1. セキュリティイベント監視

class SecurityEventMonitor {
  constructor() {
    this.rules = new Map();
    this.correlationEngine = new CorrelationEngine();
    this.threatIntelligence = new ThreatIntelligence();
    this.incidents = new Map();
  }
  
  async processSecurityEvent(event) {
    // イベント正規化
    const normalizedEvent = this.normalizeEvent(event);
    
    // 脅威インテリジェンス照合
    const threatMatch = await this.threatIntelligence.match(normalizedEvent);
    if (threatMatch) {
      normalizedEvent.threatLevel = threatMatch.severity;
      normalizedEvent.indicators = threatMatch.indicators;
    }
    
    // ルールベース検知
    const ruleMatches = this.checkRules(normalizedEvent);
    
    // 相関分析
    const correlationResult = await this.correlationEngine.analyze(normalizedEvent);
    
    // インシデント生成判定
    if (this.shouldCreateIncident(ruleMatches, correlationResult)) {
      const incident = await this.createIncident(normalizedEvent, correlationResult);
      await this.notifyIncident(incident);
    }
    
    // WebSocket配信
    this.broadcastSecurityEvent(normalizedEvent);
  }
  
  checkRules(event) {
    const matches = [];
    
    for (const [ruleId, rule] of this.rules) {
      if (this.evaluateRule(rule, event)) {
        matches.push({
          ruleId,
          severity: rule.severity,
          description: rule.description,
          mitre: rule.mitreAttack
        });
      }
    }
    
    return matches;
  }
  
  async createIncident(event, correlation) {
    const incident = {
      id: this.generateIncidentId(),
      severity: this.calculateSeverity(event, correlation),
      title: this.generateTitle(event),
      description: this.generateDescription(event, correlation),
      timeline: [event],
      status: 'open',
      assignee: null,
      createdAt: new Date(),
      artifacts: this.extractArtifacts(event)
    };
    
    this.incidents.set(incident.id, incident);
    
    // 自動対応の実行
    await this.executePlaybook(incident);
    
    return incident;
  }
  
  broadcastSecurityEvent(event) {
    // セキュリティダッシュボードに配信
    this.websocket.broadcast('security_event', {
      type: 'security_event',
      event: event,
      timestamp: Date.now()
    });
    
    // 高優先度イベントは即座通知
    if (event.priority === 'high' || event.priority === 'critical') {
      this.websocket.broadcast('urgent_alert', {
        type: 'urgent_alert',
        message: `High priority security event: ${event.title}`,
        event: event
      });
    }
  }
}

2. 認証セッション監視

class AuthenticationMonitor {
  constructor() {
    this.sessions = new Map();
    this.riskEngine = new RiskEngine();
    this.geoLocation = new GeoLocationService();
    this.deviceFingerprinting = new DeviceFingerprinting();
  }
  
  async monitorAuthentication(authEvent) {
    // セッション情報更新
    const session = await this.updateSession(authEvent);
    
    // リスク評価
    const riskScore = await this.calculateRiskScore(authEvent, session);
    
    // 異常検知
    const anomalies = await this.detectAnomalies(authEvent, session);
    
    // WebSocket配信
    this.broadcastAuthEvent({
      type: 'authentication_event',
      user: authEvent.userId,
      action: authEvent.action,
      riskScore: riskScore,
      anomalies: anomalies,
      session: session.id
    });
    
    // 高リスクの場合は追加認証
    if (riskScore > 0.8) {
      await this.requestStepUpAuthentication(session);
    }
    
    // 異常検知の場合はセッション監視強化
    if (anomalies.length > 0) {
      await this.enhanceSessionMonitoring(session);
    }
  }
  
  async calculateRiskScore(authEvent, session) {
    const factors = [];
    
    // 地理的要因
    const geoRisk = await this.assessGeographicRisk(authEvent.ipAddress, session.user);
    factors.push({ type: 'geographic', score: geoRisk });
    
    // デバイス要因
    const deviceRisk = await this.assessDeviceRisk(authEvent.deviceFingerprint, session.user);
    factors.push({ type: 'device', score: deviceRisk });
    
    // 行動要因
    const behaviorRisk = await this.assessBehaviorRisk(authEvent, session.user);
    factors.push({ type: 'behavior', score: behaviorRisk });
    
    // 時間要因
    const temporalRisk = await this.assessTemporalRisk(authEvent.timestamp, session.user);
    factors.push({ type: 'temporal', score: temporalRisk });
    
    return this.riskEngine.calculateCompositeScore(factors);
  }
  
  async detectAnomalies(authEvent, session) {
    const anomalies = [];
    
    // 不可能移動検知
    const impossibleTravel = await this.detectImpossibleTravel(authEvent, session);
    if (impossibleTravel) {
      anomalies.push({
        type: 'impossible_travel',
        severity: 'high',
        details: impossibleTravel
      });
    }
    
    // 同時多地点ログイン
    const concurrentLogins = await this.detectConcurrentLogins(authEvent, session);
    if (concurrentLogins.length > 1) {
      anomalies.push({
        type: 'concurrent_logins',
        severity: 'medium',
        details: concurrentLogins
      });
    }
    
    // ブルートフォース攻撃
    const bruteForce = await this.detectBruteForce(authEvent);
    if (bruteForce) {
      anomalies.push({
        type: 'brute_force',
        severity: 'high',
        details: bruteForce
      });
    }
    
    return anomalies;
  }
}

3. 監査ログ処理システム

class AuditLogProcessor {
  constructor() {
    this.complianceRules = new Map();
    this.retentionPolicies = new Map();
    this.encryptionKeys = new EncryptionKeyManager();
  }
  
  async processAuditLog(logEntry) {
    // ログ正規化
    const normalizedLog = this.normalizeLog(logEntry);
    
    // デジタル署名
    const signedLog = await this.signLog(normalizedLog);
    
    // 暗号化
    const encryptedLog = await this.encryptLog(signedLog);
    
    // インデックス作成
    await this.indexLog(encryptedLog);
    
    // コンプライアンスチェック
    const complianceResults = await this.checkCompliance(normalizedLog);
    
    // WebSocket配信（重要なイベントのみ）
    if (this.shouldBroadcast(normalizedLog)) {
      this.broadcastAuditEvent(normalizedLog, complianceResults);
    }
    
    // 保持期間管理
    await this.applyRetentionPolicy(encryptedLog);
    
    return {
      logId: encryptedLog.id,
      complianceStatus: complianceResults,
      retentionDate: encryptedLog.retentionDate
    };
  }
  
  async checkCompliance(logEntry) {
    const results = [];
    
    for (const [ruleId, rule] of this.complianceRules) {
      const result = await this.evaluateComplianceRule(rule, logEntry);
      if (!result.compliant) {
        results.push({
          ruleId: ruleId,
          regulation: rule.regulation,
          violation: result.violation,
          severity: result.severity,
          remediation: result.remediation
        });
      }
    }
    
    return results;
  }
  
  broadcastAuditEvent(logEntry, complianceResults) {
    const event = {
      type: 'audit_event',
      category: logEntry.category,
      user: logEntry.user,
      action: logEntry.action,
      resource: logEntry.resource,
      timestamp: logEntry.timestamp,
      complianceStatus: complianceResults.length === 0 ? 'compliant' : 'violation',
      violations: complianceResults
    };
    
    // 違反があった場合は即座通知
    if (complianceResults.length > 0) {
      this.websocket.broadcast('compliance_violation', {
        type: 'compliance_violation',
        event: event,
        urgency: this.calculateUrgency(complianceResults)
      });
    }
    
    // 通常の監査イベント配信
    this.websocket.broadcast('audit_log', event);
  }
}

4. インシデント対応自動化

class IncidentResponseAutomation {
  constructor() {
    this.playbooks = new Map();
    this.workflows = new Map();
    this.approvals = new Map();
  }
  
  async executePlaybook(incident) {
    const playbook = this.selectPlaybook(incident);
    if (!playbook) return;
    
    const execution = {
      id: this.generateExecutionId(),
      incidentId: incident.id,
      playbookId: playbook.id,
      status: 'running',
      steps: [],
      startTime: new Date()
    };
    
    // WebSocket経由で実行開始通知
    this.broadcastExecution('started', execution);
    
    try {
      for (const step of playbook.steps) {
        const stepResult = await this.executeStep(step, incident, execution);
        execution.steps.push(stepResult);
        
        // ステップ完了通知
        this.broadcastExecution('step_completed', execution, stepResult);
        
        // 人間の承認が必要な場合
        if (step.requiresApproval) {
          await this.requestApproval(execution, step);
        }
      }
      
      execution.status = 'completed';
      execution.endTime = new Date();
      
    } catch (error) {
      execution.status = 'failed';
      execution.error = error.message;
      execution.endTime = new Date();
    }
    
    // 実行完了通知
    this.broadcastExecution('completed', execution);
    
    return execution;
  }
  
  async executeStep(step, incident, execution) {
    const stepResult = {
      stepId: step.id,
      name: step.name,
      startTime: new Date(),
      status: 'running'
    };
    
    try {
      switch (step.type) {
        case 'isolate_system':
          await this.isolateSystem(step.target);
          break;
          
        case 'block_ip':
          await this.blockIP(step.ipAddress);
          break;
          
        case 'collect_evidence':
          stepResult.evidence = await this.collectEvidence(step.targets);
          break;
          
        case 'notify_team':
          await this.notifyTeam(step.team, incident);
          break;
          
        case 'run_script':
          stepResult.output = await this.runScript(step.script, step.parameters);
          break;
      }
      
      stepResult.status = 'completed';
      stepResult.endTime = new Date();
      
    } catch (error) {
      stepResult.status = 'failed';
      stepResult.error = error.message;
      stepResult.endTime = new Date();
    }
    
    return stepResult;
  }
  
  broadcastExecution(event, execution, stepResult = null) {
    this.websocket.broadcast('playbook_execution', {
      type: 'playbook_execution',
      event: event,
      execution: {
        id: execution.id,
        incidentId: execution.incidentId,
        status: execution.status,
        currentStep: stepResult?.stepId,
        progress: this.calculateProgress(execution)
      },
      stepResult: stepResult
    });
  }
}

この包括的なセキュリティ・監査システムアーキテクチャにより、リアルタイムでの脅威検知と対応が可能になります。