chainlesschain 0.47.7 → 0.47.9

package/src/commands/compliance.js

@@ -3,6 +3,7 @@
  * chainlesschain compliance evidence|report|classify|scan|policies|check-access
  */
 
+import fs from "fs";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
@@ -16,6 +17,69 @@ import {
   addPolicy,
   checkAccess,
 } from "../lib/compliance-manager.js";
+import {
+  generateFrameworkReport,
+  listFrameworks as listReporterFrameworks,
+  getFrameworkTemplate,
+} from "../lib/compliance-framework-reporter.js";
+import {
+  ensureThreatIntelTables,
+  importStixFile,
+  listIndicators,
+  matchObservable,
+  getStats as getThreatIntelStats,
+  removeIndicator,
+} from "../lib/threat-intel.js";
+import { IOC_TYPES } from "../lib/stix-parser.js";
+import {
+  ensureUebaTables,
+  buildBaseline,
+  saveBaselines,
+  loadBaseline,
+  loadAllBaselines,
+  detectAnomalies,
+  rankEntities,
+  scoreEvent,
+} from "../lib/ueba.js";
+
+function _loadEvidenceFromDb(db, framework) {
+  return db
+    .prepare(
+      `SELECT id, framework, type, description, source, status, collected_at
+         FROM compliance_evidence
+        WHERE framework = ?`,
+    )
+    .all(framework)
+    .map((r) => ({
+      id: r.id,
+      framework: r.framework,
+      type: r.type,
+      description: r.description,
+      source: r.source,
+      status: r.status,
+      collectedAt: r.collected_at,
+    }));
+}
+
+function _loadPoliciesFromDb(db, framework) {
+  return db
+    .prepare(
+      `SELECT id, name, type, framework, rules, enabled, severity, created_at
+         FROM compliance_policies
+        WHERE framework = ? AND enabled = 1`,
+    )
+    .all(framework)
+    .map((r) => ({
+      id: r.id,
+      name: r.name,
+      type: r.type,
+      framework: r.framework,
+      rules: r.rules ? JSON.parse(r.rules) : {},
+      enabled: !!r.enabled,
+      severity: r.severity,
+      createdAt: r.created_at,
+    }));
+}
 
 export function registerComplianceCommand(program) {
   const compliance = program
@@ -63,9 +127,21 @@ export function registerComplianceCommand(program) {
   // compliance report
   compliance
     .command("report <framework>")
-    .description("Generate compliance report")
+    .description(
+      "Generate compliance report (frameworks: soc2, iso27001, gdpr, hipaa)",
+    )
     .option("-t, --title <title>", "Report title")
-    .option("--json", "Output as JSON")
+    .option(
+      "-f, --format <fmt>",
+      "Output format: summary | md | html | json",
+      "summary",
+    )
+    .option("-o, --output <path>", "Write report to file instead of stdout")
+    .option(
+      "--detailed",
+      "Use framework-aware template reporter (SOC2/ISO27001/GDPR)",
+    )
+    .option("--json", "Alias for --format=json (backwards-compat)")
     .action(async (framework, options) => {
       try {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
@@ -76,15 +152,56 @@ export function registerComplianceCommand(program) {
         const db = ctx.db.getDatabase();
         ensureComplianceTables(db);
 
-        const result = generateReport(db, framework, options.title);
-        if (options.json) {
-          console.log(JSON.stringify(result, null, 2));
-        } else {
+        const fmt = options.json ? "json" : options.format;
+        const useDetailed =
+          options.detailed ||
+          fmt === "md" ||
+          fmt === "markdown" ||
+          fmt === "html" ||
+          !!options.output;
+
+        // Fast path — legacy generic report for backwards-compat.
+        if (!useDetailed && fmt === "summary") {
+          const result = generateReport(db, framework, options.title);
           logger.success("Report generated");
           logger.log(`  ${chalk.bold("ID:")}        ${chalk.cyan(result.id)}`);
           logger.log(`  ${chalk.bold("Title:")}     ${result.title}`);
           logger.log(`  ${chalk.bold("Score:")}     ${result.score}`);
           logger.log(`  ${chalk.bold("Summary:")}   ${result.summary}`);
+          await shutdown();
+          return;
+        }
+
+        if (!getFrameworkTemplate(framework)) {
+          logger.error(
+            `Framework "${framework}" has no detailed template. ` +
+              `Available: ${listReporterFrameworks().join(", ")}.`,
+          );
+          process.exit(1);
+        }
+
+        const evidence = _loadEvidenceFromDb(db, framework);
+        const policies = _loadPoliciesFromDb(db, framework);
+
+        const { analysis, body, format } = generateFrameworkReport(framework, {
+          evidence,
+          policies,
+          format: fmt === "summary" ? "markdown" : fmt,
+        });
+
+        if (options.output) {
+          fs.writeFileSync(options.output, body, "utf-8");
+          logger.success(
+            `Report written to ${chalk.cyan(options.output)} ` +
+              `(${format}, ${body.length} bytes)`,
+          );
+          logger.log(
+            `  ${chalk.bold("Score:")}   ${analysis.score}/100  ` +
+              chalk.dim(`(${analysis.summary})`),
+          );
+        } else {
+          process.stdout.write(body);
+          if (!body.endsWith("\n")) process.stdout.write("\n");
         }
 
         await shutdown();
@@ -94,6 +211,34 @@ export function registerComplianceCommand(program) {
       }
     });
 
+  // compliance frameworks (list templates)
+  compliance
+    .command("frameworks")
+    .description("List supported report frameworks")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      const frameworks = listReporterFrameworks().map((id) => {
+        const t = getFrameworkTemplate(id);
+        return {
+          id,
+          name: t.name,
+          version: t.version,
+          category: t.category,
+          controlCount: t.controls.length,
+        };
+      });
+      if (options.json) {
+        console.log(JSON.stringify(frameworks, null, 2));
+      } else {
+        for (const f of frameworks) {
+          logger.log(
+            `  ${chalk.cyan(f.id.padEnd(10))} ${f.name} ` +
+              chalk.dim(`(${f.version}, ${f.controlCount} controls)`),
+          );
+        }
+      }
+    });
+
   // compliance classify
   compliance
     .command("classify <content>")
@@ -213,4 +358,450 @@ export function registerComplianceCommand(program) {
         process.exit(1);
       }
     });
+
+  // compliance threat-intel
+  const threat = compliance
+    .command("threat-intel")
+    .description(
+      "Threat-intelligence IoC store — STIX 2.1 import, list, match",
+    );
+
+  threat
+    .command("import <file>")
+    .description("Import a STIX 2.1 bundle JSON file")
+    .option("--json", "Output as JSON")
+    .action(async (file, options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureThreatIntelTables(db);
+
+        const result = importStixFile(db, file);
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          logger.success(
+            `Imported ${chalk.cyan(result.imported)} new, ` +
+              `${chalk.cyan(result.updated)} updated, ` +
+              `${chalk.dim(result.skipped)} skipped ` +
+              chalk.dim(`(of ${result.total} indicators)`),
+          );
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  threat
+    .command("list")
+    .description("List stored indicators")
+    .option("-t, --type <type>", `Filter by IOC type (${IOC_TYPES.join("|")})`)
+    .option("--limit <n>", "Max rows", "100")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureThreatIntelTables(db);
+
+        const rows = listIndicators(db, {
+          type: options.type,
+          limit: Number(options.limit) || 100,
+        });
+        if (options.json) {
+          console.log(JSON.stringify(rows, null, 2));
+        } else if (rows.length === 0) {
+          logger.info("No indicators stored.");
+        } else {
+          for (const r of rows) {
+            const labels = r.labels.length ? ` [${r.labels.join(",")}]` : "";
+            logger.log(
+              `  ${chalk.cyan(r.type.padEnd(12))} ${r.value}` +
+                chalk.dim(labels) +
+                (r.sourceName ? chalk.dim(`  ← ${r.sourceName}`) : ""),
+            );
+          }
+          logger.log(chalk.dim(`  (${rows.length} shown)`));
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  threat
+    .command("match <observable>")
+    .description("Check whether a value matches a stored indicator")
+    .option("--json", "Output as JSON")
+    .action(async (observable, options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureThreatIntelTables(db);
+
+        const result = matchObservable(db, observable);
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else if (result.matched) {
+          logger.log(
+            `  ${chalk.red("⚠ MATCH")} ` +
+              `${chalk.cyan(result.type)} ${observable}` +
+              (result.indicator.sourceName
+                ? chalk.dim(`  ← ${result.indicator.sourceName}`)
+                : ""),
+          );
+          if (result.indicator.labels.length) {
+            logger.log(
+              chalk.dim(`    labels: ${result.indicator.labels.join(", ")}`),
+            );
+          }
+        } else if (result.type === "unknown") {
+          logger.warn(`Observable type could not be classified.`);
+          // match result already includes matched:false via JSON path
+        } else {
+          logger.log(
+            `  ${chalk.green("✓ clean")} ${chalk.cyan(result.type)} ${observable}`,
+          );
+        }
+        await shutdown();
+        if (result.matched) process.exit(2);
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  threat
+    .command("stats")
+    .description("Show indicator counts per type")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureThreatIntelTables(db);
+
+        const stats = getThreatIntelStats(db);
+        if (options.json) {
+          console.log(JSON.stringify(stats, null, 2));
+        } else {
+          logger.log(`  ${chalk.bold("Total:")} ${stats.total}`);
+          for (const [t, n] of Object.entries(stats.byType)) {
+            logger.log(`  ${chalk.cyan(t.padEnd(12))} ${n}`);
+          }
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  threat
+    .command("remove <type> <value>")
+    .description("Remove a single indicator")
+    .option("--json", "Output as JSON")
+    .action(async (type, value, options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureThreatIntelTables(db);
+
+        const removed = removeIndicator(db, type, value);
+        if (options.json) {
+          console.log(JSON.stringify({ removed }, null, 2));
+        } else if (removed) {
+          logger.success(`Removed ${chalk.cyan(type)} ${value}`);
+        } else {
+          logger.info(`No indicator matched ${type} ${value}`);
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  // ── UEBA ────────────────────────────────────────────────────
+  const ueba = compliance
+    .command("ueba")
+    .description("User and Entity Behavior Analytics over audit_log events");
+
+  const _loadAuditEvents = (db, { entity, days } = {}) => {
+    const sql = entity
+      ? `SELECT actor, operation, target, success, created_at
+           FROM audit_log
+          WHERE actor = ?`
+      : `SELECT actor, operation, target, success, created_at
+           FROM audit_log`;
+    const rows = entity ? db.prepare(sql).all(entity) : db.prepare(sql).all();
+
+    const cutoff = days
+      ? Date.now() - Number(days) * 24 * 60 * 60 * 1000
+      : null;
+
+    return rows
+      .filter((r) => {
+        if (!cutoff) return true;
+        const t = new Date(r.created_at).getTime();
+        return Number.isFinite(t) && t >= cutoff;
+      })
+      .map((r) => ({
+        entity: r.actor,
+        action: r.operation,
+        resource: r.target,
+        timestamp: r.created_at,
+        success: r.success === 1 || r.success === true,
+      }));
+  };
+
+  ueba
+    .command("baseline")
+    .description("Build and persist per-entity baselines from audit_log")
+    .option("-e, --entity <entity>", "Only baseline this entity")
+    .option("-d, --days <n>", "Limit to events from last N days")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureUebaTables(db);
+
+        const events = _loadAuditEvents(db, {
+          entity: options.entity,
+          days: options.days,
+        });
+        const baselineMap = buildBaseline(events);
+        const saved = saveBaselines(db, baselineMap);
+
+        if (options.json) {
+          console.log(
+            JSON.stringify(
+              {
+                saved,
+                entities: [...baselineMap.keys()],
+                events: events.length,
+              },
+              null,
+              2,
+            ),
+          );
+        } else {
+          logger.success(
+            `Built ${saved} baseline(s) from ${events.length} events.`,
+          );
+          for (const [entity, b] of baselineMap) {
+            logger.log(
+              `  ${chalk.cyan(entity.padEnd(24))} ` +
+                `events=${b.eventCount} failures=${b.failureCount} ` +
+                `actions=${b.uniqueActions} resources=${b.uniqueResources}`,
+            );
+          }
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  ueba
+    .command("analyze")
+    .description(
+      "Score recent audit_log events against stored baselines; print anomalies",
+    )
+    .option("-e, --entity <entity>", "Only analyze this entity")
+    .option("-t, --threshold <n>", "Anomaly score threshold (default 0.7)")
+    .option("-d, --days <n>", "Candidate window in days (default 1)")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureUebaTables(db);
+
+        const threshold = options.threshold ? Number(options.threshold) : 0.7;
+        const candidates = _loadAuditEvents(db, {
+          entity: options.entity,
+          days: options.days || 1,
+        });
+
+        const baselineMap = options.entity
+          ? (() => {
+              const m = new Map();
+              const b = loadBaseline(db, options.entity);
+              if (b) m.set(options.entity, b);
+              return m;
+            })()
+          : loadAllBaselines(db);
+
+        if (baselineMap.size === 0) {
+          logger.warn(
+            "No saved baselines found. Run `cc compliance ueba baseline` first.",
+          );
+          if (options.json) console.log(JSON.stringify([]));
+          await shutdown();
+          return;
+        }
+
+        const hits = detectAnomalies(baselineMap, candidates, { threshold });
+        if (options.json) {
+          console.log(JSON.stringify(hits, null, 2));
+        } else if (hits.length === 0) {
+          logger.info(
+            `No anomalies above ${threshold} (scanned ${candidates.length} events).`,
+          );
+        } else {
+          logger.log(
+            `${chalk.yellow(`⚠ ${hits.length} anomal${hits.length === 1 ? "y" : "ies"}`)}` +
+              ` (threshold=${threshold}, scanned ${candidates.length}):`,
+          );
+          for (const h of hits) {
+            const score = h.score.toFixed(2);
+            logger.log(
+              `  ${chalk.red(score)} ${chalk.cyan(h.event.entity.padEnd(18))}` +
+                ` ${h.event.action} ${h.event.resource || ""}` +
+                chalk.dim(` @ ${h.event.timestamp}`),
+            );
+            for (const reason of h.reasons) {
+              logger.log(chalk.dim(`      · ${reason}`));
+            }
+          }
+        }
+        await shutdown();
+        // CI hook: non-zero exit on anomaly hit (mirrors threat-intel match).
+        if (hits && hits.length > 0) process.exit(2);
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  ueba
+    .command("top")
+    .description(
+      "Rank entities by composite risk score (direct over audit_log)",
+    )
+    .option("-k, --top-k <n>", "Return top K entities (default 10)")
+    .option("-d, --days <n>", "Window in days")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+
+        const events = _loadAuditEvents(db, { days: options.days });
+        const topK = options.topK ? Number(options.topK) : 10;
+        const rows = rankEntities(events, { topK });
+
+        if (options.json) {
+          console.log(JSON.stringify(rows, null, 2));
+        } else if (rows.length === 0) {
+          logger.info("No events found in the selected window.");
+        } else {
+          logger.log(
+            `${chalk.bold("Top risky entities")} (scored over ${events.length} events):`,
+          );
+          for (const r of rows) {
+            logger.log(
+              `  ${chalk.red(String(r.riskScore).padStart(6))} ` +
+                `${chalk.cyan(r.entity.padEnd(20))} ` +
+                `events=${r.eventCount} failRate=${r.failureRate.toFixed(2)} ` +
+                `actions=${r.uniqueActions} resources=${r.uniqueResources}`,
+            );
+          }
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  ueba
+    .command("show <entity>")
+    .description("Show a stored baseline for one entity")
+    .option("--json", "Output as JSON")
+    .action(async (entity, options) => {
+      try {
+        const ctx = await bootstrap({ verbose: program.opts().verbose });
+        if (!ctx.db) {
+          logger.error("Database not available");
+          process.exit(1);
+        }
+        const db = ctx.db.getDatabase();
+        ensureUebaTables(db);
+
+        const b = loadBaseline(db, entity);
+        if (!b) {
+          if (options.json) console.log(JSON.stringify(null));
+          else logger.warn(`No baseline saved for ${entity}.`);
+          await shutdown();
+          return;
+        }
+
+        if (options.json) {
+          // Strip runtime-only Maps for JSON.
+          const { actionCounts: _a, resourceCounts: _r, ...rest } = b;
+          console.log(JSON.stringify(rest, null, 2));
+        } else {
+          logger.log(`${chalk.bold(entity)}`);
+          logger.log(`  events       : ${b.eventCount}`);
+          logger.log(
+            `  failures     : ${b.failureCount} (rate ${b.failureRate.toFixed(2)})`,
+          );
+          logger.log(`  unique acts  : ${b.uniqueActions}`);
+          logger.log(`  unique res   : ${b.uniqueResources}`);
+          if (b.firstSeen) {
+            logger.log(
+              `  first seen   : ${new Date(b.firstSeen).toISOString()}`,
+            );
+          }
+          if (b.lastSeen) {
+            logger.log(
+              `  last seen    : ${new Date(b.lastSeen).toISOString()}`,
+            );
+          }
+        }
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
 }