@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
ts 320 lines 6.06 KB
Raw
1 export type PlatformFilter = "all" | "linux" | "windows" | "powershell" | "cve"
2 export type RuleStatus = "production" | "experimental" | "deprecated"
3 export type RuleSeverity = "low" | "medium" | "high" | "critical"
4
5 export interface ParameterSchema {
6 name: string
7 description: string
8 type: string
9 required: boolean
10 default?: string | number | boolean | null
11 example?: string | number | boolean | null
12 }
13
14 export interface GraylogQuery {
15 query: string
16 }
17
18 export interface RuleSummary {
19 id: string
20 name: string
21 version: number
22 status: string
23 type: string
24 description: string
25 author: string
26 date: string
27 severity: string
28 risk_score: number
29 platform: string
30 mitre_attack_id: string[]
31 analytic_story: string[]
32 cve: string[]
33 file_path: string
34 has_graylog_query: boolean
35 }
36
37 export interface RuleDetail {
38 id: string
39 name: string
40 version: number
41 schema_version: string
42 status: string
43 type: string
44 description: string
45 author: string
46 date: string
47 data_source: string[]
48 search: Record<string, unknown>
49 parameters: ParameterSchema[]
50 how_to_implement: string
51 known_false_positives: string
52 references: string[]
53 response: RuleResponse
54 tags: RuleTags
55 file_path: string
56 raw_yaml: string
57 graylog: GraylogQuery | null
58 }
59
60 export interface RuleResponse {
61 message: string
62 risk_score: number
63 severity: string
64 risk_objects: RiskObject[]
65 threat_objects: ThreatObject[]
66 }
67
68 export interface RiskObject {
69 field: string
70 type: string
71 score: number
72 }
73
74 export interface ThreatObject {
75 field: string
76 type: string
77 }
78
79 export interface RuleTags {
80 analytic_story: string[]
81 asset_type: string
82 mitre_attack_id: string[]
83 product: string[]
84 security_domain: string
85 cve?: string[]
86 }
87
88 export interface RuleListResponse {
89 success: boolean
90 message: string
91 total: number
92 filtered: number
93 platform: string
94 rules: RuleSummary[]
95 }
96
97 export interface RuleDetailResponse {
98 success: boolean
99 message: string
100 rule: RuleDetail
101 }
102
103 export interface RuleStatsResponse {
104 success: boolean
105 message: string
106 total_rules: number
107 by_platform: Record<string, number>
108 by_status: Record<string, number>
109 by_severity: Record<string, number>
110 by_mitre_tactic: Record<string, number>
111 rules_with_graylog: number
112 last_refreshed: string | null
113 cache_ttl_minutes: number
114 }
115
116 export interface RefreshResponse {
117 success: boolean
118 message: string
119 rules_loaded: number
120 timestamp: string
121 }
122
123 // Search Execution Types
124
125 export interface ExecuteSearchRequest {
126 rule_id: string
127 index_pattern: string
128 parameters: Record<string, string | number | boolean>
129 size?: number
130 }
131
132 export interface SearchHit {
133 index: string
134 id: string
135 score: number | null
136 source: Record<string, unknown>
137 }
138
139 export interface ExecuteSearchResponse {
140 success: boolean
141 message: string
142 rule_id: string
143 rule_name: string
144 total_hits: number
145 returned_hits: number
146 took_ms: number
147 hits: SearchHit[]
148 query_executed: Record<string, unknown>
149 }
150
151 export interface SearchValidationError {
152 parameter: string
153 message: string
154 }
155
156 export interface ExecuteSearchErrorResponse {
157 success: boolean
158 message: string
159 rule_id?: string
160 validation_errors: SearchValidationError[]
161 }
162
163 // Graylog Query Types
164
165 export interface ExecuteGraylogQueryRequest {
166 rule_id: string
167 parameters?: Record<string, string | number | boolean>
168 }
169
170 export interface GraylogQueryResponse {
171 success: boolean
172 message: string
173 rule_id: string
174 rule_name: string
175 graylog_query: string
176 original_query: string
177 }
178
179 // Graylog Alert Provisioning Types
180
181 export interface ProvisionGraylogAlertRequest {
182 rule_id: string
183 search_within_seconds?: number
184 execute_every_seconds?: number
185 streams?: string[]
186 custom_title?: string
187 priority?: 1 | 2 | 3
188 event_limit?: number
189 }
190
191 export interface ProvisionGraylogAlertResponse {
192 success: boolean
193 message: string
194 rule_id: string
195 rule_name: string
196 alert_title: string
197 graylog_query: string
198 }
199
200 export interface BulkProvisionGraylogAlertRequest {
201 rule_ids: string[]
202 search_within_seconds?: number
203 execute_every_seconds?: number
204 streams?: string[]
205 priority?: 1 | 2 | 3
206 event_limit?: number
207 }
208
209 export type BulkProvisionRuleStatus = "provisioned" | "skipped" | "failed"
210
211 export interface BulkProvisionRuleResult {
212 rule_id: string
213 rule_name: string | null
214 alert_title: string | null
215 status: BulkProvisionRuleStatus
216 reason: string | null
217 }
218
219 export interface BulkProvisionGraylogAlertResponse {
220 success: boolean
221 message: string
222 provisioned_count: number
223 skipped_count: number
224 failed_count: number
225 results: BulkProvisionRuleResult[]
226 }
227
228 export interface GraylogProvisioningStatusResponse {
229 success: boolean
230 provisioned: Record<string, boolean>
231 warning: string | null
232 }
233
234 // Query Parameters
235
236 export interface RuleListQuery {
237 platform?: PlatformFilter
238 status?: RuleStatus
239 severity?: RuleSeverity
240 mitre_id?: string
241 search?: string
242 has_graylog?: boolean
243 skip?: number
244 limit?: number
245 }
246
247 // MITRE Coverage
248
249 export interface MitreSubTechnique {
250 id: string
251 name: string
252 url: string
253 rule_count: number
254 rule_ids: string[]
255 }
256
257 export interface MitreTechnique {
258 id: string
259 name: string
260 url: string
261 rule_count: number
262 rule_ids: string[]
263 total_rule_count: number
264 subtechniques: MitreSubTechnique[]
265 }
266
267 export interface MitreTactic {
268 id: string
269 name: string
270 short_name: string
271 url: string
272 techniques: MitreTechnique[]
273 }
274
275 export interface MitreCoverageStats {
276 total_tactics: number
277 total_techniques: number
278 covered_techniques: number
279 total_rules: number
280 matrix_last_refreshed: string | null
281 rules_last_refreshed: string | null
282 }
283
284 export interface MitreRuleIndexEntry {
285 id: string
286 name: string
287 severity: string
288 platform: string
289 has_graylog: boolean
290 data_sources: string[]
291 }
292
293 export interface MitreCoverageQuery {
294 platform?: PlatformFilter
295 severity?: RuleSeverity
296 status?: RuleStatus
297 has_graylog?: boolean
298 search?: string
299 }
300
301 export interface MitreCoverageResponse {
302 success: boolean
303 message: string
304 tactics: MitreTactic[]
305 rules_index: Record<string, MitreRuleIndexEntry>
306 stats: MitreCoverageStats
307 }
308
309 // Batch rule lookup
310
311 export interface RulesByIdsRequest {
312 ids: string[]
313 }
314
315 export interface RulesByIdsResponse {
316 success: boolean
317 message: string
318 rules: RuleSummary[]
319 missing: string[]
320 }