stellar-cyber-mcp-agents/dist/agents/network-agent.d.ts

Model Context Protocol (MCP) server for Stellar Cyber security operations with specialized multi-agent analysis capabilities

import { BaseAgent } from '../core/base-agent.js';
import { AgentMetadata, AgentRegistry, AgentCommunicationChannel, AgentLogger, AgentMetrics, AgentHealth, AgentRequest, AgentContext } from '../types/agent.js';
export interface NetworkAnalysisConfig {
    apiUrl: string;
    apiToken: string;
    analysisTimeout?: number;
    maxConcurrentAnalysis?: number;
    enableDeepPacketAnalysis?: boolean;
}
export interface NetworkActivityAnalysis {
    id: string;
    caseId: string;
    timestamp: string;
    summary: {
        totalConnections: number;
        uniqueIPs: number;
        suspiciousConnections: number;
        dataTransferred: {
            inbound: number;
            outbound: number;
        };
        protocols: Record<string, number>;
        riskLevel: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    };
    findings: NetworkFinding[];
    connections: NetworkConnection[];
    threats: NetworkThreat[];
    recommendations: string[];
    visualizations: NetworkVisualization[];
}
export interface NetworkFinding {
    id: string;
    type: 'suspicious_connection' | 'data_exfiltration' | 'lateral_movement' | 'c2_communication' | 'port_scan' | 'protocol_anomaly';
    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    confidence: number;
    description: string;
    evidence: NetworkEvidence[];
    mitigation: string[];
    ttps: {
        tactics: string[];
        techniques: string[];
    };
}
export interface NetworkConnection {
    id: string;
    timestamp: string;
    source: NetworkEndpoint;
    destination: NetworkEndpoint;
    protocol: string;
    port: number;
    bytesTransferred: number;
    duration: number;
    flags: string[];
    classification: 'benign' | 'suspicious' | 'malicious' | 'unknown';
    confidence: number;
    details: any;
}
export interface NetworkEndpoint {
    ip: string;
    hostname?: string;
    port: number;
    country?: string;
    asn?: string;
    organization?: string;
    reputation?: {
        score: number;
        category: string;
        tags: string[];
    };
}
export interface NetworkThreat {
    id: string;
    type: string;
    name: string;
    description: string;
    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    indicators: string[];
    connections: string[];
    firstSeen: string;
    lastSeen: string;
    mitigations: string[];
}
export interface NetworkEvidence {
    type: string;
    value: string;
    context: string;
    timestamp: string;
    source: string;
}
export interface NetworkVisualization {
    type: 'topology' | 'timeline' | 'heatmap' | 'flow';
    title: string;
    description: string;
    data: any;
}
export interface TrafficPattern {
    id: string;
    name: string;
    description: string;
    indicators: string[];
    matchCount: number;
    severity: string;
    recommendation: string;
}
export interface ProtocolAnalysis {
    protocol: string;
    totalConnections: number;
    suspiciousConnections: number;
    anomalies: ProtocolAnomaly[];
    risks: string[];
}
export interface ProtocolAnomaly {
    type: string;
    description: string;
    severity: string;
    connections: string[];
    evidence: string[];
}
export declare class NetworkAnalysisAgent extends BaseAgent {
    private config;
    private activeAnalyses;
    private analysisCache;
    private threatPatterns;
    private accessToken;
    private tokenExpiresAt;
    private refreshPromise;
    constructor(metadata: AgentMetadata, registry: AgentRegistry, channel: AgentCommunicationChannel, logger: AgentLogger, metrics: AgentMetrics, config: NetworkAnalysisConfig);
    protected onInitialize(): Promise<void>;
    protected onStart(): Promise<void>;
    protected onStop(): Promise<void>;
    protected onDestroy(): Promise<void>;
    protected onHealthCheck(): Promise<AgentHealth>;
    protected handleRequest(request: AgentRequest, context: AgentContext): Promise<any>;
    private analyzeNetworkActivity;
    private performNetworkAnalysis;
    private detectLateralMovement;
    private analyzeDataExfiltration;
    private detectC2Communication;
    private analyzeTrafficPatterns;
    private getNetworkTopology;
    private analyzeProtocolAnomalies;
    private huntNetworkThreats;
    private generateNetworkTimeline;
    private analyzeEndpointBehavior;
    private refreshToken;
    private performTokenRefresh;
    private getAccessToken;
    private makeRequest;
    private loadThreatPatterns;
    private fetchNetworkConnections;
    private fetchNetworkFlows;
    private fetchNetworkAlerts;
    private analyzeConnections;
    private detectThreats;
    private generateNetworkFindings;
    private buildNetworkVisualizations;
    private generateNetworkRecommendations;
    private calculateNetworkSummary;
    private calculateOverallRiskLevel;
    private isInternalIP;
    private detectSuspiciousLateralPatterns;
    private identifyPivotPoints;
    private buildMovementChains;
    private calculateLateralMovementConfidence;
    private generateLateralMovementRecommendations;
    private analyzeTransferPatterns;
    private checkDestinationReputation;
    private detectDataEncoding;
    private calculateExfiltrationRisk;
    private generateExfiltrationRecommendations;
    private analyzeC2Patterns;
    private detectBeaconing;
    private analyzeC2Protocols;
    private calculateC2Confidence;
    private generateC2Recommendations;
    private matchPattern;
    private analyzeTemporalPatterns;
    private analyzeVolumetricPatterns;
    private analyzeBehavioralPatterns;
    private detectPatternAnomalies;
    private summarizePatterns;
    private buildNetworkNodes;
    private buildNetworkEdges;
    private calculateNodeMetrics;
    private identifyCriticalNodes;
    private identifyNetworkClusters;
    private calculateAverageDegree;
    private calculateNetworkDensity;
    private detectHTTPAnomalies;
    private detectDNSAnomalies;
    private detectSSHAnomalies;
    private detectRDPAnomalies;
    private summarizeProtocolAnomalies;
    private generateProtocolRecommendations;
    private searchConnections;
    private applyHuntingRules;
    private correlateThreatIntel;
    private generateHuntFindings;
    private extractHuntIndicators;
    private generateHuntRecommendations;
    private suggestNextHuntSteps;
    private getConnectionSeverity;
    private calculateTimespan;
    private calculateSeverityBreakdown;
    private fetchEndpointConnections;
    private analyzeEndpointCommunication;
    private detectEndpointAnomalies;
    private profileEndpoint;
    private assessEndpointRisk;
    private generateEndpointRecommendations;
    private startPatternUpdates;
    private updateThreatPatterns;
    private cancelActiveAnalyses;
}
export declare function createNetworkAnalysisAgentMetadata(): AgentMetadata;
//# sourceMappingURL=network-agent.d.ts.map