log10x-mcp 1.30.21 → 1.30.23
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -1
- package/build/index.js +26 -4
- package/build/index.js.map +1 -1
- package/build/lib/advisor/envelope.d.ts +1 -1
- package/build/lib/advisor/reporter-forwarders.d.ts +32 -13
- package/build/lib/advisor/reporter-forwarders.js +179 -94
- package/build/lib/advisor/reporter-forwarders.js.map +1 -1
- package/build/lib/advisor/reporter.d.ts +18 -10
- package/build/lib/advisor/reporter.js +43 -16
- package/build/lib/advisor/reporter.js.map +1 -1
- package/build/lib/advisor/retriever.d.ts +6 -0
- package/build/lib/advisor/retriever.js +5 -3
- package/build/lib/advisor/retriever.js.map +1 -1
- package/build/lib/advisor/types.d.ts +3 -1
- package/build/lib/cdk-recipes.d.ts +1 -1
- package/build/lib/cdk-recipes.js +21 -10
- package/build/lib/cdk-recipes.js.map +1 -1
- package/build/lib/discovery/types.d.ts +15 -10
- package/build/lib/fenced.d.ts +2 -0
- package/build/lib/fenced.js +2 -2
- package/build/lib/fenced.js.map +1 -1
- package/build/lib/offload-recipes.d.ts +2 -1
- package/build/lib/offload-recipes.js +13 -10
- package/build/lib/offload-recipes.js.map +1 -1
- package/build/lib/poc-report-renderer.js +17 -11
- package/build/lib/poc-report-renderer.js.map +1 -1
- package/build/lib/retriever-api.d.ts +14 -0
- package/build/lib/retriever-api.js +40 -10
- package/build/lib/retriever-api.js.map +1 -1
- package/build/lib/runtime-image.d.ts +7 -2
- package/build/lib/runtime-image.js +7 -2
- package/build/lib/runtime-image.js.map +1 -1
- package/build/lib/siem/_sampling.js +4 -0
- package/build/lib/siem/_sampling.js.map +1 -1
- package/build/lib/siem/cloudwatch.d.ts +18 -0
- package/build/lib/siem/cloudwatch.js +106 -2
- package/build/lib/siem/cloudwatch.js.map +1 -1
- package/build/lib/siem/datadog.js +1 -1
- package/build/lib/siem/datadog.js.map +1 -1
- package/build/lib/siem/elasticsearch.js +13 -1
- package/build/lib/siem/elasticsearch.js.map +1 -1
- package/build/lib/siem/splunk.d.ts +18 -0
- package/build/lib/siem/splunk.js +71 -7
- package/build/lib/siem/splunk.js.map +1 -1
- package/build/product-kb/docs/apps/receiver/compact/index.md +3 -3
- package/build/product-kb/docs/apps/receiver/compact/splunk.md +81 -67
- package/build/product-kb/docs/apps/retriever/faq.md +2 -2
- package/build/product-kb/docs/engine/launcher/extension.md +20 -20
- package/build/product-kb/docs/faq/apps/retriever.md +2 -2
- package/build/product-kb/docs/faq/general.md +1 -1
- package/build/product-kb/docs/faq/stacks/splunk/comparisons.md +3 -3
- package/build/product-kb/docs/faq/stacks/splunk/compatibility.md +19 -242
- package/build/product-kb/docs/faq/stacks/splunk/index.md +1 -1
- package/build/product-kb/docs/faq/stacks/splunk/kv-store.md +41 -159
- package/build/product-kb/docs/faq/stacks/splunk/optimization.md +4 -4
- package/build/product-kb/docs/run/input/forwarder/fluentbit/index.md +1 -1
- package/build/product-kb/docs/run/input/forwarder/fluentd/index.md +1 -1
- package/build/product-kb/docs/run/input/forwarder/otel-collector/index.md +1 -1
- package/build/product-kb/docs/run/input/forwarder/vector/index.md +1 -1
- package/build/product-kb/docs/summary.md +0 -1
- package/build/tools/advise-install.d.ts +25 -18
- package/build/tools/advise-install.js +156 -90
- package/build/tools/advise-install.js.map +1 -1
- package/build/tools/advise-retriever.d.ts +5 -5
- package/build/tools/advise-retriever.js +25 -9
- package/build/tools/advise-retriever.js.map +1 -1
- package/build/tools/doctor.js +3 -2
- package/build/tools/doctor.js.map +1 -1
- package/build/tools/emit-sample-plan.js +7 -1
- package/build/tools/emit-sample-plan.js.map +1 -1
- package/build/tools/poc-from-local.js +7 -6
- package/build/tools/poc-from-local.js.map +1 -1
- package/build/tools/poc-from-siem.js +71 -4
- package/build/tools/poc-from-siem.js.map +1 -1
- package/build/tools/retriever-query.js +1 -1
- package/build/tools/retriever-query.js.map +1 -1
- package/package.json +1 -1
- package/build/product-kb/docs/run/output/event/dev/index.md +0 -351
|
@@ -18,6 +18,16 @@ export const ELASTICSEARCH_BUCKET_COUNT = 24;
|
|
|
18
18
|
export const ELASTICSEARCH_PAGE_SIZE = 1000;
|
|
19
19
|
/** Default index pattern when the caller gives no scope. */
|
|
20
20
|
export const ELASTICSEARCH_DEFAULT_INDEX = 'logs-*';
|
|
21
|
+
/**
|
|
22
|
+
* The v9 client sends `compatible-with=9`, which every Elasticsearch 8.x
|
|
23
|
+
* cluster rejects ("Accept version must be either version 8 or 7, but found
|
|
24
|
+
* 9"), so a POC against 8.17 pulled nothing. `compatible-with=8` is accepted
|
|
25
|
+
* by 8.x natively and by 9.x through REST API compatibility.
|
|
26
|
+
*/
|
|
27
|
+
const COMPAT_8_HEADERS = {
|
|
28
|
+
accept: 'application/vnd.elasticsearch+json; compatible-with=8',
|
|
29
|
+
'content-type': 'application/vnd.elasticsearch+json; compatible-with=8',
|
|
30
|
+
};
|
|
21
31
|
function getConn() {
|
|
22
32
|
const url = process.env.ELASTIC_URL || process.env.ELASTICSEARCH_URL;
|
|
23
33
|
if (!url)
|
|
@@ -74,6 +84,7 @@ async function pullEvents(opts) {
|
|
|
74
84
|
: conn.username && conn.password
|
|
75
85
|
? { auth: { username: conn.username, password: conn.password } }
|
|
76
86
|
: {}),
|
|
87
|
+
headers: COMPAT_8_HEADERS,
|
|
77
88
|
});
|
|
78
89
|
const deadline = Date.now() + opts.maxPullMinutes * 60_000;
|
|
79
90
|
const windowMs = parseWindowMs(opts.window);
|
|
@@ -86,7 +97,7 @@ async function pullEvents(opts) {
|
|
|
86
97
|
// Stratified random sampling: 24 child sub-windows scattered across
|
|
87
98
|
// the parent window with per-run RNG. Each bucket is its own
|
|
88
99
|
// search_after pagination scope, capped at perBucketCap.
|
|
89
|
-
const BUCKET_COUNT = ELASTICSEARCH_BUCKET_COUNT;
|
|
100
|
+
const BUCKET_COUNT = Math.max(1, opts.buckets ?? ELASTICSEARCH_BUCKET_COUNT);
|
|
90
101
|
const buckets = randomTimeBuckets(fromMs, toMs, BUCKET_COUNT);
|
|
91
102
|
const bucketCap = perBucketCap(opts.targetEventCount, BUCKET_COUNT);
|
|
92
103
|
const pageSize = ELASTICSEARCH_PAGE_SIZE;
|
|
@@ -203,6 +214,7 @@ async function detectDailyVolumeGb(opts) {
|
|
|
203
214
|
: conn.username && conn.password
|
|
204
215
|
? { auth: { username: conn.username, password: conn.password } }
|
|
205
216
|
: {}),
|
|
217
|
+
headers: COMPAT_8_HEADERS,
|
|
206
218
|
});
|
|
207
219
|
const indexPattern = opts.scope || ELASTICSEARCH_DEFAULT_INDEX;
|
|
208
220
|
try {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;
|
|
1
|
+
{"version":3,"file":"elasticsearch.js","sourceRoot":"","sources":["../../../src/lib/siem/elasticsearch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,uDAAuD;IAC/D,cAAc,EAAE,uDAAuD;CACxE,CAAC;AASF,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpF,IAAI,QAAQ,IAAI,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC7D,uFAAuF;IACvF,mFAAmF;IACnF,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,QAAQ;SACf;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE;oBACL,2FAA2F;wBACzF,uEAAuE;iBAC1E;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,wEAAwE;QACxE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAE/D,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,6DAA6D;IAC7D,yDAAyD;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC;IAEzC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C;gBACE,KAAK,EAAE;oBACL,YAAY,EAAE;wBACZ,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;wBAC1C,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;qBACzC;iBACF;aACF;SACF,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAkC,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,YAAY,GAAG,SAAS,EAAE,CAAC;YAChC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,2DAA2D;gBAC3D,qEAAqE;gBACrE,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,gEAAgE;gBAChE,mDAAmD;gBACnD,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAA4B;oBAC1C,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;oBACtC,IAAI;oBACJ,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;oBAC/B,gBAAgB,EAAE,KAAK;iBACxB,CAAC;gBACF,IAAI,WAAW;oBAAE,UAAU,CAAC,YAAY,GAAG,WAAW,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,MAAM,CAAC;oBACZ,KAAK,EAAE,YAAY;oBACnB,GAAG,UAAU;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GACR,CAAE,IAAqF;qBACpF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,CAAC,mBAAmB;gBACjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;oBACrB,IAAI,YAAY,IAAI,SAAS;wBAAE,MAAM;oBACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC;oBACd,IAAI,EAAE,wBAAwB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,GAAG;oBAC/F,GAAG,EAAE,IAAI,CAAC,GAAG,CACX,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAC5E;oBACD,aAAa,EAAE,MAAM,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,mBAAmB;YACpD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,WAAY,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,mCAAmC;gBACnC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACnE,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;YACnC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;gBAChC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,YAAY;SACoC,CAAC,CAE1D,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,SAAS,EAAE,gCAAgC,YAAY,6BAA6B,EAAE,CAAC;QAClG,CAAC;QACD,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,CAAC;YACP,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;aACzC;SACgD,CAAC,CAKnD,CAAC;QACF,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC;QACnD,IAAI,IAAY,CAAC;QACjB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;YACjD,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,IAAI,GAAG,CAAC,CAAC;YACT,QAAQ,GAAG,oCAAoC,CAAC;QAClD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO;YACP,MAAM,EAAE,4BAA4B,YAAY,MAAM,QAAQ,GAAG;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,0CAA2C,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,eAAe;IAC5B,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
|
|
@@ -22,4 +22,22 @@ import type { SiemConnector } from './index.js';
|
|
|
22
22
|
export declare const SPLUNK_BUCKET_COUNT = 12;
|
|
23
23
|
/** Results page size used against `search/jobs/{sid}/results`. */
|
|
24
24
|
export declare const SPLUNK_PAGE_SIZE = 1000;
|
|
25
|
+
/**
|
|
26
|
+
* SPLUNK_INSECURE=1 skips certificate verification for the search head only.
|
|
27
|
+
* A default Splunk install serves port 8089 with its own self-signed
|
|
28
|
+
* certificate, issued to "SplunkServerDefaultCert", so neither the system CA
|
|
29
|
+
* store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
|
|
30
|
+
* Global fetch cannot relax verification per request without a newer undici
|
|
31
|
+
* than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
|
|
32
|
+
* every connection this process makes, so this path uses node:https with
|
|
33
|
+
* rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
|
|
34
|
+
* the emitted export script offers the same choice (--insecure).
|
|
35
|
+
*/
|
|
36
|
+
export declare function splunkInsecure(): boolean;
|
|
37
|
+
/**
|
|
38
|
+
* "fetch failed" alone says nothing; the reason is on the cause chain
|
|
39
|
+
* (a certificate the process does not trust, a refused connection, DNS).
|
|
40
|
+
* Name it, and say what fixes the common ones.
|
|
41
|
+
*/
|
|
42
|
+
export declare function describeSplunkError(e: unknown): string;
|
|
25
43
|
export declare const splunkConnector: SiemConnector;
|
package/build/lib/siem/splunk.js
CHANGED
|
@@ -25,6 +25,7 @@ export const SPLUNK_BUCKET_COUNT = 12;
|
|
|
25
25
|
export const SPLUNK_PAGE_SIZE = 1000;
|
|
26
26
|
import { existsSync, readFileSync } from 'fs';
|
|
27
27
|
import { homedir } from 'os';
|
|
28
|
+
import https from 'node:https';
|
|
28
29
|
import { join } from 'path';
|
|
29
30
|
function getConn() {
|
|
30
31
|
const envHost = process.env.SPLUNK_HOST;
|
|
@@ -86,9 +87,72 @@ function authHeader(conn) {
|
|
|
86
87
|
return `Bearer ${conn.token}`;
|
|
87
88
|
return 'Basic ' + Buffer.from(`${conn.username}:${conn.password}`).toString('base64');
|
|
88
89
|
}
|
|
90
|
+
/**
|
|
91
|
+
* SPLUNK_INSECURE=1 skips certificate verification for the search head only.
|
|
92
|
+
* A default Splunk install serves port 8089 with its own self-signed
|
|
93
|
+
* certificate, issued to "SplunkServerDefaultCert", so neither the system CA
|
|
94
|
+
* store nor NODE_EXTRA_CA_CERTS can verify it (the hostname never matches).
|
|
95
|
+
* Global fetch cannot relax verification per request without a newer undici
|
|
96
|
+
* than Node 20 ships, and NODE_TLS_REJECT_UNAUTHORIZED would relax it for
|
|
97
|
+
* every connection this process makes, so this path uses node:https with
|
|
98
|
+
* rejectUnauthorized:false for Splunk requests alone. Opt-in, never default;
|
|
99
|
+
* the emitted export script offers the same choice (--insecure).
|
|
100
|
+
*/
|
|
101
|
+
export function splunkInsecure() {
|
|
102
|
+
return /^(1|true|yes)$/i.test(process.env.SPLUNK_INSECURE ?? '');
|
|
103
|
+
}
|
|
104
|
+
function insecureFetch(url, init = {}) {
|
|
105
|
+
return new Promise((resolve, reject) => {
|
|
106
|
+
const headers = { ...init.headers };
|
|
107
|
+
const body = init.body == null ? undefined : String(init.body);
|
|
108
|
+
if (body !== undefined && !Object.keys(headers).some((k) => k.toLowerCase() === 'content-length')) {
|
|
109
|
+
headers['Content-Length'] = String(Buffer.byteLength(body));
|
|
110
|
+
}
|
|
111
|
+
const req = https.request(new URL(url), { method: init.method ?? 'GET', headers, rejectUnauthorized: false }, (res) => {
|
|
112
|
+
const chunks = [];
|
|
113
|
+
res.on('data', (c) => chunks.push(c));
|
|
114
|
+
res.on('error', reject);
|
|
115
|
+
res.on('end', () => {
|
|
116
|
+
const status = res.statusCode ?? 0;
|
|
117
|
+
const h = new Headers();
|
|
118
|
+
for (const [k, v] of Object.entries(res.headers)) {
|
|
119
|
+
if (v !== undefined)
|
|
120
|
+
h.set(k, Array.isArray(v) ? v.join(', ') : String(v));
|
|
121
|
+
}
|
|
122
|
+
const nullBody = status === 204 || status === 205 || status === 304;
|
|
123
|
+
resolve(new Response(nullBody ? null : Buffer.concat(chunks), { status, headers: h }));
|
|
124
|
+
});
|
|
125
|
+
});
|
|
126
|
+
req.on('error', reject);
|
|
127
|
+
if (body !== undefined)
|
|
128
|
+
req.write(body);
|
|
129
|
+
req.end();
|
|
130
|
+
});
|
|
131
|
+
}
|
|
132
|
+
function doFetch(url, init) {
|
|
133
|
+
return splunkInsecure() && url.startsWith('https:') ? insecureFetch(url, init) : fetch(url, init);
|
|
134
|
+
}
|
|
135
|
+
/**
|
|
136
|
+
* "fetch failed" alone says nothing; the reason is on the cause chain
|
|
137
|
+
* (a certificate the process does not trust, a refused connection, DNS).
|
|
138
|
+
* Name it, and say what fixes the common ones.
|
|
139
|
+
*/
|
|
140
|
+
export function describeSplunkError(e) {
|
|
141
|
+
const err = e;
|
|
142
|
+
const code = err?.cause?.code ?? err?.code;
|
|
143
|
+
const causeMsg = err?.cause?.message;
|
|
144
|
+
const base = `${err?.message ?? String(e)}${code || causeMsg ? ` (${[code, causeMsg].filter(Boolean).join(': ')})` : ''}`;
|
|
145
|
+
if (code && /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|ALTNAME/.test(code)) {
|
|
146
|
+
return `${base}. The search head's certificate is not trusted by this process; a default Splunk install serves a self-signed certificate on 8089. Set SPLUNK_INSECURE=1 in the MCP's environment to skip verification for Splunk only, or install a trusted certificate.`;
|
|
147
|
+
}
|
|
148
|
+
if (code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
|
|
149
|
+
return `${base}. Nothing answered at SPLUNK_HOST; check the host and that the management port (8089 by default) is reachable from this machine.`;
|
|
150
|
+
}
|
|
151
|
+
return base;
|
|
152
|
+
}
|
|
89
153
|
async function splunkFetch(conn, path, init = {}) {
|
|
90
154
|
const url = `${conn.host}${path}`;
|
|
91
|
-
const res = await
|
|
155
|
+
const res = await doFetch(url, {
|
|
92
156
|
...init,
|
|
93
157
|
headers: {
|
|
94
158
|
Accept: 'application/json',
|
|
@@ -141,7 +205,7 @@ async function pullEvents(opts) {
|
|
|
141
205
|
// the parent window with per-run RNG. Splunk dispatches one search
|
|
142
206
|
// job per bucket sequentially — concurrent dispatches risk hitting
|
|
143
207
|
// the search head's per-user concurrency cap (default 6).
|
|
144
|
-
const BUCKET_COUNT = SPLUNK_BUCKET_COUNT;
|
|
208
|
+
const BUCKET_COUNT = Math.max(1, opts.buckets ?? SPLUNK_BUCKET_COUNT);
|
|
145
209
|
const buckets = randomTimeBuckets(fromMs, toMs, BUCKET_COUNT);
|
|
146
210
|
const bucketCap = perBucketCap(opts.targetEventCount, BUCKET_COUNT);
|
|
147
211
|
const pageSize = SPLUNK_PAGE_SIZE;
|
|
@@ -172,7 +236,7 @@ async function pullEvents(opts) {
|
|
|
172
236
|
sid = job.sid;
|
|
173
237
|
}
|
|
174
238
|
catch (e) {
|
|
175
|
-
notes.push(`bucket_${bucket.index}_create_failed: ${e.
|
|
239
|
+
notes.push(`bucket_${bucket.index}_create_failed: ${describeSplunkError(e).slice(0, 400)}`);
|
|
176
240
|
// Per-bucket failure is non-fatal; move on.
|
|
177
241
|
continue;
|
|
178
242
|
}
|
|
@@ -208,7 +272,7 @@ async function pullEvents(opts) {
|
|
|
208
272
|
await sleep(wait);
|
|
209
273
|
}
|
|
210
274
|
catch (e) {
|
|
211
|
-
notes.push(`bucket_${bucket.index}_poll_error: ${e.
|
|
275
|
+
notes.push(`bucket_${bucket.index}_poll_error: ${describeSplunkError(e).slice(0, 400)}`);
|
|
212
276
|
pollFailed = true;
|
|
213
277
|
break;
|
|
214
278
|
}
|
|
@@ -251,7 +315,7 @@ async function pullEvents(opts) {
|
|
|
251
315
|
break;
|
|
252
316
|
}
|
|
253
317
|
catch (e) {
|
|
254
|
-
notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${e.
|
|
318
|
+
notes.push(`bucket_${bucket.index}_page_error offset=${offset}: ${describeSplunkError(e).slice(0, 400)}`);
|
|
255
319
|
break;
|
|
256
320
|
}
|
|
257
321
|
}
|
|
@@ -270,7 +334,7 @@ async function pullEvents(opts) {
|
|
|
270
334
|
};
|
|
271
335
|
}
|
|
272
336
|
async function cancelJob(conn, sid) {
|
|
273
|
-
await
|
|
337
|
+
await doFetch(`${conn.host}/services/search/jobs/${sid}`, {
|
|
274
338
|
method: 'DELETE',
|
|
275
339
|
headers: { Authorization: authHeader(conn), Accept: 'application/json' },
|
|
276
340
|
}).catch(() => undefined);
|
|
@@ -326,7 +390,7 @@ async function detectDailyVolumeGb(opts) {
|
|
|
326
390
|
};
|
|
327
391
|
}
|
|
328
392
|
catch (e) {
|
|
329
|
-
return { errorNote: `Splunk volume detection failed: ${e.
|
|
393
|
+
return { errorNote: `Splunk volume detection failed: ${describeSplunkError(e).slice(0, 400)}` };
|
|
330
394
|
}
|
|
331
395
|
}
|
|
332
396
|
export const splunkConnector = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAoB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAiB,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAM,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAoC,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
|
|
1
|
+
{"version":3,"file":"splunk.js","sourceRoot":"","sources":["../../../src/lib/siem/splunk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,4DAA4D;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,EAAE,GAA2B,EAAE,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7D,IAAI,KAAK;oBAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,IAAI,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;IACjD,4CAA4C;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAAE,CAAC,IAAI,OAAO,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAAoB,EAAE;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAA2B,EAAE,GAAI,IAAI,CAAC,OAA8C,EAAE,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACpH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;gBACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,KAAK,SAAS;wBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBACpE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,IAAiB;IAC7C,OAAO,cAAc,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,GAAG,GAAG,CAA4D,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,IAAK,GAAyB,EAAE,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1H,IAAI,IAAI,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,IAAI,2PAA2P,CAAC;IAC5Q,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC5E,OAAO,GAAG,IAAI,kIAAkI,CAAC;IACnJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU,EAAE,IAAY,EAAE,OAAoB,EAAE;IACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,GAAG,IAAI;QACP,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC;YAC/B,GAAI,IAAI,CAAC,OAA8C;SACxD;KACF,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAqD,CAAC;QACzH,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAuB;IAC/C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE;gBACR,WAAW,EAAE,CAAC;gBACd,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,CAAC,0DAA0D,CAAC;aACpE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IAE/B,+EAA+E;IAC/E,MAAM,WAAW,GAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAmB,kBAAkB,CAAC;IAEvD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;IAElC,UAAU,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC7F,MAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC7C,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7D,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,mBAAmB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,4CAA4C;YAC5C,SAAS;QACX,CAAC;QAED,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,iBAAiB,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACjF,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACxD,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;QAEH,uBAAuB;QACvB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,aAAa,GAAG,gBAAgB,CAAC;gBACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAAC,CACnE,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAoJ,CAAC;gBACpL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBACzC,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,MAAM;oBAAE,MAAM;gBAC3B,IAAI,OAAO,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACxC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,kBAAkB,CAAC,CAAC;oBACrD,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,gBAAgB,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzF,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,yCAAyC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,OAAO,MAAM,GAAG,eAAe,IAAI,YAAY,GAAG,SAAS,EAAE,CAAC;YAC5D,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/D,aAAa,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;gBAC7F,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,UAAU,CAAC;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CACvC,WAAW,CACT,IAAI,EACJ,yBAAyB,GAAG,mBAAmB,MAAM,UAAU,KAAK,mBAAmB,CACxF,CACF,CAAC;gBACF,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;gBACjF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACV,SAAS,EAAE,CAAC,CAAC,KAAK;wBAClB,OAAO,EAAE,CAAC,CAAC,IAAI;wBACf,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC;qBACP,CAAC,CAAC;oBACH,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,sBAAsB,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChG,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,SAAS;YACT,SAAS,EAAE,GAAG;YACd,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAU,EAAE,GAAW;IAC9C,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,yBAAyB,GAAG,EAAE,EAAE;QACxD,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACzE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAA4B;IAC7D,KAAK,IAAI,CAAC;IACV,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,mCAAmC,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,GAAG,GACP,+DAA+D;QAC/D,sBAAsB;QACtB,kCAAkC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM;QACnB,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,+BAA+B,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,qFAAqF,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,+CAA+C,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,uCAAuC,IAAI,QAAQ;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,SAAS,EAAE,mCAAmC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAkB;IAC5C,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,mBAAmB;IACnB,UAAU;IACV,mBAAmB;CACpB,CAAC"}
|
|
@@ -14,7 +14,7 @@ Reduce storage costs by forwarding [compact](https://doc.log10x.com/run/transfor
|
|
|
14
14
|
|
|
15
15
|
<h3 id="analytics-costs"><span class="twemoji" ><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M11 21H7v-2h4v2m4.5-2H17v2h-4v-2h.2l-1.4-6.1-2.5.6c-.1.5-.3.9-.5 1.3-.9 1.5-2.8 1.9-4.3 1-1.5-.9-1.9-2.8-1-4.3.9-1.5 2.8-1.9 4.3-1 .4.2.7.6.9.9l2.5-.6-.6-2.5c-.4-.1-.8-.3-1.2-.5C8 6.9 7.5 5 8.4 3.5c.9-1.5 2.8-1.9 4.3-1 1.5.9 1.9 2.8 1 4.3-.2.4-.6.7-.9.9L15.5 19M7 11.8c-.7-.5-1.7-.2-2.2.5-.5.7-.2 1.7.5 2.1.7.5 1.7.3 2.2-.5.4-.7.2-1.7-.5-2.1M12.4 6c.5-.7.2-1.7-.5-2.2-.7-.5-1.7-.2-2.2.5-.4.7-.2 1.7.6 2.2.7.4 1.7.2 2.1-.5m.4 5.3c-.2-.1-.4-.1-.5.1-.1.2-.1.4.1.5.2.1.4.1.5-.1.2-.2.1-.4-.1-.5M21 8.5 14.5 10l.5 2.2 7.5-1.8.5-.7-2-1.2M23 19h-4v2h4v-2M5 19H1v2h4v-2Z"></path></svg></span> Cut Log Analytics Costs</h3>
|
|
16
16
|
|
|
17
|
-
Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [
|
|
17
|
+
Reduce ingestion and licensing costs, where the destination supports it, by forwarding [compact](https://doc.log10x.com/run/transform/#compact) events to Splunk or self-hosted Elasticsearch/OpenSearch. The open-source [Log10x App](splunk.md) and [L1ES Elasticsearch plugin](elasticsearch.md) expand events in real-time, maintaining full querying, dashboard, and alerting capabilities; compact is lossless, so expanded events match the originals.
|
|
18
18
|
|
|
19
19
|
## :material-cog-transfer-outline: Workflow
|
|
20
20
|
|
|
@@ -87,10 +87,10 @@ Compact mode executes inside the [Receiver](../index.md) sidecar, compacting eve
|
|
|
87
87
|
|
|
88
88
|
=== ":material-greater-than: Splunk"
|
|
89
89
|
|
|
90
|
-
Forward compact events to Splunk. The open-source [
|
|
90
|
+
Forward compact events to Splunk. The open-source [Log10x App](splunk.md) expands events on-the-fly at search time, displaying them in full JSON/text form in dashboards and queries.
|
|
91
91
|
|
|
92
92
|
<figure markdown="span">
|
|
93
|
-
{ align=left }
|
|
94
94
|
<figcaption>:white_check_mark: **Compact mode** losslessly compacts events before they ship to Splunk</figcaption>
|
|
95
95
|
</figure>
|
|
96
96
|
|