enrichments.ts

.ts

class EnrichmentBuilder {
  constructor(baseEvent) {
    this.baseEvent = baseEvent;
    this.enrichments = [];
  }

  addEnrichment({ name, value, type, data }) {
    const enrichment = { name, value };
    if (type) enrichment.type = type;
    if (data) enrichment.data = data;
    this.enrichments.push(enrichment);
    return this;
  }

  build() {
    return {
      ...this.baseEvent,
      enrichments: this.enrichments
    };
  }
}

module.exports = EnrichmentBuilder;


// CLIENT

const fetch = require('node-fetch');

class ApiClient {
  constructor(apiEndpoint, apiKey) {
    this.apiEndpoint = apiEndpoint;
    this.apiKey = apiKey;
  }

  async sendEnrichedEvent(enrichedEvent) {
    const response = await fetch(this.apiEndpoint, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        ...(this.apiKey && { 'Authorization': `Bearer ${this.apiKey}` })
      },
      body: JSON.stringify(enrichedEvent)
    });
    if (!response.ok) {
      throw new Error(`API error: ${response.statusText}`);
    }
    return response.json();
  }
}

module.exports = ApiClient;

// USAGE

const EnrichmentBuilder = require('./EnrichmentBuilder');
const ApiClient = require('./ApiClient');

const baseEvent = { event_id: 'abc123' };

const builder = new EnrichmentBuilder(baseEvent);
const enrichedEvent = builder
  .addEnrichment({
    name: 'ip_address',
    value: '192.0.2.1',
    type: 'geoip',
    data: { country: 'US', city: 'New York' }
  })
  .addEnrichment({
    name: 'file_hash',
    value: 'abcdef123456',
    type: 'threat_intel',
    data: { is_malicious: true }
  })
  .build();

const client = new ApiClient('https://api.example.com/ocsf/events', 'your-api-key-here');
client.sendEnrichedEvent(enrichedEvent)
  .then(result => console.log('Enriched event sent:', result))
  .catch(console.error);


//This structure keeps the builder and client responsibilities clearly separated, following best practices for the Builder pattern