@panguard-ai/threat-cloud 0.2.0 → 0.2.2

package/dist/sighting-store.js

@@ -1,191 +0,0 @@
-/**
- * Sighting Store — IoC observation tracking with learning feedback
- * 觀測儲存 — IoC 觀測追蹤與學習回饋
- *
- * When agents (Guard/Trap) report threats that match existing IoCs,
- * sightings are created and feed back into the reputation engine.
- * Positive sightings boost confidence; false positives flag for review.
- *
- * @module @panguard-ai/threat-cloud/sighting-store
- */
-function rowToRecord(row) {
-    return {
-        id: row.id,
-        iocId: row.ioc_id,
-        type: row.type,
-        source: row.source,
-        confidence: row.confidence,
-        details: row.details,
-        actorHash: row.actor_hash,
-        createdAt: row.created_at,
-    };
-}
-/** Confidence adjustment per sighting type */
-const CONFIDENCE_DELTA = {
-    positive: 5,
-    negative: -10,
-    false_positive: -25,
-};
-export class SightingStore {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    /**
-     * Record a new sighting for an IoC.
-     * Updates the IoC's confidence and status based on sighting type.
-     * 記錄新的觀測，根據觀測類型更新 IoC 信心度和狀態
-     */
-    createSighting(input, actorHash = '') {
-        const sightingConfidence = input.confidence ?? 50;
-        const result = this.db
-            .prepare(`INSERT INTO sightings (ioc_id, type, source, confidence, details, actor_hash)
-         VALUES (?, ?, ?, ?, ?, ?)`)
-            .run(input.iocId, input.type, input.source, sightingConfidence, input.details ?? '', actorHash);
-        // Apply feedback to the IoC
-        this.applyFeedback(input.iocId, input.type, sightingConfidence);
-        return this.getSightingById(Number(result.lastInsertRowid));
-    }
-    /**
-     * Auto-create a positive sighting when agent data matches an existing IoC.
-     * Called from threat/trap-intel upload handlers.
-     * 當 Agent 資料匹配現有 IoC 時自動建立正面觀測
-     */
-    recordAgentMatch(iocId, source, actorHash = '') {
-        return this.createSighting({
-            iocId,
-            type: 'positive',
-            source: `agent:${source}`,
-            confidence: source === 'trap' ? 70 : 55,
-            details: `Auto-sighting from ${source} agent match`,
-        }, actorHash);
-    }
-    /**
-     * Record cross-source correlation: same IoC seen by both Guard and Trap.
-     * Gives a larger confidence boost than single-source sightings.
-     * 跨來源關聯：同一 IoC 被 Guard 和 Trap 同時看到時，信心度提升更大
-     */
-    recordCrossSourceMatch(iocId, actorHash = '') {
-        // Check if we already have sightings from both guard and trap
-        const sources = this.db
-            .prepare(`SELECT DISTINCT source FROM sightings
-         WHERE ioc_id = ? AND type = 'positive' AND source LIKE 'agent:%'`)
-            .all(iocId);
-        const hasGuard = sources.some((s) => s.source === 'agent:guard');
-        const hasTrap = sources.some((s) => s.source === 'agent:trap');
-        if (hasGuard && hasTrap) {
-            // Already have cross-source — check if we already recorded this
-            const existing = this.db
-                .prepare(`SELECT id FROM sightings
-           WHERE ioc_id = ? AND source = 'cross-source-correlation'
-           AND created_at > datetime('now', '-1 day')`)
-                .get(iocId);
-            if (existing)
-                return null;
-            return this.createSighting({
-                iocId,
-                type: 'positive',
-                source: 'cross-source-correlation',
-                confidence: 85,
-                details: 'Confirmed by both Guard and Trap agents',
-            }, actorHash);
-        }
-        return null;
-    }
-    /**
-     * Get sightings for an IoC / 取得 IoC 的觀測記錄
-     */
-    getSightingsForIoC(iocId, pagination) {
-        const safePage = Math.max(1, pagination.page);
-        const safeLimit = Math.min(Math.max(1, pagination.limit), 500);
-        const offset = (safePage - 1) * safeLimit;
-        const total = this.db.prepare('SELECT COUNT(*) as count FROM sightings WHERE ioc_id = ?').get(iocId).count;
-        const rows = this.db
-            .prepare(`SELECT * FROM sightings WHERE ioc_id = ?
-         ORDER BY created_at DESC LIMIT ? OFFSET ?`)
-            .all(iocId, safeLimit, offset);
-        return {
-            items: rows.map(rowToRecord),
-            total,
-            page: safePage,
-            limit: safeLimit,
-            hasMore: offset + safeLimit < total,
-        };
-    }
-    /**
-     * Get sighting summary for an IoC / 取得 IoC 的觀測摘要
-     */
-    getSightingSummary(iocId) {
-        const row = this.db
-            .prepare(`SELECT
-          COUNT(*) as total,
-          SUM(CASE WHEN type = 'positive' THEN 1 ELSE 0 END) as positive,
-          SUM(CASE WHEN type = 'negative' THEN 1 ELSE 0 END) as negative,
-          SUM(CASE WHEN type = 'false_positive' THEN 1 ELSE 0 END) as false_positive,
-          COUNT(DISTINCT source) as unique_sources,
-          MAX(created_at) as last_seen
-        FROM sightings WHERE ioc_id = ?`)
-            .get(iocId);
-        return {
-            total: row.total,
-            positive: row.positive,
-            negative: row.negative,
-            falsePositive: row.false_positive,
-            uniqueSources: row.unique_sources,
-            lastSeen: row.last_seen,
-        };
-    }
-    /**
-     * Get recent sighting count within time window / 取得時間窗口內的近期觀測數量
-     */
-    getRecentSightingCount(iocId, windowHours = 24) {
-        return this.db
-            .prepare(`SELECT COUNT(*) as count FROM sightings
-           WHERE ioc_id = ? AND created_at > datetime('now', '-' || ? || ' hours')`)
-            .get(iocId, windowHours).count;
-    }
-    /** Get sighting by ID */
-    getSightingById(id) {
-        const row = this.db.prepare('SELECT * FROM sightings WHERE id = ?').get(id);
-        return row ? rowToRecord(row) : null;
-    }
-    /**
-     * Apply sighting feedback to IoC confidence and status.
-     * 將觀測回饋套用到 IoC 的信心度和狀態
-     */
-    applyFeedback(iocId, type, _sightingConfidence) {
-        const delta = CONFIDENCE_DELTA[type];
-        if (type === 'false_positive') {
-            // Mark IoC as under review and reduce confidence
-            this.db
-                .prepare(`UPDATE iocs SET
-            status = 'under_review',
-            confidence = MAX(0, MIN(100, confidence + ?)),
-            updated_at = datetime('now')
-          WHERE id = ? AND status != 'revoked'`)
-                .run(delta, iocId);
-        }
-        else if (type === 'positive') {
-            // Boost confidence and update last_seen
-            this.db
-                .prepare(`UPDATE iocs SET
-            confidence = MAX(0, MIN(100, confidence + ?)),
-            sightings = sightings + 1,
-            last_seen = datetime('now'),
-            status = CASE WHEN status = 'expired' THEN 'active' ELSE status END,
-            updated_at = datetime('now')
-          WHERE id = ?`)
-                .run(delta, iocId);
-        }
-        else {
-            // Negative sighting: reduce confidence
-            this.db
-                .prepare(`UPDATE iocs SET
-            confidence = MAX(0, MIN(100, confidence + ?)),
-            updated_at = datetime('now')
-          WHERE id = ?`)
-                .run(delta, iocId);
-        }
-    }
-}
-//# sourceMappingURL=sighting-store.js.map

package/dist/sighting-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sighting-store.js","sourceRoot":"","sources":["../src/sighting-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAuBH,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,IAAI,EAAE,GAAG,CAAC,IAAoB;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,gBAAgB,GAAiC;IACrD,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC,EAAE;IACb,cAAc,EAAE,CAAC,EAAE;CACpB,CAAC;AAEF,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD;;;;OAIG;IACH,cAAc,CAAC,KAAoB,EAAE,SAAS,GAAG,EAAE;QACjD,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN;mCAC2B,CAC5B;aACA,GAAG,CACF,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,MAAM,EACZ,kBAAkB,EAClB,KAAK,CAAC,OAAO,IAAI,EAAE,EACnB,SAAS,CACV,CAAC;QAEJ,4BAA4B;QAC5B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,KAAa,EAAE,MAAwB,EAAE,SAAS,GAAG,EAAE;QACtE,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,KAAK;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,SAAS,MAAM,EAAE;YACzB,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACvC,OAAO,EAAE,sBAAsB,MAAM,cAAc;SACpD,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,sBAAsB,CAAC,KAAa,EAAE,SAAS,GAAG,EAAE;QAClD,8DAA8D;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;aACpB,OAAO,CACN;0EACkE,CACnE;aACA,GAAG,CAAC,KAAK,CAA8B,CAAC;QAE3C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;QAE/D,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;YACxB,gEAAgE;YAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;iBACrB,OAAO,CACN;;sDAE4C,CAC7C;iBACA,GAAG,CAAC,KAAK,CAA+B,CAAC;YAE5C,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE1B,OAAO,IAAI,CAAC,cAAc,CACxB;gBACE,KAAK;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,0BAA0B;gBAClC,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,yCAAyC;aACnD,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,kBAAkB,CAChB,KAAa,EACb,UAA4B;QAE5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC;QAE1C,MAAM,KAAK,GACT,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,CAAC,KAAK,CAGtF,CAAC,KAAK,CAAC;QAER,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN;mDAC2C,CAC5C;aACA,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAkB,CAAC;QAElD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAC5B,KAAK;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK;SACpC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,KAAa;QAQ9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CACN;;;;;;;wCAOgC,CACjC;aACA,GAAG,CAAC,KAAK,CAOX,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,QAAQ,EAAE,GAAG,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,KAAa,EAAE,WAAW,GAAG,EAAE;QACpD,OACE,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;mFACyE,CAC1E;aACA,GAAG,CAAC,KAAK,EAAE,WAAW,CAC1B,CAAC,KAAK,CAAC;IACV,CAAC;IAED,yBAAyB;IACjB,eAAe,CAAC,EAAU;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,EAAE,CAE7D,CAAC;QACd,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,KAAa,EAAE,IAAkB,EAAE,mBAA2B;QAClF,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,iDAAiD;YACjD,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;;+CAIqC,CACtC;iBACA,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,wCAAwC;YACxC,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;;;;uBAMa,CACd;iBACA,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,uCAAuC;YACvC,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN;;;uBAGa,CACd;iBACA,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}