventOutcome["InvalidRequest"] = "InvalidRequest";
+    // Something failed while authorizing (for example the permission cache).
+    ListenToModelEventOutcome["Failed"] = "Failed";
+})(ListenToModelEventOutcome || (ListenToModelEventOutcome = {}));
 class Realtime {
     static isInitialized() {
         logger.debug("Checking if socket server is initialized");
@@ -35,40 +48,96 @@ class Realtime {
             logger.debug("Realtime socket server initialized");
             this.socketServer.on("connection", (socket) => {
                 logger.debug("New socket connection established");
-                socket.on(EventName.ListenToModalEvent, async (data) => {
-                    var _a;
-                    logger.debug("Received ListenToModalEvent with data:");
-                    logger.debug(data);
-                    const socketLogAttributes = {
-                        projectId: (_a = data["tenantId"]) === null || _a === void 0 ? void 0 : _a.toString(),
-                    };
-                    if (typeof data["eventType"] !== "string") {
-                        logger.error("eventType is not a string", socketLogAttributes);
-                        throw new BadDataException("eventType is not a string");
-                    }
-                    if (typeof data["modelType"] !== "string") {
-                        logger.error("modelType is not a string", socketLogAttributes);
-                        throw new BadDataException("modelType is not a string");
-                    }
-                    if (typeof data["modelName"] !== "string") {
-                        logger.error("modelName is not a string", socketLogAttributes);
-                        throw new BadDataException("modelName is not a string");
-                    }
-                    if (typeof data["tenantId"] !== "string") {
-                        logger.error("tenantId is not a string", socketLogAttributes);
-                        throw new BadDataException("tenantId is not a string");
-                    }
-                    await Realtime.listenToModelEvent(socket, {
-                        eventType: data["eventType"],
-                        modelType: data["modelType"],
-                        modelName: data["modelName"],
-                        tenantId: data["tenantId"],
+                /*
+                 * socket.io calls a listener and throws away what it returns. An async
+                 * listener that throws is therefore an unhandled rejection: nothing
+                 * goes back to the client, and the subscription it asked for simply
+                 * never happens. handleListenToModelEventRequest settles every outcome
+                 * itself; the catch is a backstop, not the error handling.
+                 */
+                socket.on(EventName.ListenToModalEvent, (data) => {
+                    Realtime.handleListenToModelEventRequest(socket, data).catch((err) => {
+                        logger.error(err);
                     });
                 });
             });
         }
         return this.socketServer;
     }
+    /*
+     * One ListenToModelEvent from a client, start to finish. Never throws: a
+     * malformed request, a missing or expired access token, a refused
+     * subscription and a failing permission lookup each end here as an outcome,
+     * so none of them can become an unhandled rejection in the socket listener.
+     */
+    static async handleListenToModelEventRequest(socket, data) {
+        logger.debug("Received ListenToModalEvent with data:");
+        logger.debug(data);
+        let request;
+        try {
+            request = Realtime.parseListenToModelEventRequest(data);
+        }
+        catch (err) {
+            logger.error(err);
+            return ListenToModelEventOutcome.InvalidRequest;
+        }
+        try {
+            return await Realtime.listenToModelEvent(socket, request);
+        }
+        catch (err) {
+            // A permission-cache (Redis) failure, say. The room is not joined.
+            const failureLogAttributes = {
+                projectId: request.tenantId,
+            };
+            logger.error(err, failureLogAttributes);
+            return ListenToModelEventOutcome.Failed;
+        }
+    }
+    static parseListenToModelEventRequest(data) {
+        var _a;
+        if (!data || typeof data !== "object") {
+            logger.error("ListenToModelEvent data is not an object");
+            throw new BadDataException("ListenToModelEvent data is not an object");
+        }
+        const socketLogAttributes = {
+            projectId: (_a = data["tenantId"]) === null || _a === void 0 ? void 0 : _a.toString(),
+        };
+        if (typeof data["eventType"] !== "string") {
+            logger.error("eventType is not a string", socketLogAttributes);
+            throw new BadDataException("eventType is not a string");
+        }
+        if (typeof data["modelType"] !== "string") {
+            logger.error("modelType is not a string", socketLogAttributes);
+            throw new BadDataException("modelType is not a string");
+        }
+        if (typeof data["modelName"] !== "string") {
+            logger.error("modelName is not a string", socketLogAttributes);
+            throw new BadDataException("modelName is not a string");
+        }
+        if (typeof data["tenantId"] !== "string") {
+            logger.error("tenantId is not a string", socketLogAttributes);
+            throw new BadDataException("tenantId is not a string");
+        }
+        return {
+            eventType: data["eventType"],
+            modelType: data["modelType"],
+            modelName: data["modelName"],
+            tenantId: data["tenantId"],
+        };
+    }
+    /*
+     * The socket has no usable user session: tell the client, which refreshes
+     * its session and reconnects so the new handshake carries the new cookie.
+     * Dropping the request silently is what used to happen, and it left every
+     * subscription made after the access token expired dead (no live counters
+     * after switching project, no live logs) with nothing in the browser to
+     * show why.
+     */
+    static rejectForMissingAuthentication(socket, data, reason, listenLogAttributes) {
+        logger.debug(`${reason}, aborting joining room and asking the client to re-authenticate`, listenLogAttributes);
+        socket.emit(EventName.AuthenticationRequired, data);
+        return ListenToModelEventOutcome.AuthenticationRequired;
+    }
     static async listenToModelEvent(socket, data) {
         var _a;
         const listenLogAttributes = {
@@ -87,18 +156,27 @@ class Realtime {
         logger.debug("Extracting user access token from socket", listenLogAttributes);
         const userAccessToken = this.getAccessTokenFromSocket(socket);
         if (!userAccessToken) {
-            logger.debug("User access token not found in socket, aborting joining room", listenLogAttributes);
-            return;
+            return this.rejectForMissingAuthentication(socket, data, "User access token not found in socket", listenLogAttributes);
         }
         logger.debug("Decoding user access token", listenLogAttributes);
-        const userAuthorizationData = JSONWebToken.decode(userAccessToken);
+        /*
+         * The token is the one the browser sent with the handshake, and it is not
+         * re-read for the life of the connection. Once it expires every decode
+         * throws, which is the normal state of a dashboard tab left open past the
+         * access token's lifetime, not an error in the request.
+         */
+        let userAuthorizationData;
+        try {
+            userAuthorizationData = JSONWebToken.decode(userAccessToken);
+        }
+        catch (_b) {
+            return this.rejectForMissingAuthentication(socket, data, "User access token in socket is invalid or expired", listenLogAttributes);
+        }
         if (!userAuthorizationData) {
-            logger.debug("User authorization data not found in socket, aborting joining room", listenLogAttributes);
-            return;
+            return this.rejectForMissingAuthentication(socket, data, "User authorization data not found in socket", listenLogAttributes);
         }
         if (!userAuthorizationData.userId) {
-            logger.debug("User ID not found in socket, aborting joining room", listenLogAttributes);
-            return;
+            return this.rejectForMissingAuthentication(socket, data, "User ID not found in socket", listenLogAttributes);
         }
         logger.debug("Checking user access permissions", listenLogAttributes);
         let hasAccess = false;
@@ -116,7 +194,7 @@ class Realtime {
             });
             if (!hasAccessToProjectId) {
                 logger.debug("User does not have access to this tenant, aborting joining room", listenLogAttributes);
-                return;
+                return ListenToModelEventOutcome.NotAuthorized;
             }
             logger.debug("User has access to the tenant, checking model access", listenLogAttributes);
             const userId = new ObjectID(userAuthorizationData.userId.toString());
@@ -130,9 +208,13 @@ class Realtime {
                 hasAccess = true;
             }
         }
+        /*
+         * Authenticated but not allowed. The room is not joined and, as before,
+         * nothing is sent back: a fresh session would not change the answer.
+         */
         if (!hasAccess) {
             logger.debug("User does not have access to this tenant, aborting joining room", listenLogAttributes);
-            return;
+            return ListenToModelEventOutcome.NotAuthorized;
         }
         if (data.modelId) {
             const modelRoomId = RealtimeUtil.getRoomId(data.tenantId, data.modelName, ModelEventType.Create, data.modelId);
@@ -146,6 +228,7 @@ class Realtime {
             // join the room.
             await socket.join(roomId);
         }
+        return ListenToModelEventOutcome.Joined;
     }
     static async stopListeningToModelEvent(socket, data) {
         var _a;
@@ -229,6 +312,12 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], Realtime, "init", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], Realtime, "handleListenToModelEventRequest", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Utils/Realtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"Realtime.js","sourceRoot":"","sources":["../../../../Server/Utils/Realtime.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAA4B,MAAM,4BAA4B,CAAC;AACtE,OAAO,MAAyB,MAAM,UAAU,CAAC;AAIjD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,YAAY,MAAM,sBAAsB,CAAC;AAEhD,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAK1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACvG,OAAO,eAAe,MAAM,0CAA0C,CAAC;AACvE,OAAO,cAAc,MAAM,qCAAqC,CAAC;AAEjE,OAAO,SAAS,MAAM,gCAAgC,CAAC;AACvD,OAAO,UAAU,MAAM,UAAU,CAAC;AAElC,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,MAA8B,QAAQ;IAItB,AAAP,MAAM,CAAC,aAAa;QACzB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,MAAM,aAAa,GAAY,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,aAAa,CAAC;IACvB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,IAAI;QACtB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAEnD,IAAI,CAAC,YAAa,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;gBACrD,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAElD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;;oBACjE,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;oBACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEnB,MAAM,mBAAmB,GAAkB;wBACzC,SAAS,EAAE,MAAA,IAAI,CAAC,UAAU,CAAC,0CAAE,QAAQ,EAAE;qBACxC,CAAC;oBAEF,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1C,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;wBAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;oBAC1D,CAAC;oBACD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1C,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;wBAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;oBAC1D,CAAC;oBACD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1C,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;wBAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;oBAC1D,CAAC;oBACD,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACzC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;wBAC9D,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;oBACzD,CAAC;oBAED,MAAM,QAAQ,CAAC,kBAAkB,CAAC,MAAM,EAAE;wBACxC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAmB;wBAC9C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAiB;wBAC5C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAW;wBACtC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAW;qBACrC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,kBAAkB,CACpC,MAAc,EACd,IAA4B;;QAE5B,MAAM,mBAAmB,GAAkB;YACzC,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,0CAAE,QAAQ,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,mBAAmB,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAExC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,mBAAmB,CACpB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED;;;WAGG;QAEH,MAAM,CAAC,KAAK,CACV,0CAA0C,EAC1C,mBAAmB,CACpB,CAAC;QACF,MAAM,eAAe,GACnB,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CACV,8DAA8D,EAC9D,mBAAmB,CACpB,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,mBAAmB,CAAC,CAAC;QAChE,MAAM,qBAAqB,GACzB,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEvC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CACV,oEAAoE,EACpE,mBAAmB,CACpB,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CACV,oDAAoD,EACpD,mBAAmB,CACpB,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,mBAAmB,CAAC,CAAC;QACtE,IAAI,SAAS,GAAY,KAAK,CAAC;QAE/B,IAAI,qBAAqB,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CACV,yCAAyC,EACzC,mBAAmB,CACpB,CAAC;YACF,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,KAAK,CACV,yCAAyC,EACzC,mBAAmB,CACpB,CAAC;QACF,MAAM,0BAA0B,GAC9B,MAAM,kBAAkB,CAAC,sCAAsC,CAC7D,qBAAqB,CAAC,MAAM,CAC7B,CAAC;QAEJ,8CAA8C;QAC9C,IAAI,0BAA0B,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,CAAC,KAAK,CACV,2CAA2C,EAC3C,mBAAmB,CACpB,CAAC;YACF,MAAM,oBAAoB,GACxB,0BAA0B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAmB,EAAE,EAAE;gBACjE,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEL,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,MAAM,CAAC,KAAK,CACV,iEAAiE,EACjE,mBAAmB,CACpB,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,CAAC,KAAK,CACV,sDAAsD,EACtD,mBAAmB,CACpB,CAAC;YACF,MAAM,MAAM,GAAa,IAAI,QAAQ,CACnC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,CACxC,CAAC;YACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEnE,0EAA0E;YAC1E,MAAM,0BAA0B,GAC9B,MAAM,kBAAkB,CAAC,sCAAsC,CAC7D,MAAM,EACN,SAAS,CACV,CAAC;YAEJ,6CAA6C;YAC7C,IACE,0BAA0B;gBAC1B,IAAI,CAAC,yBAAyB,CAC5B,0BAA0B,EAC1B,IAAI,CAAC,SAAS,CACf,EACD,CAAC;gBACD,MAAM,CAAC,KAAK,CACV,+CAA+C,EAC/C,mBAAmB,CACpB,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,iEAAiE,EACjE,mBAAmB,CACpB,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,WAAW,GAAW,YAAY,CAAC,SAAS,CAChD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,cAAc,CAAC,MAAM,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,yBAAyB,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAC1E,iBAAiB;YACjB,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAW,YAAY,CAAC,SAAS,CAC3C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACrE,iBAAiB;YACjB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,MAAc,EACd,IAA4B;;QAE5B,MAAM,iBAAiB,GAAkB;YACvC,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,0CAAE,QAAQ,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,8CAA8C,EAC9C,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAEtC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,iBAAiB,CAClB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,MAAM,GAAW,YAAY,CAAC,SAAS,CAC3C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACnE,mBAAmB;QACnB,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAKlC;;QACC,MAAM,iBAAiB,GAAkB;YACvC,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,0CAAE,QAAQ,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAE7D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,iBAAiB,CAClB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,UAAU,GAAe;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;SACjC,CAAC;QAEF,MAAM,KAAK,GAAmC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAEnE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,gDAAgD,EAChD,iBAAiB,CAClB,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAW,YAAY,CAAC,SAAS,CAC3C,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,SAAU,EAChB,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,WAAW,GAAW,YAAY,CAAC,SAAS,CAChD,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,SAAU,EAChB,cAAc,CAAC,MAAM,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,YAAa,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,YAAa,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IAGa,AAAP,MAAM,CAAC,yBAAyB,CACrC,sBAAsE,EACtE,SAAiB;QAEjB,IAAI,gBAAgB,GAAsB,EAAE,CAAC;QAE7C,IAAI,SAAS,GAGF,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,oCAAoC;YACpC,SAAS,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,gBAAgB,GAAG,IAAI,SAAS,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAExD,OAAO,eAAe,CAAC,cAAc,CACnC,sBAAsB,EACtB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAGa,AAAP,MAAM,CAAC,wBAAwB,CAAC,MAAc;QACnD,IAAI,WAAW,GAAuB,SAAS,CAAC;QAEhD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAuB,UAAU,CAAC,0BAA0B,CACvE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAChC,CAAC;YAEF,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;gBAC1C,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;;AAzWc,qBAAY,GAAwB,IAAI,CAAC;eAD5B,QAAQ;AAItB;IADb,WAAW,EAAE;;;;mCAMb;AAGmB;IADnB,WAAW,EAAE;;;;0BA8Cb;AAGmB;IADnB,WAAW,EAAE;;;;wCAiKb;AAGmB;IADnB,WAAW,EAAE;;;;+CAiCb;AAGmB;IADnB,WAAW,EAAE;;;;oCA2Db;AAGa;IADb,WAAW,EAAE;;;;+CA2Bb;AAGa;IADb,WAAW,EAAE;;;;8CAeb"}
+{"version":3,"file":"Realtime.js","sourceRoot":"","sources":["../../../../Server/Utils/Realtime.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAA4B,MAAM,4BAA4B,CAAC;AACtE,OAAO,MAAyB,MAAM,UAAU,CAAC;AAIjD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,YAAY,MAAM,sBAAsB,CAAC;AAEhD,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAK1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACvG,OAAO,eAAe,MAAM,0CAA0C,CAAC;AACvE,OAAO,cAAc,MAAM,qCAAqC,CAAC;AAEjE,OAAO,SAAS,MAAM,gCAAgC,CAAC;AACvD,OAAO,UAAU,MAAM,UAAU,CAAC;AAElC,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,iDAAiD;AACjD,MAAM,CAAN,IAAY,yBAUX;AAVD,WAAY,yBAAyB;IACnC,8CAAiB,CAAA;IACjB,uEAAuE;IACvE,8EAAiD,CAAA;IACjD,0DAA0D;IAC1D,4DAA+B,CAAA;IAC/B,oCAAoC;IACpC,8DAAiC,CAAA;IACjC,yEAAyE;IACzE,8CAAiB,CAAA;AACnB,CAAC,EAVW,yBAAyB,KAAzB,yBAAyB,QAUpC;AAED,MAA8B,QAAQ;IAItB,AAAP,MAAM,CAAC,aAAa;QACzB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,MAAM,aAAa,GAAY,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,aAAa,CAAC;IACvB,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,IAAI;QACtB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC3C,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAEnD,IAAI,CAAC,YAAa,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;gBACrD,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAElD;;;;;;mBAMG;gBACH,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC,IAAgB,EAAQ,EAAE;oBACjE,QAAQ,CAAC,+BAA+B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAC1D,CAAC,GAAY,EAAE,EAAE;wBACf,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACpB,CAAC,CACF,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,+BAA+B,CACjD,MAAc,EACd,IAAgB;QAEhB,MAAM,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,OAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,yBAAyB,CAAC,cAAc,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,MAAM,oBAAoB,GAAkB;gBAC1C,SAAS,EAAE,OAAO,CAAC,QAAQ;aAC5B,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YACxC,OAAO,yBAAyB,CAAC,MAAM,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,8BAA8B,CAC3C,IAAgB;;QAEhB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACzD,MAAM,IAAI,gBAAgB,CAAC,0CAA0C,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,mBAAmB,GAAkB;YACzC,SAAS,EAAE,MAAA,IAAI,CAAC,UAAU,CAAC,0CAAE,QAAQ,EAAE;SACxC,CAAC;QAEF,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;YAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;YAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;YAC/D,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,CAAC;YAC9D,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;QACzD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,WAAW,CAAmB;YAC9C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAiB;YAC5C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAW;YACtC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAW;SACrC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,8BAA8B,CAC3C,MAAc,EACd,IAA4B,EAC5B,MAAc,EACd,mBAAkC;QAElC,MAAM,CAAC,KAAK,CACV,GAAG,MAAM,kEAAkE,EAC3E,mBAAmB,CACpB,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAEpD,OAAO,yBAAyB,CAAC,sBAAsB,CAAC;IAC1D,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,kBAAkB,CACpC,MAAc,EACd,IAA4B;;QAE5B,MAAM,mBAAmB,GAAkB;YACzC,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,0CAAE,QAAQ,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,mBAAmB,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAExC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,mBAAmB,CACpB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED;;;WAGG;QAEH,MAAM,CAAC,KAAK,CACV,0CAA0C,EAC1C,mBAAmB,CACpB,CAAC;QACF,MAAM,eAAe,GACnB,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,8BAA8B,CACxC,MAAM,EACN,IAAI,EACJ,uCAAuC,EACvC,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,mBAAmB,CAAC,CAAC;QAEhE;;;;;WAKG;QACH,IAAI,qBAAuC,CAAC;QAE5C,IAAI,CAAC;YACH,qBAAqB,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC,8BAA8B,CACxC,MAAM,EACN,IAAI,EACJ,mDAAmD,EACnD,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,8BAA8B,CACxC,MAAM,EACN,IAAI,EACJ,6CAA6C,EAC7C,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,8BAA8B,CACxC,MAAM,EACN,IAAI,EACJ,6BAA6B,EAC7B,mBAAmB,CACpB,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,mBAAmB,CAAC,CAAC;QACtE,IAAI,SAAS,GAAY,KAAK,CAAC;QAE/B,IAAI,qBAAqB,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CACV,yCAAyC,EACzC,mBAAmB,CACpB,CAAC;YACF,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,KAAK,CACV,yCAAyC,EACzC,mBAAmB,CACpB,CAAC;QACF,MAAM,0BAA0B,GAC9B,MAAM,kBAAkB,CAAC,sCAAsC,CAC7D,qBAAqB,CAAC,MAAM,CAC7B,CAAC;QAEJ,8CAA8C;QAC9C,IAAI,0BAA0B,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,CAAC,KAAK,CACV,2CAA2C,EAC3C,mBAAmB,CACpB,CAAC;YACF,MAAM,oBAAoB,GACxB,0BAA0B,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAmB,EAAE,EAAE;gBACjE,OAAO,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEL,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,MAAM,CAAC,KAAK,CACV,iEAAiE,EACjE,mBAAmB,CACpB,CAAC;gBACF,OAAO,yBAAyB,CAAC,aAAa,CAAC;YACjD,CAAC;YAED,MAAM,CAAC,KAAK,CACV,sDAAsD,EACtD,mBAAmB,CACpB,CAAC;YACF,MAAM,MAAM,GAAa,IAAI,QAAQ,CACnC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,CACxC,CAAC;YACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEnE,0EAA0E;YAC1E,MAAM,0BAA0B,GAC9B,MAAM,kBAAkB,CAAC,sCAAsC,CAC7D,MAAM,EACN,SAAS,CACV,CAAC;YAEJ,6CAA6C;YAC7C,IACE,0BAA0B;gBAC1B,IAAI,CAAC,yBAAyB,CAC5B,0BAA0B,EAC1B,IAAI,CAAC,SAAS,CACf,EACD,CAAC;gBACD,MAAM,CAAC,KAAK,CACV,+CAA+C,EAC/C,mBAAmB,CACpB,CAAC;gBACF,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,iEAAiE,EACjE,mBAAmB,CACpB,CAAC;YACF,OAAO,yBAAyB,CAAC,aAAa,CAAC;QACjD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,WAAW,GAAW,YAAY,CAAC,SAAS,CAChD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,cAAc,CAAC,MAAM,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,yBAAyB,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAC1E,iBAAiB;YACjB,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAW,YAAY,CAAC,SAAS,CAC3C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;YAEF,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACrE,iBAAiB;YACjB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,yBAAyB,CAAC,MAAM,CAAC;IAC1C,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,MAAc,EACd,IAA4B;;QAE5B,MAAM,iBAAiB,GAAkB;YACvC,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,0CAAE,QAAQ,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,8CAA8C,EAC9C,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAEtC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,iBAAiB,CAClB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,MAAM,GAAW,YAAY,CAAC,SAAS,CAC3C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACnE,mBAAmB;QACnB,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAKlC;;QACC,MAAM,iBAAiB,GAAkB;YACvC,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,0CAAE,QAAQ,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAE7D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CACV,iDAAiD,EACjD,iBAAiB,CAClB,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,UAAU,GAAe;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;SACjC,CAAC;QAEF,MAAM,KAAK,GAAmC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAEnE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,gDAAgD,EAChD,iBAAiB,CAClB,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAW,YAAY,CAAC,SAAS,CAC3C,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,SAAU,EAChB,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,WAAW,GAAW,YAAY,CAAC,SAAS,CAChD,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,SAAU,EAChB,cAAc,CAAC,MAAM,EACrB,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,MAAM,CAAC,KAAK,CACV,mCAAmC,MAAM,EAAE,EAC3C,iBAAiB,CAClB,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,YAAa,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,YAAa,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IAGa,AAAP,MAAM,CAAC,yBAAyB,CACrC,sBAAsE,EACtE,SAAiB;QAEjB,IAAI,gBAAgB,GAAsB,EAAE,CAAC;QAE7C,IAAI,SAAS,GAGF,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,oCAAoC;YACpC,SAAS,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,gBAAgB,GAAG,IAAI,SAAS,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAExD,OAAO,eAAe,CAAC,cAAc,CACnC,sBAAsB,EACtB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAGa,AAAP,MAAM,CAAC,wBAAwB,CAAC,MAAc;QACnD,IAAI,WAAW,GAAuB,SAAS,CAAC;QAEhD,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAuB,UAAU,CAAC,0BAA0B,CACvE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAChC,CAAC;YAEF,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;gBAC1C,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;;AAldc,qBAAY,GAAwB,IAAI,CAAC;eAD5B,QAAQ;AAItB;IADb,WAAW,EAAE;;;;mCAMb;AAGmB;IADnB,WAAW,EAAE;;;;0BA4Bb;AASmB;IADnB,WAAW,EAAE;;;;qDA4Bb;AAgEmB;IADnB,WAAW,EAAE;;;;wCA2Lb;AAGmB;IADnB,WAAW,EAAE;;;;+CAiCb;AAGmB;IADnB,WAAW,EAAE;;;;oCA2Db;AAGa;IADb,WAAW,EAAE;;;;+CA2Bb;AAGa;IADb,WAAW,EAAE;;;;8CAeb"}

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js

@@ -12,8 +12,8 @@ import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import OneUptimeDate from "../../../Types/Date";
 import OcsfSeverity, { OcsfSeverityId, } from "../../../Types/SecurityEvent/OcsfSeverity";
 import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
-import { SigmaLevel } from "../../../Types/SecurityEvent/SigmaRule";
-import { DETECTION_DISTINCT_COUNT_ATTRIBUTE, DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, DETECTION_GROUP_VALUE_ATTRIBUTE, DETECTION_MATCH_COUNT_ATTRIBUTE, DETECTION_RULE_ID_ATTRIBUTE, DETECTION_RULE_NAME_ATTRIBUTE, DETECTION_SIGMA_ID_ATTRIBUTE, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
+import { SIGMA_LEVEL_TO_OCSF_SEVERITY, isSevereSigmaLevel, } from "../../../Types/SecurityEvent/SigmaRule";
+import { DETECTION_DISTINCT_COUNT_ATTRIBUTE, DETECTION_FINDING_CLASS_NAME, DETECTION_FINDING_CLASS_UID, DETECTION_GROUP_VALUE_ATTRIBUTE, DETECTION_MATCH_COUNT_ATTRIBUTE, DETECTION_MAX_GROUPS_PER_EVALUATION, DETECTION_MAX_LOOKBACK_IN_MINUTES, DETECTION_RULE_ID_ATTRIBUTE, DETECTION_RULE_NAME_ATTRIBUTE, DETECTION_SIGMA_ID_ATTRIBUTE, } from "../../../Types/SecurityEvent/DetectionFindingConstants";
 import SigmaRuleParser from "../../../Utils/SecurityEvent/Sigma/SigmaRuleParser";
 import MetricSeriesFingerprint from "../../../Utils/Metrics/MetricSeriesFingerprint";
 import DetectionRuleService from "../../Services/DetectionRuleService";
@@ -27,21 +27,6 @@ import { openDedupedAlerts, openDedupedIncidents, resolveAlertSeverityIdForProje
 import SigmaClickhouseCompiler, { buildSigmaDistinctCountExpression, buildSigmaFieldExpression, } from "./Sigma/SigmaClickhouseCompiler";
 import { buildSecurityEventDbRow } from "./SecurityEventRow";
 const DETECTIONS_SERVICE_NAME = "OneUptime Detections";
-/*
- * Cap on how far back one evaluation may scan, whatever lastEvaluatedAt
- * says — a rule re-enabled after a month must not trigger a month-long
- * table scan.
- */
-const MAX_LOOKBACK_IN_MINUTES = 24 * 60;
-// One alert per distinct group value per cycle, at most.
-const MAX_GROUPS_PER_EVALUATION = 100;
-const SIGMA_LEVEL_TO_OCSF = {
-    [SigmaLevel.Informational]: OcsfSeverity.Informational,
-    [SigmaLevel.Low]: OcsfSeverity.Low,
-    [SigmaLevel.Medium]: OcsfSeverity.Medium,
-    [SigmaLevel.High]: OcsfSeverity.High,
-    [SigmaLevel.Critical]: OcsfSeverity.Critical,
-};
 /*
  * The detections-as-code engine: every minute, evaluate due Sigma rules
  * against the SecurityEvent table; matches open deduped alerts and write
@@ -128,7 +113,7 @@ export default class DetectionRuleEvaluator {
         const whereFragment = SigmaClickhouseCompiler.compile(parsedRule);
         const endTime = OneUptimeDate.getCurrentDate();
         const intervalInMinutes = Math.max(1, rule.evaluationIntervalInMinutes || 1);
-        const earliestAllowed = OneUptimeDate.addRemoveMinutes(endTime, -MAX_LOOKBACK_IN_MINUTES);
+        const earliestAllowed = OneUptimeDate.addRemoveMinutes(endTime, -DETECTION_MAX_LOOKBACK_IN_MINUTES);
         let startTime = rule.lastEvaluatedAt
             ? rule.lastEvaluatedAt
             : OneUptimeDate.addRemoveMinutes(endTime, -intervalInMinutes);
@@ -150,7 +135,7 @@ export default class DetectionRuleEvaluator {
             groupByExpression,
             distinctCountExpression,
             minMatchCount: matchCountThreshold,
-            maxGroups: MAX_GROUPS_PER_EVALUATION,
+            maxGroups: DETECTION_MAX_GROUPS_PER_EVALUATION,
         });
         /*
          * The query's HAVING clause already enforces the threshold — this
@@ -348,7 +333,7 @@ export default class DetectionRuleEvaluator {
             projectConfig: serviceMetadata.projectRetentionConfig,
             projectRetentionInDays: serviceMetadata.projectRetentionInDays,
         });
-        const severityName = SIGMA_LEVEL_TO_OCSF[parsedRule.level] || OcsfSeverity.Medium;
+        const severityName = SIGMA_LEVEL_TO_OCSF_SEVERITY[parsedRule.level] || OcsfSeverity.Medium;
         const { categoryUid, categoryName } = ocsfCategoryForClassUid(DETECTION_FINDING_CLASS_UID);
         const rows = matchedGroups.map((matchGroup) => {
             const distinctSuffix = rule.distinctCountField
@@ -437,7 +422,7 @@ export default class DetectionRuleEvaluator {
             projectId: data.projectId,
             explicitSeverityId: data.rule.alertSeverityId,
             severityLabel: data.parsedRule.level,
-            isSevere: this.isSevereLevel(data.parsedRule.level),
+            isSevere: isSevereSigmaLevel(data.parsedRule.level),
         });
     }
     /*
@@ -454,12 +439,9 @@ export default class DetectionRuleEvaluator {
             projectId: data.projectId,
             explicitSeverityId: data.rule.incidentSeverityId,
             severityLabel: data.parsedRule.level,
-            isSevere: this.isSevereLevel(data.parsedRule.level),
+            isSevere: isSevereSigmaLevel(data.parsedRule.level),
         });
     }
-    static isSevereLevel(level) {
-        return level === SigmaLevel.Critical || level === SigmaLevel.High;
-    }
 }
 __decorate([
     CaptureSpan(),

package/build/dist/Server/Utils/SecurityEvent/DetectionRuleEvaluator.js.map

@@ -1 +1 @@
-{"version":3,"file":"DetectionRuleEvaluator.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,aAAa,MAAM,8CAA8C,CAAC;AACzE,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAIhD,OAAO,YAAY,EAAE,EACnB,cAAc,GACf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAkB,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAC/B,+BAA+B,EAC/B,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,eAAe,MAAM,oDAAoD,CAAC;AACjF,OAAO,uBAAuB,MAAM,gDAAgD,CAAC;AACrF,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,iBAEN,MAAM,2CAA2C,CAAC;AACnD,OAAO,oBAAoB,EAAE,EAE3B,+BAA+B,GAChC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,uBAAuB,EAAE,EAC9B,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,uBAAuB,GAAW,sBAAsB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,uBAAuB,GAAW,EAAE,GAAG,EAAE,CAAC;AAEhD,yDAAyD;AACzD,MAAM,yBAAyB,GAAW,GAAG,CAAC;AAE9C,MAAM,mBAAmB,GAAqC;IAC5D,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,aAAa;IACtD,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,GAAG;IAClC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM;IACxC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI;IACpC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,QAAQ;CAC7C,CAAC;AAYF;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,sBAAsB;IAErB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB;;QACrC,MAAM,KAAK,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI;aAChB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,IAAI;gBACnB,2BAA2B,EAAE,IAAI;gBACjC,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,IAAI;gBACxB,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,IAAI;gBACvB,2BAA2B,EAAE,IAAI;gBACjC,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,IAAI;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,IAAI;aACtB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;YAEF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAS,aAAa,CAAC,gBAAgB,CAChD,IAAI,CAAC,eAAe,EACpB,iBAAiB,CAClB,CAAC;gBAEF,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,iDAAiD,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACxE,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAEpB;;;;;;mBAMG;gBACH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAa,IAAI,CAAC,EAAE,CAAC;oBAEjC,MAAM,qBAAqB,CAAC,aAAa,CAAC;wBACxC,KAAK,EAAE,gCAAgC,MAAM,CAAC,QAAQ,EAAE,EAAE;wBAC1D,KAAK,EAAE,KAAK,IAAmB,EAAE;4BAC/B,MAAM,oBAAoB,CAAC,aAAa,CAAC;gCACvC,EAAE,EAAE,MAAM;gCACV,IAAI,EAAE;oCACJ,eAAe,EAAE,aAAa,CAAC,cAAc,EAAE;oCAC/C,SAAS,EAAE,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC;iCAClD;gCACD,KAAK,EAAE;oCACL,MAAM,EAAE,IAAI;iCACb;6BACF,CAAC,CAAC;wBACL,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,YAAY,CAC9B,IAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAc,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxE,MAAM,aAAa,GACjB,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;QAEF,MAAM,eAAe,GAAS,aAAa,CAAC,gBAAgB,CAC1D,OAAO,EACP,CAAC,uBAAuB,CACzB,CAAC;QAEF,IAAI,SAAS,GAAS,IAAI,CAAC,eAAe;YACxC,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;YACvD,SAAS,GAAG,eAAe,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAqB,IAAI,CAAC,YAAY;YAC3D,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,uBAAuB,GAAqB,IAAI,CAAC,kBAAkB;YACvE,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,mBAAmB,GAAW,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAElE,MAAM,MAAM,GACV,MAAM,oBAAoB,CAAC,oBAAoB,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,OAAO;YACP,aAAa;YACb,iBAAiB;YACjB,uBAAuB;YACvB,aAAa,EAAE,mBAAmB;YAClC,SAAS,EAAE,yBAAyB;SACrC,CAAC,CAAC;QAEL;;;;;WAKG;QACH,MAAM,aAAa,GAA+B,MAAM,CAAC,MAAM,CAC7D,CAAC,GAAwB,EAAW,EAAE;YACpC,OAAO,+BAA+B,CAAC;gBACrC,KAAK,EAAE,GAAG;gBACV,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;gBACnD,aAAa,EAAE,mBAAmB;aACnC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,GAAW,CAAC,CAAC;QAC9B,IAAI,gBAAgB,GAAW,CAAC,CAAC;QACjC,IAAI,eAAe,GAAW,CAAC,CAAC;QAChC,IAAI,YAAY,GAAW,CAAC,CAAC;QAE7B,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;YACvC,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC;QACxC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBACrC,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC9C,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED;;;;;eAKG;YACH,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACvC,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC;oBACpD,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC;gBAC/C,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;oBAClD,IAAI;oBACJ,UAAU;oBACV,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,CAAC,aAAa,CAAC;YACvC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,kBACF,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,IAAyB,IACjC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE;YAC1B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY;YACZ,aAAa;YACb,gBAAgB;YAChB,eAAe;YACf,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAMzC;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GAAoB,MAAM,IAAI,CAAC,sBAAsB,CAAC;YACzE,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,8DAA8D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAC5I,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED;;;;;;WAMG;QACH,OAAO,iBAAiB,CAAC;YACvB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE,gCAAgC,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,EAAE;YAC/D,OAAO,EAAE,aAAa,CAAC,GAAG,CACxB,CAAC,UAA+B,EAAkB,EAAE;gBAClD,OAAO;oBACL,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC;oBACnE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC;oBAC7C,WAAW,EAAE,IAAI,CAAC,qBAAqB,CAAC;wBACtC,IAAI;wBACJ,UAAU;wBACV,UAAU;wBACV,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC;oBACF,SAAS,EAAE,yBAAyB,IAAI,CAAC,IAAI,4BAA4B;iBAC1E,CAAC;YACJ,CAAC,CACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAM5C;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC;YACnC,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEL,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,oEAAoE,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAClJ,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,oBAAoB,CAAC;YAC1B,SAAS;YACT,kBAAkB;YAClB,QAAQ,EAAE,gCAAgC,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,EAAE;YAC/D,OAAO,EAAE,aAAa,CAAC,GAAG,CACxB,CAAC,UAA+B,EAAkB,EAAE;gBAClD,OAAO;oBACL,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC;oBACnE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC;oBAC7C,WAAW,EAAE,IAAI,CAAC,qBAAqB,CAAC;wBACtC,IAAI;wBACJ,UAAU;wBACV,UAAU;wBACV,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC;oBACF,SAAS,EAAE,yBAAyB,IAAI,CAAC,IAAI,4BAA4B;iBAC1E,CAAC;YACJ,CAAC,CACF;SACF,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,eAAe,CAC5B,IAAmB,EACnB,UAA+B;QAE/B,OAAO,UAAU,CAAC,UAAU;YAC1B,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,EAAE;YACvD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,IAMpC;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,gBAAgB,GAAkB,EAAE,CAAC;QAE3C,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,gBAAgB,CAAC,IAAI,CACnB,0BAA0B,UAAU,CAAC,UAAU,kBAC7C,UAAU,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,YAAY,aAAa,CAAC,wBAAwB,CAChD,IAAI,CAAC,SAAS,CACf,QAAQ,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CACjE,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CACnB,GAAG,UAAU,CAAC,aAAa,aAAa,IAAI,CAAC,kBAAkB,SAC7D,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACxC,yCAAyC,IAAI,CAAC,kBAAkB,CAC9D,IAAI,CACL,IAAI,CACN,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,gBAAgB,CAAC,IAAI,CACnB,gBAAgB,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GACnB,MAAM,iBAAiB,CAAC,wBAAwB,CAAC;YAC/C,WAAW,EAAE,uBAAuB;YACpC,SAAS;SACV,CAAC,CAAC;QAEL,MAAM,aAAa,GAAW,+BAA+B,CAAC;YAC5D,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;YAC9D,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;SAC/D,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC;QAE/D,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,IAAI,GAAsB,aAAa,CAAC,GAAG,CAC/C,CAAC,UAA+B,EAAc,EAAE;YAC9C,MAAM,cAAc,GAAW,IAAI,CAAC,kBAAkB;gBACpD,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,aAAa,IAAI,CAAC,kBAAkB,EAAE;gBACrE,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,UAAU,GAA4B;gBAC1C,IAAI,EAAE,aAAa,CAAC,cAAc,EAAE;gBACpC,QAAQ,EAAE,aAAa,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,gBAAgB,CACjE,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,UAAU,CACtB,IAAI,aAAa,CAAC,wBAAwB,EAAE,EAAE;gBAC/C,WAAW;gBACX,YAAY;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,4BAA4B;gBACvC,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;gBACxC,YAAY;gBACZ,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,UAAU,CAAC,UAAU;oBAC5B,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,UAAU,cAAc,GAAG;oBACzG,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,UAAU,UAAU,cAAc,GAAG;gBAChF,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,sBAAsB;gBACnC,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE;gBAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK;gBACvC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,aAAa,EAAE,EAAE;gBACjB,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;gBACf,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,UAAU,CAAC,UAAU;oBAChC,CAAC,CAAC;wBACE,UAAU,CAAC,UAAU;wBACrB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CACpC,CAAC,UAAkB,EAAW,EAAE;4BAC9B,OAAO,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC;wBAC9C,CAAC,CACF;qBACF;oBACH,CAAC,CAAC,UAAU,CAAC,iBAAiB;gBAChC,UAAU,8CACR,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,EAClD,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,EAC9D,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAC7D,CAAC,IAAI,CAAC,kBAAkB;oBACzB,CAAC,CAAC;wBACE,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAC1C,UAAU,CAAC,aAAa,CACzB;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,UAAU,CAAC,UAAU;oBACvB,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,UAAU,CAAC,EAAE;oBACf,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC,CACR;aACF,CAAC;YAEF,OAAO,uBAAuB,CAAC;gBAC7B,UAAU;gBACV,SAAS;gBACT,eAAe;gBACf,aAAa;aACd,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,MAAM,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,kBAAkB,CAAC,IAAmB;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAC7B,MAAgB,EAChB,UAAkB;QAElB,OAAO,kBAAkB,MAAM,CAAC,QAAQ,EAAE,IAAI,uBAAuB,CAAC,kBAAkB,CACtF;YACE,UAAU,EAAE,UAAU,IAAI,EAAE;SAC7B,CACF,EAAE,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,OAAO,gCAAgC,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC7C,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YACpC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAI9C;QACC,OAAO,mCAAmC,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YACpC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,aAAa,CAAC,KAAiB;QAC5C,OAAO,KAAK,KAAK,UAAU,CAAC,QAAQ,IAAI,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC;IACpE,CAAC;CACF;AA1jBqB;IADnB,WAAW,EAAE;;;;uDAqFb;AAGmB;IADnB,WAAW,EAAE;;qCAEN,aAAa;;gDAqIpB"}
+{"version":3,"file":"DetectionRuleEvaluator.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,aAAa,MAAM,8CAA8C,CAAC;AACzE,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAIhD,OAAO,YAAY,EAAE,EACnB,cAAc,GACf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAkB,EAChB,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,+BAA+B,EAC/B,+BAA+B,EAC/B,mCAAmC,EACnC,iCAAiC,EACjC,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wDAAwD,CAAC;AAChE,OAAO,eAAe,MAAM,oDAAoD,CAAC;AACjF,OAAO,uBAAuB,MAAM,gDAAgD,CAAC;AACrF,OAAO,oBAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,iBAEN,MAAM,2CAA2C,CAAC;AACnD,OAAO,oBAAoB,EAAE,EAE3B,+BAA+B,GAChC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,mDAAmD,CAAC;AACpG,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,uBAAuB,EAAE,EAC9B,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,uBAAuB,GAAW,sBAAsB,CAAC;AAY/D;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,sBAAsB;IAErB,AAAb,MAAM,CAAC,KAAK,CAAC,mBAAmB;;QACrC,MAAM,KAAK,GAAyB,MAAM,oBAAoB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI;aAChB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,IAAI;gBACnB,2BAA2B,EAAE,IAAI;gBACjC,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,IAAI;gBACxB,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,IAAI;gBACvB,2BAA2B,EAAE,IAAI;gBACjC,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,IAAI;gBACrB,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,IAAI;aACtB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;YAEF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAS,aAAa,CAAC,gBAAgB,CAChD,IAAI,CAAC,eAAe,EACpB,iBAAiB,CAClB,CAAC;gBAEF,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CACV,iDAAiD,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CACxE,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAEpB;;;;;;mBAMG;gBACH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAa,IAAI,CAAC,EAAE,CAAC;oBAEjC,MAAM,qBAAqB,CAAC,aAAa,CAAC;wBACxC,KAAK,EAAE,gCAAgC,MAAM,CAAC,QAAQ,EAAE,EAAE;wBAC1D,KAAK,EAAE,KAAK,IAAmB,EAAE;4BAC/B,MAAM,oBAAoB,CAAC,aAAa,CAAC;gCACvC,EAAE,EAAE,MAAM;gCACV,IAAI,EAAE;oCACJ,eAAe,EAAE,aAAa,CAAC,cAAc,EAAE;oCAC/C,SAAS,EAAE,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC;iCAClD;gCACD,KAAK,EAAE;oCACL,MAAM,EAAE,IAAI;iCACb;6BACF,CAAC,CAAC;wBACL,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAGmB,AAAb,MAAM,CAAC,KAAK,CAAC,YAAY,CAC9B,IAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAc,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACxE,MAAM,aAAa,GACjB,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAS,aAAa,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,iBAAiB,GAAW,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,2BAA2B,IAAI,CAAC,CACtC,CAAC;QAEF,MAAM,eAAe,GAAS,aAAa,CAAC,gBAAgB,CAC1D,OAAO,EACP,CAAC,iCAAiC,CACnC,CAAC;QAEF,IAAI,SAAS,GAAS,IAAI,CAAC,eAAe;YACxC,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,aAAa,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;YACvD,SAAS,GAAG,eAAe,CAAC;QAC9B,CAAC;QAED,MAAM,iBAAiB,GAAqB,IAAI,CAAC,YAAY;YAC3D,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,uBAAuB,GAAqB,IAAI,CAAC,kBAAkB;YACvE,CAAC,CAAC,iCAAiC,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,mBAAmB,GAAW,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAElE,MAAM,MAAM,GACV,MAAM,oBAAoB,CAAC,oBAAoB,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,OAAO;YACP,aAAa;YACb,iBAAiB;YACjB,uBAAuB;YACvB,aAAa,EAAE,mBAAmB;YAClC,SAAS,EAAE,mCAAmC;SAC/C,CAAC,CAAC;QAEL;;;;;WAKG;QACH,MAAM,aAAa,GAA+B,MAAM,CAAC,MAAM,CAC7D,CAAC,GAAwB,EAAW,EAAE;YACpC,OAAO,+BAA+B,CAAC;gBACrC,KAAK,EAAE,GAAG;gBACV,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;gBACnD,aAAa,EAAE,mBAAmB;aACnC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,GAAW,CAAC,CAAC;QAC9B,IAAI,gBAAgB,GAAW,CAAC,CAAC;QACjC,IAAI,eAAe,GAAW,CAAC,CAAC;QAChC,IAAI,YAAY,GAAW,CAAC,CAAC;QAE7B,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;YACvC,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC;QACxC,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBACrC,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC9C,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED;;;;;eAKG;YACH,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;gBACvC,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC;oBACpD,IAAI;oBACJ,UAAU;oBACV,aAAa;oBACb,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC;gBAC/C,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC;oBAClD,IAAI;oBACJ,UAAU;oBACV,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,CAAC,aAAa,CAAC;YACvC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,kBACF,eAAe,EAAE,OAAO,EACxB,SAAS,EAAE,IAAyB,IACjC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE;YAC1B,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,YAAY;YACZ,aAAa;YACb,gBAAgB;YAChB,eAAe;YACf,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAMzC;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GAAoB,MAAM,IAAI,CAAC,sBAAsB,CAAC;YACzE,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,8DAA8D,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAC5I,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED;;;;;;WAMG;QACH,OAAO,iBAAiB,CAAC;YACvB,SAAS;YACT,eAAe;YACf,QAAQ,EAAE,gCAAgC,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,EAAE;YAC/D,OAAO,EAAE,aAAa,CAAC,GAAG,CACxB,CAAC,UAA+B,EAAkB,EAAE;gBAClD,OAAO;oBACL,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC;oBACnE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC;oBAC7C,WAAW,EAAE,IAAI,CAAC,qBAAqB,CAAC;wBACtC,IAAI;wBACJ,UAAU;wBACV,UAAU;wBACV,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC;oBACF,SAAS,EAAE,yBAAyB,IAAI,CAAC,IAAI,4BAA4B;iBAC1E,CAAC;YACJ,CAAC,CACF;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAM5C;;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,yBAAyB,CAAC;YACnC,SAAS;YACT,IAAI;YACJ,UAAU;SACX,CAAC,CAAC;QAEL,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,CAAC,QAAQ,EAAE,oEAAoE,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,GAAG,CAClJ,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,oBAAoB,CAAC;YAC1B,SAAS;YACT,kBAAkB;YAClB,QAAQ,EAAE,gCAAgC,MAAA,IAAI,CAAC,EAAE,0CAAE,QAAQ,EAAE,EAAE;YAC/D,OAAO,EAAE,aAAa,CAAC,GAAG,CACxB,CAAC,UAA+B,EAAkB,EAAE;gBAClD,OAAO;oBACL,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAG,EAAE,UAAU,CAAC,UAAU,CAAC;oBACnE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC;oBAC7C,WAAW,EAAE,IAAI,CAAC,qBAAqB,CAAC;wBACtC,IAAI;wBACJ,UAAU;wBACV,UAAU;wBACV,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC;oBACF,SAAS,EAAE,yBAAyB,IAAI,CAAC,IAAI,4BAA4B;iBAC1E,CAAC;YACJ,CAAC,CACF;SACF,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,eAAe,CAC5B,IAAmB,EACnB,UAA+B;QAE/B,OAAO,UAAU,CAAC,UAAU;YAC1B,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,EAAE;YACvD,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,IAMpC;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,gBAAgB,GAAkB,EAAE,CAAC;QAE3C,IAAI,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC;QAED,gBAAgB,CAAC,IAAI,CACnB,0BAA0B,UAAU,CAAC,UAAU,kBAC7C,UAAU,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,YAAY,aAAa,CAAC,wBAAwB,CAChD,IAAI,CAAC,SAAS,CACf,QAAQ,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CACjE,CAAC;QAEF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CACnB,GAAG,UAAU,CAAC,aAAa,aAAa,IAAI,CAAC,kBAAkB,SAC7D,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACxC,yCAAyC,IAAI,CAAC,kBAAkB,CAC9D,IAAI,CACL,IAAI,CACN,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,gBAAgB,CAAC,IAAI,CACnB,gBAAgB,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACjD,MAAM,SAAS,GAAa,IAAI,CAAC,SAAU,CAAC;QAE5C,MAAM,eAAe,GACnB,MAAM,iBAAiB,CAAC,wBAAwB,CAAC;YAC/C,WAAW,EAAE,uBAAuB;YACpC,SAAS;SACV,CAAC,CAAC;QAEL,MAAM,aAAa,GAAW,+BAA+B,CAAC;YAC5D,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;YAC9D,aAAa,EAAE,eAAe,CAAC,sBAAsB;YACrD,sBAAsB,EAAE,eAAe,CAAC,sBAAsB;SAC/D,CAAC,CAAC;QAEH,MAAM,YAAY,GAChB,4BAA4B,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC;QAExE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,IAAI,GAAsB,aAAa,CAAC,GAAG,CAC/C,CAAC,UAA+B,EAAc,EAAE;YAC9C,MAAM,cAAc,GAAW,IAAI,CAAC,kBAAkB;gBACpD,CAAC,CAAC,KAAK,UAAU,CAAC,aAAa,aAAa,IAAI,CAAC,kBAAkB,EAAE;gBACrE,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,UAAU,GAA4B;gBAC1C,IAAI,EAAE,aAAa,CAAC,cAAc,EAAE;gBACpC,QAAQ,EAAE,aAAa,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,gBAAgB,CACjE,IAAI,CAAC,EAAG,EACR,UAAU,CAAC,UAAU,CACtB,IAAI,aAAa,CAAC,wBAAwB,EAAE,EAAE;gBAC/C,WAAW;gBACX,YAAY;gBACZ,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,4BAA4B;gBACvC,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;gBACxC,YAAY;gBACZ,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,UAAU,CAAC,UAAU;oBAC5B,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,MAAM,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,UAAU,cAAc,GAAG;oBACzG,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,UAAU,UAAU,cAAc,GAAG;gBAChF,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,sBAAsB;gBACnC,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE;gBAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK;gBACvC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,eAAe,EAAE,UAAU,CAAC,eAAe;gBAC3C,aAAa,EAAE,EAAE;gBACjB,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;gBACf,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,EAAE;gBACd,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,UAAU,CAAC,UAAU;oBAChC,CAAC,CAAC;wBACE,UAAU,CAAC,UAAU;wBACrB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CACpC,CAAC,UAAkB,EAAW,EAAE;4BAC9B,OAAO,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC;wBAC9C,CAAC,CACF;qBACF;oBACH,CAAC,CAAC,UAAU,CAAC,iBAAiB;gBAChC,UAAU,8CACR,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,EAClD,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,EAC9D,CAAC,+BAA+B,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAC7D,CAAC,IAAI,CAAC,kBAAkB;oBACzB,CAAC,CAAC;wBACE,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAC1C,UAAU,CAAC,aAAa,CACzB;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,UAAU,CAAC,UAAU;oBACvB,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,UAAU,CAAC,EAAE;oBACf,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC,CACR;aACF,CAAC;YAEF,OAAO,uBAAuB,CAAC;gBAC7B,UAAU;gBACV,SAAS;gBACT,eAAe;gBACf,aAAa;aACd,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,MAAM,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,kBAAkB,CAAC,IAAmB;QACnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAC7B,MAAgB,EAChB,UAAkB;QAElB,OAAO,kBAAkB,MAAM,CAAC,QAAQ,EAAE,IAAI,uBAAuB,CAAC,kBAAkB,CACtF;YACE,UAAU,EAAE,UAAU,IAAI,EAAE;SAC7B,CACF,EAAE,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAI3C;QACC,OAAO,gCAAgC,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC7C,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YACpC,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAI9C;QACC,OAAO,mCAAmC,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YACpC,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;CACF;AAtjBqB;IADnB,WAAW,EAAE;;;;uDAqFb;AAGmB;IADnB,WAAW,EAAE;;qCAEN,aAAa;;gDAqIpB"}

package/build/dist/Server/Utils/SecurityEvent/GoogleSecOpsSeverityRepair.js

@@ -0,0 +1,127 @@
+import OcsfSeverity, { OCSF_SEVERITY_ALIASES, OcsfSeverityId, } from "../../../Types/SecurityEvent/OcsfSeverity";
+import { DETECTION_FINDING_CLASS_UID, GOOGLE_SECOPS_PRODUCT_NAME, GOOGLE_SECOPS_RISK_SCORE_BANDS, GOOGLE_SECOPS_VENDOR_NAME, } from "../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer";
+/*
+ * Re-grades Google SecOps detections that were stored as Unknown before the
+ * normalizer learned to read a custom rule's severity.
+ *
+ * Every stored row keeps its source payload flattened into `attributes`
+ * (`detection.0.ruleLabels.2.key` = "severity", `...2.value` = "Medium"), so
+ * the grade the fixed GoogleSecOpsAlertNormalizer would give a row can be
+ * computed in SQL from the row itself. The expression below is that
+ * normalizer's resolveSeverity, written against the flattened keys:
+ *
+ *   1. detection[0].severity   (Google's grade on curated rules)
+ *   2. the Collection's severity
+ *   3. the first ruleLabels "severity" that names a grade (YARA-L meta)
+ *   4. the first outcomes "risk_score" that grades, on Google's bands
+ *
+ * Its text tables are generated from OCSF_SEVERITY_ALIASES and
+ * GOOGLE_SECOPS_RISK_SCORE_BANDS, the same tables the normalizer reads, so
+ * the two cannot drift apart. It reads the list form of ruleLabels and
+ * outcomes Google returns; a label map in a hand-built webhook body is
+ * graded at ingest but not here.
+ *
+ * Only rows that are still Unknown and that the expression grades are
+ * touched, so the repair is idempotent and never overrides a grade.
+ */
+export default class GoogleSecOpsSeverityRepair {
+    /*
+     * The OCSF severity name a stored row's attributes grade to, or '' when
+     * nothing in them grades.
+     */
+    static gradeExpression() {
+        const detectionSeverity = `if(attributes['detection.0.severity'] != '', attributes['detection.0.severity'], attributes['detection.severity'])`;
+        const graded = [
+            GoogleSecOpsSeverityRepair.gradeText(detectionSeverity),
+            GoogleSecOpsSeverityRepair.gradeText("attributes['severity']"),
+            GoogleSecOpsSeverityRepair.firstKeyedGrade("(ruleLabels|rule_labels)", "severity", GoogleSecOpsSeverityRepair.gradeText),
+            GoogleSecOpsSeverityRepair.firstKeyedGrade("outcomes", "risk_score", GoogleSecOpsSeverityRepair.gradeRiskScore),
+        ];
+        // The first of the four grades that is set, in the normalizer's order.
+        return `arrayFirst(grade -> grade != '', [${graded.join(", ")}])`;
+    }
+    /*
+     * The async ON CLUSTER mutation. `storageTable` is the local storage
+     * table and `onCluster` the cluster clause, as every data mutation on
+     * the clustered analytics schema is written.
+     */
+    static repairStatement(data) {
+        const grade = GoogleSecOpsSeverityRepair.gradeExpression();
+        const names = Object.keys(OcsfSeverityId);
+        const severityId = `transform(${grade}, [${names
+            .map((name) => {
+            return GoogleSecOpsSeverityRepair.literal(name);
+        })
+            .join(", ")}], [${names
+            .map((name) => {
+            return String(OcsfSeverityId[name]);
+        })
+            .join(", ")}], ${OcsfSeverityId[OcsfSeverity.Unknown]})`;
+        return `ALTER TABLE ${data.storageTable}${data.onCluster} UPDATE severityName = ${grade}, severityId = ${severityId} WHERE ${GoogleSecOpsSeverityRepair.condition()}`;
+    }
+    /*
+     * The rows the repair rewrites: Google SecOps detection findings still
+     * stored as Unknown whose attributes now grade. The cheap column checks
+     * come first so ClickHouse evaluates the attribute expression only for
+     * those rows.
+     */
+    static condition() {
+        return [
+            `vendorName = ${GoogleSecOpsSeverityRepair.literal(GOOGLE_SECOPS_VENDOR_NAME)}`,
+            `productName = ${GoogleSecOpsSeverityRepair.literal(GOOGLE_SECOPS_PRODUCT_NAME)}`,
+            `classUid = ${DETECTION_FINDING_CLASS_UID}`,
+            `severityId = ${OcsfSeverityId[OcsfSeverity.Unknown]}`,
+            `${GoogleSecOpsSeverityRepair.gradeExpression()} != ''`,
+        ].join(" AND ");
+    }
+    // normalizeOcsfSeverity, minus Unknown: text that names no grade is ''.
+    static gradeText(expression) {
+        const graded = Object.entries(OCSF_SEVERITY_ALIASES).filter((entry) => {
+            return entry[1] !== OcsfSeverity.Unknown;
+        });
+        const from = graded
+            .map((entry) => {
+            return GoogleSecOpsSeverityRepair.literal(entry[0]);
+        })
+            .join(", ");
+        const to = graded
+            .map((entry) => {
+            return GoogleSecOpsSeverityRepair.literal(entry[1]);
+        })
+            .join(", ");
+        return `transform(upperUTF8(${GoogleSecOpsSeverityRepair.trimmed(expression)}), [${from}], [${to}], '')`;
+    }
+    /*
+     * The normalizer's gradeRiskScore: a finite score above zero grades into
+     * the first band whose minimum it reaches.
+     */
+    static gradeRiskScore(expression) {
+        const bands = GOOGLE_SECOPS_RISK_SCORE_BANDS.map((band) => {
+            return `score >= ${band.minimum}, ${GoogleSecOpsSeverityRepair.literal(band.severity)}`;
+        }).join(", ");
+        return `arrayMap(score -> multiIf(NOT isFinite(score) OR score <= 0, '', ${bands}, ''), [ifNull(toFloat64OrNull(${GoogleSecOpsSeverityRepair.trimmed(expression)}), 0)])[1]`;
+    }
+    /*
+     * The first grade among the entries of detection[0].<list> whose key is
+     * `key`, in list order: the normalizer's readKeyedValues + firstGrade.
+     * A flattened entry is `detection.0.<list>.<index>.key` / `.value`
+     * (`detection.<list>...` when the webhook sent detection as an object).
+     */
+    static firstKeyedGrade(listPattern, key, grade) {
+        const keyPattern = `^detection[.](0[.])?${listPattern}[.][0-9]+[.]key$`;
+        const keys = `arraySort(entryKey -> toUInt64OrZero(extract(entryKey, '[.]([0-9]+)[.]key$')), arrayFilter(entryKey -> match(entryKey, ${GoogleSecOpsSeverityRepair.literal(keyPattern)}), mapKeys(attributes)))`;
+        const value = "attributes[concat(substring(entryKey, 1, length(entryKey) - 3), 'value')]";
+        return `arrayFirst(entryGrade -> entryGrade != '', arrayMap(entryKey -> if(lowerUTF8(${GoogleSecOpsSeverityRepair.trimmed("attributes[entryKey]")}) = ${GoogleSecOpsSeverityRepair.literal(key)}, ${grade(value)}, ''), ${keys}))`;
+    }
+    /*
+     * JavaScript's String.trim strips all surrounding whitespace; ClickHouse's
+     * trim() strips spaces only.
+     */
+    static trimmed(expression) {
+        return `replaceRegexpAll(${expression}, '^[[:space:]]+|[[:space:]]+$', '')`;
+    }
+    static literal(value) {
+        return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+    }
+}
+//# sourceMappingURL=GoogleSecOpsSeverityRepair.js.map

package/build/dist/Server/Utils/SecurityEvent/GoogleSecOpsSeverityRepair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GoogleSecOpsSeverityRepair.js","sourceRoot":"","sources":["../../../../../Server/Utils/SecurityEvent/GoogleSecOpsSeverityRepair.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,EAAE,EACnB,qBAAqB,EACrB,cAAc,GACf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,0DAA0D,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,0BAA0B;IAC7C;;;OAGG;IACI,MAAM,CAAC,eAAe;QAC3B,MAAM,iBAAiB,GAAW,oHAAoH,CAAC;QACvJ,MAAM,MAAM,GAAkB;YAC5B,0BAA0B,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACvD,0BAA0B,CAAC,SAAS,CAAC,wBAAwB,CAAC;YAC9D,0BAA0B,CAAC,eAAe,CACxC,0BAA0B,EAC1B,UAAU,EACV,0BAA0B,CAAC,SAAS,CACrC;YACD,0BAA0B,CAAC,eAAe,CACxC,UAAU,EACV,YAAY,EACZ,0BAA0B,CAAC,cAAc,CAC1C;SACF,CAAC;QAEF,uEAAuE;QACvE,OAAO,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,eAAe,CAAC,IAG7B;QACC,MAAM,KAAK,GAAW,0BAA0B,CAAC,eAAe,EAAE,CAAC;QACnE,MAAM,KAAK,GAAwB,MAAM,CAAC,IAAI,CAC5C,cAAc,CACQ,CAAC;QACzB,MAAM,UAAU,GAAW,aAAa,KAAK,MAAM,KAAK;aACrD,GAAG,CAAC,CAAC,IAAkB,EAAU,EAAE;YAClC,OAAO,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK;aACtB,GAAG,CAAC,CAAC,IAAkB,EAAU,EAAE;YAClC,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;QAE3D,OAAO,eAAe,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,0BAA0B,KAAK,kBAAkB,UAAU,UAAU,0BAA0B,CAAC,SAAS,EAAE,EAAE,CAAC;IACxK,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,SAAS;QACrB,OAAO;YACL,gBAAgB,0BAA0B,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE;YAC/E,iBAAiB,0BAA0B,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE;YACjF,cAAc,2BAA2B,EAAE;YAC3C,gBAAgB,cAAc,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,GAAG,0BAA0B,CAAC,eAAe,EAAE,QAAQ;SACxD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,wEAAwE;IAChE,MAAM,CAAC,SAAS,CAAC,UAAkB;QACzC,MAAM,MAAM,GAAkC,MAAM,CAAC,OAAO,CAC1D,qBAAqB,CACtB,CAAC,MAAM,CAAC,CAAC,KAA6B,EAAW,EAAE;YAClD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAW,MAAM;aACxB,GAAG,CAAC,CAAC,KAA6B,EAAU,EAAE;YAC7C,OAAO,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,EAAE,GAAW,MAAM;aACtB,GAAG,CAAC,CAAC,KAA6B,EAAU,EAAE;YAC7C,OAAO,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,uBAAuB,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,EAAE,QAAQ,CAAC;IAC3G,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,cAAc,CAAC,UAAkB;QAC9C,MAAM,KAAK,GAAW,8BAA8B,CAAC,GAAG,CACtD,CAAC,IAAiD,EAAU,EAAE;YAC5D,OAAO,YAAY,IAAI,CAAC,OAAO,KAAK,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1F,CAAC,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,OAAO,oEAAoE,KAAK,kCAAkC,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC/K,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,eAAe,CAC5B,WAAmB,EACnB,GAAW,EACX,KAAqC;QAErC,MAAM,UAAU,GAAW,uBAAuB,WAAW,kBAAkB,CAAC;QAChF,MAAM,IAAI,GAAW,0HAA0H,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC;QACxN,MAAM,KAAK,GACT,2EAA2E,CAAC;QAE9E,OAAO,gFAAgF,0BAA0B,CAAC,OAAO,CAAC,sBAAsB,CAAC,OAAO,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IACrO,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,OAAO,CAAC,UAAkB;QACvC,OAAO,oBAAoB,UAAU,sCAAsC,CAAC;IAC9E,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,KAAa;QAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAClE,CAAC;CACF"}

package/build/dist/Server/Utils/SecurityEvent/Sigma/SigmaClickhouseCompiler.js

@@ -53,7 +53,7 @@ const ARRAY_COLUMNS = new Set([
  * under its original spelling — which is exactly the flattened source
  * payload key, so rules written against raw UDM/OCSF field paths work.
  */
-const FIELD_ALIASES = {
+export const FIELD_ALIASES = {
     user: "principalUser",
     username: "principalUser",
     "user.name": "principalUser",