agent-threat-rules 2.0.2 → 2.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -1
- package/dist/cli.js +0 -0
- package/dist/tc-reporter.d.ts.map +1 -1
- package/dist/tc-reporter.js +4 -2
- package/dist/tc-reporter.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -8,13 +8,15 @@ AI Agent 威脅偵測規則 -- 開源、社群驅動
|
|
|
8
8
|
|
|
9
9
|
<br />
|
|
10
10
|
|
|
11
|
+
[](https://www.npmjs.com/package/agent-threat-rules)
|
|
12
|
+
[](https://pypi.org/project/pyatr/)
|
|
13
|
+
[](https://github.com/marketplace/actions/atr-scan)
|
|
11
14
|
[](LICENSE)
|
|
12
15
|
[](#what-atr-detects)
|
|
13
16
|
[](#ecosystem)
|
|
14
17
|
[](#evaluation)
|
|
15
18
|
[](#ecosystem-scan)
|
|
16
19
|
[](#standards-coverage)
|
|
17
|
-
[](#roadmap)
|
|
18
20
|
|
|
19
21
|
</div>
|
|
20
22
|
|
package/dist/cli.js
CHANGED
|
File without changes
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tc-reporter.d.ts","sourceRoot":"","sources":["../src/tc-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAsC,MAAM,aAAa,CAAC;AAInF,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAC3C;AAYD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,GAAG;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B,
|
|
1
|
+
{"version":3,"file":"tc-reporter.d.ts","sourceRoot":"","sources":["../src/tc-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAsC,MAAM,aAAa,CAAC;AAInF,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAC3C;AAYD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,WAAW,GAAG;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B,CA8HA"}
|
package/dist/tc-reporter.js
CHANGED
|
@@ -56,12 +56,14 @@ export function createTCReporter(config) {
|
|
|
56
56
|
flushing = true;
|
|
57
57
|
const batch = [...buffer];
|
|
58
58
|
buffer = [];
|
|
59
|
-
// Map ATR events to TC ThreatDataSchema format
|
|
59
|
+
// Map ATR events to TC ThreatDataSchema format.
|
|
60
|
+
// Field name `sigmaRuleMatched` is legacy on the TC side (now stores ATR
|
|
61
|
+
// rule ID) — reporter must match the API contract or requests get 400.
|
|
60
62
|
const tcEvents = batch.map((e) => ({
|
|
61
63
|
attackSourceIP: clientId,
|
|
62
64
|
attackType: e.category,
|
|
63
65
|
mitreTechnique: e.ruleId,
|
|
64
|
-
|
|
66
|
+
sigmaRuleMatched: e.ruleId,
|
|
65
67
|
timestamp: e.timestamp,
|
|
66
68
|
region: 'unknown',
|
|
67
69
|
// Extra fields for richer data (TC ignores unknown fields via Zod passthrough)
|
package/dist/tc-reporter.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tc-reporter.js","sourceRoot":"","sources":["../src/tc-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,GAAG,IAAI,CAAC;AA2BxB;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IAIxD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,MAAM,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAC;IAE7F,kCAAkC;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAA0C,IAAI,CAAC;IAE7D,uBAAuB;IACvB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACzE,iDAAiD;IACjD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1E,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5C,QAAQ,GAAG,IAAI,CAAC;QAEhB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC1B,MAAM,GAAG,EAAE,CAAC;QAEZ
|
|
1
|
+
{"version":3,"file":"tc-reporter.js","sourceRoot":"","sources":["../src/tc-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,GAAG,IAAI,CAAC;AA2BxB;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IAIxD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,MAAM,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAC;IAE7F,kCAAkC;IAClC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,GAAkB,EAAE,CAAC;IAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAA0C,IAAI,CAAC;IAE7D,uBAAuB;IACvB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACzE,iDAAiD;IACjD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1E,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC5C,QAAQ,GAAG,IAAI,CAAC;QAEhB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC1B,MAAM,GAAG,EAAE,CAAC;QAEZ,gDAAgD;QAChD,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,cAAc,EAAE,QAAQ;YACxB,UAAU,EAAE,CAAC,CAAC,QAAQ;YACtB,cAAc,EAAE,CAAC,CAAC,MAAM;YACxB,gBAAgB,EAAE,CAAC,CAAC,MAAM;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,+EAA+E;YAC/E,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,KAAK,cAAc,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,sBAAsB,EAAE,QAAQ;oBAChC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;gBAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpD,OAAO,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IAED,SAAS,OAAO,CAAC,KAAkB;QACjC,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5B,oCAAoC;QACpC,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,qCAAqC;QACrC,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,KAAK,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAGV;QACF,WAAW,EAAE,CAAC,MAA0B,EAAE,EAAE;YAC1C,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC,MAAsB,EAAE,EAAE;YAClC,OAAO,CAAC;gBACN,MAAM,EAAE,WAAW;gBACnB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,KAAK,EAAE,WAAW;QAElB,sFAAsF;QACtF,KAAK,CAAC,OAAO;YACX,IAAI,UAAU,EAAE,CAAC;gBACf,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,MAAM;SACV,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1B,OAAO,CAAC,KAAK,WAAW;eACnB,CAAC,KAAK,WAAW;eACjB,CAAC,KAAK,KAAK;eACX,CAAC,KAAK,OAAO,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "agent-threat-rules",
|
|
3
|
-
"version": "2.0.
|
|
3
|
+
"version": "2.0.3",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"description": "Open detection standard for AI agent security. 113 rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. Shipped in Cisco AI Defense.",
|
|
6
6
|
"main": "./dist/index.js",
|