@vorionsys/platform-core 0.1.0

package/dist/security/incident/actions/revoke-credentials.js

@@ -0,0 +1,320 @@
+/**
+ * Credential Revocation Action
+ *
+ * Automated credential revocation for compromised accounts.
+ * Handles passwords, API keys, tokens, sessions, and OAuth grants.
+ *
+ * @packageDocumentation
+ * @module security/incident/actions/revoke-credentials
+ */
+import { createLogger } from '../../../common/logger.js';
+const logger = createLogger({ component: 'action-revoke-credentials' });
+// ============================================================================
+// Default Mock Credential Service
+// ============================================================================
+class MockCredentialService {
+    async invalidatePassword(userId) {
+        logger.info('Invalidating password', { userId });
+        await this.simulateOperation(500);
+        return { success: true, resetToken: `reset-${Date.now()}` };
+    }
+    async revokeApiKeys(userId, keyIds) {
+        logger.info('Revoking API keys', { userId, keyIds });
+        await this.simulateOperation(800);
+        const revokedKeyIds = keyIds || ['key-1', 'key-2'];
+        return { success: true, revokedCount: revokedKeyIds.length, keyIds: revokedKeyIds };
+    }
+    async revokeOAuthTokens(userId, clientIds) {
+        logger.info('Revoking OAuth tokens', { userId, clientIds });
+        await this.simulateOperation(600);
+        return { success: true, revokedCount: clientIds?.length || 3 };
+    }
+    async terminateSessions(userId, sessionIds) {
+        logger.info('Terminating sessions', { userId, sessionIds });
+        await this.simulateOperation(400);
+        return { success: true, terminatedCount: sessionIds?.length || 5 };
+    }
+    async revokeSshKeys(userId, keyIds) {
+        logger.info('Revoking SSH keys', { userId, keyIds });
+        await this.simulateOperation(700);
+        return { success: true, revokedCount: keyIds?.length || 2 };
+    }
+    async revokeCertificates(userId, certIds) {
+        logger.info('Revoking certificates', { userId, certIds });
+        await this.simulateOperation(900);
+        return { success: true, revokedCount: certIds?.length || 1 };
+    }
+    async getActiveCredentials(userId) {
+        logger.info('Getting active credentials', { userId });
+        await this.simulateOperation(300);
+        return {
+            apiKeys: ['key-1', 'key-2'],
+            oauthClients: ['client-1', 'client-2', 'client-3'],
+            activeSessions: ['session-1', 'session-2', 'session-3', 'session-4', 'session-5'],
+            sshKeys: ['ssh-1', 'ssh-2'],
+            certificates: ['cert-1'],
+        };
+    }
+    simulateOperation(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}
+// ============================================================================
+// Singleton Credential Service
+// ============================================================================
+let credentialService = new MockCredentialService();
+export function setCredentialService(service) {
+    credentialService = service;
+}
+export function getCredentialService() {
+    return credentialService;
+}
+// ============================================================================
+// Action Implementation
+// ============================================================================
+async function executeRevocation(context) {
+    const { incident, logger: actionLogger, setVariable, getVariable } = context;
+    const startTime = Date.now();
+    const results = [];
+    // Get affected users from incident
+    const affectedUsers = extractAffectedUsers(incident.affectedResources, incident.metadata);
+    if (affectedUsers.length === 0) {
+        actionLogger.warn('No affected users identified for credential revocation');
+        return {
+            success: true,
+            output: { message: 'No affected users identified', results: [] },
+            metrics: { durationMs: Date.now() - startTime, itemsProcessed: 0 },
+            canRollback: false,
+        };
+    }
+    actionLogger.info('Starting credential revocation', {
+        affectedUsers,
+        userCount: affectedUsers.length,
+    });
+    let totalRevoked = 0;
+    let totalFailed = 0;
+    for (const userId of affectedUsers) {
+        try {
+            actionLogger.info('Processing user credentials', { userId });
+            // Get all active credentials
+            const activeCredentials = await credentialService.getActiveCredentials(userId);
+            // 1. Terminate all sessions first (immediate effect)
+            try {
+                const sessionResult = await credentialService.terminateSessions(userId);
+                results.push({
+                    credentialType: 'session',
+                    identifier: userId,
+                    revoked: sessionResult.success,
+                    timestamp: new Date(),
+                    previousState: { terminatedCount: sessionResult.terminatedCount },
+                });
+                if (sessionResult.success) {
+                    totalRevoked += sessionResult.terminatedCount;
+                    actionLogger.info('Sessions terminated', { userId, count: sessionResult.terminatedCount });
+                }
+            }
+            catch (error) {
+                totalFailed++;
+                actionLogger.error('Failed to terminate sessions', { userId, error });
+            }
+            // 2. Invalidate password
+            try {
+                const passwordResult = await credentialService.invalidatePassword(userId);
+                results.push({
+                    credentialType: 'password',
+                    identifier: userId,
+                    revoked: passwordResult.success,
+                    timestamp: new Date(),
+                    previousState: { resetToken: passwordResult.resetToken },
+                });
+                if (passwordResult.success) {
+                    totalRevoked++;
+                    setVariable(`password_reset_token_${userId}`, passwordResult.resetToken);
+                    actionLogger.info('Password invalidated', { userId });
+                }
+            }
+            catch (error) {
+                totalFailed++;
+                actionLogger.error('Failed to invalidate password', { userId, error });
+            }
+            // 3. Revoke API keys
+            if (activeCredentials.apiKeys.length > 0) {
+                try {
+                    const apiKeyResult = await credentialService.revokeApiKeys(userId);
+                    results.push({
+                        credentialType: 'api_key',
+                        identifier: userId,
+                        revoked: apiKeyResult.success,
+                        timestamp: new Date(),
+                        previousState: { revokedKeyIds: apiKeyResult.keyIds },
+                    });
+                    if (apiKeyResult.success) {
+                        totalRevoked += apiKeyResult.revokedCount;
+                        actionLogger.info('API keys revoked', { userId, count: apiKeyResult.revokedCount });
+                    }
+                }
+                catch (error) {
+                    totalFailed++;
+                    actionLogger.error('Failed to revoke API keys', { userId, error });
+                }
+            }
+            // 4. Revoke OAuth tokens
+            if (activeCredentials.oauthClients.length > 0) {
+                try {
+                    const oauthResult = await credentialService.revokeOAuthTokens(userId);
+                    results.push({
+                        credentialType: 'oauth_token',
+                        identifier: userId,
+                        revoked: oauthResult.success,
+                        timestamp: new Date(),
+                        previousState: { revokedCount: oauthResult.revokedCount },
+                    });
+                    if (oauthResult.success) {
+                        totalRevoked += oauthResult.revokedCount;
+                        actionLogger.info('OAuth tokens revoked', { userId, count: oauthResult.revokedCount });
+                    }
+                }
+                catch (error) {
+                    totalFailed++;
+                    actionLogger.error('Failed to revoke OAuth tokens', { userId, error });
+                }
+            }
+            // 5. Revoke SSH keys
+            if (activeCredentials.sshKeys.length > 0) {
+                try {
+                    const sshResult = await credentialService.revokeSshKeys(userId);
+                    results.push({
+                        credentialType: 'ssh_key',
+                        identifier: userId,
+                        revoked: sshResult.success,
+                        timestamp: new Date(),
+                        previousState: { revokedCount: sshResult.revokedCount },
+                    });
+                    if (sshResult.success) {
+                        totalRevoked += sshResult.revokedCount;
+                        actionLogger.info('SSH keys revoked', { userId, count: sshResult.revokedCount });
+                    }
+                }
+                catch (error) {
+                    totalFailed++;
+                    actionLogger.error('Failed to revoke SSH keys', { userId, error });
+                }
+            }
+            // 6. Revoke certificates
+            if (activeCredentials.certificates.length > 0) {
+                try {
+                    const certResult = await credentialService.revokeCertificates(userId);
+                    results.push({
+                        credentialType: 'certificate',
+                        identifier: userId,
+                        revoked: certResult.success,
+                        timestamp: new Date(),
+                        previousState: { revokedCount: certResult.revokedCount },
+                    });
+                    if (certResult.success) {
+                        totalRevoked += certResult.revokedCount;
+                        actionLogger.info('Certificates revoked', { userId, count: certResult.revokedCount });
+                    }
+                }
+                catch (error) {
+                    totalFailed++;
+                    actionLogger.error('Failed to revoke certificates', { userId, error });
+                }
+            }
+        }
+        catch (error) {
+            totalFailed++;
+            actionLogger.error('Error processing user credentials', {
+                userId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    // Store results for reference
+    setVariable('credential_revocation_results', results);
+    const durationMs = Date.now() - startTime;
+    const success = totalFailed === 0;
+    actionLogger.info('Credential revocation completed', {
+        success,
+        totalRevoked,
+        totalFailed,
+        durationMs,
+    });
+    // Credential revocation generally cannot be rolled back (security best practice)
+    return {
+        success,
+        output: {
+            message: success
+                ? `Successfully revoked ${totalRevoked} credential(s) for ${affectedUsers.length} user(s)`
+                : `Revocation completed with ${totalFailed} failure(s), ${totalRevoked} credential(s) revoked`,
+            results,
+            totalRevoked,
+            totalFailed,
+            affectedUsers,
+        },
+        metrics: {
+            durationMs,
+            itemsProcessed: totalRevoked,
+            itemsFailed: totalFailed,
+        },
+        canRollback: false, // Credentials should not be restored after compromise
+        rollbackData: {
+            revocations: results,
+            incidentId: incident.id,
+            canRestore: false,
+        },
+    };
+}
+// ============================================================================
+// Helper Functions
+// ============================================================================
+function extractAffectedUsers(affectedResources, metadata) {
+    const users = new Set();
+    for (const resource of affectedResources) {
+        if (resource.startsWith('user:')) {
+            users.add(resource.replace('user:', ''));
+        }
+        else if (resource.startsWith('account:')) {
+            users.add(resource.replace('account:', ''));
+        }
+    }
+    // Also check metadata for affected users
+    const metadataUsers = metadata?.['affectedUsers'];
+    if (metadataUsers) {
+        metadataUsers.forEach((u) => users.add(u));
+    }
+    // Check for compromised user ID
+    const compromisedUserId = metadata?.['compromisedUserId'];
+    if (compromisedUserId) {
+        users.add(compromisedUserId);
+    }
+    return Array.from(users);
+}
+// ============================================================================
+// Action Definition Export
+// ============================================================================
+export const revokeCredentialsAction = {
+    id: 'revoke-credentials',
+    name: 'Revoke Compromised Credentials',
+    description: 'Revoke all credentials (passwords, API keys, tokens, sessions) for compromised accounts',
+    category: 'containment',
+    riskLevel: 'medium',
+    requiresApproval: false, // Critical action, should execute immediately
+    supportsRollback: false, // Security best practice - don't restore compromised credentials
+    defaultTimeoutMs: 180000, // 3 minutes
+    maxRetries: 3,
+    execute: executeRevocation,
+    validate: async (context) => {
+        const { incident } = context;
+        const affectedUsers = extractAffectedUsers(incident.affectedResources, incident.metadata);
+        if (affectedUsers.length === 0) {
+            return {
+                valid: false,
+                reason: 'No affected users identified for credential revocation',
+            };
+        }
+        return { valid: true };
+    },
+};
+export default revokeCredentialsAction;
+//# sourceMappingURL=revoke-credentials.js.map

package/dist/security/incident/actions/revoke-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke-credentials.js","sourceRoot":"","sources":["../../../../src/security/incident/actions/revoke-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;AA6DxE,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E,MAAM,qBAAqB;IACzB,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,MAAiB;QACnD,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,SAAoB;QAC1D,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,UAAqB;QAC3D,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,MAAiB;QACnD,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAkB;QACzD,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc;QAOvC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3B,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC;YAClD,cAAc,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC;YACjF,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3B,YAAY,EAAE,CAAC,QAAQ,CAAC;SACzB,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,EAAU;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAED,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,IAAI,iBAAiB,GAAsB,IAAI,qBAAqB,EAAE,CAAC;AAEvE,MAAM,UAAU,oBAAoB,CAAC,OAA0B;IAC7D,iBAAiB,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,iBAAiB,CAAC,OAAsB;IACrD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,mCAAmC;IACnC,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE1F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,YAAY,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC5E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,EAAE,EAAE;YAChE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,CAAC,EAAE;YAClE,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,gCAAgC,EAAE;QAClD,aAAa;QACb,SAAS,EAAE,aAAa,CAAC,MAAM;KAChC,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAE7D,6BAA6B;YAC7B,MAAM,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAE/E,qDAAqD;YACrD,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC;oBACX,cAAc,EAAE,SAAS;oBACzB,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,aAAa,CAAC,OAAO;oBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,aAAa,EAAE,EAAE,eAAe,EAAE,aAAa,CAAC,eAAe,EAAE;iBAClE,CAAC,CAAC;gBACH,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;oBAC1B,YAAY,IAAI,aAAa,CAAC,eAAe,CAAC;oBAC9C,YAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,eAAe,EAAE,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,EAAE,CAAC;gBACd,YAAY,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC;oBACX,cAAc,EAAE,UAAU;oBAC1B,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,cAAc,CAAC,OAAO;oBAC/B,SAAS,EAAE,IAAI,IAAI,EAAE;oBACrB,aAAa,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE;iBACzD,CAAC,CAAC;gBACH,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC3B,YAAY,EAAE,CAAC;oBACf,WAAW,CAAC,wBAAwB,MAAM,EAAE,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;oBACzE,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,EAAE,CAAC;gBACd,YAAY,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,qBAAqB;YACrB,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;oBACnE,OAAO,CAAC,IAAI,CAAC;wBACX,cAAc,EAAE,SAAS;wBACzB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,YAAY,CAAC,OAAO;wBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,aAAa,EAAE,EAAE,aAAa,EAAE,YAAY,CAAC,MAAM,EAAE;qBACtD,CAAC,CAAC;oBACH,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;wBACzB,YAAY,IAAI,YAAY,CAAC,YAAY,CAAC;wBAC1C,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC;oBACtF,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,WAAW,EAAE,CAAC;oBACd,YAAY,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,IAAI,iBAAiB,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBACtE,OAAO,CAAC,IAAI,CAAC;wBACX,cAAc,EAAE,aAAa;wBAC7B,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,WAAW,CAAC,OAAO;wBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,aAAa,EAAE,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;qBAC1D,CAAC,CAAC;oBACH,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;wBACxB,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC;wBACzC,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;oBACzF,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,WAAW,EAAE,CAAC;oBACd,YAAY,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;oBAChE,OAAO,CAAC,IAAI,CAAC;wBACX,cAAc,EAAE,SAAS;wBACzB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,SAAS,CAAC,OAAO;wBAC1B,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,aAAa,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE;qBACxD,CAAC,CAAC;oBACH,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;wBACtB,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;wBACvC,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;oBACnF,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,WAAW,EAAE,CAAC;oBACd,YAAY,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,IAAI,iBAAiB,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBACtE,OAAO,CAAC,IAAI,CAAC;wBACX,cAAc,EAAE,aAAa;wBAC7B,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,aAAa,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;qBACzD,CAAC,CAAC;oBACH,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;wBACvB,YAAY,IAAI,UAAU,CAAC,YAAY,CAAC;wBACxC,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;oBACxF,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,WAAW,EAAE,CAAC;oBACd,YAAY,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,EAAE,CAAC;YACd,YAAY,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBACtD,MAAM;gBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,WAAW,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,WAAW,KAAK,CAAC,CAAC;IAElC,YAAY,CAAC,IAAI,CAAC,iCAAiC,EAAE;QACnD,OAAO;QACP,YAAY;QACZ,WAAW;QACX,UAAU;KACX,CAAC,CAAC;IAEH,iFAAiF;IACjF,OAAO;QACL,OAAO;QACP,MAAM,EAAE;YACN,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,wBAAwB,YAAY,sBAAsB,aAAa,CAAC,MAAM,UAAU;gBAC1F,CAAC,CAAC,6BAA6B,WAAW,gBAAgB,YAAY,wBAAwB;YAChG,OAAO;YACP,YAAY;YACZ,WAAW;YACX,aAAa;SACd;QACD,OAAO,EAAE;YACP,UAAU;YACV,cAAc,EAAE,YAAY;YAC5B,WAAW,EAAE,WAAW;SACzB;QACD,WAAW,EAAE,KAAK,EAAE,sDAAsD;QAC1E,YAAY,EAAE;YACZ,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,UAAU,EAAE,KAAK;SAClB;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,SAAS,oBAAoB,CAC3B,iBAA2B,EAC3B,QAAkC;IAElC,MAAM,KAAK,GAAgB,IAAI,GAAG,EAAE,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,aAAa,GAAG,QAAQ,EAAE,CAAC,eAAe,CAAyB,CAAC;IAC1E,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,QAAQ,EAAE,CAAC,mBAAmB,CAAuB,CAAC;IAChF,IAAI,iBAAiB,EAAE,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,2BAA2B;AAC3B,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAqB;IACvD,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,yFAAyF;IACtG,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,QAAQ;IACnB,gBAAgB,EAAE,KAAK,EAAE,8CAA8C;IACvE,gBAAgB,EAAE,KAAK,EAAE,iEAAiE;IAC1F,gBAAgB,EAAE,MAAM,EAAE,YAAY;IACtC,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAE7B,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,wDAAwD;aACjE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/security/incident/actions/scale-monitoring.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Scale Monitoring Action
+ *
+ * Enhanced monitoring activation for incident response.
+ * Increases logging verbosity, enables additional alerts, and deploys detection rules.
+ *
+ * @packageDocumentation
+ * @module security/incident/actions/scale-monitoring
+ */
+import type { ActionDefinition } from '../types.js';
+export interface MonitoringEnhancement {
+    type: 'log_verbosity' | 'alert_rule' | 'detection_rule' | 'metric_collection' | 'trace_sampling' | 'honeypot';
+    target: string;
+    previousState?: unknown;
+    newState?: unknown;
+    activated: boolean;
+    activatedAt?: Date;
+    expiresAt?: Date;
+}
+export interface MonitoringRollbackData {
+    enhancements: MonitoringEnhancement[];
+    incidentId: string;
+}
+export interface MonitoringScalingService {
+    /** Increase log verbosity for a service */
+    increaseLogVerbosity(serviceId: string, level: 'debug' | 'trace'): Promise<{
+        success: boolean;
+        previousLevel: string;
+    }>;
+    /** Restore log verbosity */
+    restoreLogVerbosity(serviceId: string, level: string): Promise<boolean>;
+    /** Enable additional alert rules */
+    enableAlertRules(ruleIds: string[]): Promise<{
+        success: boolean;
+        enabledRules: string[];
+        previousStates: Record<string, boolean>;
+    }>;
+    /** Disable alert rules */
+    disableAlertRules(ruleIds: string[]): Promise<boolean>;
+    /** Deploy threat detection rules */
+    deployDetectionRules(rules: {
+        id: string;
+        pattern: string;
+        action: string;
+    }[]): Promise<{
+        success: boolean;
+        deployedRuleIds: string[];
+    }>;
+    /** Remove detection rules */
+    removeDetectionRules(ruleIds: string[]): Promise<boolean>;
+    /** Enable enhanced metric collection */
+    enableEnhancedMetrics(targets: string[], metricsToCollect: string[]): Promise<{
+        success: boolean;
+        enabledTargets: string[];
+    }>;
+    /** Disable enhanced metric collection */
+    disableEnhancedMetrics(targets: string[]): Promise<boolean>;
+    /** Increase trace sampling rate */
+    increaseTraceSampling(serviceId: string, samplingRate: number): Promise<{
+        success: boolean;
+        previousRate: number;
+    }>;
+    /** Restore trace sampling rate */
+    restoreTraceSampling(serviceId: string, rate: number): Promise<boolean>;
+    /** Deploy honeypots */
+    deployHoneypots(config: {
+        type: string;
+        location: string;
+    }[]): Promise<{
+        success: boolean;
+        deployedHoneypots: string[];
+    }>;
+    /** Remove honeypots */
+    removeHoneypots(honeypotIds: string[]): Promise<boolean>;
+    /** Get available alert rules for incident type */
+    getAvailableAlertRules(incidentType: string): Promise<string[]>;
+    /** Get available detection rules for incident type */
+    getAvailableDetectionRules(incidentType: string): Promise<{
+        id: string;
+        pattern: string;
+        action: string;
+    }[]>;
+}
+export declare function setMonitoringScalingService(service: MonitoringScalingService): void;
+export declare function getMonitoringScalingService(): MonitoringScalingService;
+export declare const scaleMonitoringAction: ActionDefinition;
+export default scaleMonitoringAction;
+//# sourceMappingURL=scale-monitoring.d.ts.map

package/dist/security/incident/actions/scale-monitoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scale-monitoring.d.ts","sourceRoot":"","sources":["../../../../src/security/incident/actions/scale-monitoring.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAA+B,MAAM,aAAa,CAAC;AAQjF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,GAAG,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC9G,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;QACzE,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IAEH,4BAA4B;IAC5B,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExE,oCAAoC;IACpC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACzC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvD,oCAAoC;IACpC,oBAAoB,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC;QACtF,OAAO,EAAE,OAAO,CAAC;QACjB,eAAe,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC,CAAC;IAEH,6BAA6B;IAC7B,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D,wCAAwC;IACxC,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC5E,OAAO,EAAE,OAAO,CAAC;QACjB,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CAAC;IAEH,yCAAyC;IACzC,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5D,mCAAmC;IACnC,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QACtE,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;IAEH,kCAAkC;IAClC,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExE,uBAAuB;IACvB,eAAe,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC;QACrE,OAAO,EAAE,OAAO,CAAC;QACjB,iBAAiB,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC,CAAC;IAEH,uBAAuB;IACvB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,kDAAkD;IAClD,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhE,sDAAsD;IACtD,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;CAC9G;AA0JD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAEnF;AAED,wBAAgB,2BAA2B,IAAI,wBAAwB,CAEtE;AAoXD,eAAO,MAAM,qBAAqB,EAAE,gBAkBnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}