Siem

[Polliog]

This pull request introduces major enhancements to the backend database schema, primarily focused on adding comprehensive Security Incident & Event Management (SIEM) capabilities, team invitation and role management, and Sigma rule enablement. It also updates package dependencies and configuration utilities. The most important changes are grouped below:

SIEM & Incident Management Infrastructure:

• Adds new tables for SIEM and incident management: detection_events (as a TimescaleDB hypertable for time-series analytics), incidents (main incident tracking), incident_alerts (linking incidents to alerts), incident_comments (collaboration), and incident_history (audit trail). Includes indexes, triggers for audit and timestamping, MITRE ATT&CK support, and enrichment fields for IP reputation and GeoIP. [1] [2] [3]
• Updates the database type definitions in types.ts to reflect the new SIEM-related tables and their fields, including enums for severity and status. [1] [2]

Team Invitation & Role Management:

• Adds an organization_invitations table for inviting team members via email with role assignment and token-based acceptance, plus supporting indexes and a cleanup function. Also adds a role index for organization_members and updates the type definition to use a strict role enum. [1] [2]
• Updates the organization_members and organization_invitations types to use explicit role enums ('owner' | 'admin' | 'member').

Sigma Rule Management:

• Adds an enabled boolean field to the sigma_rules table (and type definition) to allow enabling/disabling rules, with a supporting index for filtering. [1] [2]

Incident History User Context Fix:

• Alters the incident_history table to make the user_id column nullable, ensuring audit triggers work even when user context is unavailable.

Dependency and Utility Updates:

• Adds @maxmind/geoip2-node and maxmind packages for GeoIP enrichment. [1] [2]
• Adds isSmtpConfigured() utility function for checking SMTP configuration.

These changes lay the groundwork for advanced security analytics, incident response, and team management features in the backend.

refs: #5