@unchainedshop/events/lib/audit/ocsf-types.d.ts

Event emitter abstraction layer for the Unchained Engine

export declare const OCSF_CATEGORY: {
    readonly IDENTITY_ACCESS_MGMT: 3;
    readonly APPLICATION_ACTIVITY: 6;
};
export declare const OCSF_CLASS: {
    readonly ACCOUNT_CHANGE: 3001;
    readonly AUTHENTICATION: 3002;
    readonly AUTHORIZE_SESSION: 3003;
    readonly API_ACTIVITY: 6003;
};
export declare const OCSF_SEVERITY: {
    readonly UNKNOWN: 0;
    readonly INFORMATIONAL: 1;
    readonly LOW: 2;
    readonly MEDIUM: 3;
    readonly HIGH: 4;
    readonly CRITICAL: 5;
    readonly FATAL: 6;
};
export declare const OCSF_STATUS: {
    readonly UNKNOWN: 0;
    readonly SUCCESS: 1;
    readonly FAILURE: 2;
    readonly OTHER: 99;
};
export declare const OCSF_AUTH_ACTIVITY: {
    readonly UNKNOWN: 0;
    readonly LOGON: 1;
    readonly LOGOFF: 2;
    readonly AUTHENTICATION_TICKET: 3;
    readonly SERVICE_TICKET_REQUEST: 4;
    readonly SERVICE_TICKET_RENEW: 5;
    readonly PREAUTH: 6;
    readonly OTHER: 99;
};
export declare const OCSF_ACCOUNT_ACTIVITY: {
    readonly UNKNOWN: 0;
    readonly CREATE: 1;
    readonly ENABLE: 2;
    readonly PASSWORD_CHANGE: 3;
    readonly PASSWORD_RESET: 4;
    readonly DISABLE: 5;
    readonly DELETE: 6;
    readonly ATTACH_POLICY: 7;
    readonly DETACH_POLICY: 8;
    readonly LOCK: 9;
    readonly MFA_ENABLE: 10;
    readonly MFA_DISABLE: 11;
    readonly OTHER: 99;
};
export declare const OCSF_API_ACTIVITY: {
    readonly UNKNOWN: 0;
    readonly CREATE: 1;
    readonly READ: 2;
    readonly UPDATE: 3;
    readonly DELETE: 4;
    readonly CHECKOUT: 90;
    readonly PAYMENT: 91;
    readonly REFUND: 92;
    readonly EXPORT: 93;
    readonly IMPORT: 94;
    readonly ACCESS_DENIED: 95;
    readonly OTHER: 99;
};
export interface OCSFMetadata {
    version: string;
    product: {
        name: string;
        version: string;
        vendor_name?: string;
    };
    uid?: string;
    original_time?: number;
    sequence?: number;
}
export interface OCSFUser {
    uid?: string;
    name?: string;
    email_addr?: string;
    type?: string;
    type_id?: number;
}
export interface OCSFActor {
    user?: OCSFUser;
    session?: OCSFSession;
    invoked_by?: string;
}
export interface OCSFSession {
    uid?: string;
    created_time?: number;
    is_mfa?: boolean;
}
export interface OCSFEndpoint {
    ip?: string;
    port?: number;
    hostname?: string;
    agent_list?: {
        name?: string;
        version?: string;
    }[];
}
export interface OCSFApi {
    operation?: string;
    service?: {
        name?: string;
    };
    request?: {
        uid?: string;
    };
    response?: {
        code?: number;
        message?: string;
    };
}
export interface OCSFBaseEvent {
    category_uid: number;
    class_uid: number;
    type_uid: number;
    activity_id: number;
    severity_id: number;
    time: number;
    message?: string;
    metadata: OCSFMetadata;
    status_id?: number;
    status_detail?: string;
    unmapped?: {
        seq: number;
        prev_hash: string;
        hash: string;
    };
}
export interface OCSFAuthenticationEvent extends OCSFBaseEvent {
    category_uid: 3;
    class_uid: 3002;
    user: OCSFUser;
    src_endpoint?: OCSFEndpoint;
    dst_endpoint?: OCSFEndpoint;
    auth_protocol_id?: number;
    auth_protocol?: string;
    is_mfa?: boolean;
    logon_type_id?: number;
    session?: OCSFSession;
}
export interface OCSFAccountChangeEvent extends OCSFBaseEvent {
    category_uid: 3;
    class_uid: 3001;
    user: OCSFUser;
    actor?: OCSFActor;
    src_endpoint?: OCSFEndpoint;
}
export interface OCSFApiActivityEvent extends OCSFBaseEvent {
    category_uid: 6;
    class_uid: 6003;
    actor: OCSFActor;
    api: OCSFApi;
    src_endpoint?: OCSFEndpoint;
    dst_endpoint?: OCSFEndpoint;
    http_request?: {
        http_method?: string;
        url?: {
            path?: string;
        };
    };
}
export type OCSFEvent = OCSFAuthenticationEvent | OCSFAccountChangeEvent | OCSFApiActivityEvent;