@vorionsys/platform-core 0.1.0

package/dist/security/siem/formatter.js

@@ -0,0 +1,381 @@
+/**
+ * SIEM Event Formatter
+ *
+ * Provides multiple event output formats:
+ * - Common Event Format (CEF)
+ * - JSON structured logging
+ * - Syslog format (RFC 5424)
+ * - Custom field mapping per connector
+ *
+ * @packageDocumentation
+ * @module security/siem/formatter
+ */
+import { createLogger } from '../../common/logger.js';
+const logger = createLogger({ component: 'siem-formatter' });
+// =============================================================================
+// Constants
+// =============================================================================
+/**
+ * CEF severity mapping (0-10 scale)
+ */
+const CEF_SEVERITY_MAP = {
+    0: '0', // Unknown
+    1: '3', // Low
+    4: '5', // Medium
+    7: '8', // High
+    10: '10', // Critical
+};
+/**
+ * Syslog severity levels (RFC 5424)
+ */
+const SYSLOG_SEVERITY = {
+    0: 6, // Unknown -> Informational
+    1: 5, // Low -> Notice
+    4: 4, // Medium -> Warning
+    7: 3, // High -> Error
+    10: 2, // Critical -> Critical
+};
+/**
+ * CEF escape characters
+ */
+const CEF_ESCAPE_MAP = {
+    '\\': '\\\\',
+    '|': '\\|',
+    '=': '\\=',
+    '\n': '\\n',
+    '\r': '\\r',
+};
+// =============================================================================
+// Event Formatter Class
+// =============================================================================
+/**
+ * Event formatter for multiple output formats
+ */
+export class EventFormatter {
+    cefConfig;
+    syslogConfig;
+    constructor(options) {
+        this.cefConfig = options?.cef;
+        this.syslogConfig = options?.syslog;
+    }
+    /**
+     * Format an event in the specified format
+     */
+    format(event, format) {
+        switch (format) {
+            case 'cef':
+                return this.formatCEF(event);
+            case 'syslog':
+                return this.formatSyslog(event);
+            case 'json':
+            default:
+                return this.formatJSON(event);
+        }
+    }
+    /**
+     * Format as JSON
+     */
+    formatJSON(event) {
+        const jsonEvent = {
+            ...event,
+            timestamp: event.timestamp.toISOString(),
+            threat: event.threat
+                ? {
+                    ...event.threat,
+                    firstSeen: event.threat.firstSeen?.toISOString(),
+                    lastSeen: event.threat.lastSeen?.toISOString(),
+                }
+                : undefined,
+        };
+        return JSON.stringify(jsonEvent);
+    }
+    /**
+     * Format as CEF (Common Event Format)
+     *
+     * CEF:Version|Device Vendor|Device Product|Device Version|Device Event Class ID|Name|Severity|[Extension]
+     */
+    formatCEF(event) {
+        const config = this.cefConfig ?? {
+            vendor: 'Vorion',
+            product: 'SecurityPlatform',
+            version: '1.0',
+        };
+        const version = 'CEF:0';
+        const vendor = this.escapeCEFHeader(config.vendor);
+        const product = this.escapeCEFHeader(config.product);
+        const deviceVersion = this.escapeCEFHeader(config.version);
+        const eventClassId = this.escapeCEFHeader(`${config.deviceEventClassIdPrefix ?? ''}${event.eventType}`);
+        const name = this.escapeCEFHeader(event.message.substring(0, 512));
+        const severity = CEF_SEVERITY_MAP[event.severity] ?? '0';
+        // Build extension
+        const extension = this.buildCEFExtension(event);
+        return `${version}|${vendor}|${product}|${deviceVersion}|${eventClassId}|${name}|${severity}|${extension}`;
+    }
+    /**
+     * Format as Syslog (RFC 5424)
+     *
+     * <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID ...] MSG
+     */
+    formatSyslog(event) {
+        const config = this.syslogConfig ?? {
+            facility: 1, // user-level
+            appName: 'vorion',
+        };
+        // Calculate PRI
+        const severity = SYSLOG_SEVERITY[event.severity] ?? 6;
+        const pri = config.facility * 8 + severity;
+        // Format components
+        const version = 1;
+        const timestamp = event.timestamp.toISOString();
+        const hostname = event.sourceHost ?? '-';
+        const appName = config.appName;
+        const procId = config.procId ?? '-';
+        const msgId = config.msgId ?? event.eventType;
+        // Build structured data
+        const structuredData = config.includeStructuredData
+            ? this.buildSyslogStructuredData(event)
+            : '-';
+        // Message
+        const msg = event.message;
+        return `<${pri}>${version} ${timestamp} ${hostname} ${appName} ${procId} ${msgId} ${structuredData} ${msg}`;
+    }
+    /**
+     * Build CEF extension field
+     */
+    buildCEFExtension(event) {
+        const fields = [
+            // Timestamps
+            ['rt', event.timestamp.getTime()],
+            ['deviceExternalId', event.id],
+            // Source
+            ['src', event.sourceIp],
+            ['spt', event.sourcePort],
+            ['shost', event.sourceHost],
+            ['smac', event.sourceMac],
+            // Destination
+            ['dst', event.destinationIp],
+            ['dpt', event.destinationPort],
+            ['dhost', event.destinationHost],
+            ['dmac', event.destinationMac],
+            // Network
+            ['proto', event.protocol],
+            ['requestMethod', event.httpMethod],
+            ['request', event.httpUrl],
+            // User
+            ['suser', event.user?.username],
+            ['suid', event.user?.userId],
+            // Outcome
+            ['outcome', event.outcome],
+            ['cat', event.category],
+            // Device
+            ['deviceProcessName', event.processName],
+            ['deviceProcessId', event.processId],
+            // File
+            ['filePath', event.filePath],
+            ['fileHash', event.fileHash],
+            // Custom
+            ['cs1', event.user?.tenantId],
+            ['cs1Label', event.user?.tenantId ? 'TenantId' : undefined],
+            ['cs2', event.requestId],
+            ['cs2Label', event.requestId ? 'RequestId' : undefined],
+            ['cs3', event.environment],
+            ['cs3Label', event.environment ? 'Environment' : undefined],
+            // Geo
+            ['cs4', event.geo?.country],
+            ['cs4Label', event.geo?.country ? 'Country' : undefined],
+            ['cs5', event.geo?.city],
+            ['cs5Label', event.geo?.city ? 'City' : undefined],
+            // Threat
+            ['cs6', event.threat?.threatType],
+            ['cs6Label', event.threat?.threatType ? 'ThreatType' : undefined],
+            // Message
+            ['msg', event.description],
+        ];
+        return fields
+            .filter(([, value]) => value !== undefined && value !== null && value !== '')
+            .map(([key, value]) => `${key}=${this.escapeCEFExtension(String(value))}`)
+            .join(' ');
+    }
+    /**
+     * Build syslog structured data
+     */
+    buildSyslogStructuredData(event) {
+        const elements = [];
+        // Event metadata
+        const eventData = [
+            ['id', event.id],
+            ['type', event.eventType],
+            ['category', event.category],
+            ['severity', event.severity],
+            ['outcome', event.outcome],
+        ];
+        const eventElement = this.buildStructuredDataElement('event@47450', eventData);
+        if (eventElement) {
+            elements.push(eventElement);
+        }
+        // Source/destination
+        const networkData = [
+            ['srcIp', event.sourceIp],
+            ['srcPort', event.sourcePort],
+            ['dstIp', event.destinationIp],
+            ['dstPort', event.destinationPort],
+            ['proto', event.protocol],
+        ];
+        const networkElement = this.buildStructuredDataElement('network@47450', networkData);
+        if (networkElement) {
+            elements.push(networkElement);
+        }
+        // User context
+        if (event.user) {
+            const userData = [
+                ['id', event.user.userId],
+                ['name', event.user.username],
+                ['tenantId', event.user.tenantId],
+            ];
+            const userElement = this.buildStructuredDataElement('user@47450', userData);
+            if (userElement) {
+                elements.push(userElement);
+            }
+        }
+        // Geo context
+        if (event.geo) {
+            const geoData = [
+                ['country', event.geo.country],
+                ['city', event.geo.city],
+                ['region', event.geo.region],
+            ];
+            const geoElement = this.buildStructuredDataElement('geo@47450', geoData);
+            if (geoElement) {
+                elements.push(geoElement);
+            }
+        }
+        return elements.length > 0 ? elements.join('') : '-';
+    }
+    /**
+     * Build a single structured data element
+     */
+    buildStructuredDataElement(sdId, params) {
+        const validParams = params.filter(([, value]) => value !== undefined && value !== null && value !== '');
+        if (validParams.length === 0) {
+            return null;
+        }
+        const paramStr = validParams
+            .map(([key, value]) => `${key}="${this.escapeSyslogParamValue(String(value))}"`)
+            .join(' ');
+        return `[${sdId} ${paramStr}]`;
+    }
+    /**
+     * Escape CEF header value
+     */
+    escapeCEFHeader(value) {
+        return value.replace(/[\\|]/g, (char) => CEF_ESCAPE_MAP[char] ?? char);
+    }
+    /**
+     * Escape CEF extension value
+     */
+    escapeCEFExtension(value) {
+        return value.replace(/[\\=\n\r]/g, (char) => CEF_ESCAPE_MAP[char] ?? char);
+    }
+    /**
+     * Escape syslog param value (RFC 5424)
+     */
+    escapeSyslogParamValue(value) {
+        return value.replace(/["\]\\]/g, (char) => `\\${char}`);
+    }
+}
+// =============================================================================
+// Field Normalizer
+// =============================================================================
+/**
+ * Normalize field names across different schemas
+ */
+export class FieldNormalizer {
+    mappings;
+    constructor(mappings) {
+        this.mappings = mappings ?? {};
+    }
+    /**
+     * Normalize a security event's field names
+     */
+    normalize(event) {
+        if (Object.keys(this.mappings).length === 0) {
+            return event;
+        }
+        const customFields = event.customFields
+            ? this.normalizeObject(event.customFields)
+            : undefined;
+        return {
+            ...event,
+            customFields,
+        };
+    }
+    /**
+     * Normalize field names in an object
+     */
+    normalizeObject(obj) {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const normalizedKey = this.mappings[key] ?? key;
+            if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+                result[normalizedKey] = this.normalizeObject(value);
+            }
+            else {
+                result[normalizedKey] = value;
+            }
+        }
+        return result;
+    }
+    /**
+     * Add a field mapping
+     */
+    addMapping(from, to) {
+        this.mappings[from] = to;
+    }
+    /**
+     * Remove a field mapping
+     */
+    removeMapping(from) {
+        delete this.mappings[from];
+    }
+    /**
+     * Get all mappings
+     */
+    getMappings() {
+        return { ...this.mappings };
+    }
+}
+// =============================================================================
+// Factory Functions
+// =============================================================================
+/**
+ * Create an event formatter
+ */
+export function createEventFormatter(options) {
+    return new EventFormatter(options);
+}
+/**
+ * Create a field normalizer
+ */
+export function createFieldNormalizer(mappings) {
+    return new FieldNormalizer(mappings);
+}
+// =============================================================================
+// Singleton Formatter
+// =============================================================================
+let defaultFormatter = null;
+/**
+ * Get the default event formatter
+ */
+export function getDefaultFormatter() {
+    if (!defaultFormatter) {
+        defaultFormatter = new EventFormatter();
+    }
+    return defaultFormatter;
+}
+/**
+ * Set the default event formatter configuration
+ */
+export function configureDefaultFormatter(options) {
+    defaultFormatter = new EventFormatter(options);
+}
+//# sourceMappingURL=formatter.js.map

package/dist/security/siem/formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../../src/security/siem/formatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAE7D,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;GAEG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,CAAC,EAAE,GAAG,EAAE,UAAU;IAClB,CAAC,EAAE,GAAG,EAAE,MAAM;IACd,CAAC,EAAE,GAAG,EAAE,SAAS;IACjB,CAAC,EAAE,GAAG,EAAE,OAAO;IACf,EAAE,EAAE,IAAI,EAAE,WAAW;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAA2B;IAC9C,CAAC,EAAE,CAAC,EAAE,2BAA2B;IACjC,CAAC,EAAE,CAAC,EAAE,gBAAgB;IACtB,CAAC,EAAE,CAAC,EAAE,oBAAoB;IAC1B,CAAC,EAAE,CAAC,EAAE,gBAAgB;IACtB,EAAE,EAAE,CAAC,EAAE,uBAAuB;CAC/B,CAAC;AAEF;;GAEG;AACH,MAAM,cAAc,GAA2B;IAC7C,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,cAAc;IACR,SAAS,CAAa;IACtB,YAAY,CAAgB;IAE7C,YAAY,OAAoD;QAC9D,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,GAAG,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,MAAM,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAoB,EAAE,MAAmB;QAC9C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,MAAM,CAAC;YACZ;gBACE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAoB;QAC7B,MAAM,SAAS,GAAG;YAChB,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,KAAK,CAAC,MAAM;gBAClB,CAAC,CAAC;oBACE,GAAG,KAAK,CAAC,MAAM;oBACf,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;oBAChD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE;iBAC/C;gBACH,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAAoB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI;YAC/B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,kBAAkB;YAC3B,OAAO,EAAE,KAAK;SACf,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CACvC,GAAG,MAAM,CAAC,wBAAwB,IAAI,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAC7D,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QAEzD,kBAAkB;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEhD,OAAO,GAAG,OAAO,IAAI,MAAM,IAAI,OAAO,IAAI,aAAa,IAAI,YAAY,IAAI,IAAI,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;IAC7G,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAoB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI;YAClC,QAAQ,EAAE,CAAC,EAAE,aAAa;YAC1B,OAAO,EAAE,QAAQ;SAClB,CAAC;QAEF,gBAAgB;QAChB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC;QAE3C,oBAAoB;QACpB,MAAM,OAAO,GAAG,CAAC,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC;QAE9C,wBAAwB;QACxB,MAAM,cAAc,GAAG,MAAM,CAAC,qBAAqB;YACjD,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC;QAER,UAAU;QACV,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QAE1B,OAAO,IAAI,GAAG,IAAI,OAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,OAAO,IAAI,MAAM,IAAI,KAAK,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;IAC9G,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,KAAoB;QAC5C,MAAM,MAAM,GAAiD;YAC3D,aAAa;YACb,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;YAE9B,SAAS;YACT,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC;YACvB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC;YACzB,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;YAC3B,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;YAEzB,cAAc;YACd,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC;YAC5B,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC;YAC9B,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC;YAChC,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YAE9B,UAAU;YACV,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YACzB,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC;YACnC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;YAE1B,OAAO;YACP,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/B,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;YAE5B,UAAU;YACV,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC;YAEvB,SAAS;YACT,CAAC,mBAAmB,EAAE,KAAK,CAAC,WAAW,CAAC;YACxC,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC;YAEpC,OAAO;YACP,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC5B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YAE5B,SAAS;YACT,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7B,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3D,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;YACxB,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;YAC1B,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YAE3D,MAAM;YACN,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC;YAC3B,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;YACxB,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAElD,SAAS;YACT,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC;YACjC,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YAEjE,UAAU;YACV,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;SAC3B,CAAC;QAEF,OAAO,MAAM;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;aAC5E,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;aACzE,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED;;OAEG;IACK,yBAAyB,CAAC,KAAoB;QACpD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,iBAAiB;QACjB,MAAM,SAAS,GAAiD;YAC9D,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChB,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC;YACzB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC5B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;YAC5B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC;SAC3B,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC/E,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;QAED,qBAAqB;QACrB,MAAM,WAAW,GAAiD;YAChE,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;YACzB,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;YAC7B,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC;YAC9B,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC;YAClC,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;SAC1B,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,CAAC,0BAA0B,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACrF,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChC,CAAC;QAED,eAAe;QACf,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,QAAQ,GAAiD;gBAC7D,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;gBACzB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC7B,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;aAClC,CAAC;YAEF,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC5E,IAAI,WAAW,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,cAAc;QACd,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,OAAO,GAAiD;gBAC5D,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC9B,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBACxB,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;aAC7B,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACzE,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,CAAC;IAED;;OAEG;IACK,0BAA0B,CAChC,IAAY,EACZ,MAAoD;QAEpD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CACrE,CAAC;QAEF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW;aACzB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;aAC/E,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,OAAO,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,KAAa;QACnC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,KAAa;QACtC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,KAAa;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,OAAO,eAAe;IACT,QAAQ,CAAyB;IAElD,YAAY,QAAiC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAoB;QAC5B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY;YACrC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;YAC1C,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,GAAG,KAAK;YACR,YAAY;SACb,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,GAA4B;QAE5B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YAEhD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,eAAe,CAC1C,KAAgC,CACjC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAY,EAAE,EAAU;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAGpC;IACC,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiC;IAEjC,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,IAAI,gBAAgB,GAA0B,IAAI,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,gBAAgB,GAAG,IAAI,cAAc,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAGzC;IACC,gBAAgB,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/security/siem/hooks.d.ts

@@ -0,0 +1,107 @@
+/**
+ * SIEM Integration Hooks
+ *
+ * Pre-built integration hooks for common use cases:
+ * - Auto-forward security alerts
+ * - Auto-forward audit logs
+ * - Auto-forward anomaly detections
+ * - Configurable event filtering
+ *
+ * @packageDocumentation
+ * @module security/siem/hooks
+ */
+import type { SIEMService } from './service.js';
+import type { SecurityEvent, IntegrationHook } from './types.js';
+import type { SecurityAlert } from '../alerting/types.js';
+import type { Anomaly } from '../anomaly/types.js';
+import type { AuditRecord } from '../../audit/types.js';
+/**
+ * Configuration for security alert hook
+ */
+export interface SecurityAlertHookConfig {
+    /** Only forward alerts with these severities */
+    severities?: string[];
+    /** Only forward alerts with these types */
+    alertTypes?: string[];
+    /** Include raw alert data */
+    includeRawData?: boolean;
+    /** Additional tags to add */
+    additionalTags?: string[];
+}
+/**
+ * Create a hook for forwarding security alerts to SIEM
+ */
+export declare function createSecurityAlertHook(config?: SecurityAlertHookConfig): IntegrationHook;
+/**
+ * Convert a SecurityAlert to a SecurityEvent for SIEM
+ */
+export declare function securityAlertToEvent(alert: SecurityAlert): SecurityEvent;
+/**
+ * Configuration for audit log hook
+ */
+export interface AuditLogHookConfig {
+    /** Only forward audit logs with these categories */
+    categories?: string[];
+    /** Only forward audit logs with these severities */
+    severities?: string[];
+    /** Only forward audit logs with these outcomes */
+    outcomes?: string[];
+    /** Exclude certain event types */
+    excludeEventTypes?: string[];
+    /** Include state change data */
+    includeStateChange?: boolean;
+    /** Additional tags to add */
+    additionalTags?: string[];
+}
+/**
+ * Create a hook for forwarding audit logs to SIEM
+ */
+export declare function createAuditLogHook(config?: AuditLogHookConfig): IntegrationHook;
+/**
+ * Convert an AuditRecord to a SecurityEvent for SIEM
+ */
+export declare function auditRecordToEvent(record: AuditRecord): SecurityEvent;
+/**
+ * Configuration for anomaly detection hook
+ */
+export interface AnomalyHookConfig {
+    /** Only forward anomalies with these types */
+    anomalyTypes?: string[];
+    /** Minimum confidence threshold (0-100) */
+    minConfidence?: number;
+    /** Only forward anomalies with these severities */
+    severities?: string[];
+    /** Include indicators */
+    includeIndicators?: boolean;
+    /** Additional tags to add */
+    additionalTags?: string[];
+}
+/**
+ * Create a hook for forwarding anomaly detections to SIEM
+ */
+export declare function createAnomalyHook(config?: AnomalyHookConfig): IntegrationHook;
+/**
+ * Convert an Anomaly to a SecurityEvent for SIEM
+ */
+export declare function anomalyToEvent(anomaly: Anomaly): SecurityEvent;
+/**
+ * Register standard hooks with a SIEM service
+ */
+export declare function registerStandardHooks(siemService: SIEMService, config?: {
+    alerts?: SecurityAlertHookConfig | false;
+    audit?: AuditLogHookConfig | false;
+    anomaly?: AnomalyHookConfig | false;
+}): void;
+/**
+ * Forward a security alert to SIEM
+ */
+export declare function forwardSecurityAlert(siemService: SIEMService, alert: SecurityAlert): Promise<void>;
+/**
+ * Forward an audit record to SIEM
+ */
+export declare function forwardAuditRecord(siemService: SIEMService, record: AuditRecord): Promise<void>;
+/**
+ * Forward an anomaly to SIEM
+ */
+export declare function forwardAnomaly(siemService: SIEMService, anomaly: Anomaly): Promise<void>;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/security/siem/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/security/siem/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EACV,aAAa,EAIb,eAAe,EAGhB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAQxD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,GAAE,uBAA4B,GACnC,eAAe,CAkCjB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAoCxE;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,kCAAkC;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gCAAgC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,kBAAuB,GAC9B,eAAe,CAmEjB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAkCrE;AAMD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yBAAyB;IACzB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,GAAE,iBAAsB,GAC7B,eAAe,CAqDjB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAwB9D;AAMD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE;IACP,MAAM,CAAC,EAAE,uBAAuB,GAAG,KAAK,CAAC;IACzC,KAAK,CAAC,EAAE,kBAAkB,GAAG,KAAK,CAAC;IACnC,OAAO,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;CACrC,GACA,IAAI,CAqCN;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAGf"}