@vorionsys/platform-core 0.1.0

package/dist/security/siem/datadog.js

@@ -0,0 +1,362 @@
+/**
+ * Datadog SIEM Connector
+ *
+ * Datadog Logs API integration:
+ * - Logs API v2 integration
+ * - Tags and attributes mapping
+ * - API key authentication
+ * - Service and source configuration
+ * - Gzip compression support
+ *
+ * @packageDocumentation
+ * @module security/siem/datadog
+ */
+import { createLogger } from '../../common/logger.js';
+import { BaseSIEMConnector, registerConnectorFactory } from './connector.js';
+import { gzipSync } from 'zlib';
+const logger = createLogger({ component: 'siem-datadog' });
+// =============================================================================
+// Datadog Site URLs
+// =============================================================================
+const DATADOG_SITES = {
+    us1: 'https://http-intake.logs.datadoghq.com',
+    us3: 'https://http-intake.logs.us3.datadoghq.com',
+    us5: 'https://http-intake.logs.us5.datadoghq.com',
+    eu1: 'https://http-intake.logs.datadoghq.eu',
+    ap1: 'https://http-intake.logs.ap1.datadoghq.com',
+};
+// =============================================================================
+// Datadog Connector
+// =============================================================================
+/**
+ * Datadog connector for SIEM integration
+ *
+ * Features:
+ * - Logs API v2 for efficient ingestion
+ * - Tag-based event categorization
+ * - Gzip compression for large payloads
+ * - Multi-site support
+ */
+export class DatadogConnector extends BaseSIEMConnector {
+    type = 'datadog';
+    site;
+    apiKey;
+    service;
+    source;
+    hostname;
+    defaultTags;
+    compress;
+    baseUrl;
+    constructor(config) {
+        super(config);
+        this.site = config.site;
+        this.apiKey = config.apiKey;
+        this.service = config.service;
+        this.source = config.source ?? 'vorion';
+        this.hostname = config.hostname;
+        this.defaultTags = config.tags ?? [];
+        this.compress = config.compress ?? true;
+        this.baseUrl = DATADOG_SITES[this.site];
+        if (!this.baseUrl) {
+            throw new Error(`Invalid Datadog site: ${this.site}`);
+        }
+        logger.info({
+            name: this.name,
+            site: this.site,
+            service: this.service,
+            source: this.source,
+            compress: this.compress,
+        }, 'DatadogConnector initialized');
+    }
+    /**
+     * Connect to Datadog (verify API key)
+     */
+    async doConnect() {
+        // Verify API key by checking validation endpoint
+        const healthy = await this.doHealthCheck();
+        if (!healthy) {
+            throw new Error('Failed to validate Datadog API key');
+        }
+    }
+    /**
+     * Disconnect from Datadog (no-op for HTTP)
+     */
+    async doDisconnect() {
+        // HTTP-based connection, no persistent connection to close
+    }
+    /**
+     * Send events to Datadog Logs API
+     */
+    async doSend(events) {
+        const batches = this.splitIntoBatches(events);
+        let totalSent = 0;
+        let totalFailed = 0;
+        const failedIds = [];
+        for (const batch of batches) {
+            try {
+                const result = await this.sendBatch(batch);
+                totalSent += result.eventsSent;
+                totalFailed += result.eventsFailed;
+                if (result.failedEventIds) {
+                    failedIds.push(...result.failedEventIds);
+                }
+            }
+            catch (error) {
+                totalFailed += batch.length;
+                failedIds.push(...batch.map((e) => e.id));
+                this.logger.error({ error, batchSize: batch.length }, 'Failed to send batch to Datadog');
+            }
+        }
+        return {
+            success: totalFailed === 0,
+            eventsSent: totalSent,
+            eventsFailed: totalFailed,
+            durationMs: 0,
+            failedEventIds: failedIds.length > 0 ? failedIds : undefined,
+        };
+    }
+    /**
+     * Send a single batch to Datadog
+     */
+    async sendBatch(events) {
+        const logs = events.map((event) => this.toDatadogLog(event));
+        const jsonBody = JSON.stringify(logs);
+        const headers = {
+            'DD-API-KEY': this.apiKey,
+            'Content-Type': 'application/json',
+        };
+        let body = jsonBody;
+        // Compress if enabled and payload is large enough
+        if (this.compress && jsonBody.length > 1000) {
+            body = gzipSync(jsonBody);
+            headers['Content-Encoding'] = 'gzip';
+        }
+        const response = await this.httpRequest({
+            url: `${this.baseUrl}/api/v2/logs`,
+            method: 'POST',
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            throw new Error(`Datadog API error: ${response.status} - ${response.text}`);
+        }
+        return {
+            success: true,
+            eventsSent: events.length,
+            eventsFailed: 0,
+            durationMs: 0,
+            response: response.data,
+        };
+    }
+    /**
+     * Health check - validate API key
+     */
+    async doHealthCheck() {
+        try {
+            // Use the validate endpoint
+            const response = await this.httpRequest({
+                url: 'https://api.datadoghq.com/api/v1/validate',
+                method: 'GET',
+                headers: {
+                    'DD-API-KEY': this.apiKey,
+                },
+                timeout: 5000,
+            });
+            return response.ok;
+        }
+        catch (error) {
+            this.logger.warn({ error: error.message }, 'Datadog health check failed');
+            return false;
+        }
+    }
+    /**
+     * Convert security event to Datadog log format
+     */
+    toDatadogLog(event) {
+        // Build tags array
+        const tags = [
+            ...this.defaultTags,
+            `category:${event.category}`,
+            `severity:${this.getSeverityName(event.severity)}`,
+            `outcome:${event.outcome}`,
+            `event_type:${event.eventType}`,
+        ];
+        if (event.environment) {
+            tags.push(`env:${event.environment}`);
+        }
+        if (event.user?.tenantId) {
+            tags.push(`tenant:${event.user.tenantId}`);
+        }
+        if (event.tags) {
+            tags.push(...event.tags);
+        }
+        const log = {
+            message: event.message,
+            service: this.service,
+            ddsource: this.source,
+            ddtags: tags.join(','),
+            '@timestamp': event.timestamp.toISOString(),
+            // Event metadata
+            event_id: event.id,
+            event_type: event.eventType,
+            event_category: event.category,
+            event_severity: event.severity,
+            event_severity_name: this.getSeverityName(event.severity),
+            event_outcome: event.outcome,
+            description: event.description,
+            // Network attributes
+            network: this.buildNetworkAttributes(event),
+            // User attributes
+            usr: this.buildUserAttributes(event),
+            // Geo attributes
+            geo: event.geo
+                ? {
+                    country: event.geo.country,
+                    country_code: event.geo.countryCode,
+                    city: event.geo.city,
+                    region: event.geo.region,
+                    latitude: event.geo.latitude,
+                    longitude: event.geo.longitude,
+                    timezone: event.geo.timezone,
+                }
+                : undefined,
+            // Threat attributes
+            threat: event.threat
+                ? {
+                    indicator: event.threat.indicator,
+                    type: event.threat.threatType,
+                    confidence: event.threat.confidence,
+                    source: event.threat.source,
+                    malware_families: event.threat.malwareFamilies,
+                    threat_actors: event.threat.threatActors,
+                    mitre_attack: event.threat.mitreAttack,
+                }
+                : undefined,
+            // Process attributes
+            process: event.processName || event.processId
+                ? {
+                    name: event.processName,
+                    pid: event.processId,
+                }
+                : undefined,
+            // File attributes
+            file: event.filePath || event.fileHash
+                ? {
+                    path: event.filePath,
+                    hash: event.fileHash,
+                }
+                : undefined,
+            // Source attributes
+            vorion: {
+                source: event.source,
+                component: event.component,
+                version: event.version,
+                request_id: event.requestId,
+            },
+            // Custom fields
+            ...event.customFields,
+        };
+        if (this.hostname) {
+            log.hostname = this.hostname;
+        }
+        // Remove undefined values
+        return this.removeUndefined(log);
+    }
+    /**
+     * Build network attributes
+     */
+    buildNetworkAttributes(event) {
+        if (!event.sourceIp &&
+            !event.destinationIp &&
+            !event.protocol &&
+            !event.httpUrl) {
+            return undefined;
+        }
+        return {
+            client: event.sourceIp
+                ? {
+                    ip: event.sourceIp,
+                    port: event.sourcePort,
+                }
+                : undefined,
+            destination: event.destinationIp
+                ? {
+                    ip: event.destinationIp,
+                    port: event.destinationPort,
+                }
+                : undefined,
+            protocol: event.protocol,
+        };
+    }
+    /**
+     * Build user attributes
+     */
+    buildUserAttributes(event) {
+        if (!event.user) {
+            return undefined;
+        }
+        return {
+            id: event.user.userId,
+            name: event.user.username,
+            email: event.user.email,
+            roles: event.user.roles,
+            groups: event.user.groups,
+            tenant_id: event.user.tenantId,
+            tenant_name: event.user.tenantName,
+            department: event.user.department,
+            privileged: event.user.privileged,
+        };
+    }
+    /**
+     * Get severity name from numeric value
+     */
+    getSeverityName(severity) {
+        switch (severity) {
+            case 0:
+                return 'unknown';
+            case 1:
+                return 'low';
+            case 4:
+                return 'medium';
+            case 7:
+                return 'high';
+            case 10:
+                return 'critical';
+            default:
+                return 'unknown';
+        }
+    }
+    /**
+     * Remove undefined values from object
+     */
+    removeUndefined(obj) {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            if (value === undefined) {
+                continue;
+            }
+            if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+                const cleaned = this.removeUndefined(value);
+                if (Object.keys(cleaned).length > 0) {
+                    result[key] = cleaned;
+                }
+            }
+            else {
+                result[key] = value;
+            }
+        }
+        return result;
+    }
+}
+// =============================================================================
+// Factory Registration
+// =============================================================================
+/**
+ * Create a Datadog connector
+ */
+export function createDatadogConnector(config) {
+    return new DatadogConnector(config);
+}
+// Register the factory
+registerConnectorFactory('datadog', (config) => createDatadogConnector(config));
+//# sourceMappingURL=datadog.js.map

package/dist/security/siem/datadog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.js","sourceRoot":"","sources":["../../../src/security/siem/datadog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC;AAEhC,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC;AAkC3D,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,aAAa,GAA2B;IAC5C,GAAG,EAAE,wCAAwC;IAC7C,GAAG,EAAE,4CAA4C;IACjD,GAAG,EAAE,4CAA4C;IACjD,GAAG,EAAE,uCAAuC;IAC5C,GAAG,EAAE,4CAA4C;CAClD,CAAC;AAEF,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrC,IAAI,GAAG,SAAS,CAAC;IAEhB,IAAI,CAAS;IACb,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,QAAQ,CAAU;IAClB,WAAW,CAAW;IACtB,QAAQ,CAAU;IAClB,OAAO,CAAS;IAEjC,YAAY,MAA8B;QACxC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEd,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QAExC,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,SAAS;QACvB,iDAAiD;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,YAAY;QAC1B,2DAA2D;IAC7D,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,MAAM,CAAC,MAAuB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC3C,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;gBAC/B,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC;gBACnC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAClC,iCAAiC,CAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,WAAW,KAAK,CAAC;YAC1B,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,MAAuB;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAEtC,MAAM,OAAO,GAA2B;YACtC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,cAAc,EAAE,kBAAkB;SACnC,CAAC;QAEF,IAAI,IAAI,GAAoB,QAAQ,CAAC;QAErC,kDAAkD;QAClD,IAAI,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC5C,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAkB;YACvD,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,cAAc;YAClC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,QAAQ,CAAC,IAAI;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,aAAa;QAC3B,IAAI,CAAC;YACH,4BAA4B;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAqB;gBAC1D,GAAG,EAAE,2CAA2C;gBAChD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,YAAY,EAAE,IAAI,CAAC,MAAM;iBAC1B;gBACD,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EACnC,6BAA6B,CAC9B,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAAoB;QACvC,mBAAmB;QACnB,MAAM,IAAI,GAAG;YACX,GAAG,IAAI,CAAC,WAAW;YACnB,YAAY,KAAK,CAAC,QAAQ,EAAE;YAC5B,YAAY,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;YAClD,WAAW,KAAK,CAAC,OAAO,EAAE;YAC1B,cAAc,KAAK,CAAC,SAAS,EAAE;SAChC,CAAC;QAEF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,GAAG,GAAoB;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACtB,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YAE3C,iBAAiB;YACjB,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,cAAc,EAAE,KAAK,CAAC,QAAQ;YAC9B,cAAc,EAAE,KAAK,CAAC,QAAQ;YAC9B,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzD,aAAa,EAAE,KAAK,CAAC,OAAO;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAE9B,qBAAqB;YACrB,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAE3C,kBAAkB;YAClB,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAEpC,iBAAiB;YACjB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACZ,CAAC,CAAC;oBACE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;oBAC1B,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW;oBACnC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;oBACpB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;oBACxB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;oBAC5B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;oBAC9B,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;iBAC7B;gBACH,CAAC,CAAC,SAAS;YAEb,oBAAoB;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBAClB,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;oBACjC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;oBAC7B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;oBACnC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;oBAC3B,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe;oBAC9C,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;oBACxC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;iBACvC;gBACH,CAAC,CAAC,SAAS;YAEb,qBAAqB;YACrB,OAAO,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS;gBAC3C,CAAC,CAAC;oBACE,IAAI,EAAE,KAAK,CAAC,WAAW;oBACvB,GAAG,EAAE,KAAK,CAAC,SAAS;iBACrB;gBACH,CAAC,CAAC,SAAS;YAEb,kBAAkB;YAClB,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;gBACpC,CAAC,CAAC;oBACE,IAAI,EAAE,KAAK,CAAC,QAAQ;oBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ;iBACrB;gBACH,CAAC,CAAC,SAAS;YAEb,oBAAoB;YACpB,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,SAAS;aAC5B;YAED,gBAAgB;YAChB,GAAG,KAAK,CAAC,YAAY;SACtB,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,CAAC;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAoB,CAAC;IACtD,CAAC;IAED;;OAEG;IACK,sBAAsB,CAC5B,KAAoB;QAEpB,IACE,CAAC,KAAK,CAAC,QAAQ;YACf,CAAC,KAAK,CAAC,aAAa;YACpB,CAAC,KAAK,CAAC,QAAQ;YACf,CAAC,KAAK,CAAC,OAAO,EACd,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,QAAQ;gBACpB,CAAC,CAAC;oBACE,EAAE,EAAE,KAAK,CAAC,QAAQ;oBAClB,IAAI,EAAE,KAAK,CAAC,UAAU;iBACvB;gBACH,CAAC,CAAC,SAAS;YACb,WAAW,EAAE,KAAK,CAAC,aAAa;gBAC9B,CAAC,CAAC;oBACE,EAAE,EAAE,KAAK,CAAC,aAAa;oBACvB,IAAI,EAAE,KAAK,CAAC,eAAe;iBAC5B;gBACH,CAAC,CAAC,SAAS;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,KAAoB;QAEpB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;YACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YACzB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;YACzB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YAClC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,QAAgB;QACtC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,CAAC;gBACJ,OAAO,SAAS,CAAC;YACnB,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,KAAK,EAAE;gBACL,OAAO,UAAU,CAAC;YACpB;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAA4B;QAClD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,KAAgC,CAAC,CAAC;gBACvE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;gBACxB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B;IAE9B,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,uBAAuB;AACvB,wBAAwB,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAC7C,sBAAsB,CAAC,MAAgC,CAAC,CACzD,CAAC"}

package/dist/security/siem/elastic.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Elasticsearch SIEM Connector
+ *
+ * Elasticsearch/OpenSearch integration for SIEM:
+ * - Bulk API for efficient ingestion
+ * - Index template management
+ * - API key or basic auth
+ * - Connection pooling
+ *
+ * @packageDocumentation
+ * @module security/siem/elastic
+ */
+import { BaseSIEMConnector } from './connector.js';
+import type { SecurityEvent, SendResult, ElasticConnectorConfig } from './types.js';
+/**
+ * Elasticsearch connector for SIEM integration
+ *
+ * Features:
+ * - Bulk API for efficient ingestion
+ * - ECS (Elastic Common Schema) compliant
+ * - Multiple authentication methods
+ * - Connection pooling via node selection
+ */
+export declare class ElasticConnector extends BaseSIEMConnector {
+    readonly type = "elastic";
+    private readonly nodes;
+    private readonly auth;
+    private readonly apiKey?;
+    private readonly username?;
+    private readonly password?;
+    private readonly bearerToken?;
+    private readonly index;
+    private readonly pipeline?;
+    private readonly verifySsl;
+    private readonly refresh?;
+    private currentNodeIndex;
+    constructor(config: ElasticConnectorConfig);
+    /**
+     * Connect to Elasticsearch cluster
+     */
+    protected doConnect(): Promise<void>;
+    /**
+     * Disconnect from Elasticsearch (no-op for HTTP)
+     */
+    protected doDisconnect(): Promise<void>;
+    /**
+     * Send events using Bulk API
+     */
+    protected doSend(events: SecurityEvent[]): Promise<SendResult>;
+    /**
+     * Send a bulk request to Elasticsearch
+     */
+    private sendBulk;
+    /**
+     * Health check - verify cluster is accessible
+     */
+    protected doHealthCheck(): Promise<boolean>;
+    /**
+     * Ensure index template exists
+     */
+    private ensureIndexTemplate;
+    /**
+     * Convert security event to ECS document
+     */
+    private toECSDocument;
+    /**
+     * Resolve index name (supports date patterns)
+     */
+    private resolveIndex;
+    /**
+     * Get current node URL with round-robin
+     */
+    private getNode;
+    /**
+     * Get authentication headers
+     */
+    private getAuthHeaders;
+}
+/**
+ * Create an Elasticsearch connector
+ */
+export declare function createElasticConnector(config: ElasticConnectorConfig): ElasticConnector;
+//# sourceMappingURL=elastic.d.ts.map

package/dist/security/siem/elastic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elastic.d.ts","sourceRoot":"","sources":["../../../src/security/siem/elastic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,iBAAiB,EAA4B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AA2JpF;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;IACrD,SAAgB,IAAI,aAAa;IAEjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAgC;IAEzD,OAAO,CAAC,gBAAgB,CAAK;gBAEjB,MAAM,EAAE,sBAAsB;IAyB1C;;OAEG;cACa,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAW1C;;OAEG;cACa,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C;;OAEG;cACa,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAiCpE;;OAEG;YACW,QAAQ;IA4EtB;;OAEG;cACa,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAwBjD;;OAEG;YACW,mBAAmB;IA0GjC;;OAEG;IACH,OAAO,CAAC,aAAa;IA2KrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAQpB;;OAEG;IACH,OAAO,CAAC,OAAO;IAMf;;OAEG;IACH,OAAO,CAAC,cAAc;CA6BvB;AAMD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,GAC7B,gBAAgB,CAElB"}