runcloud 0.2.168 → 0.2.169

package/dist/commands/run-cloud-fleet-observations.js

@@ -145,8 +145,10 @@ export function hostReport(host, canonical, extra, diagnoses, now, fleetTtl, dee
         processScan: Object.keys(process).length ? {
             observedAt: stamp(process.observedAt), staleAfterSeconds: num(process.staleAfterSeconds) ?? 900,
             sourceUnavailable: process.sourceUnavailable === true || Boolean(extra.collectorError), status: str(process.status) ?? 'unknown', error: str(process.error), root: process.root === true,
-            iocs: rows(process.iocs).map(ioc => ({ status: str(ioc.status) ?? 'unknown', contained: ioc.contained === true })),
-            findings: rows(process.findings).map(finding => ({ reason: str(finding.reason) ?? 'unknown' })),
+            iocs: rows(process.iocs).map(ioc => ({ status: str(ioc.status) ?? 'unknown', contained: ioc.contained === true,
+                signals: Array.isArray(ioc.signals) ? ioc.signals.filter((signal) => typeof signal === 'string') : [], lastObservedAt: stamp(ioc.lastObservedAt) })),
+            findings: rows(process.findings).map(finding => ({ reason: str(finding.reason) ?? 'unknown', confidence: str(finding.confidence) ?? undefined,
+                lastObservedAt: stamp(finding.lastObservedAt) })),
             coverage: { iocs: str(row(process.coverage).iocs) ?? 'partial' }, baseline: { state: str(row(process.baseline).state) ?? 'missing' },
         } : null,
     };

package/dist/commands/run-cloud-machine-diagnosis.js

@@ -10,6 +10,22 @@ export function processFreshness(scan, now) {
         return 'stale';
     return 'fresh';
 }
+export function processSecurityAlert(scan, held = false) {
+    if (!scan)
+        return null;
+    const strongIocs = (scan.iocs ?? []).filter(ioc => ['present', 'active'].includes(ioc.status) && ((ioc.signals ?? []).some(signal => ['binary_hash', 'running_hash'].includes(signal)) ||
+        ((ioc.signals ?? []).includes('original_path') && (ioc.signals ?? []).some(signal => ['plist_hash', 'loaded_label', 'root_daemon', 'running_path'].includes(signal)))));
+    const knownFindings = (scan.findings ?? []).filter(finding => finding.reason === 'known_ioc' && finding.confidence === 'high');
+    const contained = (scan.iocs ?? []).filter(ioc => ioc.contained || ioc.status === 'contained');
+    const detected = scan.status === 'critical' || strongIocs.length > 0 || knownFindings.length > 0;
+    if (!detected && (!held || !contained.length))
+        return null;
+    const timestamps = (detected ? [...strongIocs.map(ioc => ioc.lastObservedAt), ...knownFindings.map(finding => finding.lastObservedAt)]
+        : contained.map(ioc => ioc.lastObservedAt)).filter((value) => !!value && Number.isFinite(Date.parse(value)));
+    const observedAt = timestamps.sort((a, b) => Date.parse(b) - Date.parse(a))[0] ?? scan.observedAt;
+    return detected ? { state: 'detected', label: 'Known malware detected', observedAt }
+        : { state: 'contained-hold', label: 'Malware contained · hold reported', observedAt };
+}
 export function leaseStateLabel(state) {
     return { accepting: 'Lease gate open', rejecting: 'Lease gate closed', unknown: 'Lease gate unknown', held: 'Operator hold' }[state] ?? state;
 }
@@ -102,11 +118,12 @@ export function machineDiagnosis(host, hosted, observedState, now, staleAfterSec
         checks.push('process checks missing');
     else {
         const freshness = processFreshness(scan, now);
-        const malicious = scan.iocs.some(ioc => ['present', 'active'].includes(ioc.status)) || scan.findings.some(finding => finding.reason === 'known_ioc');
+        const alert = processSecurityAlert(scan);
+        const malicious = alert?.state === 'detected';
         if (malicious)
-            findings.unshift(`known malicious daemon detected${freshness === 'fresh' ? '' : ' in retained evidence; recheck required'}`);
-        else if (scan.status === 'critical')
-            findings.unshift('critical process finding requires review');
+            findings.unshift(`known malicious daemon detected${processFreshness({ ...scan, observedAt: alert.observedAt }, now) === 'fresh' ? '' : ' in retained evidence; recheck required'}`);
+        else if (scan.iocs.some(ioc => ['present', 'active'].includes(ioc.status)))
+            checks.push('process IOC signals need corroboration; see scanner details');
         const review = scan.findings.filter(finding => ['rooted_workload', 'long_lived_workload', 'identity_changed', 'unreviewed_persistence'].includes(finding.reason));
         if (review.length)
             findings.push(`${review.length} process or persistence finding(s) need review`);

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.2.168';
+export const CLI_VERSION = '0.2.169';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.2.168",
+  "version": "0.2.169",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [