Collectors

Overview

The CQ.Collectors namespace provides collectors for use in customizable CYBERQUEST scripts, including Data Transformation Service (DTS), alerts, and Data Source Manager scripts.

Available members

Usage

CyberQuestIPDataCollector

Helper class with the role of contacting getIpData api for obtaining data. Extends BaseCollector class.

For each event, the module will call a callback received, passing the event back.

Parameters

Usage

var callBackFunction = function (IP) {
    console.log("BlackListedIP", IP);
};
var parameters = {
    ipDataUrl: "https://example.com/api/getIPData"
};
var Collector = CQ.Collectors.CyberQuestIPDataCollector;
var collector = new Collector(parameters);
collector.execute(callBackFunction);

execute(callbackFunction) passes the parsed service response to the callback when the HTTP request succeeds. The method does not return the collected value.

ElasticSearchCollector

Connects to the Online DataStorage service. It can collect data from it and has the option of obtaining data in batch through the same call. Extends BaseCollector class.

On execution, it can receive a callback after each result. Treats the errors received.

Parameters

Usage

var callBackFunction = function (Event) {
    console.log(Event);
};
var parameters = {
    elasticSearchUrl: "http://192.168.0.1",
    elasticSearchQueryUrl: "logstash*/_search",
    elasticSearchPort: 9200,
    elasticSearchScrollTimeSpan: "1m",
    lastLocalTime: "lastLocalTime",
    searchRequest: {
        "size": 3,
        "sort": [
            { "@timestamp": { "order": "asc" } }
        ],
        "query": {
            "bool": {
                "must": {
                    "match_all": {}
                },
                "filter": [
                    {
                        "range": {
                            "@timestamp": {
                                "gt": lastLocalTime
                            }
                        }
                    }
                ]
            }
        }
    }
};
var collector = CQ.Collectors.ElasticSearchCollector;
collector.init(parameters);
collector.execute(callBackFunction);

init(parameters) stores the merged collector configuration and returns undefined. execute(callbackFunction) invokes the callback for every collected hit and returns undefined.

CloudTrailCollector

Reads the current CloudTrail file from the CYBERQUEST runtime and invokes the callback once for every item in its Records array.

This collector has no configuration parameters. Call execute(callbackFunction), where callbackFunction receives one CloudTrail record. The method returns null for invalid input or a file without a Records array; otherwise, it returns undefined.

Usage

var collector = new CQ.Collectors.CloudTrailCollector();

collector.execute(function (record) {
    console.log(record);
});

HttpServerCollector

Creates an HTTP or HTTPS server. Pass the parameters to the collector constructor, then call start().

Parameters

var HttpServerCollector = CQ.Collectors.HttpServerCollector;
var collector = new HttpServerCollector({
    hostname: "127.0.0.1",
    port: 8080,
    routes: [{
        path: "/events",
        method: "POST",
        handler: function (payload) {
            console.log(payload);
        }
    }]
});
collector.start();

start() starts the underlying server and returns undefined.

CloudGravityZone

Starts an HTTP(S) receiver and configures a Bitdefender GravityZone push-event subscription. Create the collector with optional defaults, then pass the server and subscription settings to execute(serverParams).

Collector parameters

execute(serverParams) parameters

serverParams accepts the HttpServerCollector parameters and the following subscription settings:

Supported keys in subscribeToEventTypes are modules, sva, registration, supa-update-status, av, aph, fw, avc, uc, dp, sva-load, task-status, exchange-malware, network-sandboxing, adcloud, exchange-user-credentials, endpoint-moved-out, endpoint-moved-in, troubleshooting-activity, uninstall, install, hwid-change, new-incident, antiexploit, network-monitor, ransomware-mitigation, and security-container-update-available.

execute(serverParams) starts the receiver and performs subscription setup when the required registration values are present. It does not return a collected event; receiver routes process incoming payloads through callbacks.

Usage

var collector = new CQ.Collectors.CloudGravityZone();

collector.execute({
    hostname: "0.0.0.0",
    port: 9001,
    register_hostname: "events.example.com",
    id: "gravityzone-api-client-id",
    authorization: "receiver-authorization-value",
    requireValidSslCertificate: true
});

When no routes are supplied, the collector adds a POST route at / that converts incoming GravityZone events into CYBERQUEST log records.

SamsungKnoxCollector

Collects Samsung Knox activity logs. Pass overrides to the constructor.

Parameters

Supply your own Knox credentials and RSA keys; do not expose them in scripts or documentation.

Call execute(callbackFunction). The callback receives each normalized Knox record. The method returns the number of records retrieved.

Usage

var collector = new CQ.Collectors.SamsungKnoxCollector({
    keys: {
        Private: "base64-encoded-private-key",
        Public: "base64-encoded-public-key",
        Identifier: "certificate-identifier"
    },
    clientInfo: {
        clientID: "knox-client-identifier"
    },
    request: {
        pageNum: 0,
        pageSize: 100,
        filter: {
            duration: 15
        }
    }
});

var recordCount = collector.execute(function (record) {
    console.log(record);
});
console.log("Collected records:", recordCount);

Office365Collector

Collects Microsoft 365 Management Activity API content.

Parameters

Call execute(callbackFunction). The callback receives each normalized event and an optional localTS value. The method returns an object containing count (the sum of callback return values) and lastLocalTime. It returns null when required credentials are absent and may return undefined if authentication fails.

Usage

var collector = new CQ.Collectors.Office365Collector({
    tenant_id: "microsoft-entra-tenant-id",
    client_id: "application-client-id",
    client_secret: "application-client-secret",
    logs: [
        "Audit.Exchange",
        "Audit.Sharepoint",
        "Audit.AzureActiveDirectory"
    ],
    lastLocalTime: "2026-07-27T00:00:00.000Z"
});

var result = collector.execute(function (event, localTS) {
    console.log(event, localTS);
    return 1;
});
console.log(result);

NucleonCollector

Provides Nucleon/CyberCure threat-intelligence endpoints. Pass overrides to the constructor.

Parameters

getActiveThreats(callbackFunction) invokes the callback for every returned threat and returns undefined. executeActiveThreats(body) accepts a form body object and returns the parsed response, or null when the request fails or cannot be parsed.

Usage

var collector = new CQ.Collectors.NucleonCollector();

collector.getActiveThreats(function (threat) {
    console.log(threat);
});

DekeneasOrangeRoCollector

Collects threat-intelligence data from the Dekeneas API. Pass overrides to the constructor.

Parameters

Call execute(callbackFunction). If the callback is omitted, the collector creates CYBERQUEST log records through its built-in callback. The method returns undefined.

Usage

var collector = new CQ.Collectors.DekeneasOrangeRoCollector({
    ipDataUrl: "https://example.com/api",
    content: {
        apikey: "dekeneas-api-key",
        fetch: "all",
        period: "1d"
    }
});

collector.execute(function (event) {
    console.log(event);
});