@netbobr/core

Firewall rule risk analysis engine. Analyzes network flows against 6 compliance frameworks (PCI-DSS, CIS Controls, NIST 800-53, NIS2, DORA, MITRE ATT&CK) and produces risk scores -- all stateless, zero dependencies.

Install

npm install @netbobr/core

Usage

import { analyze } from '@netbobr/core';

const result = analyze(
  { src: '10.0.0.1', dst: '0.0.0.0/0', proto: 'TCP', port: '22' },
  { /* optional config */ }
);

console.log(result.riskScore);    // { score: 73, label: 'High', factors: [...] }
console.log(result.overallRisk);  // 'HIGH'
console.log(result.pciFindings);  // [{ ruleId, severity, finding, ... }]

API

analyze(flow, config?)

flow { src, dst, proto, port, appName? } -- the firewall rule to analyze.

config (all optional):

• disabledRuleIds -- Set<string> of rule IDs to suppress
• zoneInfo -- zone matrix lookup result (pre-computed)
• zones -- raw zone config (zone-matrix JSON shape); analyze() will perform zone matching internally
• customRules -- array of custom rule objects
• weights -- { srcMax, dstMax, portMax, zoneMax } (must sum to 100)
• thresholds -- [{ max, label }, ...] array of 4 score thresholds
• zoneAttributes -- { src: {...}, dst: {...} } zone attribute objects

Returns: { ok, overallRisk, riskScore, pciFindings, cisFindings, nistFindings, nis2Findings, doraFindings, mitreFindings, customFindings, advice, breakdownRows, verdictOverride, ... }

License

MIT