stellar-cyber-mcp-agents/dist/agents/correlation-agent.d.ts

Model Context Protocol (MCP) server for Stellar Cyber security operations with specialized multi-agent analysis capabilities

import { BaseAgent } from '../core/base-agent.js';
import { AgentMetadata, AgentRegistry, AgentCommunicationChannel, AgentLogger, AgentMetrics, AgentHealth, AgentRequest, AgentContext } from '../types/agent.js';
export interface CorrelationConfig {
    apiUrl: string;
    apiToken: string;
    correlationThreshold?: number;
    timeWindowHours?: number;
    maxCasesPerCorrelation?: number;
    enableCampaignDetection?: boolean;
}
export interface CorrelationRule {
    id: string;
    name: string;
    description: string;
    type: 'observable' | 'temporal' | 'behavioral' | 'campaign';
    weight: number;
    threshold: number;
    enabled: boolean;
    conditions: CorrelationCondition[];
}
export interface CorrelationCondition {
    field: string;
    operator: 'equals' | 'contains' | 'regex' | 'range' | 'similarity';
    value: any;
    weight: number;
}
export interface CorrelationResult {
    id: string;
    type: 'case_similarity' | 'observable_overlap' | 'temporal_proximity' | 'campaign_detection';
    score: number;
    confidence: number;
    primaryCaseId: string;
    relatedCases: RelatedCase[];
    commonElements: CommonElement[];
    timeline: CorrelationTimelineEvent[];
    recommendations: CorrelationRecommendation[];
    metadata: {
        analysisTime: string;
        rulesApplied: string[];
        dataPoints: number;
        correlationMethod: string;
    };
}
export interface RelatedCase {
    caseId: string;
    name: string;
    severity: string;
    status: string;
    createdAt: string;
    score: number;
    confidence: number;
    relationshipType: string;
    sharedElements: string[];
    timeProximity?: number;
}
export interface CommonElement {
    type: 'observable' | 'actor' | 'technique' | 'target' | 'pattern';
    value: string;
    frequency: number;
    confidence: number;
    cases: string[];
    firstSeen: string;
    lastSeen: string;
    tags: string[];
}
export interface CorrelationTimelineEvent {
    timestamp: string;
    caseId: string;
    eventType: string;
    description: string;
    severity: string;
    correlation: {
        type: string;
        score: number;
        relatedEvents: string[];
    };
}
export interface CorrelationRecommendation {
    id: string;
    priority: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    category: string;
    description: string;
    rationale: string;
    actions: string[];
    evidence: string[];
    impact: string;
    effort: string;
}
export interface CampaignDetectionResult {
    campaignId: string;
    name: string;
    description: string;
    confidence: number;
    timeframe: {
        start: string;
        end: string;
        duration: string;
    };
    cases: string[];
    indicators: CampaignIndicator[];
    tactics: string[];
    techniques: string[];
    targets: string[];
    progression: CampaignPhase[];
    attribution?: {
        actor: string;
        confidence: number;
        evidence: string[];
    };
}
export interface CampaignIndicator {
    type: string;
    value: string;
    frequency: number;
    confidence: number;
    cases: string[];
    category: 'infrastructure' | 'malware' | 'technique' | 'target';
}
export interface CampaignPhase {
    phase: string;
    description: string;
    timeframe: {
        start: string;
        end: string;
    };
    cases: string[];
    techniques: string[];
    indicators: string[];
}
export interface CorrelationQuery {
    caseId?: string;
    observables?: string[];
    timeRange?: {
        start: string;
        end: string;
    };
    severity?: string[];
    status?: string[];
    correlationTypes?: string[];
    threshold?: number;
    limit?: number;
}
export declare class CorrelationAgent extends BaseAgent {
    private config;
    private correlationRules;
    private correlationCache;
    private campaignCache;
    private accessToken;
    private tokenExpiresAt;
    private refreshPromise;
    constructor(metadata: AgentMetadata, registry: AgentRegistry, channel: AgentCommunicationChannel, logger: AgentLogger, metrics: AgentMetrics, config: CorrelationConfig);
    protected onInitialize(): Promise<void>;
    protected onStart(): Promise<void>;
    protected onStop(): Promise<void>;
    protected onDestroy(): Promise<void>;
    protected onHealthCheck(): Promise<AgentHealth>;
    protected handleRequest(request: AgentRequest, context: AgentContext): Promise<any>;
    private correlateCases;
    private correlateCaseData;
    private findRelatedCases;
    private detectCampaigns;
    private analyzeCaseSimilarity;
    private getCorrelationTimeline;
    private createCorrelationRule;
    private updateCorrelationRule;
    private getCorrelationRules;
    private getCorrelationStatistics;
    private refreshToken;
    private performTokenRefresh;
    private getAccessToken;
    private makeRequest;
    private initializeCorrelationRules;
    private getCacheKey;
    private getCasesForCorrelation;
    private applyCorrelationRule;
    private applyObservableCorrelation;
    private applyTemporalCorrelation;
    private applyBehavioralCorrelation;
    private mergeCorrelationResults;
    private calculateObservableSimilarity;
    private getSharedObservables;
    private buildCommonElementsFromCases;
    private generateCorrelationRecommendations;
    private extractObservables;
    private findCasesByObservables;
    private calculateCorrelationScore;
    private buildCommonElements;
    private calculateConfidence;
    private buildCorrelationTimeline;
    private validateCorrelationRule;
    private persistCorrelationRule;
    private getRecentCorrelations;
    private getTopCorrelationTypes;
    private startCacheCleanup;
    private cleanupCache;
    private startCampaignDetection;
    private findRelatedCasesByObservables;
    private findRelatedCasesByTime;
    private findRelatedCasesByBehavior;
    private mergeRelatedCases;
    private getCasesForCampaignDetection;
    private groupCasesIntoCampaigns;
    private analyzeCampaignGroup;
    private getCaseData;
    private calculateOverallSimilarity;
    private calculateTemporalSimilarity;
    private calculateBehavioralSimilarity;
    private calculateMetadataSimilarity;
    private findCommonElements;
    private generateSimilarityRecommendations;
    private calculateSimilarityConfidence;
    private getCaseEvents;
    private addCorrelationInfo;
}
export declare function createCorrelationAgentMetadata(): AgentMetadata;
//# sourceMappingURL=correlation-agent.d.ts.map