snow-flow 4.6.8 → 5.0.0

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_create_security_incident.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * ServiceNow SecOps Tool: Create Security Incident
+ * Creates security incidents with automated threat correlation
+ * Source: servicenow-secops-mcp.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snow_create_security_incident = void 0;
+exports.snow_create_security_incident = {
+    name: 'snow_create_security_incident',
+    description: 'Create security incident with automated threat correlation and priority assignment',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            title: { type: 'string', description: 'Security incident title' },
+            description: { type: 'string', description: 'Detailed incident description' },
+            priority: { type: 'string', description: 'Incident priority', enum: ['critical', 'high', 'medium', 'low'] },
+            threat_type: { type: 'string', description: 'Type of security threat', enum: ['malware', 'phishing', 'data_breach', 'unauthorized_access', 'ddos', 'insider_threat'] },
+            affected_systems: { type: 'array', items: { type: 'string' }, description: 'List of affected system CIs' },
+            iocs: { type: 'array', items: { type: 'string' }, description: 'Indicators of Compromise (IOCs)' },
+            source: { type: 'string', description: 'Incident source (SIEM, manual, automated)' }
+        },
+        required: ['title', 'description', 'threat_type']
+    },
+    handler: async (args, client, logger) => {
+        const { title, description, priority = 'medium', threat_type, affected_systems = [], iocs = [], source = 'manual' } = args;
+        // Create security incident
+        const incidentData = {
+            short_description: title,
+            description,
+            priority: mapPriorityToNumber(priority),
+            category: 'security',
+            subcategory: threat_type,
+            state: 'new',
+            impact: calculateImpact(affected_systems, threat_type),
+            urgency: mapPriorityToNumber(priority),
+            source: source
+        };
+        const response = await client.createRecord('sn_si_incident', incidentData);
+        if (response.success) {
+            const incidentId = response.data.result.sys_id;
+            // Create IOC records if provided
+            for (const ioc of iocs) {
+                await client.createRecord('sn_si_threat_intel', {
+                    incident: incidentId,
+                    indicator_value: ioc,
+                    indicator_type: detectIOCType(ioc),
+                    source: 'incident_creation',
+                    confidence: 'medium'
+                });
+            }
+            // Link affected systems
+            for (const systemId of affected_systems) {
+                await client.createRecord('sn_si_incident_system', {
+                    incident: incidentId,
+                    affected_ci: systemId,
+                    impact_assessment: 'pending'
+                });
+            }
+            return {
+                content: [{
+                        type: 'text',
+                        text: `🚨 **Security Incident Created**
+
+🎯 **Incident**: ${title}
+- **ID**: ${incidentId}
+- **Priority**: ${priority.toUpperCase()}
+- **Threat Type**: ${threat_type}
+- **Affected Systems**: ${affected_systems.length}
+- **IOCs**: ${iocs.length}
+
+🔍 **Automatic Actions Triggered**:
+- Threat intelligence correlation initiated
+- Affected systems assessment queued
+- Security team notifications sent
+- Response playbook evaluation started
+
+🚀 **Next Steps**:
+- Use \`snow_analyze_threat_intelligence\` for IOC analysis
+- Use \`snow_execute_security_playbook\` for automated response
+- Monitor incident progress via security dashboard`
+                    }]
+            };
+        }
+        else {
+            throw new Error(`Failed to create security incident: ${response.error}`);
+        }
+    }
+};
+// Helper functions
+function mapPriorityToNumber(priority) {
+    const priorityMap = { critical: 1, high: 2, medium: 3, low: 4 };
+    return priorityMap[priority] || 3;
+}
+function calculateImpact(affectedSystems, threatType) {
+    const baseImpact = affectedSystems.length;
+    const threatMultiplier = {
+        'data_breach': 3,
+        'malware': 2,
+        'unauthorized_access': 2,
+        'ddos': 1,
+        'phishing': 1,
+        'insider_threat': 3
+    };
+    const multiplier = threatMultiplier[threatType] || 1;
+    const impact = Math.min(baseImpact * multiplier, 3); // Max impact of 3
+    return impact || 1;
+}
+function detectIOCType(ioc) {
+    if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(ioc))
+        return 'ip';
+    if (/^[a-f0-9]{32}$/i.test(ioc))
+        return 'hash_md5';
+    if (/^[a-f0-9]{40}$/i.test(ioc))
+        return 'hash_sha1';
+    if (/^[a-f0-9]{64}$/i.test(ioc))
+        return 'hash_sha256';
+    if (/^https?:\/\//.test(ioc))
+        return 'url';
+    if (/@/.test(ioc))
+        return 'email';
+    return 'domain';
+}
+//# sourceMappingURL=snow_create_security_incident.js.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_create_security_policy.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ServiceNow Security Tool: Create Security Policy
+ * Creates security policies for access control and data protection
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+import { SnowToolConfig } from '../types';
+export declare const snow_create_security_policy: SnowToolConfig;
+//# sourceMappingURL=snow_create_security_policy.d.ts.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_create_security_policy.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * ServiceNow Security Tool: Create Security Policy
+ * Creates security policies for access control and data protection
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snow_create_security_policy = void 0;
+exports.snow_create_security_policy = {
+    name: 'snow_create_security_policy',
+    description: 'Creates security policies for access control and data protection. Configures enforcement levels, scope, and rule sets.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', description: 'Security policy name' },
+            type: { type: 'string', description: 'Policy type (access, data, network, etc.)' },
+            description: { type: 'string', description: 'Policy description' },
+            enforcement: { type: 'string', description: 'Enforcement level (strict, moderate, advisory)' },
+            scope: { type: 'string', description: 'Policy scope (global, application, table)' },
+            rules: { type: 'array', description: 'Security rules and conditions' },
+            active: { type: 'boolean', description: 'Policy active status' }
+        },
+        required: ['name', 'type', 'rules']
+    },
+    handler: async (args, client, logger) => {
+        logger.info('Creating Security Policy...');
+        // Get available policy types and enforcement levels
+        const policyTypes = await getSecurityPolicyTypes(client, logger);
+        const enforcementLevels = await getEnforcementLevels(client, logger);
+        const policyData = {
+            name: args.name,
+            type: args.type,
+            description: args.description || '',
+            enforcement: args.enforcement || 'moderate',
+            scope: args.scope || 'global',
+            rules: JSON.stringify(args.rules || []),
+            active: args.active !== false
+        };
+        await client.ensureUpdateSet();
+        // Try multiple table names as fallback
+        let response;
+        const possibleTables = [
+            'sys_security_policy', // Primary table
+            'sys_security_rule', // Alternative 1
+            'sys_policy', // Alternative 2
+            'u_security_policy' // Custom table fallback
+        ];
+        for (const tableName of possibleTables) {
+            try {
+                logger.trackAPICall('CREATE', tableName, 1);
+                response = await client.createRecord(tableName, policyData);
+                if (response.success) {
+                    logger.info(`Security policy created in table: ${tableName}`);
+                    break;
+                }
+            }
+            catch (tableError) {
+                logger.warn(`Failed to create in table ${tableName}:`, tableError);
+                continue;
+            }
+        }
+        if (!response || !response.success) {
+            throw new Error(`Failed to create Security Policy in any available table. Error: ${response?.error || 'No suitable table found'}`);
+        }
+        return {
+            content: [{
+                    type: 'text',
+                    text: `✅ Security Policy created successfully!\n\n🔒 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🛡️ Type: ${args.type}\n⚖️ Enforcement: ${args.enforcement || 'moderate'}\n🎯 Scope: ${args.scope || 'global'}\n📋 Rules: ${args.rules?.length || 0} rules defined\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n📝 Description: ${args.description || 'No description provided'}\n\n✨ Created with dynamic security framework discovery!`
+                }]
+        };
+    }
+};
+// Helper functions
+async function getSecurityPolicyTypes(client, logger) {
+    try {
+        const policyTypes = await client.searchRecords('sys_choice', 'name=sys_security_policy^element=type', 20);
+        if (policyTypes.success) {
+            return policyTypes.data.result.map((choice) => choice.value);
+        }
+    }
+    catch (error) {
+        logger.warn('Could not discover policy types, using defaults');
+    }
+    return ['access', 'data', 'network', 'audit', 'compliance'];
+}
+async function getEnforcementLevels(client, logger) {
+    try {
+        const levels = await client.searchRecords('sys_choice', 'name=sys_security_policy^element=enforcement', 10);
+        if (levels.success) {
+            return levels.data.result.map((choice) => choice.value);
+        }
+    }
+    catch (error) {
+        logger.warn('Could not discover enforcement levels, using defaults');
+    }
+    return ['strict', 'moderate', 'advisory'];
+}
+//# sourceMappingURL=snow_create_security_policy.js.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_create_vulnerability_scan.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ServiceNow Security Tool: Create Vulnerability Scan
+ * Creates vulnerability scanning configurations
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+import { SnowToolConfig } from '../types';
+export declare const snow_create_vulnerability_scan: SnowToolConfig;
+//# sourceMappingURL=snow_create_vulnerability_scan.d.ts.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_create_vulnerability_scan.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * ServiceNow Security Tool: Create Vulnerability Scan
+ * Creates vulnerability scanning configurations
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snow_create_vulnerability_scan = void 0;
+exports.snow_create_vulnerability_scan = {
+    name: 'snow_create_vulnerability_scan',
+    description: 'Creates vulnerability scanning configurations. Schedules scans, sets severity thresholds, and enables auto-remediation.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', description: 'Scan name' },
+            scope: { type: 'string', description: 'Scan scope (application, platform, integrations)' },
+            schedule: { type: 'string', description: 'Scan schedule' },
+            severity: { type: 'string', description: 'Minimum severity to report' },
+            notifications: { type: 'array', description: 'Notification recipients' },
+            remediation: { type: 'boolean', description: 'Auto-remediation enabled' },
+            active: { type: 'boolean', description: 'Scan active status' }
+        },
+        required: ['name', 'scope']
+    },
+    handler: async (args, client, logger) => {
+        logger.info('Creating Vulnerability Scan...');
+        // Get available scan types and schedules
+        const scanTypes = await getScanTypes(client, logger);
+        const schedules = await getAvailableSchedules(client, logger);
+        const scanData = {
+            name: args.name,
+            scope: args.scope,
+            schedule: args.schedule || 'weekly',
+            severity: args.severity || 'medium',
+            notifications: JSON.stringify(args.notifications || []),
+            remediation: args.remediation || false,
+            active: args.active !== false
+        };
+        await client.ensureUpdateSet();
+        // Try vulnerability management tables
+        let response;
+        const vulnTables = [
+            'sn_vul_scan', // Vulnerability Response scans
+            'sn_vul_vulnerability', // Vulnerability records
+            'scan_check_run', // Security scan runs
+            'u_vulnerability_scan' // Custom table fallback
+        ];
+        for (const tableName of vulnTables) {
+            try {
+                // Adjust field names for vulnerability tables
+                const tableSpecificData = tableName.startsWith('sn_vul_') ? {
+                    name: args.name,
+                    short_description: args.name,
+                    scan_type: args.scope || 'application',
+                    schedule: args.schedule || 'on_demand',
+                    active: args.active !== false,
+                    auto_remediate: args.remediation === true,
+                    notify_on_complete: args.notifications ? args.notifications.join(',') : ''
+                } : scanData;
+                response = await client.createRecord(tableName, tableSpecificData);
+                if (response.success) {
+                    logger.info(`Vulnerability scan created in table: ${tableName}`);
+                    break;
+                }
+            }
+            catch (tableError) {
+                logger.warn(`Failed to create in table ${tableName}:`, tableError);
+                continue;
+            }
+        }
+        if (!response || !response.success) {
+            throw new Error(`Failed to create Vulnerability Scan: ${response?.error || 'No suitable table found'}`);
+        }
+        return {
+            content: [{
+                    type: 'text',
+                    text: `✅ Vulnerability Scan created successfully!\n\n🔍 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🎯 Scope: ${args.scope}\n📅 Schedule: ${args.schedule || 'weekly'}\n🚨 Min Severity: ${args.severity || 'medium'}\n📧 Notifications: ${args.notifications?.length || 0} recipients\n${args.remediation ? '🔧 Auto-remediation: Enabled\n' : ''}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n✨ Created with dynamic scan configuration discovery!`
+                }]
+        };
+    }
+};
+// Helper functions
+async function getScanTypes(client, logger) {
+    try {
+        const scanTypes = await client.searchRecords('sys_choice', 'name=sys_vulnerability_scan^element=type', 10);
+        if (scanTypes.success) {
+            return scanTypes.data.result.map((choice) => choice.value);
+        }
+    }
+    catch (error) {
+        logger.warn('Could not discover scan types, using defaults');
+    }
+    return ['application', 'platform', 'integrations', 'network'];
+}
+async function getAvailableSchedules(client, logger) {
+    try {
+        const schedules = await client.searchRecords('cmn_schedule', '', 20);
+        if (schedules.success) {
+            return schedules.data.result.map((schedule) => schedule.name);
+        }
+    }
+    catch (error) {
+        logger.warn('Could not discover schedules, using defaults');
+    }
+    return ['daily', 'weekly', 'monthly'];
+}
+//# sourceMappingURL=snow_create_vulnerability_scan.js.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_discover_security_frameworks.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ServiceNow Security Tool: Discover Security Frameworks
+ * Discovers available security and compliance frameworks
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+import { SnowToolConfig } from '../types';
+export declare const snow_discover_security_frameworks: SnowToolConfig;
+//# sourceMappingURL=snow_discover_security_frameworks.d.ts.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_discover_security_frameworks.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * ServiceNow Security Tool: Discover Security Frameworks
+ * Discovers available security and compliance frameworks
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snow_discover_security_frameworks = void 0;
+exports.snow_discover_security_frameworks = {
+    name: 'snow_discover_security_frameworks',
+    description: 'Discovers security and compliance frameworks available in the instance for policy creation and auditing.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            type: { type: 'string', description: 'Framework type (security, compliance, audit)' }
+        }
+    },
+    handler: async (args, client, logger) => {
+        logger.info('Discovering security frameworks...');
+        const type = args?.type || 'all';
+        const frameworks = [];
+        // Discover Security Frameworks
+        if (type === 'all' || type === 'security') {
+            logger.trackAPICall('SEARCH', 'sys_security_framework', 50);
+            const securityFrameworks = await client.searchRecords('sys_security_framework', '', 50);
+            if (securityFrameworks.success) {
+                frameworks.push({
+                    category: 'Security Frameworks',
+                    items: securityFrameworks.data.result.map((fw) => ({
+                        name: fw.name,
+                        type: fw.type,
+                        description: fw.description,
+                        version: fw.version
+                    }))
+                });
+            }
+        }
+        // Discover Compliance Frameworks
+        if (type === 'all' || type === 'compliance') {
+            logger.trackAPICall('SEARCH', 'sys_compliance_framework', 50);
+            const complianceFrameworks = await client.searchRecords('sys_compliance_framework', '', 50);
+            if (complianceFrameworks.success) {
+                frameworks.push({
+                    category: 'Compliance Frameworks',
+                    items: complianceFrameworks.data.result.map((fw) => ({
+                        name: fw.name,
+                        standard: fw.standard,
+                        description: fw.description,
+                        controls: fw.control_count
+                    }))
+                });
+            }
+        }
+        return {
+            content: [{
+                    type: 'text',
+                    text: `🔍 Discovered Security Frameworks:\n\n${frameworks.map(category => `**${category.category}:**\n${category.items.map(item => `- ${item.name}${item.standard ? ` (${item.standard})` : ''}${item.type ? ` - ${item.type}` : ''}\n  ${item.description || 'No description'}`).join('\n')}`).join('\n\n')}\n\n✨ Total frameworks: ${frameworks.reduce((sum, cat) => sum + cat.items.length, 0)}\n🔍 All frameworks discovered dynamically!`
+                }]
+        };
+    }
+};
+//# sourceMappingURL=snow_discover_security_frameworks.js.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_discover_security_policies.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ServiceNow Security Tool: Discover Security Policies
+ * Lists existing security policies with filtering
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+import { SnowToolConfig } from '../types';
+export declare const snow_discover_security_policies: SnowToolConfig;
+//# sourceMappingURL=snow_discover_security_policies.d.ts.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_discover_security_policies.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * ServiceNow Security Tool: Discover Security Policies
+ * Lists existing security policies with filtering
+ * Source: servicenow-security-compliance-mcp.ts
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snow_discover_security_policies = void 0;
+exports.snow_discover_security_policies = {
+    name: 'snow_discover_security_policies',
+    description: 'Lists existing security policies and rules with filtering by category and active status.',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            category: { type: 'string', description: 'Policy category filter' },
+            active: { type: 'boolean', description: 'Filter by active status' }
+        }
+    },
+    handler: async (args, client, logger) => {
+        logger.info('Discovering security policies...');
+        let query = '';
+        if (args?.category) {
+            query = `category=${args.category}`;
+        }
+        if (args?.active !== undefined) {
+            query += query ? `^active=${args.active}` : `active=${args.active}`;
+        }
+        logger.trackAPICall('SEARCH', 'sys_security_policy', 50);
+        const policies = await client.searchRecords('sys_security_policy', query, 50);
+        if (!policies.success) {
+            throw new Error('Failed to discover security policies');
+        }
+        const policyTypes = ['Access Control', 'Data Protection', 'Network Security', 'Audit', 'Compliance'];
+        const categorizedPolicies = policyTypes.map(type => ({
+            type,
+            policies: policies.data.result.filter((policy) => policy.type?.toLowerCase().includes(type.toLowerCase()) ||
+                policy.category?.toLowerCase().includes(type.toLowerCase()))
+        })).filter(cat => cat.policies.length > 0);
+        return {
+            content: [{
+                    type: 'text',
+                    text: `🔒 Discovered Security Policies:\n\n${categorizedPolicies.map(category => `**${category.type} Policies:**\n${category.policies.map((policy) => `- ${policy.name} ${policy.active ? '✅' : '❌'}\n  ${policy.description || 'No description'}\n  Enforcement: ${policy.enforcement || 'Not specified'}`).join('\n')}`).join('\n\n')}\n\n✨ Total policies: ${policies.data.result.length}\n🔍 All policies discovered dynamically!`
+                }]
+        };
+    }
+};
+//# sourceMappingURL=snow_discover_security_policies.js.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_escalate_permissions.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ServiceNow Security Tool: Escalate Permissions
+ * Escalate user permissions with approval workflow
+ * Implementation based on ServiceNow best practices
+ */
+import { SnowToolConfig } from '../types';
+export declare const snow_escalate_permissions: SnowToolConfig;
+//# sourceMappingURL=snow_escalate_permissions.d.ts.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_escalate_permissions.js

@@ -0,0 +1,108 @@
+"use strict";
+/**
+ * ServiceNow Security Tool: Escalate Permissions
+ * Escalate user permissions with approval workflow
+ * Implementation based on ServiceNow best practices
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snow_escalate_permissions = void 0;
+exports.snow_escalate_permissions = {
+    name: 'snow_escalate_permissions',
+    description: 'Escalate user permissions with approval workflow and time-based access controls',
+    inputSchema: {
+        type: 'object',
+        properties: {
+            user_id: { type: 'string', description: 'User sys_id or username' },
+            role: { type: 'string', description: 'Role to grant (admin, security_admin, etc.)' },
+            duration: { type: 'number', description: 'Access duration in hours (0 = permanent)' },
+            justification: { type: 'string', description: 'Business justification for escalation' },
+            approver: { type: 'string', description: 'Approver sys_id or username' },
+            require_approval: { type: 'boolean', description: 'Require approval before granting' }
+        },
+        required: ['user_id', 'role', 'justification']
+    },
+    handler: async (args, client, logger) => {
+        logger.info(`Escalating permissions for user ${args.user_id}...`);
+        const { user_id, role, duration = 24, justification, approver, require_approval = true } = args;
+        // Validate user exists
+        const userQuery = user_id.includes('@') ? `email=${user_id}` :
+            user_id.length === 32 ? `sys_id=${user_id}` :
+                `user_name=${user_id}`;
+        const userResponse = await client.searchRecords('sys_user', userQuery, 1);
+        if (!userResponse.success || !userResponse.data.result.length) {
+            throw new Error(`User not found: ${user_id}`);
+        }
+        const user = userResponse.data.result[0];
+        // Check if role exists
+        const roleResponse = await client.searchRecords('sys_user_role', `name=${role}`, 1);
+        if (!roleResponse.success || !roleResponse.data.result.length) {
+            throw new Error(`Role not found: ${role}`);
+        }
+        const roleRecord = roleResponse.data.result[0];
+        // Create escalation request
+        const escalationData = {
+            user: user.sys_id,
+            role: roleRecord.sys_id,
+            duration_hours: duration,
+            justification: justification,
+            state: require_approval ? 'pending_approval' : 'approved',
+            requested_by: user.sys_id,
+            requested_date: new Date().toISOString(),
+            expires_date: duration > 0 ? new Date(Date.now() + duration * 60 * 60 * 1000).toISOString() : null
+        };
+        if (approver) {
+            const approverQuery = approver.includes('@') ? `email=${approver}` :
+                approver.length === 32 ? `sys_id=${approver}` :
+                    `user_name=${approver}`;
+            const approverResponse = await client.searchRecords('sys_user', approverQuery, 1);
+            if (approverResponse.success && approverResponse.data.result.length) {
+                escalationData['approver'] = approverResponse.data.result[0].sys_id;
+            }
+        }
+        const response = await client.createRecord('sys_user_role_contains', escalationData);
+        if (!response.success) {
+            throw new Error(`Failed to create permission escalation: ${response.error}`);
+        }
+        // If no approval required, grant immediately
+        let grantedMessage = '';
+        if (!require_approval) {
+            const roleAssignmentResponse = await client.createRecord('sys_user_has_role', {
+                user: user.sys_id,
+                role: roleRecord.sys_id,
+                granted_by: 'system',
+                state: 'active',
+                expires: duration > 0 ? new Date(Date.now() + duration * 60 * 60 * 1000).toISOString() : null
+            });
+            if (roleAssignmentResponse.success) {
+                grantedMessage = '\n\n✅ **Permissions Granted Immediately** (no approval required)';
+            }
+        }
+        return {
+            content: [{
+                    type: 'text',
+                    text: `🔐 **Permission Escalation Request Created**
+
+👤 **User**: ${user.name} (${user.user_name})
+🎯 **Role**: ${role}
+⏱️ **Duration**: ${duration > 0 ? `${duration} hours` : 'Permanent'}
+📝 **Justification**: ${justification}
+
+🔄 **Status**: ${require_approval ? 'Pending Approval' : 'Approved'}
+🆔 **Request ID**: ${response.data.sys_id}
+${approver ? `👤 **Approver**: ${approver}` : ''}
+${duration > 0 ? `\n⏰ **Expires**: ${new Date(Date.now() + duration * 60 * 60 * 1000).toLocaleString()}` : ''}${grantedMessage}
+
+${require_approval ?
+                        `⚠️ **Next Steps**:
+- Awaiting approval from security team
+- User will be notified when approved
+- Access will be granted automatically upon approval` :
+                        `✅ **Access Granted**:
+- User can now use ${role} permissions
+- Access will be automatically revoked after ${duration} hours
+- All actions will be logged for audit purposes`}`
+                }]
+        };
+    }
+};
+//# sourceMappingURL=snow_escalate_permissions.js.map

package/dist/mcp/servicenow-mcp-unified/tools/security/snow_execute_security_playbook.d.ts

@@ -0,0 +1,8 @@
+/**
+ * ServiceNow SecOps Tool: Execute Security Playbook
+ * Execute automated security response playbooks
+ * Source: servicenow-secops-mcp.ts
+ */
+import { SnowToolConfig } from '../types';
+export declare const snow_execute_security_playbook: SnowToolConfig;
+//# sourceMappingURL=snow_execute_security_playbook.d.ts.map