https://mrprobe.ai/assets/ComplianceMappingPage-BbXqawIo.js

1import{cp as ee,u as re,a as te,aZ as oe,r as d,j as e,B as i,eQ as se,eR as F,T as o,K as W,ae as ne,af as ae,ag as ie,ah as le,J as ce,y as x,cs as de,e as H,A as q,by as me,bz as pe,d as y,bm as xe,bA as he,ci as fe,ac as ge,eS as ue,cg as be}from"./index-Ce7Evpuz.js";import{d as p,D as je,a as E}from"./DocsChrome-CrB-SCzm.js";import{b as ye,r as Se,g as ke,c as we,A as C,C as Ce}from"./ComplianceControlChip-CMAgpHFa.js";import{L as ve}from"./ListSubheader-CGZKO_2z.js";import{T as _e,a as v}from"./Tabs--ClSHzP7.js";import{S as ze}from"./Security-DwSXgxpK.js";import{M as Ae}from"./MenuBook-B_bUjijo.js";const Me="https://api.mrprobe.ai/api/v1";async function B(a){const c=await fetch(`${Me}${a}`);if(!c.ok){const f=await c.json().catch(()=>({})),b=typeof f?.detail=="string"?f.detail:c.statusText;throw new Error(b||`Request failed (${c.status})`)}return c.json()}function We(){return B("/compliance/catalog/frameworks")}function Ee(a){return B(`/compliance/catalog/mapping/${encodeURIComponent(a)}`)}const N=new Set(["owasp_llm","mitre_atlas"]);function Te(a){return N.has(a)?"attack_catalog":a==="nist_ai_rmf"?"standards":["healthcare","financial","enterprise","uae_tier3"].includes(a)?"combo":["eu_ai_act","uae_ai_act"].includes(a)?"ai_regulation":["hipaa","pci_dss","sox","gdpr"].includes(a)?"industry":"standards"}function Ie(){return ee.filter(a=>a.complianceFramework).map(a=>{const c=a.complianceFramework,f=N.has(c)?"attack_catalog":"control_equivalence";return{id:c,name:a.label,version:"",description:a.description,attack_categories:[...a.categories],mapping_kind:f,country_specific:!1,group:Te(c)}})}function Re(a){return ye(a)}const Pe={attack_catalog:"Attack catalogs (direct mapping)",standards:"Standards & risk frameworks",ai_regulation:"AI regulation (national / regional)",industry:"Industry regulation",combo:"Combined profiles",data_protection:"Data protection (by jurisdiction)"},G={CRITICAL:"#ef4444",HIGH:"#f97316",MEDIUM:"#eab308",LOW:"#64748b"},De={full:"#22c55e",strong:"#3b82f6",partial:"#eab308",out_of_scope:"#94a3b8"};function U(a){return G[a?.toUpperCase()]||G.MEDIUM}function $(a){return De[a]}function T(a){return be.find(c=>c.id===a)}function $e(){const a=re(),c=a.palette.mode==="dark",f=te(),[b,S]=oe(),g=c?"rgba(19,19,30,0.7)":"rgba(255,255,255,0.95)",u=c?"rgba(255,255,255,0.06)":"rgba(0,0,0,0.06)",[k,I]=d.useState([]),[R,w]=d.useState(null),[P,_]=d.useState(null),[K,D]=d.useState(!0),[z,O]=d.useState(!1),[h,A]=d.useState(0),[Q,M]=d.useState(!1),m=b.get("framework")||"";d.useEffect(()=>{let r=!1;return D(!0),We().then(t=>{if(!r&&(I(t.frameworks),!b.get("framework")&&t.frameworks.length>0)){const s=t.frameworks.find(n=>n.id==="gdpr")||t.frameworks[0];S({framework:s.id},{replace:!0})}}).catch(()=>{if(r)return;const t=Ie();if(I(t),M(!0),!b.get("framework")&&t.length>0){const s=t.find(n=>n.id==="gdpr")||t[0];S({framework:s.id},{replace:!0})}}).finally(()=>{r||D(!1)}),()=>{r=!0}},[]),d.useEffect(()=>{if(!m){w(null);return}let r=!1;return O(!0),_(null),Ee(m).then(t=>{r||(w(t),M(!1))}).catch(()=>{if(r)return;const t=Re(m);t?(w(t),M(!0),_(null)):(w(null),_("Could not load mapping for this framework."))}).finally(()=>{r||O(!1)}),()=>{r=!0}},[m]);const Y=d.useMemo(()=>{const r=new Map;for(const s of k){const n=r.get(s.group)||[];n.push(s),r.set(s.group,n)}return["attack_catalog","standards","ai_regulation","industry","combo","data_protection"].filter(s=>r.has(s)).map(s=>({group:s,label:Pe[s],items:r.get(s)}))},[k]),V=d.useCallback(r=>{S({framework:r}),A(0)},[S]),l=d.useMemo(()=>Se(R,m),[R,m]),j=d.useMemo(()=>ke(m),[m]),L=d.useMemo(()=>{if(!l)return[];const r=l.priority_order||[],t=new Map(r.map((s,n)=>[s,n]));return[...l.controls].sort((s,n)=>{const J=t.has(s.control_id)?t.get(s.control_id):999,Z=t.has(n.control_id)?t.get(n.control_id):999;return J-Z})},[l]),X=k.find(r=>r.id===m);return e.jsxs(i,{className:"marketing-fill",sx:{minHeight:"100vh",bgcolor:"#f6f5f2"},children:[e.jsx(se,{}),e.jsx(i,{sx:{pt:14,pb:6,textAlign:"left"},children:e.jsxs(F,{maxWidth:"lg",children:[e.jsx(o,{sx:{fontSize:"0.6875rem",fontWeight:800,letterSpacing:"0.18em",textTransform:"uppercase",color:p,mb:2},children:"Documentation"}),e.jsx(o,{component:"h1",sx:{fontSize:{xs:"2rem",sm:"2.75rem"},fontWeight:900,lineHeight:1.1,letterSpacing:"-0.04em",color:"text.primary",mb:2},children:"Compliance & attack mapping"}),e.jsx(o,{sx:{fontSize:"1.0625rem",color:"text.secondary",lineHeight:1.75,maxWidth:720}

1,children:"Choose a framework to see which regulatory articles or clauses MrProbe tests, which attack domains run, and real-world examples of what we probe."})]})}),e.jsx(F,{maxWidth:"lg",sx:{pb:12},children:e.jsxs(i,{sx:{display:"flex",gap:6},children:[e.jsx(i,{sx:{width:220,flexShrink:0,display:{xs:"none",lg:"block"}},children:e.jsxs(i,{sx:{position:"sticky",top:80},children:[e.jsx(je,{}),l&&e.jsx(o,{sx:{fontSize:"0.625rem",fontWeight:800,letterSpacing:"0.12em",textTransform:"uppercase",color:"text.disabled",mb:1.5,mt:2},children:"This framework"}),l&&e.jsx(i,{sx:{display:"flex",flexDirection:"column",gap:.5},children:["Overview","Articles & controls","Attack domains","Examples"].map((r,t)=>e.jsx(o,{component:"button",type:"button",onClick:()=>A(t),sx:{textAlign:"left",border:"none",background:"none",cursor:"pointer",fontSize:"0.75rem",fontWeight:h===t?700:500,color:h===t?p:"text.secondary",py:.5,pl:1.5,borderLeft:"2px solid",borderColor:h===t?p:"transparent"},children:r},r))})]})}),e.jsxs(i,{sx:{flex:1,minWidth:0},children:[Q&&e.jsx(W,{severity:"info",sx:{mb:3},children:"Catalog API unavailable — showing embedded article mapping from MrProbe compliance documentation. Deploy orchestration + gateway for live updates from the server registry."}),e.jsx(i,{sx:{mb:4,p:3,borderRadius:"16px",background:g,border:"1px solid",borderColor:u},children:e.jsxs(ne,{fullWidth:!0,size:"small",disabled:K||k.length===0,children:[e.jsx(ae,{id:"fw-select-label",children:"Compliance framework"}),e.jsx(ie,{labelId:"fw-select-label",label:"Compliance framework",value:m,onChange:r=>V(r.target.value),children:Y.map(({group:r,label:t,items:s})=>[e.jsx(ve,{sx:{fontWeight:800,fontSize:"0.6875rem",letterSpacing:"0.06em"},children:t},r),...s.map(n=>e.jsxs(le,{value:n.id,children:[n.name," ",n.version?`(${n.version})`:""]},n.id))])})]})}),z&&e.jsx(i,{sx:{display:"flex",justifyContent:"center",py:8},children:e.jsx(ce,{size:36,sx:{color:p}})}),P&&!z&&e.jsx(W,{severity:"warning",sx:{mb:3},children:P}),l&&!z&&e.jsxs(e.Fragment,{children:[e.jsx(i,{sx:{display:{xs:"block",lg:"none"},mb:2},children:e.jsxs(_e,{value:h,onChange:(r,t)=>A(t),variant:"scrollable",scrollButtons:"auto",children:[e.jsx(v,{label:"Overview"}),e.jsx(v,{label:"Articles"}),e.jsx(v,{label:"Domains"}),e.jsx(v,{label:"Examples"})]})}),h===0&&e.jsxs(i,{children:[e.jsxs(i,{sx:{p:3,borderRadius:"16px",background:g,border:"1px solid",borderColor:u,mb:3},children:[e.jsxs(i,{sx:{display:"flex",flexWrap:"wrap",gap:1,mb:2},children:[e.jsx(x,{size:"small",icon:e.jsx(de,{sx:{fontSize:14}}),label:l.mapping_kind_label,sx:{fontWeight:600}}),l.coverage_testable!=null&&e.jsx(x,{size:"small",label:`${l.coverage_testable}% runtime-testable`,variant:"outlined"}),e.jsx(x,{size:"small",label:`${l.attack_categories.length} attack domains`,variant:"outlined"}),e.jsx(x,{size:"small",label:`${l.controls.length} controls / articles`,variant:"outlined"})]}),e.jsxs(o,{sx:{fontSize:"1.375rem",fontWeight:800,color:"text.primary",mb:1},children:[l.name,l.version?e.jsx(o,{component:"span",sx:{fontSize:"0.875rem",fontWeight:600,color:"text.secondary",ml:1},children:l.version}):null]}),e.jsx(o,{sx:{fontSize:"0.9375rem",color:"text.secondary",lineHeight:1.75,mb:2},children:l.description}),j.articlesSummary&&e.jsx(o,{sx:{fontSize:"0.875rem",color:"text.primary",lineHeight:1.7,mb:2,fontWeight:600},children:j.articlesSummary}),j.overviewExtra&&e.jsx(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",lineHeight:1.7,mb:2},children:j.overviewExtra}),X?.country_specific&&e.jsx(E,{type:"tip",children:"This framework is tied to a primary country on your agent. When you register an agent with that jurisdiction, MrProbe can surface this mapping in reports and jurisdictional compliance sections automatically."})]}),e.jsxs(E,{type:"info",children:[e.jsx("strong",{children:"Attack catalog"})," frameworks (OWASP LLM, MITRE ATLAS) map each clause directly to technique IDs.",e.jsx("strong",{children:" Control equivalence"})," frameworks (GDPR, HIPAA, PCI, EU AI Act, etc.) map regulatory outcomes to adversarial attack categories — the same red-team probes that prove OWASP gaps also produce audit-ready evidence for your regulator."]}),e.jsx(o,{sx:{fontSize:"1.125rem",fontWeight:800,color:"text.primary",mb:2},children:"How to run this in MrProbe"}),e.jsxs(i,{sx:{display:"grid",gridTemplateColumns:{xs:"1fr",md:"1fr 1fr"},gap:2,mb:3},children:[e.jsxs(i,{sx:{p:2.5,borderRadius:"12px",border:"1px solid",borderColor:u,background:g},children:[e.jsx(ze,{sx:{color:p,mb:1}}),e.jsx(o,{sx:{fontWeight:700,fontSize:"0.9375rem",mb:.5}

1,children:"Quick Scan (pay-as-you-go)"}),e.jsxs(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",lineHeight:1.6,mb:2},children:["On the LENS Quick Scan widget, choose ",e.jsx("em",{children:"Compliance framework"})," and select ",l.name,". Paid tier runs the attack domains listed for this framework."]}),e.jsx(H,{size:"small",onClick:()=>f({pathname:"/lens",hash:"quick-scan"}),endIcon:e.jsx(q,{}),children:"Open Quick Scan"})]}),e.jsxs(i,{sx:{p:2.5,borderRadius:"12px",border:"1px solid",borderColor:u,background:g},children:[e.jsx(Ae,{sx:{color:p,mb:1}}),e.jsx(o,{sx:{fontWeight:700,fontSize:"0.9375rem",mb:.5},children:"Security campaign"}),e.jsx(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",lineHeight:1.6,mb:2},children:"Signed-in users pick this profile when creating a campaign. Reports include per-clause compliance status and article citations for proven findings."}),e.jsx(H,{size:"small",onClick:()=>f("/docs/getting-started"),endIcon:e.jsx(q,{}),children:"Getting started"})]})]})]}),h===1&&e.jsxs(i,{children:[e.jsx(o,{sx:{fontSize:"1.125rem",fontWeight:800,color:"text.primary",mb:1},children:"Articles, clauses & controls"}),e.jsx(o,{sx:{fontSize:"0.875rem",color:"text.secondary",mb:3,lineHeight:1.7},children:"Each row is a testable control in MrProbe. Attack domains show what red-team categories prove compliance (or expose gaps). Technique prefixes (e.g. PI-*, EX-*) link to the pattern library executed in your campaign."}),L.length===0&&e.jsx(W,{severity:"warning",sx:{mb:2},children:"Article-level mapping is not yet documented for this framework. Select OWASP LLM, EU AI Act, GDPR, HIPAA, PCI DSS, SOX, UAE AI Act, or MITRE ATLAS for full clause detail."}),L.map(r=>{const t=j.howCoveredByControlId.get(r.control_id);return e.jsxs(me,{disableGutters:!0,sx:{mb:1,borderRadius:"12px !important",border:"1px solid",borderColor:u,background:g,"&:before":{display:"none"}},children:[e.jsx(pe,{expandIcon:e.jsx(xe,{}),children:e.jsxs(i,{sx:{display:"flex",alignItems:"center",gap:1.5,flexWrap:"wrap",width:"100%",pr:1},children:[e.jsx(o,{sx:{fontFamily:"monospace",fontWeight:700,fontSize:"0.8125rem",color:p},children:r.control_id}),e.jsx(o,{sx:{fontWeight:700,fontSize:"0.9375rem",flex:1,minWidth:160},children:r.name}),e.jsx(x,{size:"small",label:r.severity,sx:{bgcolor:y(U(r.severity),.12),color:U(r.severity),fontWeight:700,fontSize:"0.625rem"}}),t&&e.jsx(x,{size:"small",label:we(t.coverage_level),sx:{bgcolor:y($(t.coverage_level),.12),color:$(t.coverage_level),fontWeight:700,fontSize:"0.625rem"}})]})}),e.jsxs(he,{children:[r.description&&e.jsx(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",lineHeight:1.7,mb:2},children:r.description}),t?.how_covered&&e.jsxs(e.Fragment,{children:[e.jsx(o,{sx:{fontSize:"0.6875rem",fontWeight:800,letterSpacing:"0.08em",textTransform:"uppercase",color:"text.disabled",mb:1},children:"How MrProbe covers this"}),e.jsx(o,{sx:{fontSize:"0.8125rem",color:"text.primary",lineHeight:1.7,mb:2},children:t.how_covered})]}),r.scope_note&&e.jsx(E,{type:"warning",children:r.scope_note}),e.jsx(o,{sx:{fontSize:"0.6875rem",fontWeight:800,letterSpacing:"0.08em",textTransform:"uppercase",color:"text.disabled",mb:1},children:"Attack domains tested"}),e.jsx(i,{sx:{display:"flex",flexWrap:"wrap",gap:.75,mb:2},children:r.attack_categories.map(s=>{const n=T(s);return e.jsx(x,{size:"small",label:n?.label||s,variant:"outlined"},s)})}),r.technique_prefixes.length>0&&e.jsxs(e.Fragment,{children:[e.jsx(o,{sx:{fontSize:"0.6875rem",fontWeight:800,letterSpacing:"0.08em",textTransform:"uppercase",color:"text.disabled",mb:1},children:"Technique prefixes"}),e.jsx(o,{sx:{fontSize:"0.75rem",fontFamily:"monospace",color:"text.secondary"},children:r.technique_prefixes.join(", ")})]})]})]},r.control_id)})]}),h===2&&e.jsxs(i,{children:[e.jsx(o,{sx:{fontSize:"1.125rem",fontWeight:800,color:"text.primary",mb:1},children:"Attack domains in this framework"}),e.jsxs(o,{sx:{fontSize:"0.875rem",color:"text.secondary",mb:3,lineHeight:1.7},children:["When you select ",l.name,", MrProbe runs techniques from these domains. Counts are from the pattern library; exact techniques vary by agent type and jurisdiction."]}),l.attack_categories.map(r=>{const t=T(r),s=l.category_controls[r]||[];return e.jsxs(i,{sx:{p:2.5,mb:2,borderRadius:"12px",border:"1px solid",borderColor:u,background:g},children:[e.jsxs(i,{sx:{display:"flex",flexWrap:"wrap",alignItems:"center",gap:1,mb:1},children:[e.jsx(o,{sx:{fontWeight:800,fontSize:"1rem"},children:t?.label||r}),t?.owaspMapping&&e.jsx(x,{size:"small",label:fe(t.owaspMapping),sx:{fontSize:"0.6875rem"}}),t?.techniqueCount!=null&&e.jsx(x,{size:"small",variant:"outlined",label:`~${t.techniqueCount} techniques`})]}),t?.description&&e.jsx(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",mb:1.5,lineHeight:1.6},children:t.description}),C[r]&&e.jsxs(i,{sx:{mb:1.5,p:1.5,borderRadius:1,bgcolor:y(a.palette.primary.main,.04)},children:[e.jsxs(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",mb:.75},children:[e.jsx("strong",{children:"Why we test this:"})," ",C[r].why]}),e.jsxs(o,{sx:{fontSize:"0.8125rem",color:"text.secondary"},children:[e.jsx("strong",{children:"Example:"})," ",e.jsx("em",{children:C[r].example})]})]}),s.length>0&&e.jsxs(e.Fragment,{children:[e.jsx(ge,{sx:{my:1.5}}),e.jsx(o,{sx:{fontSize:"0.6875rem",fontWeight:800,color:"text.disabled",letterSpacing:"0.06em",textTransform:"uppercase",mb:1},children:"Mapped controls"}),e.jsx(i,{sx:{display:"flex",flexWrap:"wrap",gap:.75},children:s.map(n=>e.jsx(Ce,{controlId:n.control_id,frameworkId:m,frameworkMapping:l,label:`${n.control_id}: ${n.name}`,name:n.name,severity:n.severity,techniquePrefixes:n.technique_prefixes,scopeNote:n.scope_note},n.control_id))})]})]},r)})]}),h===3&&e.jsxs(i,{children:[e.jsx(o,{sx:{fontSize:"1.125rem",fontWeight:800,color:"text.primary",mb:1},children:"What we test — examples"}),e.jsx(o,{sx:{fontSize:"0.875rem",color:"text.secondary",mb:3,lineHeight:1.7},children:"Representative adversarial prompts MrProbe uses (sanitized for documentation). Your report shows actual executed techniques and agent responses."}),l.attack_categories.map(r=>{const t=C[r];if(!t)return null;const s=T(r);return e.jsxs(i,{sx:{p:2.5,mb:2,borderRadius:"12px",border:"1px solid",borderColor:u,background:g},children:[e.jsx(o,{sx:{fontWeight:800,fontSize:"1rem",mb:1},children:s?.label||r}),e.jsxs(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",mb:1},children:[e.jsx("strong",{children:"Why:"})," ",t.why]}),e.jsxs(o,{sx:{fontSize:"0.8125rem",color:"text.secondary",mb:1},children:[e.jsx("strong",{children:"What MrProbe does:"})," ",t.whatItDoes]}),e.jsxs(i,{sx:{p:2,borderRadius:"8px",bgcolor:y(p,.04),border:"1px solid",borderColor:y(p,.12)},children:[e.jsx(o,{sx:{fontSize:"0.6875rem",fontWeight:800,color:p,mb:.5},children:"Example probe"}),e.jsx(o,{sx:{fontSize:"0.8125rem",fontStyle:"italic",color:"text.primary",lineHeight:1.6},children:t.example})]}),t.owaspNote&&e.jsx(o,{sx:{fontSize:"0.75rem",color:"text.disabled",mt:1.5},children:t.owaspNote})]},r)})]})]})]})]})}),e.jsx(ue,{})]})}

1export{$e as ComplianceMappingPage};