This package contains type definitions of common objects used in safe-security. 

aneeshrelan

signal-safe-security

 * Any kind of information about an asset that would be interesting from a security scoring point of view.

 * This specification is motivated and uses references from STIX specification. You will notice several attribute name

 * and description matching the [STIX 2.1](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html) specification.

 * [STIX](https://oasis-open.github.io/cti-documentation/stix/intro) is designed to improve many different capabilities, such as collaborative threat analysis, automated threat exchange,

 * automated detection and response, and more.

 * STIX has a far wider scope. While STIX is a well defined standard, its adoption within Security Products has been limited

 * as most Security products deals with a small aspect of Cyber Security. Most security products therefore provide STIX

 * interfaces to generate or consume STIX objects.

 * Safe Signal focuses on understanding Signals which contribute to CRQ. This project will support importing and exporting to STIX format.

 * Need for Signal spec when STIX is already present

 * -------------------------------------------------

 * STIX is a complex system, in the sense that it has a long learning curve. Its main goal is cross-collaboration between organization

 * to exchange Cyber Threat Intelligence. STIX is a connected graph of nodes and edges.  See STIX Spec document here. The SAFE Signal

 * - Those parts of STIX that can contribute to CQR

 * - Aligned to existing SAFE architecture, which focuses on a layered scoring system for CISOs.

 * SAFE Signal spec as the step towards adopting all aspects of CTI (Cyber Threat Intelligence).

 * SAFE (as of June, 2022) understands CA, VA and EDR signals only. These are not all the signals that an organization has. Therefore

 * there is a need to ingest all interesting signals for a holistic scoring and risk calculation.

 * SignalUrl is a reference to another signal where the details can be found. This allows non-repetition of some long strings.

 * The Signal.securityContext.remediation.description can be a bug paragraph. A submitter may be submitting the same signal for the

 * asset to the Signal Db on a regular or daily basis. There is no need to submit large para to be submitted in every signal.

 * A signal attribute can refer to another signal via the signal Url, via the signal.id field. So a submitter of a signal may references

 * remediation = "signalurl://<id of the original signal>"

 * The above will refer to the remediation text of the referred signal.

     * The specification of this SAFE Signal version.

     * A signal must have an unique id, preferably a GUID. This needs to be globally unique as it will be referenced for relationship building.

     * Indicates the name of the signal. It is different from the @id field as @id  represents an instance of this name.

     * Example: Consider a CA event which you want to submit multiple times. The name could be "Password length should be 8 chars long"

     * Every time you submit, you must keep this name the same else it will be treated as a different CA event.

     * In every re-submission, a different @id must be used, else it will over-write a previously submitted signal.

     * Describe the source of the signal.

     * A paragraph that provides a human readable explanation of this signal.

     * The date when the information was converted into a signal and submitted into the system

     * This is the first seen time and not when the signal object is being created as a JSON.

     * The time when this was last seen. Typically used by connector to represent last detection time.

     * The date when this signal is no longer relevant. Sources which guarantee that it will re-submit a new assessment

     * Example: A daily assessment submitter would have a Date = 24 hours from the time of submission.

 * Points to an asset management system where more details about the entity could be found.

 * Example: an ldap server, an ADFS server, an employee management system or an Identity management system

     * Type of the management system. Example: ldap

     * Connection string, if it can be referenced by a connection string

     * A set of name value pairs that can be used to infer the connection details to the system.

     * One or more IP address interfaces the asset has. A machine can have multiple interfaces as seen from the following commands

     * The type of machine, file or identity.

     * For a machine this will be the operating system name or the service name

     * Example: "Windows 10", "AWS DynamoDb"

     * For an identity, it will be the type of identity.

     * Example: user, group, role, phone, email

     * For a file, it will be the fileType.

     * The criticality of the asset from the business perspective.

     * In information security, confidentiality "is the property, that information is not made available or disclosed to

     * unauthorized individuals, entities, or processes.

     * This field captures the confidentiality requirement of the entity for which the signal is referring to.

    confidentialityRequirement?: SeverityLevel;

     * In IT security, data integrity means maintaining and assuring the accuracy and completeness of data over its entire lifecycle.

     * This field captures the integrity requirement of the entity for which the signal is referring to.

    integrityRequirement?: SeverityLevel;

     * For any information system to serve its purpose, the information must be available when it is needed.

    availabilityRequirement?: SeverityLevel;

     * A place holder to add name value pairs as tags/labels.

     * interface name, Example: eth0, Wifi

     * An IP v4 in string format. It does not need to be an int32 for convenience

 * This is a SAFE specific section which is needed for supporting SAFE managed asset on-boarding and assessment from SAFE.

 * This contains settings needed to remotely connect to the machine to perform a remote assessment.

/* eslint-disable no-secrets/no-secrets */

Object.defineProperty(exports, "__esModule", { value: true });

exports.WorkflowStatus = exports.ComplianceStatus = exports.Effect = exports.SignalType = exports.EntityType = exports.SecurityType = exports.SeverityLevel = exports.CVSS31MetricName = exports.ControlType = exports.PreDefinedSignalSources = void 0;

    PreDefinedSignalSources["qualysCa"] = "com.qualys.ca";

    PreDefinedSignalSources["taniumComply"] = "com.tanium.comply";

})(PreDefinedSignalSources = exports.PreDefinedSignalSources || (exports.PreDefinedSignalSources = {}));

 * A signal can have different types of impact on the security posture.

 * For CA, VA the degree of impact on scoring is well understood using the severity (CVSS score).

 * For EDR, the degree of impact on scoring is well understood using the severity (Critical, High, Medium, Low, Info)

 * For generic signals, when the degree of impact is not well defined or not as per a standard, this field allows the

 * submitter to define the degree of impact.

 * The signal Db has the provision to auto-determine this value for well known CSPs.

 * A well known CSP is defined by {@link PreDefinedSignalSources}

     * Indicates that the signal represents a detection control.

    ControlType["detection"] = "detection";

     * Indicates that the signal represents a mitigation control.

    ControlType["mitigation"] = "mitigation";

     * Indicates that the signal represents a resilience control.

    ControlType["resilience"] = "resilience";

     * Indicates that the signal represents a recovery Control.

    ControlType["recovery"] = "recovery";

})(ControlType = exports.ControlType || (exports.ControlType = {}));

 * The list of possible CVSS Metric names. This list is based off CVSS 3.1

    CVSS31MetricName["attackVector"] = "AV";

    CVSS31MetricName["attackComplexity"] = "AC";

    CVSS31MetricName["priviligesRequired"] = "PR";

    CVSS31MetricName["userInteraction"] = "UI";

    CVSS31MetricName["confidentiality"] = "C";

    CVSS31MetricName["availability"] = "A";

    CVSS31MetricName["exploitCodeMaturity"] = "E";

    CVSS31MetricName["remediationLevel"] = "RL";

    CVSS31MetricName["reportConfidence"] = "RC";

    CVSS31MetricName["modifiedBaseMetrics"] = "?";

    CVSS31MetricName["confidentialityRequirement"] = "CR";

    CVSS31MetricName["integrityRequirement"] = "IR";

    CVSS31MetricName["availabilityRequirement"] = "AR";

    CVSS31MetricName["modifiedAttackVector"] = "MAV";

    CVSS31MetricName["modifiedAttackComplexity"] = "AC";

    CVSS31MetricName["modifiedPriviligesRequired"] = "PR";

    CVSS31MetricName["modifiedUserInteraction"] = "UI";

    CVSS31MetricName["modifiedConfidentiality"] = "C";

    CVSS31MetricName["modifiedIntegrity"] = "I";

    CVSS31MetricName["modifiedAvailability"] = "A";

    CVSS31MetricName["modifeidScope"] = "S";

})(CVSS31MetricName = exports.CVSS31MetricName || (exports.CVSS31MetricName = {}));

    SeverityLevel["critical"] = "critical";

})(SeverityLevel = exports.SeverityLevel || (exports.SeverityLevel = {}));

 * These are the list of different types of Cyber Security types of signals supported by this specification.

 * The enum type is specifcally string and not an auto-increment number. This is because dealing with numbers

 * makes data-lake queries and reports hard to understand. Numeric values are useful for machines and highly

})(SecurityType = exports.SecurityType || (exports.SecurityType = {}));

 * A signal should always refer to an object on which the security threat applies to.

 * It can be a machine, machines in the form of hostname(s), IP addresses (IPv4 and IPv6)

 * or a network CIDR or even a set of diverse resources like a cloud account (an ARN as an example)

 * A file which is generally the object when reporting a malware.

 * A user which is not necessarily a human user. This is typically characterized by an email id or a system user id.

})(EntityType = exports.EntityType || (exports.EntityType = {}));

 * The signal specification allows submitting a complete signal (with entity and security context) which

 * For the use case of daily assessments, there are information which are duplicate. Signal specification

 * allows the flexibility to the signal submitter to choose to post asset details alone which can later be

 * used as a reference in full signal submission.

 * Example: A submitter would need to post a few 100 signals

 * for an asset on a daily basis. It is not needed to submit full details about the asset each time. This

 * approach is motivated by Azure and GCP security center's approach where they have the concept of resources

 * A signal of type=entityOnly is a resource with an unique id. A signal

 * of type=securityContext is a Finding with a unique id and referencing an entity.

    SignalType["entityOnly"] = "entityOnly";

    SignalType["securityContextOnly"] = "securityContextOnly";

})(SignalType = exports.SignalType || (exports.SignalType = {}));

 * Possible effect of the signal. The values are motivated by AWS ASFF spec

    Effect["dataExposure"] = "dataExposure";

    Effect["dataExfiltration"] = "dataExfiltration";

    Effect["dataDestruction"] = "dataDestruction";

    Effect["denialOfService"] = "denialOfService";

    Effect["resourceConsumption"] = "resourceConsumption";

})(Effect = exports.Effect || (exports.Effect = {}));

 * Status applicable to compliance signals.

    ComplianceStatus["unknown"] = "unknown";

})(ComplianceStatus = exports.ComplianceStatus || (exports.ComplianceStatus = {}));

 * Status applicable to capture workflow state from the source of signal.

    WorkflowStatus["resolved"] = "resolved";

})(WorkflowStatus = exports.WorkflowStatus || (exports.WorkflowStatus = {}));

  "author": "Shuva Brata Deb <shuva.d@safe.security>",

  "repository": "https://github.com/Safe-Security/signal.git",

    "clean": "rm -Rf dist && rm -Rf node_modules && rm -Rf docs && rm -Rf coverage",

    "docs": "typedoc --darkHighlightTheme dark-plus --readme signal.md",

    "generate-sample-signals": "env SIGNAL_SAMPLES_DIR=./../examples/samples  ./node_modules/.bin/ts-node src/bin/generateSampleSignals.ts"

    "@semantic-release/changelog": "^6.0.1",

    "eslint-config-safe-security": "^2.0.0",

		@@ -682,2 +682,3 @@ /**
		uba = "uba",
		waf = "waf",
		others = "others"
		@@ -684,0 +685,0 @@ }

		@@ -102,2 +102,3 @@ "use strict";
		SecurityType["uba"] = "uba";
		SecurityType["waf"] = "waf";
		SecurityType["others"] = "others";
		@@ -104,0 +105,0 @@ })(SecurityType = exports.SecurityType \|\| (exports.SecurityType = {}));

		{
		"name": "signal-safe-security",
		"version": "1.5.0",
		"version": "1.6.0",
		"author": "Shuva Brata Deb <shuva.d@safe.security>",
		@@ -5,0 +5,0 @@ "license": "MIT",

Improved metrics