@oneuptime/common 13.0.7 → 14.0.0

package/build/dist/Utils/Monitor/MonitoringIntervalUtil.js

@@ -0,0 +1,374 @@
+/*
+ * How often a monitor is probed: the canonical reading of
+ * `Monitor.monitoringInterval` (and `MonitorTemplate.monitoringInterval`).
+ *
+ * WHY IT LIVES IN Common
+ *
+ * The column is free-text ShortText and is supposed to hold a 5-field cron
+ * expression, but nothing ever validated it. Four places have an opinion
+ * about what a stored value MEANS and they must not disagree:
+ *
+ *   - the write hooks (MonitorService / MonitorTemplateService) — which now
+ *     normalize on save, so the column converges on canonical cron;
+ *   - the claim query (MonitorProbeService.claimMonitorProbesForProbing) —
+ *     which derives `nextPingAt` and is the thing that actually schedules
+ *     the probe;
+ *   - the telemetry-monitor worker and the over-time criteria evaluator —
+ *     which need the cadence to size their evaluation windows;
+ *   - the data migration that cleans the rows written before any of this.
+ *
+ * It is isomorphic (no server-only imports) because the dashboard needs the
+ * same reading to render a stored value, and pure and TOTAL — it never
+ * throws. Policy (reject / rewrite / leave alone) belongs to the caller:
+ * the write hook throws, the scheduler falls back, the migration skips.
+ * Same reason RescanIntervalUtil and ScanTargetUtil sit in Common.
+ *
+ * WHAT WENT WRONG, so the next person does not undo it
+ *
+ * A monitor storing "5m" was not a cron expression, so cron-parser threw,
+ * and the claim query caught that and fell back to a hard-coded "one minute
+ * from now". A monitor configured for five minutes was probed every ~75
+ * seconds — four times the requested rate — silently, for as long as the row
+ * existed. 103 monitors across 10 projects were in that state. Most of them
+ * got there by copying OUR OWN Terraform examples, which passed the dropdown
+ * LABEL ("Every 5 minutes") where the API wanted the VALUE ("*\/5 * * * *").
+ *
+ * THE INTERPRETIVE RULE THIS ENCODES
+ *
+ * A bare duration in THIS column is always a CADENCE, never a clock
+ * position: "5m" means "every five minutes", not "at five past". That is
+ * unambiguous here because the column's only consumer is a polling
+ * schedule. Do not lift this parser somewhere a duration could mean an
+ * offset. Note CronTime.ts spells out the same cadence-shaped constants.
+ */
+import CronTab from "../CronTab";
+export var MonitoringIntervalNormalizationStatus;
+(function (MonitoringIntervalNormalizationStatus) {
+    /*
+     * Null, undefined or blank. A legitimate state: the monitor is not probed
+     * on a schedule (Manual monitors, and ~4,177 rows in production).
+     */
+    MonitoringIntervalNormalizationStatus["Empty"] = "Empty";
+    /* Already a valid cron expression. Returned byte-identical. */
+    MonitoringIntervalNormalizationStatus["AlreadyCanonical"] = "AlreadyCanonical";
+    /* Understood, and rewritten to canonical cron. */
+    MonitoringIntervalNormalizationStatus["Normalized"] = "Normalized";
+    /* Not understood. The caller decides what that means. */
+    MonitoringIntervalNormalizationStatus["Unrecognized"] = "Unrecognized";
+})(MonitoringIntervalNormalizationStatus || (MonitoringIntervalNormalizationStatus = {}));
+/*
+ * Cadences that divide their unit evenly.
+ *
+ * A 7-minute step fires at :00, :07 ... :56 and then :00 again — a four-minute
+ * gap at every hour wrap. It is NOT "every 7 minutes", so storing it as the
+ * normalization of "every 7 minutes" would be storing a lie. We only accept
+ * n where the unit divides evenly; everything else is Unrecognized and the
+ * caller can tell the user to write the cron they actually want.
+ */
+const minutesDivideEvenly = (n) => {
+    return n >= 2 && n <= 59 && 60 % n === 0;
+};
+const hoursDivideEvenly = (n) => {
+    return n >= 2 && n <= 23 && 24 % n === 0;
+};
+/*
+ * Labels the dashboard dropdown offers, mirrored here because Common cannot
+ * import from the App package. MonitoringIntervalLabelParity.test.ts fails
+ * if MonitorIntervalDropdownOptions.ts and this list ever drift apart — that
+ * test is the link, not this comment.
+ */
+const DASHBOARD_DROPDOWN_LABELS = {
+    "every minute": "* * * * *",
+    "every 2 minutes": "*/2 * * * *",
+    "every 5 minutes": "*/5 * * * *",
+    "every 10 minutes": "*/10 * * * *",
+    "every 15 minutes": "*/15 * * * *",
+    "every 30 minutes": "*/30 * * * *",
+    "every hour": "0 * * * *",
+    "every 2 hours": "0 */2 * * *",
+    "every 3 hours": "0 */3 * * *",
+    "every 6 hours": "0 */6 * * *",
+    "every 12 hours": "0 */12 * * *",
+    "every day": "0 0 * * *",
+};
+/*
+ * Bare adverbs, which carry no number to run through the grammar.
+ */
+const ADVERB_LABELS = {
+    minutely: "* * * * *",
+    hourly: "0 * * * *",
+    daily: "0 0 * * *",
+    nightly: "0 0 * * *",
+    weekly: "0 0 * * 0",
+    monthly: "0 0 1 * *",
+    yearly: "0 0 1 1 *",
+    annually: "0 0 1 1 *",
+};
+/*
+ * The unit vocabulary the duration grammar accepts. Seconds are deliberately
+ * absent: the claim loop runs once a minute, so a sub-minute cadence cannot
+ * be honoured and accepting one would promise a rate we never deliver.
+ */
+/*
+ * Numbers written as words. "Every Five Minutes" is in the production
+ * census, so the grammar has to read these; the range stops where a cadence
+ * stops being plausible rather than trying to be a general number parser.
+ */
+const SPELLED_NUMBERS = {
+    a: 1,
+    an: 1,
+    one: 1,
+    two: 2,
+    three: 3,
+    four: 4,
+    five: 5,
+    six: 6,
+    seven: 7,
+    eight: 8,
+    nine: 9,
+    ten: 10,
+    eleven: 11,
+    twelve: 12,
+    fifteen: 15,
+    twenty: 20,
+    thirty: 30,
+    sixty: 60,
+};
+const DIGITS_ONLY = /^\d+$/u;
+const MINUTE_UNITS = [
+    "m",
+    "min",
+    "mins",
+    "minute",
+    "minutes",
+];
+const HOUR_UNITS = ["h", "hr", "hrs", "hour", "hours"];
+const DAY_UNITS = ["d", "day", "days"];
+const WEEK_UNITS = ["w", "week", "weeks"];
+class MonitoringIntervalUtil {
+    /*
+     * Lowercase, collapse any run of whitespace (including the non-breaking
+     * space that survives a copy-paste out of our docs) to one space, and drop
+     * wrapping quotes and a trailing period. Lookup keys are built this way so
+     * "EVERY  5   MINUTES." and "every 5 minutes" are the same key.
+     *
+     * toLowerCase, not toLocaleLowerCase: in a Turkish locale the latter maps
+     * "I" to a dotless i and the table would stop matching.
+     */
+    static toLookupKey(value) {
+        return value
+            .replace(/[\s\u00a0]+/g, " ")
+            .trim()
+            .replace(/^["']+|["']+$/g, "")
+            .replace(/\.+$/, "")
+            .trim()
+            .toLowerCase();
+    }
+    /*
+     * The preset labels we ship, keyed for lookup. Built by iterating
+     * CronTab.PRESETS rather than retyping them, so a preset added there is
+     * understood here without anyone remembering to update this file.
+     */
+    static buildLabelTable() {
+        const table = {};
+        for (const preset of CronTab.PRESETS) {
+            table[MonitoringIntervalUtil.toLookupKey(preset.label)] = preset.value;
+        }
+        /*
+         * The dashboard's own labels win where the two lists disagree on
+         * wording, because that is what an operator sees on screen and what
+         * they are most likely to paste into an API call.
+         */
+        for (const [label, cron] of Object.entries(DASHBOARD_DROPDOWN_LABELS)) {
+            table[label] = cron;
+        }
+        for (const [label, cron] of Object.entries(ADVERB_LABELS)) {
+            table[label] = cron;
+        }
+        return table;
+    }
+    static getLabelTable() {
+        if (!MonitoringIntervalUtil.labelTable) {
+            MonitoringIntervalUtil.labelTable =
+                MonitoringIntervalUtil.buildLabelTable();
+        }
+        return MonitoringIntervalUtil.labelTable;
+    }
+    /*
+     * "5m", "every 5 minutes", "2 hrs", "1 day" -> cron, or null.
+     *
+     * A missing count means one ("every minute", "hourly" handled above;
+     * "minute" and "m" land here). The divisor guards above decide whether a
+     * count is expressible as a cron step at all.
+     */
+    static fromDurationGrammar(key) {
+        /*
+         * A digit may sit flush against its unit ("5m"); a spelled-out number
+         * needs a separator or "fiveminutes" would parse. Hence the two
+         * alternatives rather than one `\s*`.
+         */
+        const match = key.match(/^(every\s+)?(?:(\d+)\s*|([a-z]+)\s+)?([a-z]+)$/);
+        if (!match) {
+            return null;
+        }
+        const hasEveryPrefix = Boolean(match[1]);
+        const digitCount = match[2];
+        const wordCount = match[3];
+        const unit = match[4];
+        const rawCount = digitCount !== null && digitCount !== void 0 ? digitCount : wordCount;
+        let count;
+        if (rawCount === undefined) {
+            /*
+             * A bare unit with no count and no "every" is not a cadence, it is a
+             * noun: "minutes" tells us nothing. Require one or the other, so
+             * "every minute" and "1 minute" are read and "minutes" is refused.
+             */
+            if (!hasEveryPrefix) {
+                return null;
+            }
+            count = 1;
+        }
+        else if (DIGITS_ONLY.test(rawCount)) {
+            count = parseInt(rawCount, 10);
+        }
+        else {
+            /*
+             * Spelled-out numbers: "Every Five Minutes" is a real production
+             * value, so the grammar has to read words as well as digits.
+             */
+            const spelled = SPELLED_NUMBERS[rawCount];
+            if (spelled === undefined) {
+                return null;
+            }
+            count = spelled;
+        }
+        if (!Number.isFinite(count) || count < 1) {
+            return null;
+        }
+        if (MINUTE_UNITS.includes(unit)) {
+            if (count === 1) {
+                return "* * * * *";
+            }
+            if (count === 60) {
+                return "0 * * * *";
+            }
+            return minutesDivideEvenly(count) ? `*/${count} * * * *` : null;
+        }
+        if (HOUR_UNITS.includes(unit)) {
+            if (count === 1) {
+                return "0 * * * *";
+            }
+            if (count === 24) {
+                return "0 0 * * *";
+            }
+            return hoursDivideEvenly(count) ? `0 */${count} * * *` : null;
+        }
+        if (DAY_UNITS.includes(unit)) {
+            return count === 1 ? "0 0 * * *" : null;
+        }
+        if (WEEK_UNITS.includes(unit)) {
+            return count === 1 ? "0 0 * * 0" : null;
+        }
+        return null;
+    }
+    /**
+     * Read a stored (or inbound) monitoring interval.
+     *
+     * Never throws. Never guesses at something it does not understand — an
+     * unrecognized value comes back as Unrecognized with a null cron, and the
+     * caller decides whether that is a 400, a log line, or a skipped row.
+     */
+    static normalize(value) {
+        if (value === null || value === undefined || typeof value !== "string") {
+            return {
+                status: MonitoringIntervalNormalizationStatus.Empty,
+                cron: null,
+                input: null,
+            };
+        }
+        const collapsed = value.replace(/[\s\u00a0]+/g, " ").trim();
+        if (collapsed === "") {
+            return {
+                status: MonitoringIntervalNormalizationStatus.Empty,
+                cron: null,
+                input: value,
+            };
+        }
+        /*
+         * Valid cron first, and on the RAW value.
+         *
+         * This is what keeps the ~4,700 rows that were always correct on an
+         * identical code path, byte for byte. It also means anything cron-parser
+         * accepts but this hand-rolled grammar does not — "@hourly", six-field
+         * expressions, step/range combinations nobody here anticipated — is
+         * passed through untouched rather than being "corrected" into something
+         * else. A normalizer that disagrees with the runtime parser would
+         * reintroduce this very bug in mirror image.
+         */
+        if (CronTab.isValid(collapsed)) {
+            return {
+                status: collapsed === value
+                    ? MonitoringIntervalNormalizationStatus.AlreadyCanonical
+                    : MonitoringIntervalNormalizationStatus.Normalized,
+                cron: collapsed,
+                input: value,
+            };
+        }
+        const key = MonitoringIntervalUtil.toLookupKey(collapsed);
+        const fromLabel = MonitoringIntervalUtil.getLabelTable()[key];
+        if (fromLabel) {
+            return {
+                status: MonitoringIntervalNormalizationStatus.Normalized,
+                cron: fromLabel,
+                input: value,
+            };
+        }
+        /*
+         * "every-1-min" and friends: treat a hyphen or underscore as a space and
+         * try the label table and the grammar again. Done after the plain
+         * lookup so a legitimate cron is never mangled by it.
+         */
+        const looseKey = key.replace(/[-_]+/g, " ").replace(/\s+/g, " ");
+        const fromLooseLabel = MonitoringIntervalUtil.getLabelTable()[looseKey];
+        if (fromLooseLabel) {
+            return {
+                status: MonitoringIntervalNormalizationStatus.Normalized,
+                cron: fromLooseLabel,
+                input: value,
+            };
+        }
+        const fromGrammar = MonitoringIntervalUtil.fromDurationGrammar(key) ||
+            MonitoringIntervalUtil.fromDurationGrammar(looseKey);
+        if (fromGrammar) {
+            return {
+                status: MonitoringIntervalNormalizationStatus.Normalized,
+                cron: fromGrammar,
+                input: value,
+            };
+        }
+        return {
+            status: MonitoringIntervalNormalizationStatus.Unrecognized,
+            cron: null,
+            input: value,
+        };
+    }
+    /**
+     * The cron this value means, or null if it is empty or not understood.
+     *
+     * The convenience form for read paths that only want a schedule and have
+     * their own fallback for "no schedule".
+     */
+    static toCronOrNull(value) {
+        return MonitoringIntervalUtil.normalize(value).cron;
+    }
+    /**
+     * The canonical cron for a recognised cadence label, for building error
+     * messages that tell the caller what to write instead.
+     */
+    static getSuggestedCronForMessage() {
+        return "*/5 * * * *";
+    }
+}
+MonitoringIntervalUtil.labelTable = null;
+export default MonitoringIntervalUtil;
+//# sourceMappingURL=MonitoringIntervalUtil.js.map

package/build/dist/Utils/Monitor/MonitoringIntervalUtil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MonitoringIntervalUtil.js","sourceRoot":"","sources":["../../../../Utils/Monitor/MonitoringIntervalUtil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,OAAO,MAAM,YAAY,CAAC;AAEjC,MAAM,CAAN,IAAY,qCAYX;AAZD,WAAY,qCAAqC;IAC/C;;;OAGG;IACH,wDAAe,CAAA;IACf,+DAA+D;IAC/D,8EAAqC,CAAA;IACrC,kDAAkD;IAClD,kEAAyB,CAAA;IACzB,yDAAyD;IACzD,sEAA6B,CAAA;AAC/B,CAAC,EAZW,qCAAqC,KAArC,qCAAqC,QAYhD;AAUD;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAA2B,CAAC,CAAS,EAAW,EAAE;IACzE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAA2B,CAAC,CAAS,EAAW,EAAE;IACvE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,yBAAyB,GAA2B;IACxD,cAAc,EAAE,WAAW;IAC3B,iBAAiB,EAAE,aAAa;IAChC,iBAAiB,EAAE,aAAa;IAChC,kBAAkB,EAAE,cAAc;IAClC,kBAAkB,EAAE,cAAc;IAClC,kBAAkB,EAAE,cAAc;IAClC,YAAY,EAAE,WAAW;IACzB,eAAe,EAAE,aAAa;IAC9B,eAAe,EAAE,aAAa;IAC9B,eAAe,EAAE,aAAa;IAC9B,gBAAgB,EAAE,cAAc;IAChC,WAAW,EAAE,WAAW;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAA2B;IAC5C,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,eAAe,GAA2B;IAC9C,CAAC,EAAE,CAAC;IACJ,EAAE,EAAE,CAAC;IACL,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,WAAW,GAAW,QAAQ,CAAC;AAErC,MAAM,YAAY,GAA0B;IAC1C,GAAG;IACH,KAAK;IACL,MAAM;IACN,QAAQ;IACR,SAAS;CACV,CAAC;AACF,MAAM,UAAU,GAA0B,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9E,MAAM,SAAS,GAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,MAAM,UAAU,GAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjE,MAAqB,sBAAsB;IACzC;;;;;;;;OAQG;IACK,MAAM,CAAC,WAAW,CAAC,KAAa;QACtC,OAAO,KAAK;aACT,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;aAC5B,IAAI,EAAE;aACN,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;aAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,eAAe;QAC5B,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,sBAAsB,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACzE,CAAC;QAED;;;;WAIG;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACtE,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAIO,MAAM,CAAC,aAAa;QAC1B,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,CAAC;YACvC,sBAAsB,CAAC,UAAU;gBAC/B,sBAAsB,CAAC,eAAe,EAAE,CAAC;QAC7C,CAAC;QAED,OAAO,sBAAsB,CAAC,UAAU,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,mBAAmB,CAAC,GAAW;QAC5C;;;;WAIG;QACH,MAAM,KAAK,GAA4B,GAAG,CAAC,KAAK,CAC9C,gDAAgD,CACjD,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,UAAU,GAAuB,KAAK,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAuB,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAW,KAAK,CAAC,CAAC,CAAE,CAAC;QAC/B,MAAM,QAAQ,GAAuB,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,SAAS,CAAC;QAE7D,IAAI,KAAa,CAAC;QAElB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B;;;;eAIG;YACH,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN;;;eAGG;YACH,MAAM,OAAO,GAAuB,eAAe,CAAC,QAAQ,CAAC,CAAC;YAE9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,SAAS,CACrB,KAAgC;QAEhC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO;gBACL,MAAM,EAAE,qCAAqC,CAAC,KAAK;gBACnD,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAW,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAEpE,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACrB,OAAO;gBACL,MAAM,EAAE,qCAAqC,CAAC,KAAK;gBACnD,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,MAAM,EACJ,SAAS,KAAK,KAAK;oBACjB,CAAC,CAAC,qCAAqC,CAAC,gBAAgB;oBACxD,CAAC,CAAC,qCAAqC,CAAC,UAAU;gBACtD,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAW,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAElE,MAAM,SAAS,GACb,sBAAsB,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,MAAM,EAAE,qCAAqC,CAAC,UAAU;gBACxD,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,MAAM,QAAQ,GAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAEzE,MAAM,cAAc,GAClB,sBAAsB,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEnD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO;gBACL,MAAM,EAAE,qCAAqC,CAAC,UAAU;gBACxD,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,sBAAsB,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAC/C,sBAAsB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,qCAAqC,CAAC,UAAU;gBACxD,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,KAAK;aACb,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,qCAAqC,CAAC,YAAY;YAC1D,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,KAAgC;QACzD,OAAO,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,0BAA0B;QACtC,OAAO,aAAa,CAAC;IACvB,CAAC;;AA9Nc,iCAAU,GAAkC,IAAI,CAAC;eAhD7C,sBAAsB"}

package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js

@@ -22,7 +22,10 @@ import { buildObservables, contentHashEventUid, flattenPayload, parseEventTime,
  * metadata; the others still have an id, timestamps, tags and (for SOAR)
  * the originating system, which is enough for a finding row.
  */
-const DETECTION_FINDING_CLASS_UID = 2004;
+export const DETECTION_FINDING_CLASS_UID = 2004;
+// The source every row this normalizer writes is attributed to.
+export const GOOGLE_SECOPS_VENDOR_NAME = "Google";
+export const GOOGLE_SECOPS_PRODUCT_NAME = "Google SecOps";
 /*
  * How many sample events to mine for observables. Detections can carry
  * hundreds of matched events; a handful is enough to identify the
@@ -42,6 +45,20 @@ const COLLECTION_TYPES = [
     "MACHINE_INTELLIGENCE_ALERT",
     "SOAR_ALERT",
 ];
+/*
+ * Google's recommended risk_score ranges for custom detections, highest
+ * band first (https://docs.cloud.google.com/chronicle/docs/yara-l/outcome-syntax):
+ * 90-100 critical, 80-89 high, 50-79 medium, 20-49 low, 1-19 observations.
+ * A score grades into the first band whose minimum it reaches; a score of
+ * zero or less grades nothing.
+ */
+export const GOOGLE_SECOPS_RISK_SCORE_BANDS = [
+    { minimum: 90, severity: OcsfSeverity.Critical },
+    { minimum: 80, severity: OcsfSeverity.High },
+    { minimum: 50, severity: OcsfSeverity.Medium },
+    { minimum: 20, severity: OcsfSeverity.Low },
+    { minimum: 0, severity: OcsfSeverity.Informational },
+];
 function collectSampleEvents(payload) {
     var _a;
     const events = [];
@@ -86,6 +103,108 @@ function readDetectionEntry(payload) {
     }
     return null;
 }
+/*
+ * Every value stored under one key of a Google key/value list. ruleLabels
+ * and outcomes both arrive as [{ key, value }]; a plain object map is
+ * accepted too, the shape a hand-built webhook body may use. Keys compare
+ * trimmed and case-insensitively because YARA-L meta keys are free text.
+ */
+function readKeyedValues(list, key) {
+    const wanted = key.toLowerCase();
+    const values = [];
+    if (Array.isArray(list)) {
+        for (const entry of list) {
+            if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+                continue;
+            }
+            const entryKey = entry["key"];
+            if (typeof entryKey === "string" &&
+                entryKey.trim().toLowerCase() === wanted) {
+                values.push(entry["value"]);
+            }
+        }
+        return values;
+    }
+    if (list && typeof list === "object") {
+        for (const entryKey of Object.keys(list)) {
+            if (entryKey.trim().toLowerCase() === wanted) {
+                values.push(list[entryKey]);
+            }
+        }
+    }
+    return values;
+}
+/*
+ * A severity only when the text names one. "Unknown" is the absence of a
+ * grade, not a grade, so it does not stop the search for a real one.
+ */
+function gradeSeverityText(value) {
+    if (typeof value !== "string" && typeof value !== "number") {
+        return null;
+    }
+    const severity = normalizeOcsfSeverity(String(value));
+    return severity === OcsfSeverity.Unknown ? null : severity;
+}
+function gradeRiskScore(value) {
+    let score = Number.NaN;
+    if (typeof value === "number") {
+        score = value;
+    }
+    else if (typeof value === "string" && value.trim() !== "") {
+        score = Number(value);
+    }
+    if (!Number.isFinite(score) || score <= 0) {
+        return null;
+    }
+    for (const band of GOOGLE_SECOPS_RISK_SCORE_BANDS) {
+        if (score >= band.minimum) {
+            return band.severity;
+        }
+    }
+    return null;
+}
+function firstGrade(values, grade) {
+    for (const value of values) {
+        const severity = grade(value);
+        if (severity) {
+            return severity;
+        }
+    }
+    return null;
+}
+/*
+ * Where a detection's severity lives depends on who wrote the rule.
+ *
+ *   1. detection[].severity — Google grades its own curated rules (Applied
+ *      Threat Intelligence, the curated rule sets) here.
+ *   2. The Collection's own severity — SOAR alerts and webhook bodies.
+ *   3. detection[].ruleLabels "severity" — a custom YARA-L rule's
+ *      `meta: severity = "High"`. Google leaves detection[].severity empty
+ *      for these and returns the meta section as ruleLabels; it is the value
+ *      the SecOps rules dashboard shows as the rule's severity.
+ *   4. detection[].outcomes "risk_score" — a rule that sets no severity but
+ *      scores its detections with $risk_score, graded with Google's
+ *      published bands. Only the outcome counts: the bare riskScore field
+ *      is filled with a default (40 when alerting, 15 when not) for rules
+ *      that set no score, and grading that would invent a severity.
+ *
+ * The first two are the only places read before, and they are read first,
+ * so a detection that already graded grades exactly as it did.
+ */
+function resolveSeverity(payload, detection) {
+    var _a;
+    const ruleLabels = detection
+        ? (_a = readValue(detection, "ruleLabels")) !== null && _a !== void 0 ? _a : readValue(detection, "rule_labels")
+        : null;
+    const outcomes = detection
+        ? readValue(detection, "outcomes")
+        : null;
+    return ((detection && gradeSeverityText(readString(detection, "severity"))) ||
+        gradeSeverityText(readString(payload, "severity")) ||
+        firstGrade(readKeyedValues(ruleLabels, "severity"), gradeSeverityText) ||
+        firstGrade(readKeyedValues(outcomes, "risk_score"), gradeRiskScore) ||
+        OcsfSeverity.Unknown);
+}
 function readCollectionType(payload) {
     return readString(payload, "type").toUpperCase();
 }
@@ -174,9 +293,7 @@ export default class GoogleSecOpsAlertNormalizer {
                 readString(detection, "ruleVersionId") ||
                 readString(detection, "rule_version_id")
             : "";
-        const severityName = (detection && normalizeOcsfSeverity(readString(detection, "severity"))) ||
-            normalizeOcsfSeverity(readString(payload, "severity")) ||
-            OcsfSeverity.Unknown;
+        const severityName = resolveSeverity(payload, detection);
         const time = parseEventTime((_c = (_b = (_a = readValue(payload, "detectionTime")) !== null && _a !== void 0 ? _a : readValue(payload, "detection_time")) !== null && _b !== void 0 ? _b : readValue(payload, "createdTime")) !== null && _c !== void 0 ? _c : readValue(payload, "created_time"));
         /*
          * Mine the matched UDM sample events for entities. The detection row's
@@ -216,8 +333,8 @@ export default class GoogleSecOpsAlertNormalizer {
                 readString(payload, "detection.alert_state") ||
                 "",
             message,
-            vendorName: "Google",
-            productName: "Google SecOps",
+            vendorName: GOOGLE_SECOPS_VENDOR_NAME,
+            productName: GOOGLE_SECOPS_PRODUCT_NAME,
             ruleId,
             ruleName,
             mitreTactics: firstSample ? firstSample.mitreTactics : [],

package/build/dist/Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleSecOpsAlertNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,2BAA2B,GAAW,IAAI,CAAC;AAEjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,gBAAgB,GAAkB;IACtC,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,4BAA4B;IAC5B,YAAY;CACb,CAAC;AAEF,SAAS,mBAAmB,CAAC,OAAmB;;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,kBAAkB,GACtB,MAAA,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,mCACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAc,SAAS,CACrC,OAAqB,EACrB,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAc,SAAS,CAAC,SAAuB,EAAE,OAAO,CAAC,CAAC;YAErE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,SAAS,GAAc,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAc,SAAS,CAAC,CAAC,CAAc,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAmB;IACnC,MAAM,IAAI,GAAc,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAc,EAAW,EAAE;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC,CAAkB,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,OAAmB;IACpD,MAAM,UAAU,GACd,UAAU,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;IAEzD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,YAAY,GAAW;QAC3B,UAAU,CAAC,OAAO,EAAE,0BAA0B,CAAC;YAC7C,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC;YAC9C,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC;QACpD,UAAU,CAAC,OAAO,EAAE,gCAAgC,CAAC;YACnD,UAAU,CAAC,OAAO,EAAE,mCAAmC,CAAC;KAC3D;SACE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAChC,OAAO,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,GAAG,YAAY,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAkB,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAW,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD;;;OAGG;IACH,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,OAAO,iBAAiB,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,2BAA2B;IACvC,MAAM,CAAC,mBAAmB,CAAC,OAAmB;QACnD,MAAM,IAAI,GAAW,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjD;;;;WAIG;QACH,IACE,kBAAkB,CAAC,OAAO,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,MAAM,EAAE,GAAc,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE/C,OAAO,CACL,OAAO,EAAE,KAAK,QAAQ;YACtB,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAChB,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,SAAS,GAAsB,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAW,SAAS;YAChC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAW,SAAS;YAC9B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/B,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC;gBACtC,UAAU,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,YAAY,GAChB,CAAC,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtD,YAAY,CAAC,OAAO,CAAC;QAEvB,MAAM,IAAI,GAAgB,cAAc,CACtC,MAAA,MAAA,MAAA,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,mCACpC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CACrC,CAAC;QAEF;;;;;WAKG;QACH,MAAM,YAAY,GAAsB,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAkB,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAmC,IAAI,CAAC;QAEvD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,UAAU,GACd,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC;YAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,WAAW,GAAW,SAAS;YACnC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GACX,QAAQ;YACR,WAAW;YACX,yBAAyB,CAAC,OAAO,CAAC;YAClC,yBAAyB,CAAC;QAE5B,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,mBAAmB;YAC9B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EACR,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAC3C,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAC5C,EAAE;YACJ,OAAO;YACP,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,eAAe;YAC5B,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YACzD,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;YAC/D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvD,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACjD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;YAC7D,WAAW,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"GoogleSecOpsAlertNormalizer.js","sourceRoot":"","sources":["../../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer.ts"],"names":[],"mappings":"AAEA,OAAO,YAAY,EAAE,EACnB,cAAc,EACd,qBAAqB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,UAAU,EACV,SAAS,GACV,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAW,IAAI,CAAC;AAExD,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAW,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAW,eAAe,CAAC;AAElE;;;;GAIG;AACH,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,gBAAgB,GAAkB;IACtC,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,4BAA4B;IAC5B,YAAY;CACb,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAGtC;IACH,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;IAChD,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE;IAC5C,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE;IAC9C,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,EAAE;IAC3C,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,aAAa,EAAE;CACrD,CAAC;AAEF,SAAS,mBAAmB,CAAC,OAAmB;;IAC9C,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,kBAAkB,GACtB,MAAA,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,mCACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAc,SAAS,CACrC,OAAqB,EACrB,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAc,SAAS,CAAC,SAAuB,EAAE,OAAO,CAAC,CAAC;YAErE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,MAAM,SAAS,GAAc,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAc,SAAS,CAAC,CAAC,CAAc,CAAC;QACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,KAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,SAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAe,EAAE,GAAW;IACnD,MAAM,MAAM,GAAW,GAAG,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAe,KAAoB,CAAC,KAAK,CAAc,CAAC;YAEtE,IACE,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EACxC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAE,KAAoB,CAAC,OAAO,CAAc,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAkB,CAAC,EAAE,CAAC;YACvD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAE,IAAmB,CAAC,QAAQ,CAAc,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAgB;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAwB,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3E,OAAO,QAAQ,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,IAAI,KAAK,GAAW,MAAM,CAAC,GAAG,CAAC;IAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5D,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,8BAA8B,EAAE,CAAC;QAClD,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,MAAwB,EACxB,KAAgD;IAEhD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAwB,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,eAAe,CACtB,OAAmB,EACnB,SAA4B;;IAE5B,MAAM,UAAU,GAAc,SAAS;QACrC,CAAC,CAAC,MAAA,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,mCAAI,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,QAAQ,GAAc,SAAS;QACnC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC;IAET,OAAO,CACL,CAAC,SAAS,IAAI,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACnE,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClD,UAAU,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC;QACtE,UAAU,CAAC,eAAe,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC;QACnE,YAAY,CAAC,OAAO,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAmB;IACnC,MAAM,IAAI,GAAc,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAc,EAAW,EAAE;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC,CAAkB,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,OAAmB;IACpD,MAAM,UAAU,GACd,UAAU,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;IAEzD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,YAAY,GAAW;QAC3B,UAAU,CAAC,OAAO,EAAE,0BAA0B,CAAC;YAC7C,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC;YAC9C,UAAU,CAAC,OAAO,EAAE,6BAA6B,CAAC;QACpD,UAAU,CAAC,OAAO,EAAE,gCAAgC,CAAC;YACnD,UAAU,CAAC,OAAO,EAAE,mCAAmC,CAAC;KAC3D;SACE,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAChC,OAAO,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,GAAG,YAAY,QAAQ,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAkB,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAW,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD;;;OAGG;IACH,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,OAAO,iBAAiB,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,2BAA2B;IACvC,MAAM,CAAC,mBAAmB,CAAC,OAAmB;QACnD,MAAM,IAAI,GAAW,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjD;;;;WAIG;QACH,IACE,kBAAkB,CAAC,OAAO,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC;YACxC,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,MAAM,EAAE,GAAc,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE/C,OAAO,CACL,OAAO,EAAE,KAAK,QAAQ;YACtB,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAChB,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,SAAS,CAAC,OAAmB;;QACzC,MAAM,SAAS,GAAsB,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEjE,MAAM,QAAQ,GAAW,SAAS;YAChC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAW,SAAS;YAC9B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAC/B,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC;gBAChC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC;gBACtC,UAAU,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC1C,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,YAAY,GAAiB,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEvE,MAAM,IAAI,GAAgB,cAAc,CACtC,MAAA,MAAA,MAAA,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,mCACpC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,mCACjC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CACrC,CAAC;QAEF;;;;;WAKG;QACH,MAAM,YAAY,GAAsB,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAkB,EAAE,CAAC;QAC5C,IAAI,WAAW,GAAmC,IAAI,CAAC;QAEvD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,UAAU,GACd,aAAa,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,UAAU,CAAC;YAC3B,CAAC;YAED,iBAAiB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,uBAAuB,CAC3D,2BAA2B,CAC5B,CAAC;QAEF,MAAM,WAAW,GAAW,SAAS;YACnC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,OAAO,GACX,QAAQ;YACR,WAAW;YACX,yBAAyB,CAAC,OAAO,CAAC;YAClC,yBAAyB,CAAC;QAE5B,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE;YACxB,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,YAAY;YACZ,QAAQ,EAAE,2BAA2B;YACrC,SAAS,EAAE,mBAAmB;YAC9B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,cAAc,CAAC,YAAY,CAAC;YACxC,YAAY;YACZ,UAAU,EACR,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAC3C,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAC5C,EAAE;YACJ,OAAO;YACP,UAAU,EAAE,yBAAyB;YACrC,WAAW,EAAE,0BAA0B;YACvC,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YACzD,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;YAC/D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC3D,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YACvD,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACrD,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACjD,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;YAC7D,WAAW,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC;SACpC,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Utils/SecurityEvent/Sigma/SigmaRuleParser.js

@@ -1,6 +1,6 @@
 import yaml from "js-yaml";
 import BadDataException from "../../../Types/Exception/BadDataException";
-import { SigmaLevel, } from "../../../Types/SecurityEvent/SigmaRule";
+import { SIGMA_DEFAULT_LEVEL, SIGMA_SUPPORTED_MODIFIERS, SigmaLevel, } from "../../../Types/SecurityEvent/SigmaRule";
 /*
  * Sigma YAML -> typed SigmaRule.
  *
@@ -11,21 +11,7 @@ import { SigmaLevel, } from "../../../Types/SecurityEvent/SigmaRule";
  * error rather than silently ignored — a rule that parses is a rule the
  * engine evaluates faithfully.
  */
-const SUPPORTED_MODIFIERS = new Set([
-    "contains",
-    "startswith",
-    "endswith",
-    "all",
-    "re",
-    "cased",
-    "gt",
-    "gte",
-    "lt",
-    "lte",
-    "cidr",
-    "exists",
-    "windash",
-]);
+const SUPPORTED_MODIFIERS = new Set(SIGMA_SUPPORTED_MODIFIERS);
 const WHITESPACE_REGEX = /\s/;
 const COUNT_REGEX = /^\d+$/;
 const TACTIC_TAG_REGEX = /^ta\d{4}$/i;
@@ -306,10 +292,10 @@ export default class SigmaRuleParser {
         const condition = new ConditionParser(tokenizeCondition(conditionRaw)).parse();
         // Every referenced selection must exist.
         this.validateConditionReferences(condition, selections);
-        const levelRaw = String(doc["level"] || "medium").toLowerCase();
+        const levelRaw = String(doc["level"] || SIGMA_DEFAULT_LEVEL).toLowerCase();
         const level = Object.values(SigmaLevel).includes(levelRaw)
             ? levelRaw
-            : SigmaLevel.Medium;
+            : SIGMA_DEFAULT_LEVEL;
         const tags = Array.isArray(doc["tags"])
             ? doc["tags"].map((tag) => {
                 return String(tag);