@vorionsys/security 1.0.0

package/dist/audit/siem/loki.js

@@ -0,0 +1,405 @@
+/**
+ * Grafana Loki SIEM Connector
+ *
+ * Primary connector for Loki (free/self-hosted SIEM).
+ * Implements the Loki Push API for log ingestion with batching and retry.
+ *
+ * @see https://grafana.com/docs/loki/latest/api/#push-log-entries-to-loki
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+import { gzip } from 'zlib';
+import { promisify } from 'util';
+import { SIEMConnectionError, SIEMBatchError } from './types.js';
+const logger = createLogger({ component: 'siem-loki' });
+const gzipAsync = promisify(gzip);
+// =============================================================================
+// LOKI CONNECTOR IMPLEMENTATION
+// =============================================================================
+/**
+ * Grafana Loki connector for SIEM integration.
+ *
+ * Features:
+ * - Push API support (/loki/api/v1/push)
+ * - Structured JSON log lines
+ * - Configurable labels (app, environment, severity)
+ * - Automatic batching with flush interval
+ * - Exponential backoff retry
+ * - Gzip compression support
+ */
+export class LokiConnector {
+    provider = 'loki';
+    config;
+    queue = [];
+    flushTimer = null;
+    isShuttingDown = false;
+    // Statistics
+    stats = {
+        eventsSent: 0,
+        eventsFailed: 0,
+        batchesSent: 0,
+        queueSize: 0,
+        avgLatencyMs: 0,
+        eventsDropped: 0,
+        retryAttempts: 0,
+    };
+    latencies = [];
+    constructor(config) {
+        this.config = config;
+        // Start the flush timer
+        this.startFlushTimer();
+        logger.info({
+            endpoint: config.endpoint,
+            batchSize: config.batchSize,
+            flushIntervalMs: config.flushIntervalMs,
+            compression: config.compression,
+        }, 'Loki connector initialized');
+    }
+    /**
+     * Check if Loki is reachable
+     */
+    async healthCheck() {
+        try {
+            // Loki's /ready endpoint is used for health checks
+            const readyUrl = new URL('/ready', this.config.endpoint).toString();
+            const response = await fetch(readyUrl, {
+                method: 'GET',
+                headers: this.buildHeaders(),
+                signal: AbortSignal.timeout(this.config.timeoutMs),
+            });
+            const isHealthy = response.ok;
+            logger.debug({ isHealthy, status: response.status }, 'Loki health check');
+            return isHealthy;
+        }
+        catch (error) {
+            logger.warn({ error }, 'Loki health check failed');
+            return false;
+        }
+    }
+    /**
+     * Send a single event to Loki
+     */
+    async sendEvent(event) {
+        if (this.isShuttingDown) {
+            throw new SIEMConnectionError('Connector is shutting down', 'loki', this.config.endpoint);
+        }
+        // Add to queue
+        this.addToQueue(event);
+        // Flush if batch size reached
+        if (this.queue.length >= this.config.batchSize) {
+            await this.flush();
+        }
+    }
+    /**
+     * Send a batch of events to Loki
+     */
+    async sendBatch(events) {
+        if (this.isShuttingDown) {
+            throw new SIEMConnectionError('Connector is shutting down', 'loki', this.config.endpoint);
+        }
+        if (events.length === 0) {
+            return;
+        }
+        const startTime = Date.now();
+        let lastError;
+        // Retry loop with exponential backoff
+        for (let attempt = 0; attempt <= this.config.retryAttempts; attempt++) {
+            try {
+                await this.pushToLoki(events);
+                // Success - update stats
+                const latency = Date.now() - startTime;
+                this.updateLatencyStats(latency);
+                this.stats.eventsSent += events.length;
+                this.stats.batchesSent++;
+                this.stats.lastSuccessAt = new Date();
+                logger.debug({
+                    eventsCount: events.length,
+                    latencyMs: latency,
+                    attempt: attempt + 1,
+                }, 'Batch sent to Loki');
+                return;
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error : new Error(String(error));
+                this.stats.retryAttempts++;
+                if (attempt < this.config.retryAttempts) {
+                    // Calculate delay with exponential backoff
+                    const delay = this.config.retryDelayMs * Math.pow(2, attempt);
+                    logger.warn({
+                        attempt: attempt + 1,
+                        maxAttempts: this.config.retryAttempts + 1,
+                        delayMs: delay,
+                        error: lastError.message,
+                    }, 'Loki push failed, retrying');
+                    await this.sleep(delay);
+                }
+            }
+        }
+        // All retries failed
+        this.stats.eventsFailed += events.length;
+        this.stats.lastErrorAt = new Date();
+        this.stats.lastError = lastError?.message ?? 'Unknown error';
+        throw new SIEMBatchError(`Failed to send batch to Loki after ${this.config.retryAttempts + 1} attempts`, 'loki', events.length, events.length, lastError);
+    }
+    /**
+     * Flush all queued events
+     */
+    async flush() {
+        if (this.queue.length === 0) {
+            return;
+        }
+        // Take all events from queue
+        const events = this.queue.splice(0, this.queue.length);
+        this.stats.queueSize = this.queue.length;
+        try {
+            await this.sendBatch(events);
+        }
+        catch (error) {
+            logger.error({ error, eventsCount: events.length }, 'Failed to flush events to Loki');
+            // Events are lost after all retries fail
+            throw error;
+        }
+    }
+    /**
+     * Graceful shutdown
+     */
+    async shutdown() {
+        logger.info('Shutting down Loki connector');
+        this.isShuttingDown = true;
+        // Stop the flush timer
+        if (this.flushTimer) {
+            clearInterval(this.flushTimer);
+            this.flushTimer = null;
+        }
+        // Flush remaining events
+        try {
+            await this.flush();
+        }
+        catch (error) {
+            logger.error({ error }, 'Error flushing events during shutdown');
+        }
+        logger.info({
+            eventsSent: this.stats.eventsSent,
+            eventsFailed: this.stats.eventsFailed,
+            eventsDropped: this.stats.eventsDropped,
+        }, 'Loki connector shutdown complete');
+    }
+    /**
+     * Get connector statistics
+     */
+    getStats() {
+        return {
+            ...this.stats,
+            queueSize: this.queue.length,
+        };
+    }
+    // ===========================================================================
+    // PRIVATE METHODS
+    // ===========================================================================
+    /**
+     * Start the periodic flush timer
+     */
+    startFlushTimer() {
+        this.flushTimer = setInterval(async () => {
+            if (this.queue.length > 0 && !this.isShuttingDown) {
+                try {
+                    await this.flush();
+                }
+                catch (error) {
+                    // Errors are already logged in flush()
+                }
+            }
+        }, this.config.flushIntervalMs);
+        // Unref so it doesn't keep the process alive
+        this.flushTimer.unref();
+    }
+    /**
+     * Add event to queue with overflow protection
+     */
+    addToQueue(event) {
+        // Check event type filter
+        if (this.config.eventTypes.length > 0 &&
+            !this.config.eventTypes.includes(event.type)) {
+            return; // Event type not in filter
+        }
+        // Check queue overflow
+        if (this.queue.length >= this.config.maxQueueSize) {
+            this.stats.eventsDropped++;
+            logger.warn({
+                queueSize: this.queue.length,
+                maxQueueSize: this.config.maxQueueSize,
+            }, 'Event dropped due to queue overflow');
+            return;
+        }
+        this.queue.push(event);
+        this.stats.queueSize = this.queue.length;
+    }
+    /**
+     * Push events to Loki's API
+     */
+    async pushToLoki(events) {
+        const pushUrl = new URL('/loki/api/v1/push', this.config.endpoint).toString();
+        // Build Loki push request
+        const request = this.buildLokiRequest(events);
+        // Serialize to JSON
+        const body = JSON.stringify(request);
+        // Optionally compress
+        let finalBody = body;
+        const headers = this.buildHeaders();
+        if (this.config.compression) {
+            finalBody = await gzipAsync(body);
+            headers['Content-Encoding'] = 'gzip';
+        }
+        // Send request - cast body for TypeScript compatibility
+        const response = await fetch(pushUrl, {
+            method: 'POST',
+            headers,
+            body: finalBody,
+            signal: AbortSignal.timeout(this.config.timeoutMs),
+        });
+        if (!response.ok) {
+            const errorBody = await response.text().catch(() => 'Unknown error');
+            throw new SIEMConnectionError(`Loki push failed: ${response.status} ${response.statusText} - ${errorBody}`, 'loki', pushUrl, response.status);
+        }
+    }
+    /**
+     * Build Loki push request from events
+     */
+    buildLokiRequest(events) {
+        // Group events by labels (app, environment, severity)
+        const streamMap = new Map();
+        for (const event of events) {
+            const labelKey = this.getLabelKey(event);
+            const existing = streamMap.get(labelKey);
+            if (existing) {
+                existing.push(event);
+            }
+            else {
+                streamMap.set(labelKey, [event]);
+            }
+        }
+        // Build streams
+        const streams = [];
+        streamMap.forEach((groupedEvents, labelKey) => {
+            const labels = this.parseLabelKey(labelKey);
+            const values = groupedEvents.map((event) => this.eventToLokiEntry(event));
+            streams.push({
+                stream: labels,
+                values,
+            });
+        });
+        return { streams };
+    }
+    /**
+     * Get a unique key for grouping events by labels
+     */
+    getLabelKey(event) {
+        return `${this.config.appLabel}|${this.config.environmentLabel}|${event.severity}|${event.category}`;
+    }
+    /**
+     * Parse label key back to label object
+     */
+    parseLabelKey(key) {
+        const [app, environment, severity, category] = key.split('|');
+        return {
+            app: app ?? this.config.appLabel,
+            environment: environment ?? this.config.environmentLabel,
+            severity: severity ?? 'info',
+            category: category ?? 'system',
+            job: 'vorion-audit',
+        };
+    }
+    /**
+     * Convert an audit event to a Loki log entry
+     */
+    eventToLokiEntry(event) {
+        // Loki expects nanosecond timestamps as strings
+        const timestampNs = (event.timestamp.getTime() * 1_000_000).toString();
+        // Build structured log line as JSON
+        const logLine = JSON.stringify({
+            id: event.id,
+            type: event.type,
+            category: event.category,
+            severity: event.severity,
+            action: event.action,
+            outcome: event.outcome,
+            actor: {
+                userId: event.actor.userId,
+                tenantId: event.actor.tenantId,
+                ipAddress: event.actor.ipAddress,
+                userAgent: event.actor.userAgent,
+                sessionId: event.actor.sessionId,
+                actorType: event.actor.actorType,
+            },
+            resource: {
+                type: event.resource.type,
+                id: event.resource.id,
+                name: event.resource.name,
+            },
+            metadata: {
+                requestId: event.metadata.requestId,
+                traceId: event.metadata.traceId,
+                spanId: event.metadata.spanId,
+                correlationId: event.metadata.correlationId,
+                source: event.metadata.source,
+                tags: event.metadata.tags,
+            },
+            details: event.details,
+        });
+        return [timestampNs, logLine];
+    }
+    /**
+     * Build HTTP headers for Loki requests
+     */
+    buildHeaders() {
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        const auth = this.config.authentication;
+        switch (auth.type) {
+            case 'basic':
+                if (auth.username && auth.password) {
+                    const credentials = Buffer.from(`${auth.username}:${auth.password}`).toString('base64');
+                    headers['Authorization'] = `Basic ${credentials}`;
+                }
+                break;
+            case 'bearer':
+                if (auth.token) {
+                    headers['Authorization'] = `Bearer ${auth.token}`;
+                }
+                break;
+            case 'api-key':
+                if (auth.apiKey) {
+                    headers['X-API-Key'] = auth.apiKey;
+                }
+                break;
+        }
+        return headers;
+    }
+    /**
+     * Update latency statistics
+     */
+    updateLatencyStats(latencyMs) {
+        this.latencies.push(latencyMs);
+        // Keep only last 100 latencies for rolling average
+        if (this.latencies.length > 100) {
+            this.latencies.shift();
+        }
+        // Calculate average
+        const sum = this.latencies.reduce((a, b) => a + b, 0);
+        this.stats.avgLatencyMs = Math.round(sum / this.latencies.length);
+    }
+    /**
+     * Sleep for a specified duration
+     */
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}
+/**
+ * Create a new Loki connector instance
+ */
+export function createLokiConnector(config) {
+    return new LokiConnector(config);
+}
+//# sourceMappingURL=loki.js.map

package/dist/audit/siem/loki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loki.js","sourceRoot":"","sources":["../../../src/audit/siem/loki.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AASjC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AACxD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAElC,gFAAgF;AAChF,gCAAgC;AAChC,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,aAAa;IACf,QAAQ,GAAG,MAAe,CAAC;IAE5B,MAAM,CAAa;IACnB,KAAK,GAAiB,EAAE,CAAC;IACzB,UAAU,GAA0B,IAAI,CAAC;IACzC,cAAc,GAAG,KAAK,CAAC;IAE/B,aAAa;IACL,KAAK,GAAuB;QAClC,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,CAAC;QACf,WAAW,EAAE,CAAC;QACd,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,CAAC;QACf,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,CAAC;KACjB,CAAC;IACM,SAAS,GAAa,EAAE,CAAC;IAEjC,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,wBAAwB;QACxB,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,MAAM,CAAC,IAAI,CACT;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBACrC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;aACnD,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;YAE9B,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;YAE1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,KAAiB;QAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CACrB,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEvB,8BAA8B;QAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAoB;QAClC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,EAC5B,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,QAAQ,CACrB,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,SAA4B,CAAC;QAEjC,sCAAsC;QACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAE9B,yBAAyB;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACvC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;gBAEtC,MAAM,CAAC,KAAK,CACV;oBACE,WAAW,EAAE,MAAM,CAAC,MAAM;oBAC1B,SAAS,EAAE,OAAO;oBAClB,OAAO,EAAE,OAAO,GAAG,CAAC;iBACrB,EACD,oBAAoB,CACrB,CAAC;gBAEF,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBAE3B,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;oBACxC,2CAA2C;oBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC9D,MAAM,CAAC,IAAI,CACT;wBACE,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC;wBAC1C,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,SAAS,CAAC,OAAO;qBACzB,EACD,4BAA4B,CAC7B,CAAC;oBACF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,SAAS,EAAE,OAAO,IAAI,eAAe,CAAC;QAE7D,MAAM,IAAI,cAAc,CACtB,sCAAsC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,WAAW,EAC9E,MAAM,EACN,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,EACb,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,EACrC,gCAAgC,CACjC,CAAC;YACF,yCAAyC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAE3B,uBAAuB;QACvB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,yBAAyB;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACjC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACrC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;SACxC,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO;YACL,GAAG,IAAI,CAAC,KAAK;YACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SAC7B,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;OAEG;IACK,eAAe;QACrB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YACvC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,uCAAuC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEhC,6CAA6C;QAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,KAAiB;QAClC,0BAA0B;QAC1B,IACE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAC5C,CAAC;YACD,OAAO,CAAC,2BAA2B;QACrC,CAAC;QAED,uBAAuB;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;aACvC,EACD,qCAAqC,CACtC,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,MAAoB;QAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAE9E,0BAA0B;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE9C,oBAAoB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAErC,sBAAsB;QACtB,IAAI,SAAS,GAAoB,IAAI,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,SAAqB;YAC3B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;YACrE,MAAM,IAAI,mBAAmB,CAC3B,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,EAC5E,MAAM,EACN,OAAO,EACP,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,MAAoB;QAC3C,sDAAsD;QACtD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;QAElD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,SAAS,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAC7B,CAAC;YAEF,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,MAAM;gBACd,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,KAAiB;QACnC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvG,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,GAAW;QAC/B,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO;YACL,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAChC,WAAW,EAAE,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB;YACxD,QAAQ,EAAE,QAAQ,IAAI,MAAM;YAC5B,QAAQ,EAAE,QAAQ,IAAI,QAAQ;YAC9B,GAAG,EAAE,cAAc;SACpB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAiB;QACxC,gDAAgD;QAChD,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEvE,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE;gBACL,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;gBAC1B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAC9B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;aACjC;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;gBACzB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;gBACrB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAC1B;YACD,QAAQ,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;gBACnC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAC/B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;gBAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;gBAC3C,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;gBAC7B,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAC1B;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QAEH,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAExC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,OAAO;gBACV,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CACpC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACrB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;gBACpD,CAAC;gBACD,MAAM;YAER,KAAK,QAAQ;gBACX,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpD,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrC,CAAC;gBACD,MAAM;QACV,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,SAAiB;QAC1C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE/B,mDAAmD;QACnD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,oBAAoB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/audit/siem/splunk.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Splunk HEC SIEM Connector
+ *
+ * Connector for Splunk HTTP Event Collector (HEC) integration.
+ * Supports batching, retry, and configurable indexing.
+ *
+ * @see https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector
+ * @packageDocumentation
+ */
+import type { AuditEvent, ISIEMConnector, SIEMConfig, SIEMConnectorStats } from './types.js';
+/**
+ * Splunk HEC connector for SIEM integration.
+ *
+ * Features:
+ * - HEC event endpoint support
+ * - Configurable source, sourcetype, and index
+ * - Automatic batching with flush interval
+ * - Exponential backoff retry
+ * - Gzip compression support
+ * - Token-based authentication
+ */
+export declare class SplunkConnector implements ISIEMConnector {
+    readonly provider: "splunk";
+    private config;
+    private queue;
+    private flushTimer;
+    private isShuttingDown;
+    private source;
+    private sourcetype;
+    private index;
+    private stats;
+    private latencies;
+    constructor(config: SIEMConfig);
+    /**
+     * Check if Splunk HEC is reachable
+     */
+    healthCheck(): Promise<boolean>;
+    /**
+     * Send a single event to Splunk
+     */
+    sendEvent(event: AuditEvent): Promise<void>;
+    /**
+     * Send a batch of events to Splunk
+     */
+    sendBatch(events: AuditEvent[]): Promise<void>;
+    /**
+     * Flush all queued events
+     */
+    flush(): Promise<void>;
+    /**
+     * Graceful shutdown
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Get connector statistics
+     */
+    getStats(): SIEMConnectorStats;
+    /**
+     * Start the periodic flush timer
+     */
+    private startFlushTimer;
+    /**
+     * Add event to queue with overflow protection
+     */
+    private addToQueue;
+    /**
+     * Push events to Splunk HEC
+     */
+    private pushToSplunk;
+    /**
+     * Convert an audit event to Splunk HEC format
+     */
+    private eventToHECEvent;
+    /**
+     * Build HTTP headers for Splunk HEC requests
+     */
+    private buildHeaders;
+    /**
+     * Update latency statistics
+     */
+    private updateLatencyStats;
+    /**
+     * Sleep for a specified duration
+     */
+    private sleep;
+}
+/**
+ * Create a new Splunk HEC connector instance
+ */
+export declare function createSplunkConnector(config: SIEMConfig): SplunkConnector;
+//# sourceMappingURL=splunk.d.ts.map

package/dist/audit/siem/splunk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"splunk.d.ts","sourceRoot":"","sources":["../../../src/audit/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AAUpB;;;;;;;;;;GAUG;AACH,qBAAa,eAAgB,YAAW,cAAc;IACpD,QAAQ,CAAC,QAAQ,EAAG,QAAQ,CAAU;IAEtC,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,cAAc,CAAS;IAG/B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,KAAK,CAAS;IAGtB,OAAO,CAAC,KAAK,CAQX;IACF,OAAO,CAAC,SAAS,CAAgB;gBAErB,MAAM,EAAE,UAAU;IAuB9B;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAyBrC;;OAEG;IACG,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjD;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAwEpD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAyB/B;;OAEG;IACH,QAAQ,IAAI,kBAAkB;IAW9B;;OAEG;IACH,OAAO,CAAC,eAAe;IAcvB;;OAEG;IACH,OAAO,CAAC,UAAU;IA0BlB;;OAEG;YACW,YAAY;IAiD1B;;OAEG;IACH,OAAO,CAAC,eAAe;IA8CvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAmCpB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;OAEG;IACH,OAAO,CAAC,KAAK;CAGd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,CAEzE"}