@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
ts 304 lines 8.73 KB
Raw
1 export interface AlertsByHost {
2 agent_name: string
3 number_of_alerts: number
4 }
5
6 export interface AlertsByRule {
7 rule: string
8 number_of_alerts: number
9 }
10
11 export interface AlertsByRulePerHost {
12 agent_name: string
13 number_of_alerts: number
14 rule: string
15 }
16
17 export interface AlertsSummary {
18 index_name: string
19 total_alerts: number
20 alerts: Alert[]
21 }
22
23 type IPAddress = `${number}.${number}.${number}.${number}`
24 type Timestamp = number
25 type Latitude = number
26 type Longitude = number
27 type Location = `${Latitude},${Longitude}`
28
29 export interface Alert {
30 _index: string
31 _id: string
32 _score: null
33 _source: AlertSourceContent
34 sort: Timestamp[]
35 }
36
37 export interface AlertSourceContent {
38 agent_id: string
39 agent_ip_city_name?: string
40 agent_ip_country_code?: string
41 agent_ip_geolocation?: AlertSourceAgentIPGeolocation
42 agent_ip_reserved_ip?: boolean
43 agent_ip: AlertSourceAgentIP
44 agent_labels_customer: string
45 agent_name: string
46 alert_url?: string
47 alert_id?: number
48 ask_socfortress_message?: string
49 data_action?: string
50 data_authors?: string
51 data_calendarTime?: string
52 data_columns_cid?: string
53 data_columns_cmdline?: string
54 data_columns_cwd?: string
55 data_columns_duration?: string
56 data_columns_exit_code?: string
57 data_columns_gid?: string
58 data_columns_ntime?: string
59 data_columns_parent?: string
60 data_columns_path?: string
61 data_columns_pid?: string
62 data_columns_probe_error?: string
63 data_columns_syscall?: string
64 data_columns_tid?: string
65 data_columns_uid?: string
66 data_counter?: string
67 data_document?: string
68 data_epoch?: string
69 data_event_CreationUtcTime?: string
70 data_event_Image?: string
71 data_event_ProcessGuid?: string
72 data_event_ProcessId?: string
73 data_event_RuleName?: string
74 data_event_TargetFilename?: string
75 data_event_User?: string
76 data_event_UtcTime?: string
77 data_falsepositives?: string
78 data_group?: AlertSourceDataGroup
79 data_hostIdentifier?: string
80 data_id?: string
81 data_kind?: AlertSourceDataKind
82 data_level?: AlertSourceDataLevelEnum
83 data_logsource_category?: AlertSourceDataLogsourceCategory
84 data_logsource_product?: AlertSourceDataLogsourceProduct
85 data_name?: string
86 data_numerics?: string
87 data_path?: string
88 data_references?: string
89 data_source?: AlertSourceDataLogsourceProduct
90 data_status?: AlertSourceDataStatus
91 data_system_Channel?: string
92 data_system_Computer?: string
93 data_system_Correlation?: string | null
94 data_system_EventID?: string
95 data_system_EventRecordID?: string
96 data_system_Execution_attributes_ProcessID?: string
97 data_system_Execution_attributes_ThreadID?: string
98 data_system_Keywords?: string
99 data_system_Level?: string
100 data_system_Opcode?: string
101 data_system_Provider_attributes_Guid?: string
102 data_system_Provider_attributes_Name?: string
103 data_system_Security_attributes_UserID?: string
104 data_system_Task?: string
105 data_system_TimeCreated_attributes_SystemTime?: string
106 data_system_Version?: string
107 data_tags?: string
108 data_timestamp?: string
109 data_unixTime?: string
110 data_vulnerability_assigner?: string
111 data_vulnerability_cve_version?: string
112 data_vulnerability_cve?: string
113 data_vulnerability_cvss_cvss3_base_score?: string
114 data_vulnerability_cvss_cvss3_vector_access_complexity?: string
115 data_vulnerability_cvss_cvss3_vector_attack_vector?: string
116 data_vulnerability_cvss_cvss3_vector_availability?: AlertSourceDataLevelEnum
117 data_vulnerability_cvss_cvss3_vector_confidentiality_impact?: AlertSourceDataLevelEnum
118 data_vulnerability_cvss_cvss3_vector_integrity_impact?: AlertSourceDataLevelEnum
119 data_vulnerability_cvss_cvss3_vector_privileges_required?: string
120 data_vulnerability_cvss_cvss3_vector_scope?: string
121 data_vulnerability_cvss_cvss3_vector_user_interaction?: string
122 data_vulnerability_cwe_reference?: string
123 data_vulnerability_package_architecture?: string
124 data_vulnerability_package_condition?: string
125 data_vulnerability_package_name?: string
126 data_vulnerability_package_version?: string
127 data_vulnerability_published?: string
128 data_vulnerability_rationale?: string
129 data_vulnerability_references?: string
130 data_vulnerability_severity?: string
131 data_vulnerability_status?: string
132 data_vulnerability_title?: string
133 data_vulnerability_type?: string
134 data_vulnerability_updated?: string
135 data_win_eventdata_callTrace?: string
136 data_win_eventdata_commandLine?: string
137 data_win_eventdata_company?: string
138 data_win_eventdata_currentDirectory?: string
139 data_win_eventdata_description?: string
140 data_win_eventdata_fileVersion?: string
141 data_win_eventdata_fWLink?: string
142 data_win_eventdata_grantedAccess?: string
143 data_win_eventdata_hashes?: string
144 data_win_eventdata_image?: string
145 data_win_eventdata_integrityLevel?: AlertSourceDataWinEventdataIntegrityLevel
146 data_win_eventdata_logonGuid?: string
147 data_win_eventdata_logonId?: string
148 data_win_eventdata_newThreadId?: string
149 data_win_eventdata_originalFileName?: string
150 data_win_eventdata_parentCommandLine?: string
151 data_win_eventdata_parentImage?: string
152 data_win_eventdata_parentProcessGuid?: string
153 data_win_eventdata_parentProcessId?: string
154 data_win_eventdata_parentUser?: string
155 data_win_eventdata_path?: string
156 data_win_eventdata_processGuid?: string
157 data_win_eventdata_processId?: string
158 data_win_eventdata_product?: string
159 data_win_eventdata_ruleName?: string
160 data_win_eventdata_sourceImage?: string
161 data_win_eventdata_sourceProcessGuid?: string
162 data_win_eventdata_sourceProcessGUID?: string
163 data_win_eventdata_sourceProcessId?: string
164 data_win_eventdata_sourceThreadId?: string
165 data_win_eventdata_sourceUser?: string
166 data_win_eventdata_startAddress?: string
167 data_win_eventdata_startFunction?: string
168 data_win_eventdata_startModule?: string
169 data_win_eventdata_state?: string
170 data_win_eventdata_targetImage?: string
171 data_win_eventdata_targetProcessGuid?: string
172 data_win_eventdata_targetProcessGUID?: string
173 data_win_eventdata_targetProcessId?: string
174 data_win_eventdata_targetUser?: string
175 data_win_eventdata_terminalSessionId?: string
176 data_win_eventdata_user?: string
177 data_win_eventdata_utcTime?: string
178 data_win_system_channel?: string
179 data_win_system_computer?: string
180 data_win_system_eventID?: string
181 data_win_system_eventRecordID?: string
182 data_win_system_keywords?: string
183 data_win_system_level?: string
184 data_win_system_message?: string
185 data_win_system_opcode?: string
186 data_win_system_processID?: string
187 data_win_system_providerGuid?: string
188 data_win_system_providerName?: string
189 data_win_system_severityValue?: AlertSourceDataWinSystemSeverityValue
190 data_win_system_systemTime?: string
191 data_win_system_task?: string
192 data_win_system_threadID?: string
193 data_win_system_version?: string
194 decoder_name: AlertSourceDecoderName
195 epss_cve?: string
196 epss_date?: string
197 epss_epss?: string
198 epss_percentile?: string
199 gl2_accounted_message_size: number
200 gl2_message_id: string
201 gl2_processing_error: string
202 gl2_remote_ip: AlertSourceIP
203 gl2_remote_port: number
204 gl2_source_input: string
205 gl2_source_node: string
206 hash_sha256?: string
207 id: string
208 location: string
209 manager_name: string
210 message: string
211 msg_timestamp?: string
212 parent_process_id?: string
213 process_cmd_line?: string
214 process_id?: string
215 process_image?: string
216 process_name?: string
217 rule_description: string
218 rule_firedtimes: number
219 rule_gdpr?: string
220 rule_gpg13?: string
221 rule_group1: string
222 rule_group2?: string
223 rule_group3?: AlertSourceDataLogsourceProduct
224 rule_groups: string
225 rule_hipaa?: string
226 rule_id: string
227 rule_level: number
228 rule_mail: boolean
229 rule_mitre_id?: string
230 rule_mitre_tactic?: string
231 rule_mitre_technique?: string
232 rule_nist_800_53?: string
233 rule_pci_dss?: string
234 rule_tsc?: string
235 sha256?: string
236 sigma_name_encoded?: string
237 source_reserved_ip: boolean
238 source: AlertSourceIP
239 streams: string[]
240 syslog_level: AlertSourceSyslogLevel
241 syslog_type: AlertSourceSyslogType
242 timestamp_utc: string
243 timestamp: string
244 type?: string
245 true: number
246 }
247
248 export type AlertSourceAgentIP = IPAddress
249 export type AlertSourceIP = IPAddress
250 export type AlertSourceAgentIPGeolocation = Location
251
252 export enum AlertSourceDataGroup {
253 Sigma = "Sigma"
254 }
255
256 export enum AlertSourceDataKind {
257 Individual = "individual"
258 }
259
260 export enum AlertSourceDataLevelEnum {
261 High = "high"
262 }
263
264 export enum AlertSourceDataLogsourceCategory {
265 FileEvent = "file_event"
266 }
267
268 export enum AlertSourceDataLogsourceProduct {
269 Sigma = "sigma",
270 Windows = "windows",
271 Osquery = "osquery",
272 Sysmon = "sysmon"
273 }
274
275 export enum AlertSourceDataStatus {
276 Experimental = "experimental"
277 }
278
279 export enum AlertSourceDataWinEventdataIntegrityLevel {
280 System = "System"
281 }
282
283 export enum AlertSourceDataWinSystemSeverityValue {
284 Information = "INFORMATION",
285 Warning = "WARNING"
286 }
287
288 export enum AlertSourceDecoderName {
289 JSON = "json",
290 WindowsEventchannel = "windows_eventchannel"
291 }
292
293 export enum AlertSourceSyslogLevel {
294 Alert = "ALERT"
295 }
296
297 export enum AlertSourceSyslogType {
298 Wazuh = "wazuh"
299 }
300
301 export interface WazuhRuleExclude {
302 wazuh_rule: string
303 explanation: string
304 }