Add sync anomaly detection, BU drift monitoring, and findings count investigation
- Add BU drift checker that classifies archived findings as BU reassignment, severity drift, closure, or decommission via unfiltered Ivanti API queries - Add post-sync anomaly summary with significance threshold and classification breakdown stored in ivanti_sync_anomaly_log table - Add per-finding BU tracking that detects BU changes across syncs and records them in ivanti_finding_bu_history table - Add drift guard that skips trend history writes when total drops more than 50% - Add CLOSED_GONE archive state for findings that vanish from the closed set - Add anomaly banner UI on Vulnerability Triage page for significant sync changes - Add API endpoints for anomaly latest/history and BU change tracking - Add diagnostic scripts for drift checking and BU reassignment verification - Add investigation document and xlsx export for the April 2026 BU reassignment incident where 109 findings were moved to SDIT-CSD-ITLS-PIES - Migrations required: add_closed_gone_state.js, add_sync_anomaly_tables.js
This commit is contained in:
root
130
backend/migrations/add_closed_gone_state.js
Normal file
130
backend/migrations/add_closed_gone_state.js
Normal file
@@ -0,0 +1,130 @@
|
||||
// Migration: Add CLOSED_GONE state to ivanti_finding_archives
|
||||
//
|
||||
// The archive table tracks findings that disappear from the Open findings set.
|
||||
// Previously it only tracked: ARCHIVED → RETURNED → CLOSED.
|
||||
//
|
||||
// This migration adds a CLOSED_GONE state for findings that were confirmed
|
||||
// in the Ivanti Closed set but then disappeared from it on a subsequent sync.
|
||||
// This closes a visibility gap where findings could vanish from the Closed API
|
||||
// results (e.g., due to VRR rescore below the severity threshold) without
|
||||
// being tracked.
|
||||
//
|
||||
// SQLite does not support ALTER TABLE to modify CHECK constraints, so this
|
||||
// migration recreates the table with the expanded constraint.
|
||||
//
|
||||
// Safe to re-run — uses IF NOT EXISTS and checks for existing data.
|
||||
//
|
||||
// Usage: node backend/migrations/add_closed_gone_state.js
|
||||
|
||||
const path = require('path');
|
||||
const sqlite3 = require('sqlite3').verbose();
|
||||
const dbPath = path.join(__dirname, '..', 'cve_database.db');
|
||||
const db = new sqlite3.Database(dbPath);
|
||||
|
||||
console.log('Starting CLOSED_GONE state migration...');
|
||||
|
||||
function run(sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.run(sql, params, function (err) {
|
||||
if (err) reject(err);
|
||||
else resolve(this);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function all(sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.all(sql, params, (err, rows) => {
|
||||
if (err) reject(err);
|
||||
else resolve(rows || []);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
async function migrate() {
|
||||
// Check if the table already has the CLOSED_GONE state
|
||||
const tableInfo = await all("SELECT sql FROM sqlite_master WHERE name='ivanti_finding_archives'");
|
||||
if (tableInfo.length > 0 && tableInfo[0].sql.includes('CLOSED_GONE')) {
|
||||
console.log('✓ ivanti_finding_archives already has CLOSED_GONE state — skipping');
|
||||
return;
|
||||
}
|
||||
|
||||
if (tableInfo.length === 0) {
|
||||
// Table doesn't exist yet — create it fresh with the new constraint
|
||||
await run(`
|
||||
CREATE TABLE ivanti_finding_archives (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
finding_id TEXT NOT NULL UNIQUE,
|
||||
finding_title TEXT NOT NULL DEFAULT '',
|
||||
host_name TEXT NOT NULL DEFAULT '',
|
||||
ip_address TEXT NOT NULL DEFAULT '',
|
||||
current_state TEXT NOT NULL CHECK(current_state IN ('ARCHIVED','RETURNED','CLOSED','CLOSED_GONE')),
|
||||
last_severity REAL NOT NULL DEFAULT 0,
|
||||
first_archived_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
last_transition_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
||||
)
|
||||
`);
|
||||
console.log('✓ Created ivanti_finding_archives with CLOSED_GONE state');
|
||||
return;
|
||||
}
|
||||
|
||||
// Table exists but needs the constraint updated — recreate with data migration
|
||||
console.log(' Recreating table with expanded CHECK constraint...');
|
||||
|
||||
await run('BEGIN TRANSACTION');
|
||||
try {
|
||||
// 1. Rename existing table
|
||||
await run('ALTER TABLE ivanti_finding_archives RENAME TO ivanti_finding_archives_old');
|
||||
|
||||
// 2. Create new table with expanded constraint
|
||||
await run(`
|
||||
CREATE TABLE ivanti_finding_archives (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
finding_id TEXT NOT NULL UNIQUE,
|
||||
finding_title TEXT NOT NULL DEFAULT '',
|
||||
host_name TEXT NOT NULL DEFAULT '',
|
||||
ip_address TEXT NOT NULL DEFAULT '',
|
||||
current_state TEXT NOT NULL CHECK(current_state IN ('ARCHIVED','RETURNED','CLOSED','CLOSED_GONE')),
|
||||
last_severity REAL NOT NULL DEFAULT 0,
|
||||
first_archived_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
last_transition_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
||||
)
|
||||
`);
|
||||
|
||||
// 3. Copy data
|
||||
await run(`
|
||||
INSERT INTO ivanti_finding_archives
|
||||
(id, finding_id, finding_title, host_name, ip_address, current_state,
|
||||
last_severity, first_archived_at, last_transition_at, created_at)
|
||||
SELECT id, finding_id, finding_title, host_name, ip_address, current_state,
|
||||
last_severity, first_archived_at, last_transition_at, created_at
|
||||
FROM ivanti_finding_archives_old
|
||||
`);
|
||||
|
||||
// 4. Recreate indexes
|
||||
await run('CREATE INDEX IF NOT EXISTS idx_archive_finding_id ON ivanti_finding_archives(finding_id)');
|
||||
await run('CREATE INDEX IF NOT EXISTS idx_archive_current_state ON ivanti_finding_archives(current_state)');
|
||||
|
||||
// 5. Drop old table
|
||||
await run('DROP TABLE ivanti_finding_archives_old');
|
||||
|
||||
await run('COMMIT');
|
||||
console.log('✓ ivanti_finding_archives updated with CLOSED_GONE state');
|
||||
} catch (err) {
|
||||
await run('ROLLBACK').catch(() => {});
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
migrate()
|
||||
.then(() => {
|
||||
console.log('Migration complete.');
|
||||
db.close();
|
||||
})
|
||||
.catch((err) => {
|
||||
console.error('Migration failed:', err);
|
||||
db.close();
|
||||
process.exit(1);
|
||||
});
|
||||
90
backend/migrations/add_sync_anomaly_tables.js
Normal file
90
backend/migrations/add_sync_anomaly_tables.js
Normal file
@@ -0,0 +1,90 @@
|
||||
// Migration: Add sync anomaly detection and BU drift monitoring tables
|
||||
//
|
||||
// Creates two new tables:
|
||||
// - ivanti_sync_anomaly_log — stores one row per sync cycle with the
|
||||
// anomaly summary breakdown (count deltas, classification, significance).
|
||||
// - ivanti_finding_bu_history — records BU change events detected on
|
||||
// individual findings across syncs.
|
||||
//
|
||||
// Safe to re-run — uses CREATE TABLE IF NOT EXISTS and CREATE INDEX IF NOT EXISTS.
|
||||
//
|
||||
// Usage: node backend/migrations/add_sync_anomaly_tables.js
|
||||
|
||||
const path = require('path');
|
||||
const sqlite3 = require('sqlite3').verbose();
|
||||
const dbPath = path.join(__dirname, '..', 'cve_database.db');
|
||||
const db = new sqlite3.Database(dbPath);
|
||||
|
||||
console.log('Starting sync anomaly tables migration...');
|
||||
|
||||
function run(sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.run(sql, params, function (err) {
|
||||
if (err) reject(err);
|
||||
else resolve(this);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function all(sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.all(sql, params, (err, rows) => {
|
||||
if (err) reject(err);
|
||||
else resolve(rows || []);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
async function migrate() {
|
||||
// 1. Create ivanti_sync_anomaly_log table
|
||||
await run(`
|
||||
CREATE TABLE IF NOT EXISTS ivanti_sync_anomaly_log (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
sync_timestamp DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
open_count_delta INTEGER NOT NULL DEFAULT 0,
|
||||
closed_count_delta INTEGER NOT NULL DEFAULT 0,
|
||||
newly_archived_count INTEGER NOT NULL DEFAULT 0,
|
||||
returned_count INTEGER NOT NULL DEFAULT 0,
|
||||
classification_json TEXT NOT NULL DEFAULT '{}',
|
||||
is_significant INTEGER NOT NULL DEFAULT 0,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
||||
)
|
||||
`);
|
||||
console.log('✓ ivanti_sync_anomaly_log table ready');
|
||||
|
||||
// 2. Create ivanti_finding_bu_history table
|
||||
await run(`
|
||||
CREATE TABLE IF NOT EXISTS ivanti_finding_bu_history (
|
||||
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||
finding_id TEXT NOT NULL,
|
||||
finding_title TEXT NOT NULL DEFAULT '',
|
||||
host_name TEXT NOT NULL DEFAULT '',
|
||||
previous_bu TEXT NOT NULL,
|
||||
new_bu TEXT NOT NULL,
|
||||
detected_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
|
||||
)
|
||||
`);
|
||||
console.log('✓ ivanti_finding_bu_history table ready');
|
||||
|
||||
// 3. Create indexes
|
||||
await run('CREATE INDEX IF NOT EXISTS idx_anomaly_sync_timestamp ON ivanti_sync_anomaly_log(sync_timestamp)');
|
||||
console.log('✓ idx_anomaly_sync_timestamp index ready');
|
||||
|
||||
await run('CREATE INDEX IF NOT EXISTS idx_bu_history_finding_id ON ivanti_finding_bu_history(finding_id)');
|
||||
console.log('✓ idx_bu_history_finding_id index ready');
|
||||
|
||||
await run('CREATE INDEX IF NOT EXISTS idx_bu_history_detected_at ON ivanti_finding_bu_history(detected_at)');
|
||||
console.log('✓ idx_bu_history_detected_at index ready');
|
||||
}
|
||||
|
||||
migrate()
|
||||
.then(() => {
|
||||
console.log('Migration complete.');
|
||||
db.close();
|
||||
})
|
||||
.catch((err) => {
|
||||
console.error('Migration failed:', err);
|
||||
db.close();
|
||||
process.exit(1);
|
||||
});
|
||||
@@ -168,7 +168,7 @@ function initArchiveTables(db) {
|
||||
finding_title TEXT NOT NULL DEFAULT '',
|
||||
host_name TEXT NOT NULL DEFAULT '',
|
||||
ip_address TEXT NOT NULL DEFAULT '',
|
||||
current_state TEXT NOT NULL CHECK(current_state IN ('ARCHIVED','RETURNED','CLOSED')),
|
||||
current_state TEXT NOT NULL CHECK(current_state IN ('ARCHIVED','RETURNED','CLOSED','CLOSED_GONE')),
|
||||
last_severity REAL NOT NULL DEFAULT 0,
|
||||
first_archived_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
last_transition_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
@@ -305,7 +305,24 @@ async function detectArchiveChanges(db, previousFindings, currentFindings) {
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`[Archive Detection] Processed ${disappearedIds.length} disappeared, checked ${currentIdsList.length} current findings against archive`);
|
||||
// Count returned findings for anomaly summary
|
||||
let returnedCount = 0;
|
||||
if (currentIdsList.length > 0) {
|
||||
try {
|
||||
// Count how many ARCHIVED records transitioned to RETURNED in this cycle
|
||||
// (already handled above, just count them)
|
||||
const archivedForCount = await dbAll(db,
|
||||
`SELECT id, finding_id FROM ivanti_finding_archives WHERE current_state = 'RETURNED' AND last_transition_at >= datetime('now', '-1 minute')`
|
||||
);
|
||||
returnedCount = archivedForCount.length;
|
||||
} catch (err) {
|
||||
// Non-fatal — returnedCount stays 0
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`[Archive Detection] Processed ${disappearedIds.length} disappeared, ${returnedCount} returned, checked ${currentIdsList.length} current findings against archive`);
|
||||
|
||||
return { disappearedIds, returnedCount };
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -350,6 +367,54 @@ async function detectClosedFindings(db, closedFindingIds) {
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Closed-gone detection — find archive CLOSED findings that vanished from the
|
||||
// Ivanti closed API set. These are findings we previously confirmed as closed
|
||||
// but that no longer appear in the closed results (likely VRR rescore below
|
||||
// the severity threshold).
|
||||
// ---------------------------------------------------------------------------
|
||||
async function detectClosedGoneFindings(db, closedFindingIds) {
|
||||
if (!closedFindingIds) return;
|
||||
|
||||
const closedSet = new Set(closedFindingIds.map(String));
|
||||
|
||||
try {
|
||||
// Get all findings we previously marked as CLOSED in the archive
|
||||
const records = await dbAll(db,
|
||||
`SELECT id, finding_id, last_severity FROM ivanti_finding_archives WHERE current_state = 'CLOSED'`
|
||||
);
|
||||
|
||||
let goneCount = 0;
|
||||
for (const record of records) {
|
||||
// If this finding is still in the closed API set, it's fine
|
||||
if (closedSet.has(record.finding_id)) continue;
|
||||
|
||||
try {
|
||||
await dbRun(db,
|
||||
`UPDATE ivanti_finding_archives
|
||||
SET current_state = 'CLOSED_GONE', last_transition_at = datetime('now')
|
||||
WHERE id = ?`,
|
||||
[record.id]
|
||||
);
|
||||
await dbRun(db,
|
||||
`INSERT INTO ivanti_archive_transitions (archive_id, from_state, to_state, severity_at_transition, reason, transitioned_at)
|
||||
VALUES (?, 'CLOSED', 'CLOSED_GONE', ?, 'disappeared_from_closed_set', datetime('now'))`,
|
||||
[record.id, record.last_severity || 0]
|
||||
);
|
||||
goneCount++;
|
||||
} catch (err) {
|
||||
console.error(`[Archive Detection] Error marking finding ${record.finding_id} as CLOSED_GONE:`, err.message);
|
||||
}
|
||||
}
|
||||
|
||||
if (goneCount > 0) {
|
||||
console.warn(`[Archive Detection] ${goneCount} previously-closed findings disappeared from the Ivanti closed set (CLOSED → CLOSED_GONE)`);
|
||||
}
|
||||
} catch (err) {
|
||||
console.error('[Archive Detection] Error in closed-gone detection:', err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Extract only the fields we need from a raw finding object
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -461,14 +526,36 @@ async function syncClosedCount(db, openCount, apiKey, clientId, skipTls) {
|
||||
[openCount, closedCount]
|
||||
);
|
||||
|
||||
// Drift guard — if the new total (open+closed) drops by more than 50%
|
||||
// compared to the most recent history snapshot, skip writing to history.
|
||||
// This prevents partial API responses from corrupting the trend chart.
|
||||
const newTotal = openCount + closedCount;
|
||||
let skipHistory = false;
|
||||
try {
|
||||
const prev = await dbGet(db,
|
||||
`SELECT open_count, closed_count FROM ivanti_counts_history ORDER BY recorded_at DESC LIMIT 1`
|
||||
);
|
||||
if (prev) {
|
||||
const prevTotal = (prev.open_count || 0) + (prev.closed_count || 0);
|
||||
if (prevTotal > 0 && newTotal < prevTotal * 0.5) {
|
||||
console.warn(`[Ivanti Findings] Drift guard triggered — new total ${newTotal} is <50% of previous ${prevTotal}. Skipping history write.`);
|
||||
skipHistory = true;
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Drift guard check failed (non-fatal):', err.message);
|
||||
}
|
||||
|
||||
// Append a snapshot to history — every sync is stored; the history
|
||||
// endpoint aggregates to last-per-day at query time (Option B).
|
||||
await dbRun(db,
|
||||
`INSERT INTO ivanti_counts_history (open_count, closed_count) VALUES (?, ?)`,
|
||||
[openCount, closedCount]
|
||||
);
|
||||
if (!skipHistory) {
|
||||
await dbRun(db,
|
||||
`INSERT INTO ivanti_counts_history (open_count, closed_count) VALUES (?, ?)`,
|
||||
[openCount, closedCount]
|
||||
);
|
||||
}
|
||||
|
||||
console.log(`[Ivanti Findings] Counts updated — open: ${openCount}, closed: ${closedCount}`);
|
||||
console.log(`[Ivanti Findings] Counts updated — open: ${openCount}, closed: ${closedCount}${skipHistory ? ' (history write skipped — drift guard)' : ''}`);
|
||||
|
||||
// Detect closed findings in the archive — wrap in try/catch so errors don't break sync
|
||||
try {
|
||||
@@ -476,6 +563,13 @@ async function syncClosedCount(db, openCount, apiKey, clientId, skipTls) {
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Closed finding archive detection failed (non-fatal):', err.message);
|
||||
}
|
||||
|
||||
// Detect findings that vanished from the closed set — CLOSED → CLOSED_GONE
|
||||
try {
|
||||
await detectClosedGoneFindings(db, closedFindingIds);
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Closed-gone detection failed (non-fatal):', err.message);
|
||||
}
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Failed to fetch closed count:', err.message);
|
||||
// Still update open count so it stays in sync; leave closed_count as-is
|
||||
@@ -637,6 +731,29 @@ async function syncFindings(db) {
|
||||
console.error('[Ivanti Findings] Failed to read previous findings for archive detection:', err.message);
|
||||
}
|
||||
|
||||
// Per-finding BU comparison — detect BU changes across syncs (Task 5.1)
|
||||
try {
|
||||
const previousMap = new Map(previousFindings.map(f => [String(f.id), f]));
|
||||
for (const finding of allFindings) {
|
||||
try {
|
||||
const prev = previousMap.get(String(finding.id));
|
||||
if (prev && prev.buOwnership && finding.buOwnership && prev.buOwnership !== finding.buOwnership) {
|
||||
await dbRun(db,
|
||||
`INSERT INTO ivanti_finding_bu_history (finding_id, finding_title, host_name, previous_bu, new_bu, detected_at)
|
||||
VALUES (?, ?, ?, ?, ?, datetime('now'))`,
|
||||
[String(finding.id), finding.title || '', finding.hostName || '', prev.buOwnership, finding.buOwnership]
|
||||
);
|
||||
console.log(`[BU Tracking] Finding ${finding.id} BU changed: ${prev.buOwnership} → ${finding.buOwnership}`);
|
||||
}
|
||||
// First-time findings (no prev entry) — store BU without recording a change event
|
||||
} catch (err) {
|
||||
console.error(`[BU Tracking] Error recording BU change for finding ${finding.id}:`, err.message);
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
console.error('[BU Tracking] BU comparison failed (non-fatal):', err.message);
|
||||
}
|
||||
|
||||
await dbRun(db,
|
||||
`UPDATE ivanti_findings_cache SET total=?, findings_json=?, synced_at=datetime('now'), sync_status='success', error_message=NULL WHERE id=1`,
|
||||
[allFindings.length, JSON.stringify(allFindings)]
|
||||
@@ -646,14 +763,60 @@ async function syncFindings(db) {
|
||||
|
||||
// Archive detection — compare previous vs current to detect disappeared/returned findings
|
||||
// Only runs after a successful sync (skipped on error per requirement 1.5)
|
||||
let archiveResult = { disappearedIds: [], returnedCount: 0 };
|
||||
try {
|
||||
await detectArchiveChanges(db, previousFindings, allFindings);
|
||||
archiveResult = await detectArchiveChanges(db, previousFindings, allFindings) || { disappearedIds: [], returnedCount: 0 };
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Archive detection failed (non-fatal):', err.message);
|
||||
}
|
||||
|
||||
// Read previous counts BEFORE syncClosedCount updates them — needed for anomaly deltas
|
||||
let previousOpenCount = 0;
|
||||
let previousClosedCount = 0;
|
||||
try {
|
||||
const prevCounts = await dbGet(db,
|
||||
`SELECT open_count, closed_count FROM ivanti_counts_cache WHERE id = 1`
|
||||
);
|
||||
if (prevCounts) {
|
||||
previousOpenCount = prevCounts.open_count || 0;
|
||||
previousClosedCount = prevCounts.closed_count || 0;
|
||||
}
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Failed to read previous counts for anomaly summary (non-fatal):', err.message);
|
||||
}
|
||||
|
||||
await syncClosedCount(db, allFindings.length, apiKey, clientId, skipTls);
|
||||
await syncFPWorkflowCounts(db, allFindings, apiKey, clientId, skipTls);
|
||||
|
||||
// Post-sync: BU drift checker for newly archived findings
|
||||
let classificationBreakdown = { bu_reassignment: 0, severity_drift: 0, closed_on_platform: 0, decommissioned: 0 };
|
||||
try {
|
||||
classificationBreakdown = await runBUDriftChecker(db, archiveResult.disappearedIds, apiKey, clientId, skipTls);
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] BU drift checker failed (non-fatal):', err.message);
|
||||
}
|
||||
|
||||
// Post-sync: Compute and store anomaly summary
|
||||
try {
|
||||
const currentCounts = await dbGet(db,
|
||||
`SELECT open_count, closed_count FROM ivanti_counts_cache WHERE id = 1`
|
||||
);
|
||||
const currentOpenCount = currentCounts?.open_count || 0;
|
||||
const currentClosedCount = currentCounts?.closed_count || 0;
|
||||
const openCountDelta = currentOpenCount - previousOpenCount;
|
||||
const closedCountDelta = currentClosedCount - previousClosedCount;
|
||||
|
||||
await computeAnomalySummary(
|
||||
db,
|
||||
openCountDelta,
|
||||
closedCountDelta,
|
||||
archiveResult.disappearedIds.length,
|
||||
archiveResult.returnedCount,
|
||||
classificationBreakdown
|
||||
);
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] Anomaly summary failed (non-fatal):', err.message);
|
||||
}
|
||||
} catch (err) {
|
||||
const msg = err.message || 'Unknown error';
|
||||
console.error('[Ivanti Findings] Sync failed:', msg);
|
||||
@@ -771,6 +934,151 @@ async function readStateWithNotes(db) {
|
||||
return state;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// BU Drift Checker — post-sync classification of newly archived findings
|
||||
// ---------------------------------------------------------------------------
|
||||
const EXPECTED_BUS = new Set(['NTS-AEO-ACCESS-ENG', 'NTS-AEO-STEAM']);
|
||||
|
||||
async function runBUDriftChecker(db, newlyArchivedIds, apiKey, clientId, skipTls) {
|
||||
const summary = { bu_reassignment: 0, severity_drift: 0, closed_on_platform: 0, decommissioned: 0 };
|
||||
|
||||
if (!newlyArchivedIds || newlyArchivedIds.length === 0) return summary;
|
||||
|
||||
const urlPath = `/client/${encodeURIComponent(clientId)}/hostFinding/search`;
|
||||
const chunkSize = 50;
|
||||
|
||||
// Collect all API results across batches
|
||||
const foundMap = new Map();
|
||||
|
||||
for (let i = 0; i < newlyArchivedIds.length; i += chunkSize) {
|
||||
const chunk = newlyArchivedIds.slice(i, i + chunkSize);
|
||||
const idList = chunk.join(',');
|
||||
|
||||
try {
|
||||
const filters = [
|
||||
{
|
||||
field: 'id',
|
||||
exclusive: false,
|
||||
operator: 'IN',
|
||||
orWithPrevious: false,
|
||||
implicitFilters: [],
|
||||
value: idList,
|
||||
caseSensitive: false
|
||||
}
|
||||
];
|
||||
|
||||
let page = 0;
|
||||
let totalPages = 1;
|
||||
|
||||
do {
|
||||
const body = {
|
||||
filters,
|
||||
projection: 'internal',
|
||||
sort: [{ field: 'severity', direction: 'ASC' }],
|
||||
page,
|
||||
size: 100
|
||||
};
|
||||
|
||||
const result = await ivantiPost(urlPath, body, apiKey, skipTls);
|
||||
if (result.status !== 200) {
|
||||
console.error(`[BU Drift Checker] API returned status ${result.status} for batch starting at index ${i}`);
|
||||
break;
|
||||
}
|
||||
|
||||
const data = JSON.parse(result.body);
|
||||
totalPages = data.page?.totalPages || 1;
|
||||
const findings = data._embedded?.hostFindings || [];
|
||||
|
||||
for (const f of findings) {
|
||||
const bu = f.assetCustomAttributes?.['1550_host_1']?.[0] || 'UNKNOWN';
|
||||
const severity = typeof f.severity === 'number' ? f.severity : parseFloat(f.severity) || 0;
|
||||
const state = f.status || f.generic_state || '';
|
||||
foundMap.set(String(f.id), { bu, severity, state });
|
||||
}
|
||||
|
||||
page++;
|
||||
} while (page < totalPages);
|
||||
|
||||
console.log(`[BU Drift Checker] Batch ${Math.floor(i / chunkSize) + 1}: queried ${chunk.length} IDs, found ${foundMap.size} so far`);
|
||||
} catch (err) {
|
||||
console.error(`[BU Drift Checker] Error querying batch at index ${i}:`, err.message);
|
||||
// Skip failed batch, continue with remaining
|
||||
}
|
||||
}
|
||||
|
||||
// Classify each archived finding and update the archive transition reason
|
||||
for (const id of newlyArchivedIds) {
|
||||
const found = foundMap.get(id);
|
||||
let classification;
|
||||
let reason;
|
||||
|
||||
if (!found) {
|
||||
classification = 'decommissioned';
|
||||
reason = 'decommissioned';
|
||||
} else if (!EXPECTED_BUS.has(found.bu)) {
|
||||
classification = 'bu_reassignment';
|
||||
reason = `bu_reassignment:${found.bu}`;
|
||||
} else if (found.severity < 8.5) {
|
||||
classification = 'severity_drift';
|
||||
reason = `severity_drift:${found.severity}`;
|
||||
} else if (found.state === 'Closed') {
|
||||
classification = 'closed_on_platform';
|
||||
reason = 'closed_on_platform';
|
||||
} else {
|
||||
// BU matches, severity >= 8.5, not closed — unexpected, leave as default
|
||||
classification = 'decommissioned';
|
||||
reason = 'decommissioned';
|
||||
}
|
||||
|
||||
summary[classification] = (summary[classification] || 0) + 1;
|
||||
|
||||
// Update the most recent archive transition reason for this finding
|
||||
try {
|
||||
const archive = await dbGet(db,
|
||||
`SELECT id FROM ivanti_finding_archives WHERE finding_id = ?`,
|
||||
[id]
|
||||
);
|
||||
if (archive) {
|
||||
await dbRun(db,
|
||||
`UPDATE ivanti_archive_transitions SET reason = ?
|
||||
WHERE archive_id = ? AND id = (
|
||||
SELECT id FROM ivanti_archive_transitions
|
||||
WHERE archive_id = ? ORDER BY transitioned_at DESC LIMIT 1
|
||||
)`,
|
||||
[reason, archive.id, archive.id]
|
||||
);
|
||||
}
|
||||
} catch (err) {
|
||||
console.error(`[BU Drift Checker] Error updating transition reason for finding ${id}:`, err.message);
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`[BU Drift Checker] Classification complete:`, summary);
|
||||
return summary;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Anomaly Summary — compute and store post-sync anomaly report
|
||||
// ---------------------------------------------------------------------------
|
||||
async function computeAnomalySummary(db, openCountDelta, closedCountDelta, newlyArchivedCount, returnedCount, classificationBreakdown) {
|
||||
try {
|
||||
const isSignificant = newlyArchivedCount > 5 ? 1 : 0;
|
||||
const classificationJson = JSON.stringify(classificationBreakdown || {});
|
||||
|
||||
await dbRun(db,
|
||||
`INSERT INTO ivanti_sync_anomaly_log
|
||||
(sync_timestamp, open_count_delta, closed_count_delta, newly_archived_count, returned_count, classification_json, is_significant)
|
||||
VALUES (datetime('now'), ?, ?, ?, ?, ?, ?)`,
|
||||
[openCountDelta, closedCountDelta, newlyArchivedCount, returnedCount, classificationJson, isSignificant]
|
||||
);
|
||||
|
||||
console.log(`[Anomaly Summary] Sync anomaly logged — open_delta: ${openCountDelta}, closed_delta: ${closedCountDelta}, archived: ${newlyArchivedCount}, returned: ${returnedCount}, significant: ${!!isSignificant}`);
|
||||
console.log(`[Anomaly Summary] Classification:`, classificationBreakdown);
|
||||
} catch (err) {
|
||||
console.error('[Anomaly Summary] Failed to write anomaly summary (non-fatal):', err.message);
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Router
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -898,6 +1206,152 @@ function createIvantiFindingsRouter(db, requireAuth) {
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* GET /api/ivanti/findings/anomaly/latest
|
||||
*
|
||||
* Return the most recent anomaly summary row from ivanti_sync_anomaly_log.
|
||||
* The classification_json column is parsed into an object in the response.
|
||||
*
|
||||
* @returns {Object} 200 - { anomaly: Object|null }
|
||||
* @returns {Object} 500 - { error: string } on database error
|
||||
*/
|
||||
router.get('/anomaly/latest', async (req, res) => {
|
||||
try {
|
||||
const row = await dbGet(db,
|
||||
`SELECT id, sync_timestamp, open_count_delta, closed_count_delta,
|
||||
newly_archived_count, returned_count, classification_json, is_significant
|
||||
FROM ivanti_sync_anomaly_log
|
||||
ORDER BY sync_timestamp DESC LIMIT 1`
|
||||
);
|
||||
if (!row) return res.json({ anomaly: null });
|
||||
let classification = {};
|
||||
try { classification = JSON.parse(row.classification_json || '{}'); } catch (_) {}
|
||||
res.json({
|
||||
anomaly: {
|
||||
id: row.id,
|
||||
sync_timestamp: row.sync_timestamp,
|
||||
open_count_delta: row.open_count_delta,
|
||||
closed_count_delta: row.closed_count_delta,
|
||||
newly_archived_count: row.newly_archived_count,
|
||||
returned_count: row.returned_count,
|
||||
classification,
|
||||
is_significant: !!row.is_significant
|
||||
}
|
||||
});
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] GET /anomaly/latest error:', err.message);
|
||||
res.status(500).json({ error: 'Database error reading latest anomaly' });
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* GET /api/ivanti/findings/anomaly/history
|
||||
*
|
||||
* Return anomaly history. Accepts optional `from` and `to` query parameters
|
||||
* (ISO date strings) for date-range filtering (inclusive). If neither is
|
||||
* provided, returns the last 30 rows ordered by sync_timestamp descending.
|
||||
*
|
||||
* @query {string} [from] - Inclusive start date (ISO string)
|
||||
* @query {string} [to] - Inclusive end date (ISO string)
|
||||
*
|
||||
* @returns {Object} 200 - { history: Array<Object> }
|
||||
* @returns {Object} 500 - { error: string } on database error
|
||||
*/
|
||||
router.get('/anomaly/history', async (req, res) => {
|
||||
try {
|
||||
const { from, to } = req.query;
|
||||
let rows;
|
||||
|
||||
if (from && to) {
|
||||
rows = await dbAll(db,
|
||||
`SELECT sync_timestamp, open_count_delta, closed_count_delta,
|
||||
newly_archived_count, returned_count, classification_json, is_significant
|
||||
FROM ivanti_sync_anomaly_log
|
||||
WHERE sync_timestamp >= ? AND sync_timestamp <= ?
|
||||
ORDER BY sync_timestamp DESC`,
|
||||
[from, to]
|
||||
);
|
||||
} else {
|
||||
rows = await dbAll(db,
|
||||
`SELECT sync_timestamp, open_count_delta, closed_count_delta,
|
||||
newly_archived_count, returned_count, classification_json, is_significant
|
||||
FROM ivanti_sync_anomaly_log
|
||||
ORDER BY sync_timestamp DESC LIMIT 30`
|
||||
);
|
||||
}
|
||||
|
||||
const history = rows.map(row => {
|
||||
let classification = {};
|
||||
try { classification = JSON.parse(row.classification_json || '{}'); } catch (_) {}
|
||||
return {
|
||||
sync_timestamp: row.sync_timestamp,
|
||||
open_count_delta: row.open_count_delta,
|
||||
closed_count_delta: row.closed_count_delta,
|
||||
newly_archived_count: row.newly_archived_count,
|
||||
returned_count: row.returned_count,
|
||||
classification,
|
||||
is_significant: !!row.is_significant
|
||||
};
|
||||
});
|
||||
|
||||
res.json({ history });
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] GET /anomaly/history error:', err.message);
|
||||
res.status(500).json({ error: 'Database error reading anomaly history' });
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* GET /api/ivanti/findings/bu-changes
|
||||
*
|
||||
* Return all BU change events from ivanti_finding_bu_history,
|
||||
* ordered by detected_at descending (newest first).
|
||||
*
|
||||
* @returns {Object} 200 - { changes: Array<Object> }
|
||||
* @returns {Object} 500 - { error: string } on database error
|
||||
*/
|
||||
router.get('/bu-changes', async (req, res) => {
|
||||
try {
|
||||
const rows = await dbAll(db,
|
||||
`SELECT id, finding_id, finding_title, host_name, previous_bu, new_bu, detected_at
|
||||
FROM ivanti_finding_bu_history
|
||||
ORDER BY detected_at DESC`
|
||||
);
|
||||
res.json({ changes: rows });
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] GET /bu-changes error:', err.message);
|
||||
res.status(500).json({ error: 'Database error reading BU changes' });
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* GET /api/ivanti/findings/:findingId/bu-history
|
||||
*
|
||||
* Return BU change history for a specific finding from ivanti_finding_bu_history,
|
||||
* ordered by detected_at descending (newest first).
|
||||
*
|
||||
* @param {string} findingId - The finding identifier (URL param)
|
||||
*
|
||||
* @returns {Object} 200 - { finding_id: string, history: Array<Object> }
|
||||
* @returns {Object} 500 - { error: string } on database error
|
||||
*/
|
||||
router.get('/:findingId/bu-history', async (req, res) => {
|
||||
try {
|
||||
const { findingId } = req.params;
|
||||
const rows = await dbAll(db,
|
||||
`SELECT previous_bu, new_bu, detected_at
|
||||
FROM ivanti_finding_bu_history
|
||||
WHERE finding_id = ?
|
||||
ORDER BY detected_at DESC`,
|
||||
[findingId]
|
||||
);
|
||||
res.json({ finding_id: findingId, history: rows });
|
||||
} catch (err) {
|
||||
console.error('[Ivanti Findings] GET /:findingId/bu-history error:', err.message);
|
||||
res.status(500).json({ error: 'Database error reading finding BU history' });
|
||||
}
|
||||
});
|
||||
|
||||
/**
|
||||
* PUT /api/ivanti/findings/:findingId/override
|
||||
*
|
||||
@@ -982,3 +1436,6 @@ module.exports = createIvantiFindingsRouter;
|
||||
module.exports.detectArchiveChanges = detectArchiveChanges;
|
||||
module.exports.detectClosedFindings = detectClosedFindings;
|
||||
module.exports.initArchiveTables = initArchiveTables;
|
||||
module.exports.runBUDriftChecker = runBUDriftChecker;
|
||||
module.exports.computeAnomalySummary = computeAnomalySummary;
|
||||
module.exports.extractFinding = extractFinding;
|
||||
|
||||
270
backend/scripts/bu-reassignment-check.js
Normal file
270
backend/scripts/bu-reassignment-check.js
Normal file
@@ -0,0 +1,270 @@
|
||||
#!/usr/bin/env node
|
||||
// bu-reassignment-check.js — Check if disappeared findings were reassigned to a different BU
|
||||
//
|
||||
// Queries Ivanti for the specific finding IDs that are completely gone from our
|
||||
// BU-filtered results, using NO filters at all (just the finding IDs).
|
||||
// If they come back with a different BU, that confirms BU reassignment.
|
||||
//
|
||||
// Usage: node backend/scripts/bu-reassignment-check.js
|
||||
|
||||
require('dotenv').config({ path: require('path').join(__dirname, '..', '.env') });
|
||||
|
||||
const path = require('path');
|
||||
const sqlite3 = require('sqlite3').verbose();
|
||||
const { ivantiPost } = require('../helpers/ivantiApi');
|
||||
|
||||
const DB_PATH = path.join(__dirname, '..', 'cve_database.db');
|
||||
|
||||
function dbAll(db, sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.all(sql, params, (err, rows) => {
|
||||
if (err) reject(err);
|
||||
else resolve(rows || []);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
async function queryByFindingIds(findingIds, apiKey, clientId, skipTls) {
|
||||
const urlPath = `/client/${encodeURIComponent(clientId)}/hostFinding/search`;
|
||||
const allResults = [];
|
||||
|
||||
// Ivanti's IN filter can handle batches — but let's chunk to be safe
|
||||
const chunkSize = 50;
|
||||
for (let i = 0; i < findingIds.length; i += chunkSize) {
|
||||
const chunk = findingIds.slice(i, i + chunkSize);
|
||||
const idList = chunk.join(',');
|
||||
|
||||
// Query with ONLY the finding ID filter — no BU, no severity, no state
|
||||
const filters = [
|
||||
{
|
||||
field: 'id',
|
||||
exclusive: false,
|
||||
operator: 'IN',
|
||||
orWithPrevious: false,
|
||||
implicitFilters: [],
|
||||
value: idList,
|
||||
caseSensitive: false
|
||||
}
|
||||
];
|
||||
|
||||
let page = 0;
|
||||
let totalPages = 1;
|
||||
|
||||
do {
|
||||
const body = {
|
||||
filters,
|
||||
projection: 'internal',
|
||||
sort: [{ field: 'severity', direction: 'ASC' }],
|
||||
page,
|
||||
size: 100
|
||||
};
|
||||
|
||||
try {
|
||||
const result = await ivantiPost(urlPath, body, apiKey, skipTls);
|
||||
if (result.status !== 200) {
|
||||
console.error(` API returned status ${result.status} for chunk starting at ${i}`);
|
||||
break;
|
||||
}
|
||||
|
||||
const data = JSON.parse(result.body);
|
||||
totalPages = data.page?.totalPages || 1;
|
||||
const findings = data._embedded?.hostFindings || [];
|
||||
|
||||
for (const f of findings) {
|
||||
const bu = f.assetCustomAttributes?.['1550_host_1']?.[0] || 'UNKNOWN';
|
||||
allResults.push({
|
||||
id: String(f.id),
|
||||
severity: typeof f.severity === 'number' ? f.severity : parseFloat(f.severity) || 0,
|
||||
title: f.title || '',
|
||||
hostName: f.host?.hostName || '',
|
||||
ipAddress: f.host?.ipAddress || '',
|
||||
state: f.status || f.generic_state || '',
|
||||
bu,
|
||||
// Check for FP workflow
|
||||
fpWorkflow: extractFP(f)
|
||||
});
|
||||
}
|
||||
|
||||
console.error(` Chunk ${Math.floor(i/chunkSize)+1}: page ${page+1}/${totalPages}, ${findings.length} results`);
|
||||
page++;
|
||||
} catch (err) {
|
||||
console.error(` Error querying chunk at ${i}:`, err.message);
|
||||
break;
|
||||
}
|
||||
} while (page < totalPages);
|
||||
}
|
||||
|
||||
return allResults;
|
||||
}
|
||||
|
||||
function extractFP(f) {
|
||||
const wfDist = f.workflowDistribution || {};
|
||||
const fpBuckets = [
|
||||
...(wfDist.approvedWorkflows || []),
|
||||
...(wfDist.actionableWorkflows || []),
|
||||
...(wfDist.requestedWorkflows || []),
|
||||
...(wfDist.reworkedWorkflows || []),
|
||||
...(wfDist.rejectedWorkflows || []),
|
||||
...(wfDist.expiredWorkflows || []),
|
||||
].filter(w => (w.generatedId || '').startsWith('FP#'));
|
||||
const entry = fpBuckets[0];
|
||||
if (!entry) return null;
|
||||
return { id: entry.generatedId, state: entry.state };
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const apiKey = process.env.IVANTI_API_KEY;
|
||||
const clientId = process.env.IVANTI_CLIENT_ID || '1550';
|
||||
const skipTls = process.env.IVANTI_SKIP_TLS === 'true';
|
||||
|
||||
if (!apiKey) {
|
||||
console.error('IVANTI_API_KEY not set');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
const db = new sqlite3.Database(DB_PATH);
|
||||
|
||||
// Get the 124 finding IDs that were completely gone from BU-filtered results
|
||||
const goneFindings = await dbAll(db,
|
||||
`SELECT finding_id, last_severity, finding_title, current_state
|
||||
FROM ivanti_finding_archives
|
||||
WHERE current_state IN ('ARCHIVED', 'CLOSED')`
|
||||
);
|
||||
|
||||
const goneIds = goneFindings.map(f => f.finding_id);
|
||||
console.error(`\n=== BU Reassignment Check ===`);
|
||||
console.error(`Querying Ivanti for ${goneIds.length} disappeared finding IDs (no BU/severity/state filter)...\n`);
|
||||
|
||||
const results = await queryByFindingIds(goneIds, apiKey, clientId, skipTls);
|
||||
|
||||
const foundMap = new Map(results.map(r => [r.id, r]));
|
||||
|
||||
// Categorize
|
||||
const reassigned = []; // Found with different BU
|
||||
const sameBU = []; // Found with same BU (STEAM or ACCESS-ENG)
|
||||
const notFound = []; // Still not found even without filters
|
||||
const withFP = []; // Has an FP workflow (any state)
|
||||
|
||||
for (const arch of goneFindings) {
|
||||
const found = foundMap.get(arch.finding_id);
|
||||
if (!found) {
|
||||
notFound.push(arch);
|
||||
} else if (found.bu !== 'NTS-AEO-ACCESS-ENG' && found.bu !== 'NTS-AEO-STEAM') {
|
||||
reassigned.push({ ...arch, currentBU: found.bu, currentSeverity: found.severity, currentState: found.state, fp: found.fpWorkflow });
|
||||
if (found.fpWorkflow) withFP.push({ ...arch, ...found });
|
||||
} else {
|
||||
sameBU.push({ ...arch, currentBU: found.bu, currentSeverity: found.severity, currentState: found.state, fp: found.fpWorkflow });
|
||||
if (found.fpWorkflow) withFP.push({ ...arch, ...found });
|
||||
}
|
||||
}
|
||||
|
||||
console.log('');
|
||||
console.log('='.repeat(130));
|
||||
console.log('BU REASSIGNMENT CHECK RESULTS');
|
||||
console.log('='.repeat(130));
|
||||
|
||||
console.log(`\nREASSIGNED TO DIFFERENT BU: ${reassigned.length} findings`);
|
||||
console.log('-'.repeat(130));
|
||||
if (reassigned.length > 0) {
|
||||
console.log(
|
||||
'Finding ID'.padEnd(14) +
|
||||
'Archive State'.padEnd(15) +
|
||||
'Last Sev'.padEnd(10) +
|
||||
'Current Sev'.padEnd(13) +
|
||||
'Current BU'.padEnd(30) +
|
||||
'FP Workflow'.padEnd(25) +
|
||||
'Title'
|
||||
);
|
||||
console.log('-'.repeat(130));
|
||||
for (const f of reassigned) {
|
||||
const fpStr = f.fp ? `${f.fp.id} (${f.fp.state})` : '-';
|
||||
console.log(
|
||||
f.finding_id.padEnd(14) +
|
||||
f.current_state.padEnd(15) +
|
||||
f.last_severity.toFixed(2).padEnd(10) +
|
||||
f.currentSeverity.toFixed(2).padEnd(13) +
|
||||
f.currentBU.padEnd(30) +
|
||||
fpStr.padEnd(25) +
|
||||
f.finding_title.substring(0, 40)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`\nSTILL SAME BU (but missing from filtered results): ${sameBU.length} findings`);
|
||||
console.log('-'.repeat(130));
|
||||
if (sameBU.length > 0) {
|
||||
console.log(
|
||||
'Finding ID'.padEnd(14) +
|
||||
'Archive State'.padEnd(15) +
|
||||
'Last Sev'.padEnd(10) +
|
||||
'Current Sev'.padEnd(13) +
|
||||
'Current BU'.padEnd(30) +
|
||||
'Current State'.padEnd(15) +
|
||||
'Title'
|
||||
);
|
||||
console.log('-'.repeat(130));
|
||||
for (const f of sameBU) {
|
||||
console.log(
|
||||
f.finding_id.padEnd(14) +
|
||||
f.current_state.padEnd(15) +
|
||||
f.last_severity.toFixed(2).padEnd(10) +
|
||||
f.currentSeverity.toFixed(2).padEnd(13) +
|
||||
f.currentBU.padEnd(30) +
|
||||
f.currentState.padEnd(15) +
|
||||
f.finding_title.substring(0, 40)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`\nCOMPLETELY GONE (not found even without any filters): ${notFound.length} findings`);
|
||||
if (notFound.length > 0 && notFound.length <= 20) {
|
||||
console.log('-'.repeat(130));
|
||||
for (const f of notFound) {
|
||||
console.log(` ${f.finding_id} ${f.last_severity.toFixed(2)} ${f.finding_title.substring(0, 60)}`);
|
||||
}
|
||||
}
|
||||
|
||||
if (withFP.length > 0) {
|
||||
console.log(`\nFINDINGS WITH FP WORKFLOWS: ${withFP.length}`);
|
||||
console.log('-'.repeat(130));
|
||||
for (const f of withFP) {
|
||||
const fpStr = f.fpWorkflow ? `${f.fpWorkflow.id} (${f.fpWorkflow.state})` : f.fp ? `${f.fp.id} (${f.fp.state})` : '-';
|
||||
console.log(` ${f.finding_id || f.id} ${fpStr} ${f.bu || f.currentBU} ${(f.finding_title || f.title || '').substring(0, 50)}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Summary
|
||||
console.log('');
|
||||
console.log('='.repeat(130));
|
||||
console.log('SUMMARY');
|
||||
console.log('='.repeat(130));
|
||||
console.log(` Total disappeared findings checked: ${goneFindings.length}`);
|
||||
console.log(` Reassigned to different BU: ${reassigned.length}`);
|
||||
console.log(` Still same BU (unexpected): ${sameBU.length}`);
|
||||
console.log(` Completely gone from platform: ${notFound.length}`);
|
||||
console.log(` Have FP workflows: ${withFP.length}`);
|
||||
|
||||
if (reassigned.length > 0) {
|
||||
const buCounts = {};
|
||||
reassigned.forEach(f => { buCounts[f.currentBU] = (buCounts[f.currentBU] || 0) + 1; });
|
||||
console.log('\n BU reassignment breakdown:');
|
||||
for (const [bu, cnt] of Object.entries(buCounts).sort((a, b) => b[1] - a[1])) {
|
||||
console.log(` ${bu}: ${cnt} findings`);
|
||||
}
|
||||
}
|
||||
|
||||
if (reassigned.length > goneFindings.length * 0.5) {
|
||||
console.log('\n VERDICT: BU REASSIGNMENT CONFIRMED.');
|
||||
} else if (notFound.length > goneFindings.length * 0.5) {
|
||||
console.log('\n VERDICT: Findings removed from platform entirely (decommission or data purge).');
|
||||
} else {
|
||||
console.log('\n VERDICT: Mixed causes — review individual categories above.');
|
||||
}
|
||||
|
||||
db.close();
|
||||
}
|
||||
|
||||
main().catch(err => {
|
||||
console.error('Fatal error:', err);
|
||||
process.exit(1);
|
||||
});
|
||||
275
backend/scripts/drift-check.js
Normal file
275
backend/scripts/drift-check.js
Normal file
@@ -0,0 +1,275 @@
|
||||
#!/usr/bin/env node
|
||||
// drift-check.js — One-time diagnostic to confirm host-level VRR score drift
|
||||
//
|
||||
// Queries Ivanti WITHOUT the severity filter for the same BUs, then cross-
|
||||
// references the results against our archived finding IDs to see if they
|
||||
// still exist at lower severity scores.
|
||||
//
|
||||
// Usage: node backend/scripts/drift-check.js
|
||||
//
|
||||
// Output: prints a comparison table and summary. Does NOT modify cve_database.db
|
||||
// permanently — uses a temporary in-memory table for the comparison.
|
||||
|
||||
require('dotenv').config({ path: require('path').join(__dirname, '..', '.env') });
|
||||
|
||||
const path = require('path');
|
||||
const sqlite3 = require('sqlite3').verbose();
|
||||
const { ivantiPost } = require('../helpers/ivantiApi');
|
||||
|
||||
const DB_PATH = path.join(__dirname, '..', 'cve_database.db');
|
||||
|
||||
// Same BU filter, NO severity filter, NO state filter — get everything
|
||||
const ALL_FINDINGS_FILTERS = [
|
||||
{
|
||||
field: 'assetCustomAttributes.1550_host_1.value',
|
||||
exclusive: false,
|
||||
operator: 'IN',
|
||||
orWithPrevious: false,
|
||||
implicitFilters: [],
|
||||
value: 'NTS-AEO-ACCESS-ENG,NTS-AEO-STEAM',
|
||||
caseSensitive: false
|
||||
}
|
||||
];
|
||||
|
||||
function dbAll(db, sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.all(sql, params, (err, rows) => {
|
||||
if (err) reject(err);
|
||||
else resolve(rows || []);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
function dbRun(db, sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.run(sql, params, function (err) {
|
||||
if (err) reject(err);
|
||||
else resolve(this);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
async function fetchAllFindings(apiKey, clientId, skipTls, state) {
|
||||
const urlPath = `/client/${encodeURIComponent(clientId)}/hostFinding/search`;
|
||||
const filters = [
|
||||
...ALL_FINDINGS_FILTERS,
|
||||
{
|
||||
field: 'generic_state',
|
||||
exclusive: false,
|
||||
operator: 'EXACT',
|
||||
orWithPrevious: false,
|
||||
implicitFilters: [],
|
||||
value: state,
|
||||
caseSensitive: false
|
||||
}
|
||||
];
|
||||
|
||||
let allFindings = [];
|
||||
let page = 0;
|
||||
let totalPages = 1;
|
||||
|
||||
do {
|
||||
const body = {
|
||||
filters,
|
||||
projection: 'internal',
|
||||
sort: [{ field: 'severity', direction: 'ASC' }],
|
||||
page,
|
||||
size: 100
|
||||
};
|
||||
|
||||
const result = await ivantiPost(urlPath, body, apiKey, skipTls);
|
||||
if (result.status !== 200) {
|
||||
console.error(` API returned status ${result.status} on page ${page}`);
|
||||
break;
|
||||
}
|
||||
|
||||
const data = JSON.parse(result.body);
|
||||
totalPages = data.page?.totalPages || 1;
|
||||
const findings = data._embedded?.hostFindings || [];
|
||||
|
||||
for (const f of findings) {
|
||||
allFindings.push({
|
||||
id: String(f.id),
|
||||
severity: typeof f.severity === 'number' ? f.severity : parseFloat(f.severity) || 0,
|
||||
title: f.title || '',
|
||||
hostName: f.host?.hostName || '',
|
||||
state
|
||||
});
|
||||
}
|
||||
|
||||
console.error(` ${state} page ${page + 1}/${totalPages} — ${allFindings.length} findings so far`);
|
||||
page++;
|
||||
} while (page < totalPages);
|
||||
|
||||
return allFindings;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const apiKey = process.env.IVANTI_API_KEY;
|
||||
const clientId = process.env.IVANTI_CLIENT_ID || '1550';
|
||||
const skipTls = process.env.IVANTI_SKIP_TLS === 'true';
|
||||
|
||||
if (!apiKey) {
|
||||
console.error('IVANTI_API_KEY not set in backend/.env');
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
console.error('=== Drift Check: Querying Ivanti WITHOUT severity filter ===\n');
|
||||
|
||||
// Fetch all Open findings (no severity filter)
|
||||
console.error('Fetching ALL Open findings (no severity filter)...');
|
||||
const openFindings = await fetchAllFindings(apiKey, clientId, skipTls, 'Open');
|
||||
console.error(` Total Open (all severities): ${openFindings.length}\n`);
|
||||
|
||||
// Fetch all Closed findings (no severity filter)
|
||||
console.error('Fetching ALL Closed findings (no severity filter)...');
|
||||
const closedFindings = await fetchAllFindings(apiKey, clientId, skipTls, 'Closed');
|
||||
console.error(` Total Closed (all severities): ${closedFindings.length}\n`);
|
||||
|
||||
const allFindings = [...openFindings, ...closedFindings];
|
||||
const findingMap = new Map(allFindings.map(f => [f.id, f]));
|
||||
|
||||
console.error(`Total findings across both states: ${allFindings.length}\n`);
|
||||
|
||||
// Open the database and get archived finding IDs
|
||||
const db = new sqlite3.Database(DB_PATH);
|
||||
|
||||
const archived = await dbAll(db,
|
||||
`SELECT finding_id, last_severity, finding_title, host_name, current_state
|
||||
FROM ivanti_finding_archives
|
||||
WHERE current_state IN ('ARCHIVED', 'CLOSED')
|
||||
ORDER BY current_state, last_severity DESC`
|
||||
);
|
||||
|
||||
console.log('');
|
||||
console.log('='.repeat(120));
|
||||
console.log('DRIFT CHECK RESULTS');
|
||||
console.log('='.repeat(120));
|
||||
console.log('');
|
||||
|
||||
// Categorize results
|
||||
const drifted = []; // Found in API at lower severity (below 8.5)
|
||||
const stillHigh = []; // Found in API, severity still >= 8.5
|
||||
const gone = []; // Not found in API at all (any severity)
|
||||
const stateChanged = []; // Found but in different state
|
||||
|
||||
for (const arch of archived) {
|
||||
const current = findingMap.get(arch.finding_id);
|
||||
if (!current) {
|
||||
gone.push(arch);
|
||||
} else if (current.severity < 8.5) {
|
||||
drifted.push({ ...arch, currentSeverity: current.severity, currentState: current.state });
|
||||
} else {
|
||||
stillHigh.push({ ...arch, currentSeverity: current.severity, currentState: current.state });
|
||||
}
|
||||
}
|
||||
|
||||
// Print drifted findings
|
||||
console.log(`CONFIRMED SCORE DRIFT (now below 8.5): ${drifted.length} findings`);
|
||||
console.log('-'.repeat(120));
|
||||
if (drifted.length > 0) {
|
||||
console.log(
|
||||
'Finding ID'.padEnd(14) +
|
||||
'Archive State'.padEnd(15) +
|
||||
'Last Severity'.padEnd(15) +
|
||||
'Current Severity'.padEnd(18) +
|
||||
'Delta'.padEnd(10) +
|
||||
'Current State'.padEnd(15) +
|
||||
'Title'
|
||||
);
|
||||
console.log('-'.repeat(120));
|
||||
for (const f of drifted) {
|
||||
const delta = (f.currentSeverity - f.last_severity).toFixed(2);
|
||||
console.log(
|
||||
f.finding_id.padEnd(14) +
|
||||
f.current_state.padEnd(15) +
|
||||
f.last_severity.toFixed(2).padEnd(15) +
|
||||
f.currentSeverity.toFixed(2).padEnd(18) +
|
||||
delta.padEnd(10) +
|
||||
f.currentState.padEnd(15) +
|
||||
f.finding_title.substring(0, 50)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
console.log('');
|
||||
console.log(`STILL HIGH SEVERITY (>= 8.5, should be in filtered results): ${stillHigh.length} findings`);
|
||||
console.log('-'.repeat(120));
|
||||
if (stillHigh.length > 0) {
|
||||
console.log(
|
||||
'Finding ID'.padEnd(14) +
|
||||
'Archive State'.padEnd(15) +
|
||||
'Last Severity'.padEnd(15) +
|
||||
'Current Severity'.padEnd(18) +
|
||||
'Current State'.padEnd(15) +
|
||||
'Title'
|
||||
);
|
||||
console.log('-'.repeat(120));
|
||||
for (const f of stillHigh) {
|
||||
console.log(
|
||||
f.finding_id.padEnd(14) +
|
||||
f.current_state.padEnd(15) +
|
||||
f.last_severity.toFixed(2).padEnd(15) +
|
||||
f.currentSeverity.toFixed(2).padEnd(18) +
|
||||
f.currentState.padEnd(15) +
|
||||
f.finding_title.substring(0, 50)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
console.log('');
|
||||
console.log(`COMPLETELY GONE (not in API at any severity): ${gone.length} findings`);
|
||||
console.log('-'.repeat(120));
|
||||
if (gone.length > 0) {
|
||||
console.log(
|
||||
'Finding ID'.padEnd(14) +
|
||||
'Archive State'.padEnd(15) +
|
||||
'Last Severity'.padEnd(15) +
|
||||
'Title'
|
||||
);
|
||||
console.log('-'.repeat(120));
|
||||
for (const f of gone) {
|
||||
console.log(
|
||||
f.finding_id.padEnd(14) +
|
||||
f.current_state.padEnd(15) +
|
||||
f.last_severity.toFixed(2).padEnd(15) +
|
||||
f.finding_title.substring(0, 50)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Summary
|
||||
console.log('');
|
||||
console.log('='.repeat(120));
|
||||
console.log('SUMMARY');
|
||||
console.log('='.repeat(120));
|
||||
console.log(` Archived/Closed findings checked: ${archived.length}`);
|
||||
console.log(` Confirmed score drift (< 8.5): ${drifted.length}`);
|
||||
console.log(` Still high severity (>= 8.5): ${stillHigh.length}`);
|
||||
console.log(` Completely gone from API: ${gone.length}`);
|
||||
console.log('');
|
||||
|
||||
if (drifted.length > 0) {
|
||||
const avgDelta = drifted.reduce((sum, f) => sum + (f.currentSeverity - f.last_severity), 0) / drifted.length;
|
||||
const minNew = Math.min(...drifted.map(f => f.currentSeverity));
|
||||
const maxNew = Math.max(...drifted.map(f => f.currentSeverity));
|
||||
console.log(` Score drift range: ${minNew.toFixed(2)} – ${maxNew.toFixed(2)} (avg delta: ${avgDelta.toFixed(2)})`);
|
||||
}
|
||||
|
||||
if (drifted.length > archived.length * 0.5) {
|
||||
console.log('\n VERDICT: Host-level VRR score drift CONFIRMED.');
|
||||
console.log(' The majority of disappeared findings still exist in Ivanti but at lower severity scores.');
|
||||
} else if (drifted.length > 0) {
|
||||
console.log('\n VERDICT: Partial score drift detected. Some findings drifted, others may have been removed.');
|
||||
} else if (gone.length > archived.length * 0.5) {
|
||||
console.log('\n VERDICT: Score drift NOT confirmed. Most findings are completely gone from the API.');
|
||||
console.log(' This suggests BU reassignment, host decommission, or a platform-side data issue.');
|
||||
}
|
||||
|
||||
db.close();
|
||||
}
|
||||
|
||||
main().catch(err => {
|
||||
console.error('Fatal error:', err);
|
||||
process.exit(1);
|
||||
});
|
||||
197
backend/scripts/export-reassigned-findings.js
Normal file
197
backend/scripts/export-reassigned-findings.js
Normal file
@@ -0,0 +1,197 @@
|
||||
#!/usr/bin/env node
|
||||
// export-reassigned-findings.js — Generate an xlsx with findings reassigned to SDIT-CSD-ITLS-PIES
|
||||
//
|
||||
// Pulls data from the archive database and the BU reassignment check results.
|
||||
// Outputs to docs/reassigned-findings-2026-04-24.xlsx
|
||||
//
|
||||
// Usage: node backend/scripts/export-reassigned-findings.js
|
||||
|
||||
require('dotenv').config({ path: require('path').join(__dirname, '..', '.env') });
|
||||
|
||||
const path = require('path');
|
||||
const sqlite3 = require('sqlite3').verbose();
|
||||
const XLSX = require('xlsx');
|
||||
const { ivantiPost } = require('../helpers/ivantiApi');
|
||||
|
||||
const DB_PATH = path.join(__dirname, '..', 'cve_database.db');
|
||||
const OUTPUT_PATH = path.join(__dirname, '..', '..', 'docs', 'reassigned-findings-2026-04-24.xlsx');
|
||||
|
||||
function dbAll(db, sql, params = []) {
|
||||
return new Promise((resolve, reject) => {
|
||||
db.all(sql, params, (err, rows) => {
|
||||
if (err) reject(err);
|
||||
else resolve(rows || []);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
async function queryByFindingIds(findingIds, apiKey, clientId, skipTls) {
|
||||
const urlPath = `/client/${encodeURIComponent(clientId)}/hostFinding/search`;
|
||||
const results = new Map();
|
||||
const chunkSize = 50;
|
||||
|
||||
for (let i = 0; i < findingIds.length; i += chunkSize) {
|
||||
const chunk = findingIds.slice(i, i + chunkSize);
|
||||
const idList = chunk.join(',');
|
||||
const filters = [{
|
||||
field: 'id', exclusive: false, operator: 'IN',
|
||||
orWithPrevious: false, implicitFilters: [],
|
||||
value: idList, caseSensitive: false
|
||||
}];
|
||||
|
||||
let page = 0;
|
||||
let totalPages = 1;
|
||||
do {
|
||||
try {
|
||||
const body = { filters, projection: 'internal', sort: [{ field: 'severity', direction: 'ASC' }], page, size: 100 };
|
||||
const result = await ivantiPost(urlPath, body, apiKey, skipTls);
|
||||
if (result.status !== 200) break;
|
||||
const data = JSON.parse(result.body);
|
||||
totalPages = data.page?.totalPages || 1;
|
||||
const findings = data._embedded?.hostFindings || [];
|
||||
for (const f of findings) {
|
||||
const bu = f.assetCustomAttributes?.['1550_host_1']?.[0] || 'UNKNOWN';
|
||||
const wfDist = f.workflowDistribution || {};
|
||||
const fpBuckets = [
|
||||
...(wfDist.approvedWorkflows || []), ...(wfDist.actionableWorkflows || []),
|
||||
...(wfDist.requestedWorkflows || []), ...(wfDist.reworkedWorkflows || []),
|
||||
...(wfDist.rejectedWorkflows || []), ...(wfDist.expiredWorkflows || []),
|
||||
].filter(w => (w.generatedId || '').startsWith('FP#'));
|
||||
const fp = fpBuckets[0] || null;
|
||||
results.set(String(f.id), {
|
||||
bu,
|
||||
severity: typeof f.severity === 'number' ? f.severity : parseFloat(f.severity) || 0,
|
||||
state: f.status || '',
|
||||
fpId: fp ? fp.generatedId : '',
|
||||
fpState: fp ? fp.state : '',
|
||||
hostName: f.host?.hostName || '',
|
||||
ipAddress: f.host?.ipAddress || '',
|
||||
title: f.title || '',
|
||||
});
|
||||
}
|
||||
page++;
|
||||
} catch (err) {
|
||||
console.error(` Error on batch at ${i}:`, err.message);
|
||||
break;
|
||||
}
|
||||
} while (page < totalPages);
|
||||
}
|
||||
return results;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
const apiKey = process.env.IVANTI_API_KEY;
|
||||
const clientId = process.env.IVANTI_CLIENT_ID || '1550';
|
||||
const skipTls = process.env.IVANTI_SKIP_TLS === 'true';
|
||||
|
||||
const db = new sqlite3.Database(DB_PATH);
|
||||
|
||||
// Get all archived/closed findings from the archive
|
||||
const archived = await dbAll(db,
|
||||
`SELECT finding_id, last_severity, finding_title, host_name, ip_address, current_state,
|
||||
DATE(first_archived_at) as archived_date, DATE(last_transition_at) as last_transition_date
|
||||
FROM ivanti_finding_archives
|
||||
WHERE current_state IN ('ARCHIVED', 'CLOSED')
|
||||
ORDER BY current_state, last_severity DESC`
|
||||
);
|
||||
|
||||
const ids = archived.map(a => a.finding_id);
|
||||
console.log(`Querying Ivanti for ${ids.length} findings...`);
|
||||
const currentData = await queryByFindingIds(ids, apiKey, clientId, skipTls);
|
||||
|
||||
// Build rows for each sheet
|
||||
const reassignedRows = [];
|
||||
const goneRows = [];
|
||||
const sameBuRows = [];
|
||||
|
||||
for (const arch of archived) {
|
||||
const current = currentData.get(arch.finding_id);
|
||||
|
||||
if (!current) {
|
||||
goneRows.push({
|
||||
'Finding ID': arch.finding_id,
|
||||
'Title': arch.finding_title,
|
||||
'Last Severity': arch.last_severity,
|
||||
'Host': arch.host_name,
|
||||
'IP Address': arch.ip_address,
|
||||
'Archive State': arch.current_state,
|
||||
'Archived Date': arch.archived_date,
|
||||
'Status': 'Gone from platform',
|
||||
});
|
||||
} else if (current.bu !== 'NTS-AEO-ACCESS-ENG' && current.bu !== 'NTS-AEO-STEAM') {
|
||||
reassignedRows.push({
|
||||
'Finding ID': arch.finding_id,
|
||||
'Title': current.title || arch.finding_title,
|
||||
'Last Severity (STEAM)': arch.last_severity,
|
||||
'Current Severity': current.severity,
|
||||
'Host': current.hostName || arch.host_name,
|
||||
'IP Address': current.ipAddress || arch.ip_address,
|
||||
'Previous BU': 'NTS-AEO-STEAM / ACCESS-ENG',
|
||||
'Current BU': current.bu,
|
||||
'Current State': current.state,
|
||||
'FP Workflow': current.fpId ? `${current.fpId} (${current.fpState})` : '',
|
||||
'Archive State': arch.current_state,
|
||||
'Archived Date': arch.archived_date,
|
||||
});
|
||||
} else {
|
||||
sameBuRows.push({
|
||||
'Finding ID': arch.finding_id,
|
||||
'Title': current.title || arch.finding_title,
|
||||
'Severity': current.severity,
|
||||
'Host': current.hostName || arch.host_name,
|
||||
'IP Address': current.ipAddress || arch.ip_address,
|
||||
'BU': current.bu,
|
||||
'Current State': current.state,
|
||||
'FP Workflow': current.fpId ? `${current.fpId} (${current.fpState})` : '',
|
||||
'Archive State': arch.current_state,
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// Create workbook
|
||||
const wb = XLSX.utils.book_new();
|
||||
|
||||
// Sheet 1: Reassigned findings
|
||||
const ws1 = XLSX.utils.json_to_sheet(reassignedRows);
|
||||
// Set column widths
|
||||
ws1['!cols'] = [
|
||||
{ wch: 14 }, { wch: 55 }, { wch: 18 }, { wch: 16 },
|
||||
{ wch: 30 }, { wch: 16 }, { wch: 28 }, { wch: 24 },
|
||||
{ wch: 14 }, { wch: 24 }, { wch: 14 }, { wch: 14 },
|
||||
];
|
||||
XLSX.utils.book_append_sheet(wb, ws1, 'Reassigned to SDIT-PIES');
|
||||
|
||||
// Sheet 2: Gone from platform
|
||||
if (goneRows.length > 0) {
|
||||
const ws2 = XLSX.utils.json_to_sheet(goneRows);
|
||||
ws2['!cols'] = [
|
||||
{ wch: 14 }, { wch: 55 }, { wch: 14 }, { wch: 30 },
|
||||
{ wch: 16 }, { wch: 14 }, { wch: 14 }, { wch: 20 },
|
||||
];
|
||||
XLSX.utils.book_append_sheet(wb, ws2, 'Gone from Platform');
|
||||
}
|
||||
|
||||
// Sheet 3: Still same BU
|
||||
if (sameBuRows.length > 0) {
|
||||
const ws3 = XLSX.utils.json_to_sheet(sameBuRows);
|
||||
ws3['!cols'] = [
|
||||
{ wch: 14 }, { wch: 55 }, { wch: 10 }, { wch: 30 },
|
||||
{ wch: 16 }, { wch: 24 }, { wch: 14 }, { wch: 24 }, { wch: 14 },
|
||||
];
|
||||
XLSX.utils.book_append_sheet(wb, ws3, 'Still Same BU');
|
||||
}
|
||||
|
||||
// Write file
|
||||
XLSX.writeFile(wb, OUTPUT_PATH);
|
||||
console.log(`\nExported to: ${OUTPUT_PATH}`);
|
||||
console.log(` Reassigned: ${reassignedRows.length}`);
|
||||
console.log(` Gone: ${goneRows.length}`);
|
||||
console.log(` Same BU: ${sameBuRows.length}`);
|
||||
|
||||
db.close();
|
||||
}
|
||||
|
||||
main().catch(err => {
|
||||
console.error('Fatal error:', err);
|
||||
process.exit(1);
|
||||
});
|
||||
Reference in New Issue
Block a user