Assessor_2.0/src/profiles/cis-cat/cis-cat-definition.ts

import type { ToolProfileDefinition } from '../../domain/tool-profile-definition';
import { commonSeverityMappings, commonStatusMappings } from '../common-normalization';
import { genericFieldRules } from '../generic/generic-field-rules';

export const cisCatDefinition: ToolProfileDefinition = {
  schemaVersion: 1,
  id: 'cis-cat',
  securityScoring: {
    version: '1.0.0',
    native: { kind: 'mapped', properties: ['benchmark.score'], scope: 'overall', scale: '0-100', direction: 'higher-is-better' },
    targets: ['host.name'], benchmark: ['benchmark.name'], resultPopulation: 'complete'
  },
  priorityBasis: {
    version: '1.0.0',
    basis: {
      kind: 'unavailable',
      reason: 'CIS benchmarks state no per-recommendation criticality. Findings stay unranked.'
    },
    excludedProperties: [
      {
        property: 'recommendation.level',
        reason: 'Level 1 / Level 2 is a hardening profile tier, not a criticality. Promoting it would manufacture severities the benchmark never stated.'
      },
      { property: 'recommendation.scored', reason: 'Marks score participation, not risk.' }
    ]
  },
  timeslotComparison: {
    version: '1.0.0', kind: 'available', granularity: 'scope',
    scope: { kind: 'cis-benchmark-target', properties: ['host.name', 'benchmark.name'] },
    observationTimeProperties: ['report.generated_at'],
    resultEvidence: 'explicit-results', negativeEvidence: 'unsupported',
    diagnosticPolicy: 'fail-closed-by-impact'
  },
  name: 'CIS-CAT Pro',
  // 1.4.0: Der Bericht liefert zusaetzlich Umgebungskontext (bewertetes System,
  // Benchmarkidentitaet, deklarierte Ergebniszahlen, Abschnittsscores). Findings,
  // Normalisierung und Bewertung bleiben unveraendert; ein erneuter Import
  // derselben Datei ist noetig, damit bestehende Scans diesen Kontext tragen.
  version: '1.4.0',
  processing: {
    mappingVersion: '1.3.0', normalizationVersion: '1.3.0', presentationVersion: '1.3.0',
    compatibilityKey: 'cis-cat-canonical-v1', changeClass: 'compatible',
    reimportRequired: true, affectedDimensions: ['environment-context']
  },
  sourceSignals: [
    { scope: 'file-name', pattern: /cis[\s_.-]*(?:cat|benchmark|microsoft|windows|linux|ubuntu|rhel|_)/i, contribution: 0.65, message: 'Der Dateiname enthält CIS/Benchmark.' },
    { scope: 'raw-text', pattern: /cis(?:-cat)?\s+(?:benchmark|controls?|microsoft|windows|linux|ubuntu|rhel|assessment)/i, contribution: 0.45, message: 'Der Bericht enthält einen CIS-Benchmark-Marker.' },
    { scope: 'raw-text', pattern: /center\s+for\s+internet\s+security/i, contribution: 0.40, message: 'Enthält „Center for Internet Security“.' },
    { scope: 'table-name', pattern: /^(?:assessment\s+results?|assessmentresulttable)$/i, contribution: 0.28, message: 'Eine Tabelle heißt „Assessment Results“.' },
    { scope: 'header', pattern: /^recommendation$/i, contribution: 0.13, message: 'Die Kopfzeile „Recommendation“ wurde gefunden.' },
    { scope: 'header', pattern: /^scored$/i, contribution: 0.09, message: 'Die Kopfzeile „Scored“ wurde gefunden.' },
    { scope: 'header', pattern: /^level$/i, contribution: 0.07, message: 'Die Kopfzeile „Level“ wurde gefunden.' }
  ],
  tableRules: {
    preferredNames: [
      { pattern: /^(?:assessment\s+results?|assessmentresulttable)$/i, contribution: 1, message: 'CIS-CAT Assessment Results.' },
      { pattern: /^result(?:s)?|recommendation(?:s)?|rules?|table\s*\d+|html/i, contribution: 0.8, message: 'CIS-CAT Ergebnis-Tabelle.' }
    ],
    discouragedNames: [{ pattern: /^summary$|^selected\s+profiles?$/i, contribution: 0.4, message: 'Zusammenfassung oder Profilauswahl.' }]
  },
  fieldRules: [
    ...genericFieldRules,
    {
      role: 'rule-id',
      headers: [{ pattern: /^rule\s*id$/i, contribution: 1, message: 'CIS-CAT-Regelkennung aus dem Benchmark Item.' }]
    },
    {
      role: 'title',
      headers: [{ pattern: /^benchmark\s*item$/i, contribution: 1, message: 'CIS-CAT Benchmark Item ist der Finding-Titel.' }]
    }
  ],
  normalization: { severity: commonSeverityMappings, status: commonStatusMappings },
  presentation: {
    // The report's own criterion and evaluated rows state expected and found values.
    firstRead: {
      criterionEvidence: true,
      impactHeaders: [/^impact$/i],
      nextStepHeaders: [/^remediation$/i],
      backgroundHeaders: [/^description$/i, /^rationale$/i],
      referenceHeaders: [/^references$/i]
    },
    titleHeaders: [/^benchmark\s*item$/i, /^title$/i],
    severityHeaders: [/^(?:severity|level)$/i],
    sortHeaders: [/^recommendation$/i],
    sortDirection: 'asc',
    // Standardansicht zeigt Abweichungen, nicht bestandene Pruefungen.
    defaultStatusFilter: 'failed',
    statusFilters: [
      { value: 'all', label: 'All Results', patterns: [] },
      { value: 'failed', label: 'Fail', patterns: [/^fail(?:ed)?$/i] },
      { value: 'passed', label: 'Pass', patterns: [/^pass(?:ed)?$/i] },
      { value: 'manual', label: 'Manual', patterns: [/^manual$/i] },
      { value: 'error', label: 'Error', patterns: [/^error$/i] }
    ],
    // Die Rahmenwerk-Zuordnungen hinter "More" gehoeren als Belegdaten neben
    // die ebenfalls versteckten Assessment-Evidence-Tabellen in das
    // Results-Fenster. Das Rule Result XML ausdruecklich nicht: es bleibt ein
    // standardmaessig geschlossenes Detail im Finding (siehe
    // `cisCatOptionalFields`), weil es nicht der Befund ist, sondern seine
    // maschinenlesbare Rohfassung.
    resultSectionHeaders: [/^control mappings$/i],
    showResultSheetTitles: true,
    resultSheetTitleRules: [
      { pattern: /^assessment evidence(?:\s*\u00c2?\u00b7.*)?$/i, replacement: 'Assessment' },
      { pattern: /^(.+?)\s*\u00c2?\u00b7\s*.*$/i, replacement: '$1' }
    ],
    resultSectionListSheetTitles: [/^control mappings$/i],
    resultSheetHighlightedRowPatterns: [/^no matching system items were found\.$/i],
    resultSheetCriterionRowPatterns: [/(?:^|\s)criterion\s*:/i],
    resultSheetEvaluatedRowTone: 'violation'
  },
  comparisonKeys: [['rule-id', 'asset'], ['rule-id']]
};