@vorionsys/platform-core 0.1.0

package/dist/security/siem/enrichment.js

@@ -0,0 +1,434 @@
+/**
+ * SIEM Event Enrichment
+ *
+ * Provides event enrichment capabilities:
+ * - Geo-location data from IP addresses
+ * - Threat intelligence context
+ * - User context (role, tenant)
+ * - Field name normalization
+ *
+ * @packageDocumentation
+ * @module security/siem/enrichment
+ */
+import { createLogger } from '../../common/logger.js';
+const logger = createLogger({ component: 'siem-enrichment' });
+/**
+ * Default geo enrichment provider using external service
+ */
+export class DefaultGeoProvider {
+    serviceUrl;
+    cache = new Map();
+    cacheTtlMs;
+    constructor(config) {
+        this.serviceUrl = config.serviceUrl;
+        this.cacheTtlMs = (config.cacheTtlSeconds ?? 3600) * 1000;
+    }
+    async lookup(ip) {
+        // Check cache
+        const cached = this.cache.get(ip);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.value;
+        }
+        // Skip private IPs
+        if (this.isPrivateIp(ip)) {
+            return null;
+        }
+        try {
+            if (!this.serviceUrl) {
+                return null;
+            }
+            const response = await fetch(`${this.serviceUrl}/${ip}`);
+            if (!response.ok) {
+                return null;
+            }
+            const data = await response.json();
+            const geo = {
+                country: data.country,
+                countryCode: data.country_code,
+                city: data.city,
+                region: data.region,
+                latitude: data.latitude,
+                longitude: data.longitude,
+                timezone: data.timezone,
+            };
+            // Cache result
+            this.cache.set(ip, {
+                value: geo,
+                expiresAt: Date.now() + this.cacheTtlMs,
+            });
+            return geo;
+        }
+        catch (error) {
+            logger.warn({ ip, error: error.message }, 'Geo lookup failed');
+            return null;
+        }
+    }
+    isPrivateIp(ip) {
+        // Check for private IP ranges
+        const parts = ip.split('.');
+        if (parts.length !== 4) {
+            return false;
+        }
+        const first = parseInt(parts[0], 10);
+        const second = parseInt(parts[1], 10);
+        // 10.0.0.0/8
+        if (first === 10) {
+            return true;
+        }
+        // 172.16.0.0/12
+        if (first === 172 && second >= 16 && second <= 31) {
+            return true;
+        }
+        // 192.168.0.0/16
+        if (first === 192 && second === 168) {
+            return true;
+        }
+        // 127.0.0.0/8 (localhost)
+        if (first === 127) {
+            return true;
+        }
+        return false;
+    }
+}
+/**
+ * Default threat intelligence provider
+ */
+export class DefaultThreatProvider {
+    serviceUrl;
+    apiKey;
+    cache = new Map();
+    cacheTtlMs;
+    constructor(config) {
+        this.serviceUrl = config.serviceUrl;
+        this.apiKey = config.apiKey;
+        this.cacheTtlMs = (config.cacheTtlSeconds ?? 3600) * 1000;
+    }
+    async lookup(indicator, type) {
+        const cacheKey = `${type}:${indicator}`;
+        // Check cache
+        const cached = this.cache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.value;
+        }
+        try {
+            if (!this.serviceUrl) {
+                return null;
+            }
+            const headers = {
+                'Content-Type': 'application/json',
+            };
+            if (this.apiKey) {
+                headers['Authorization'] = `Bearer ${this.apiKey}`;
+            }
+            const response = await fetch(`${this.serviceUrl}/lookup?type=${type}&value=${encodeURIComponent(indicator)}`, { headers });
+            if (!response.ok) {
+                return null;
+            }
+            const data = await response.json();
+            if (!data.found) {
+                // Cache negative result
+                this.cache.set(cacheKey, {
+                    value: null,
+                    expiresAt: Date.now() + this.cacheTtlMs,
+                });
+                return null;
+            }
+            const threat = {
+                indicator,
+                threatType: data.threat_type,
+                confidence: data.confidence,
+                source: data.source,
+                firstSeen: data.first_seen ? new Date(data.first_seen) : undefined,
+                lastSeen: data.last_seen ? new Date(data.last_seen) : undefined,
+                malwareFamilies: data.malware_families,
+                threatActors: data.threat_actors,
+                mitreAttack: data.mitre_attack,
+            };
+            // Cache result
+            this.cache.set(cacheKey, {
+                value: threat,
+                expiresAt: Date.now() + this.cacheTtlMs,
+            });
+            return threat;
+        }
+        catch (error) {
+            logger.warn({ indicator, type, error: error.message }, 'Threat lookup failed');
+            return null;
+        }
+    }
+}
+/**
+ * Default user enrichment provider
+ */
+export class DefaultUserProvider {
+    serviceUrl;
+    includeRoles;
+    includeGroups;
+    includeTenant;
+    cache = new Map();
+    cacheTtlMs;
+    constructor(config) {
+        this.serviceUrl = config.serviceUrl;
+        this.includeRoles = config.includeRoles ?? true;
+        this.includeGroups = config.includeGroups ?? true;
+        this.includeTenant = config.includeTenant ?? true;
+        this.cacheTtlMs = (config.cacheTtlSeconds ?? 300) * 1000;
+    }
+    async lookup(userId) {
+        // Check cache
+        const cached = this.cache.get(userId);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.value;
+        }
+        try {
+            if (!this.serviceUrl) {
+                return null;
+            }
+            const params = new URLSearchParams();
+            if (this.includeRoles)
+                params.set('includeRoles', 'true');
+            if (this.includeGroups)
+                params.set('includeGroups', 'true');
+            if (this.includeTenant)
+                params.set('includeTenant', 'true');
+            const response = await fetch(`${this.serviceUrl}/users/${userId}?${params.toString()}`);
+            if (!response.ok) {
+                return null;
+            }
+            const data = await response.json();
+            const user = {
+                userId: data.id,
+                username: data.username,
+                email: data.email,
+                roles: data.roles,
+                groups: data.groups,
+                tenantId: data.tenant_id,
+                tenantName: data.tenant_name,
+                department: data.department,
+                privileged: data.privileged,
+            };
+            // Cache result
+            this.cache.set(userId, {
+                value: user,
+                expiresAt: Date.now() + this.cacheTtlMs,
+            });
+            return user;
+        }
+        catch (error) {
+            logger.warn({ userId, error: error.message }, 'User lookup failed');
+            return null;
+        }
+    }
+}
+// =============================================================================
+// Event Enricher
+// =============================================================================
+/**
+ * Event enricher that combines multiple enrichment sources
+ */
+export class EventEnricher {
+    config;
+    geoProvider;
+    threatProvider;
+    userProvider;
+    fieldNormalization;
+    constructor(config, options) {
+        this.config = config;
+        this.fieldNormalization = config.fieldNormalization ?? {};
+        // Initialize providers
+        if (config.geo?.enabled) {
+            this.geoProvider = options?.geoProvider ?? new DefaultGeoProvider(config.geo);
+        }
+        if (config.threat?.enabled) {
+            this.threatProvider =
+                options?.threatProvider ?? new DefaultThreatProvider(config.threat);
+        }
+        if (config.user?.enabled) {
+            this.userProvider = options?.userProvider ?? new DefaultUserProvider(config.user);
+        }
+    }
+    /**
+     * Enrich a security event
+     */
+    async enrich(event) {
+        const startTime = Date.now();
+        const enrichedFields = [];
+        const errors = [];
+        let enrichedEvent = { ...event };
+        // Geo enrichment
+        if (this.geoProvider && !event.geo) {
+            const ipFields = this.config.geo?.ipFields ?? ['sourceIp', 'destinationIp'];
+            for (const field of ipFields) {
+                const ip = this.getFieldValue(event, field);
+                if (ip && typeof ip === 'string') {
+                    try {
+                        const geo = await this.geoProvider.lookup(ip);
+                        if (geo) {
+                            enrichedEvent = { ...enrichedEvent, geo };
+                            enrichedFields.push('geo');
+                            break; // Use first successful lookup
+                        }
+                    }
+                    catch (error) {
+                        errors.push({
+                            field: 'geo',
+                            error: error.message,
+                        });
+                    }
+                }
+            }
+        }
+        // Threat enrichment
+        if (this.threatProvider && !event.threat) {
+            const indicatorFields = this.config.threat?.indicatorFields ?? [
+                'sourceIp',
+                'destinationIp',
+                'fileHash',
+            ];
+            for (const field of indicatorFields) {
+                const indicator = this.getFieldValue(event, field);
+                if (indicator && typeof indicator === 'string') {
+                    try {
+                        const indicatorType = this.getIndicatorType(field);
+                        const threat = await this.threatProvider.lookup(indicator, indicatorType);
+                        if (threat) {
+                            enrichedEvent = { ...enrichedEvent, threat };
+                            enrichedFields.push('threat');
+                            break; // Use first successful lookup
+                        }
+                    }
+                    catch (error) {
+                        errors.push({
+                            field: 'threat',
+                            error: error.message,
+                        });
+                    }
+                }
+            }
+        }
+        // User enrichment
+        if (this.userProvider && event.user?.userId) {
+            try {
+                const userContext = await this.userProvider.lookup(event.user.userId);
+                if (userContext) {
+                    enrichedEvent = {
+                        ...enrichedEvent,
+                        user: {
+                            ...enrichedEvent.user,
+                            ...userContext,
+                        },
+                    };
+                    enrichedFields.push('user');
+                }
+            }
+            catch (error) {
+                errors.push({
+                    field: 'user',
+                    error: error.message,
+                });
+            }
+        }
+        // Field normalization
+        if (Object.keys(this.fieldNormalization).length > 0) {
+            enrichedEvent = this.normalizeFields(enrichedEvent);
+            if (enrichedEvent !== event) {
+                enrichedFields.push('fields');
+            }
+        }
+        return {
+            event: enrichedEvent,
+            enrichedFields,
+            errors,
+            durationMs: Date.now() - startTime,
+        };
+    }
+    /**
+     * Enrich multiple events
+     */
+    async enrichBatch(events) {
+        // Process in parallel with concurrency limit
+        const results = [];
+        const concurrency = 10;
+        for (let i = 0; i < events.length; i += concurrency) {
+            const batch = events.slice(i, i + concurrency);
+            const batchResults = await Promise.all(batch.map((event) => this.enrich(event)));
+            results.push(...batchResults);
+        }
+        return results;
+    }
+    /**
+     * Get a field value from an event
+     */
+    getFieldValue(event, field) {
+        const parts = field.split('.');
+        let value = event;
+        for (const part of parts) {
+            if (value === null || value === undefined) {
+                return undefined;
+            }
+            value = value[part];
+        }
+        return value;
+    }
+    /**
+     * Get indicator type based on field name
+     */
+    getIndicatorType(field) {
+        if (field.toLowerCase().includes('ip')) {
+            return 'ip';
+        }
+        if (field.toLowerCase().includes('hash')) {
+            return 'hash';
+        }
+        if (field.toLowerCase().includes('domain') || field.toLowerCase().includes('host')) {
+            return 'domain';
+        }
+        if (field.toLowerCase().includes('url')) {
+            return 'url';
+        }
+        if (field.toLowerCase().includes('email')) {
+            return 'email';
+        }
+        return 'unknown';
+    }
+    /**
+     * Normalize field names
+     */
+    normalizeFields(event) {
+        if (!event.customFields) {
+            return event;
+        }
+        const normalizedCustomFields = {};
+        let changed = false;
+        for (const [key, value] of Object.entries(event.customFields)) {
+            const normalizedKey = this.fieldNormalization[key] ?? key;
+            if (normalizedKey !== key) {
+                changed = true;
+            }
+            normalizedCustomFields[normalizedKey] = value;
+        }
+        if (!changed) {
+            return event;
+        }
+        return {
+            ...event,
+            customFields: normalizedCustomFields,
+        };
+    }
+}
+// =============================================================================
+// Factory Functions
+// =============================================================================
+/**
+ * Create an event enricher
+ */
+export function createEventEnricher(config, options) {
+    return new EventEnricher(config, options);
+}
+/**
+ * Create a no-op enricher (passthrough)
+ */
+export function createNoOpEnricher() {
+    return new EventEnricher({});
+}
+//# sourceMappingURL=enrichment.js.map

package/dist/security/siem/enrichment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrichment.js","sourceRoot":"","sources":["../../../src/security/siem/enrichment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAYtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAwC9D;;GAEG;AACH,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAAU;IACpB,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAC1D,UAAU,CAAS;IAEpC,YAAY,MAA2B;QACrC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;YAE9D,MAAM,GAAG,GAAgB;gBACvB,OAAO,EAAE,IAAI,CAAC,OAA6B;gBAC3C,WAAW,EAAE,IAAI,CAAC,YAAkC;gBACpD,IAAI,EAAE,IAAI,CAAC,IAA0B;gBACrC,MAAM,EAAE,IAAI,CAAC,MAA4B;gBACzC,QAAQ,EAAE,IAAI,CAAC,QAA8B;gBAC7C,SAAS,EAAE,IAAI,CAAC,SAA+B;gBAC/C,QAAQ,EAAE,IAAI,CAAC,QAA8B;aAC9C,CAAC;YAEF,eAAe;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,KAAK,EAAE,GAAG;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;aACxC,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,EAAU;QAC5B,8BAA8B;QAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEtC,aAAa;QACb,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gBAAgB;QAChB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAcD;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAU;IACpB,MAAM,CAAU;IAChB,KAAK,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC5D,UAAU,CAAS;IAEpC,YAAY,MAA8B;QACxC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,IAAY;QAC1C,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;QAExC,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,IAAI,CAAC,UAAU,gBAAgB,IAAI,UAAU,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAC/E,EAAE,OAAO,EAAE,CACZ,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;YAE9D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,wBAAwB;gBACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACvB,KAAK,EAAE,IAAI;oBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;iBACxC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAkB;gBAC5B,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,WAAiC;gBAClD,UAAU,EAAE,IAAI,CAAC,UAAgC;gBACjD,MAAM,EAAE,IAAI,CAAC,MAA4B;gBACzC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC5E,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACzE,eAAe,EAAE,IAAI,CAAC,gBAAwC;gBAC9D,YAAY,EAAE,IAAI,CAAC,aAAqC;gBACxD,WAAW,EAAE,IAAI,CAAC,YAAoC;aACvD,CAAC;YAEF,eAAe;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACvB,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;aACxC,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EACpD,sBAAsB,CACvB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAcD;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,UAAU,CAAU;IACpB,YAAY,CAAU;IACtB,aAAa,CAAU;IACvB,aAAa,CAAU;IACvB,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAC1D,UAAU,CAAS;IAEpC,YAAY,MAA4B;QACtC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,YAAY;gBAAE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,aAAa;gBAAE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,aAAa;gBAAE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAE5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,IAAI,CAAC,UAAU,UAAU,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAC1D,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;YAE9D,MAAM,IAAI,GAAgB;gBACxB,MAAM,EAAE,IAAI,CAAC,EAAwB;gBACrC,QAAQ,EAAE,IAAI,CAAC,QAA8B;gBAC7C,KAAK,EAAE,IAAI,CAAC,KAA2B;gBACvC,KAAK,EAAE,IAAI,CAAC,KAA6B;gBACzC,MAAM,EAAE,IAAI,CAAC,MAA8B;gBAC3C,QAAQ,EAAE,IAAI,CAAC,SAA+B;gBAC9C,UAAU,EAAE,IAAI,CAAC,WAAiC;gBAClD,UAAU,EAAE,IAAI,CAAC,UAAgC;gBACjD,UAAU,EAAE,IAAI,CAAC,UAAiC;aACnD,CAAC;YAEF,eAAe;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;gBACrB,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;aACxC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,CAAmB;IACzB,WAAW,CAAyB;IACpC,cAAc,CAA4B;IAC1C,YAAY,CAA0B;IACtC,kBAAkB,CAAyB;IAE5D,YACE,MAAwB,EACxB,OAIC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE1D,uBAAuB;QACvB,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,cAAc;gBACjB,OAAO,EAAE,cAAc,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,MAAM,MAAM,GAA4C,EAAE,CAAC;QAC3D,IAAI,aAAa,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAEjC,iBAAiB;QACjB,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAE5E,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC5C,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACjC,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;wBAC9C,IAAI,GAAG,EAAE,CAAC;4BACR,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,EAAE,CAAC;4BAC1C,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BAC3B,MAAM,CAAC,8BAA8B;wBACvC,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC;4BACV,KAAK,EAAE,KAAK;4BACZ,KAAK,EAAG,KAAe,CAAC,OAAO;yBAChC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI;gBAC7D,UAAU;gBACV,eAAe;gBACf,UAAU;aACX,CAAC;YAEF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACnD,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC/C,IAAI,CAAC;wBACH,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;wBACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;wBAC1E,IAAI,MAAM,EAAE,CAAC;4BACX,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,CAAC;4BAC7C,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;4BAC9B,MAAM,CAAC,8BAA8B;wBACvC,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC;4BACV,KAAK,EAAE,QAAQ;4BACf,KAAK,EAAG,KAAe,CAAC,OAAO;yBAChC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtE,IAAI,WAAW,EAAE,CAAC;oBAChB,aAAa,GAAG;wBACd,GAAG,aAAa;wBAChB,IAAI,EAAE;4BACJ,GAAG,aAAa,CAAC,IAAI;4BACrB,GAAG,WAAW;yBACf;qBACF,CAAC;oBACF,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,MAAM;oBACb,KAAK,EAAG,KAAe,CAAC,OAAO;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,cAAc;YACd,MAAM;YACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAuB;QACvC,6CAA6C;QAC7C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC;YAC/C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACzC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAoB,EAAE,KAAa;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAY,KAAK,CAAC;QAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,KAAK,GAAI,KAAiC,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAa;QACpC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,KAAoB;QAC1C,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,sBAAsB,GAA4B,EAAE,CAAC;QAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YAC1D,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,sBAAsB,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO;YACL,GAAG,KAAK;YACR,YAAY,EAAE,sBAAsB;SACrC,CAAC;IACJ,CAAC;CACF;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAwB,EACxB,OAIC;IAED,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC"}

package/dist/security/siem/formatter.d.ts

@@ -0,0 +1,118 @@
+/**
+ * SIEM Event Formatter
+ *
+ * Provides multiple event output formats:
+ * - Common Event Format (CEF)
+ * - JSON structured logging
+ * - Syslog format (RFC 5424)
+ * - Custom field mapping per connector
+ *
+ * @packageDocumentation
+ * @module security/siem/formatter
+ */
+import type { SecurityEvent, EventFormat, CEFConfig, SyslogConfig } from './types.js';
+/**
+ * Event formatter for multiple output formats
+ */
+export declare class EventFormatter {
+    private readonly cefConfig?;
+    private readonly syslogConfig?;
+    constructor(options?: {
+        cef?: CEFConfig;
+        syslog?: SyslogConfig;
+    });
+    /**
+     * Format an event in the specified format
+     */
+    format(event: SecurityEvent, format: EventFormat): string;
+    /**
+     * Format as JSON
+     */
+    formatJSON(event: SecurityEvent): string;
+    /**
+     * Format as CEF (Common Event Format)
+     *
+     * CEF:Version|Device Vendor|Device Product|Device Version|Device Event Class ID|Name|Severity|[Extension]
+     */
+    formatCEF(event: SecurityEvent): string;
+    /**
+     * Format as Syslog (RFC 5424)
+     *
+     * <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID ...] MSG
+     */
+    formatSyslog(event: SecurityEvent): string;
+    /**
+     * Build CEF extension field
+     */
+    private buildCEFExtension;
+    /**
+     * Build syslog structured data
+     */
+    private buildSyslogStructuredData;
+    /**
+     * Build a single structured data element
+     */
+    private buildStructuredDataElement;
+    /**
+     * Escape CEF header value
+     */
+    private escapeCEFHeader;
+    /**
+     * Escape CEF extension value
+     */
+    private escapeCEFExtension;
+    /**
+     * Escape syslog param value (RFC 5424)
+     */
+    private escapeSyslogParamValue;
+}
+/**
+ * Normalize field names across different schemas
+ */
+export declare class FieldNormalizer {
+    private readonly mappings;
+    constructor(mappings?: Record<string, string>);
+    /**
+     * Normalize a security event's field names
+     */
+    normalize(event: SecurityEvent): SecurityEvent;
+    /**
+     * Normalize field names in an object
+     */
+    private normalizeObject;
+    /**
+     * Add a field mapping
+     */
+    addMapping(from: string, to: string): void;
+    /**
+     * Remove a field mapping
+     */
+    removeMapping(from: string): void;
+    /**
+     * Get all mappings
+     */
+    getMappings(): Record<string, string>;
+}
+/**
+ * Create an event formatter
+ */
+export declare function createEventFormatter(options?: {
+    cef?: CEFConfig;
+    syslog?: SyslogConfig;
+}): EventFormatter;
+/**
+ * Create a field normalizer
+ */
+export declare function createFieldNormalizer(mappings?: Record<string, string>): FieldNormalizer;
+/**
+ * Get the default event formatter
+ */
+export declare function getDefaultFormatter(): EventFormatter;
+/**
+ * Set the default event formatter configuration
+ */
+export declare function configureDefaultFormatter(options: {
+    cef?: CEFConfig;
+    syslog?: SyslogConfig;
+}): void;
+//# sourceMappingURL=formatter.d.ts.map

package/dist/security/siem/formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../../src/security/siem/formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,YAAY,CAAC;AA6CpB;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAe;gBAEjC,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,CAAA;KAAE;IAKhE;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM;IAYzD;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM;IAgBxC;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM;IAuBvC;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM;IA6B1C;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmEzB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA8DjC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAmBlC;;OAEG;IACH,OAAO,CAAC,eAAe;IAIvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAI1B;;OAEG;IACH,OAAO,CAAC,sBAAsB;CAG/B;AAMD;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;gBAEtC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa;IAe9C;;OAEG;IACH,OAAO,CAAC,eAAe;IAoBvB;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI;IAI1C;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIjC;;OAEG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAGtC;AAMD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,GAAG,cAAc,CAEjB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,eAAe,CAEjB;AAQD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAKpD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IACjD,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,GAAG,IAAI,CAEP"}