adbis-live-client

Plug-and-play website security SDK and embeddable live defense widget for ADBIS.

This package is designed for real backend connectivity, not a frontend-only mock. It sends telemetry to your control-plane, polls real alerts, runs attack-lab scenarios, and renders live pipeline evidence.

New in v0.4.0:

• Risk-based 2FA challenge APIs (create, status, verify)
• Cookie-based session fingerprinting and browser DNA enrichment
• Behavioral velocity and anomaly scoring signals in auto-captured telemetry
• Breach-specific event stream (breach event) for real-time data breach escalation

Install

npm i adbis-live-client

For local workspace testing:

npm install ./packages/adbis-live-client

Website Integration (SDK)

import { ADBISClient } from "adbis-live-client";

const adbis = new ADBISClient({
  baseUrl: "https://your-adbis-control-plane.example.com",
  authToken: "YOUR_OPERATOR_TOKEN", // required in production for /alerts polling
  entityId: "[email protected]",
  source: "my-personal-site",
  autoCapture: true,
  autoAcquireToken: true, // dev/test helper for /demo/admin/token
});

adbis.on("threat", (event) => {
  console.log(`[${event.severity}] ${event.alert_id} risk=${event.risk_score}`);
  if (event.risk_score > 80) {
    // Your custom escalation hook.
    console.warn("High risk event detected", event);
  }
});

adbis.on("breach", (event) => {
  console.error("REAL-TIME DATA BREACH SIGNAL", event);
});

adbis.on("error", (error) => {
  console.error("ADBIS client error", error);
});

await adbis.connect();

// Track custom app events (optional)
adbis.track({
  event_type: "admin_login",
  resource: "/admin/login",
  sensitivity: "high",
  access_count: 1,
  session_cookie_hash: "cookie-abc-123",
  browser_dna: "custom-browser-dna-hash",
  behavior_velocity: 4.1,
  behavior_anomaly_score: 0.78,
});

What autoCapture tracks by default

• UI clicks
• Form submits
• JavaScript runtime errors
• Unhandled promise rejections

These are shipped to /telemetry/batch on your ADBIS control-plane.

2FA challenge API from SDK

const challenge = await adbis.requestTwoFactorChallenge({
  entityId: "[email protected]",
  riskScore: 88,
  reason: "high_risk_login",
});

const verified = await adbis.verifyTwoFactorChallenge({
  challengeId: challenge.challenge_id,
  otpCode: "123456",
});

console.log(verified);

One-Call Website Widget (recommended)

import { installADBISProtection } from "adbis-live-client";

const { client, widget } = installADBISProtection({
  baseUrl: "https://your-adbis-control-plane.example.com",
  authToken: "YOUR_OPERATOR_TOKEN", // production
  entityId: "[email protected]",
  title: "ADBIS Defense Console",
  autoCapture: true,
  attackEntityId: "[email protected]",
  attackScenario: "lotl_powershell",
  mount: "body",
});

// Optional: custom application events
client.track({
  event_type: "checkout_attempt",
  resource: "/checkout",
  sensitivity: "medium",
});

Widget capabilities:

• Floating live defense console (works on any website)
• Real-time threat stream from /alerts
• Pipeline counters from correlation summaries
• One-click live feed test (/demo/realtime/run)
• One-click attack lab (/demo/attack/run)
• Connection health checks and defense logs

Direct Widget API

import { createShieldWidget } from "adbis-live-client";

const widget = createShieldWidget({
  baseUrl: "http://localhost:8000",
  autoStart: false,
  entityId: "[email protected]",
});

widget.mount("#adbis-root");
await widget.start();
await widget.runAttackDemo({ scenario: "credential_stuffing" });

SDK API Quick Reference

import {
  ADBISClient,
  ADBISShieldWidget,
  createClient,
  createShieldWidget,
  installADBISProtection,
  health,
  runRealtimeDemo,
  runAttackDemo,
  getCorrelationSummary,
} from "adbis-live-client";

CLI usage

adbis-live status
adbis-live run --source github_events --max-events 30 --watch
adbis-live attack --scenario lotl_powershell --entity-id user@site --max-events 10 --watch
adbis-live summary <correlation-id>

CLI Feature Map (frontend and website parity)

Health and pipeline demo:

adbis-live status
adbis-live run --source github_events --max-events 25 --watch
adbis-live attack --scenario data_exfiltration_burst --entity-id [email protected] --watch
adbis-live summary <correlation-id>
adbis-live replay <incident-id>

Manual ingest with cookie, DNA, and behavior inputs:

adbis-live telemetry \
  --event-type bulk_download \
  --resource finance/payroll_2026_master.xlsx \
  --sensitivity high \
  --access-count 2200 \
  --cookie-hash cookie-ops-001 \
  --browser-dna win11-chrome-en \
  --device-fingerprint workstation-22 \
  --behavior-velocity 5.2 \
  --behavior-score 0.86 \
  --failed-2fa 2 \
  --watch

Alerts and breach review:

adbis-live alerts --severity HIGH --limit 50 --token <JWT>
adbis-live alerts --severity CRITICAL --limit 50 --token <JWT>

Policy operations:

adbis-live policy-list --token <JWT>
adbis-live policy-create --name strict-prod --high-auto true --critical-auto true --exfil true --honeypot true --token <JWT>
adbis-live policy-update <policy-id> --high-auto true --critical-auto true --exfil true --honeypot true --token <JWT>

Honeypot operations:

adbis-live honeypot-list --token <JWT>
adbis-live honeypot-create --resource finance/decoy_payroll_2026.csv --trigger salary --token <JWT>
adbis-live honeypot-engagements <lure-id> --token <JWT>

Data export and import:

adbis-live export --entity alerts --limit 100 --token <JWT>
adbis-live import-validate --entity alerts --records-json '[{"alert_id":"x","entity_id":"u","risk_score":82,"severity":"HIGH","model_scores":{},"deviations":{}}]' --token <JWT>
adbis-live import-run --entity alerts --records-json '[{"alert_id":"x","entity_id":"u","risk_score":82,"severity":"HIGH","model_scores":{},"deviations":{}}]' --token <JWT>
adbis-live import-status <migration-id> --token <JWT>

2FA challenge lifecycle:

adbis-live mfa-challenge --entity-id [email protected] --risk-score 90 --cookie-hash cookie-ops-001 --browser-dna win11-chrome-en --device-fingerprint workstation-22 --token <JWT>
adbis-live mfa-status <challenge-id> --token <JWT>
adbis-live mfa-verify --challenge-id <challenge-id> --otp 123456 --cookie-hash cookie-ops-001 --browser-dna win11-chrome-en --device-fingerprint workstation-22

Backend Prerequisites

• Control-plane must be reachable by your website.
• Required endpoints:
  • POST /telemetry/batch
  • GET /alerts (requires auth in production)
  • GET /health
• Optional demo endpoints for showcase:
  • POST /demo/realtime/run
  • POST /demo/attack/run
  • GET /demo/correlation/{correlation_id}
• Configure CORS on your control-plane for your website domain.

Production Notes

• Do not rely on auto token acquisition in production.
• Always provide a real JWT or API token for alert polling.
• Keep autoCapture enabled to feed behavior signals continuously.
• Use your own escalation hooks on high-risk threats (threat event listener).
• Treat detection as high-confidence real-time detection, not a guarantee of all possible breach patterns.

Publish to npm

cd packages/adbis-live-client
npm version patch
npm publish --access public

Build npm tarball

cd packages/adbis-live-client
npm pack