fluent-plugin-jfrog-siem 2.0.2 → 2.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0620907cd8c0e76c32092edda5505cdc788de8e6335dc290a0326b218f19b2e0'
-  data.tar.gz: 3da156c3f6a47216d35dde55936caf3e70ab7b218ff46a7a34e09472576eb482
+  metadata.gz: 307868a474983029bc88e801672e271082888317c76a5004098fb5a5a96d632d
+  data.tar.gz: 7528bd2ac402a909542fd8538faf91d359f549ae878d871af70aa0181aafb5ed
 SHA512:
-  metadata.gz: bb35044f6e097e14aa822b704a183e0770510bfc0d3a6aa554bf94b8a22b62e975b1e600b0bc61bdb116ff893bb6bb7d7974a620f82e4a93cae5ffdb81647e53
-  data.tar.gz: d90b8578364568411cca2defc99d991b28f84e462a6811ae17e81652f0cd7ffec100827312ef3774a75cce9c9c9883386ae829cfd0500352b76cbb341cf3f20a
+  metadata.gz: b58f40d97e2198fd597ab71ac5963fb16bd6acd8e765667bd5dce1be6ddda00f0a88a50f33891ed6267473586c228f0d48594916df1f8d34622ee4a1233c60f8
+  data.tar.gz: c7fbfe6e8bf62edd79d8775dc038cdf3411bdf3981a1253480659c954d7de0a4793e51f58b993d4f06d12e37f23bf2db6c3ab425df84bac7e84181070c4f2b39

data/README.md

@@ -87,7 +87,8 @@ wget https://raw.githubusercontent.com/jfrog/log-analytics-datadog/master/siem/d
 Integration is done by setting up Xray. Obtain JPD url and access token for API. Configure the source directive parameters specified below
 * **tag** (string) (required): The value is the tag assigned to the generated events.
 * **jpd_url** (string) (required): JPD url required to pull Xray SIEM violations
-* **apikey** (string) (required): API Key is the [Artifactory API Key](https://www.jfrog.com/confluence/display/JFROG/User+Profile#UserProfile-APIKey) for authentication
+* **apikey** (string): API Key is the [Artifactory API Key](https://www.jfrog.com/confluence/display/JFROG/User+Profile#UserProfile-APIKey) for authentication
+* **token** (string): [Access token](https://www.jfrog.com/confluence/display/JFROG/Access+Tokens) to authenticate Xray
 * **username** (string) (required): USER is the Artifactory username for authentication
 * **pos_file** (string) (required): Position file to record last SIEM violation pulled
 * **batch_size** (integer) (optional): Batch size for processing violations

data/fluent-plugin-jfrog-siem.gemspec

@@ -3,7 +3,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name    = "fluent-plugin-jfrog-siem"
-  spec.version = "2.0.2"
+  spec.version = "2.0.4"
   spec.authors = ["Mahitha Byreddy", "Sudhindra Rao","Giridharan Ramasamy"]
   spec.email   = ["mahithab@jfrog.com", "sudhindrar@jfrog.com", "girir@jfrog.com"]
 

data/lib/fluent/plugin/in_jfrog_siem.rb

@@ -31,7 +31,8 @@ module Fluent
       config_param :tag, :string, default: ""
       config_param :jpd_url, :string, default: ""
       config_param :username, :string, default: ""
-      config_param :apikey, :string, default: ""
+      config_param :apikey, :string, default: "", :secret => true
+      config_param :token, :string, default: "", :secret => true
       config_param :batch_size, :integer, default: 25
       config_param :wait_interval, :integer, default: 60
       config_param :from_date, :string, default: ""
@@ -54,9 +55,7 @@ module Fluent
           raise Fluent::ConfigError, "Must define the username to use for authentication."
         end
 
-        if @apikey == ""
-          raise Fluent::ConfigError, "Must define the API Key to use for authentication."
-        end
+        raise Fluent::ConfigError, 'Must define the apikey or token for authentication.' if @token == '' &&  @apikey == ''
 
         if @wait_interval < 1
           raise Fluent::ConfigError, "Wait interval must be greater than 1 to wait between pulling new events."
@@ -94,7 +93,7 @@ module Fluent
         end
         date_since = last_created_date
         puts "Getting queries from #{date_since}"
-        xray = Xray.new(@jpd_url, @username, @apikey, @wait_interval, @batch_size, @pos_file_path, router, @tag)
+        xray = Xray.new(@jpd_url, @username, @apikey, @token, @wait_interval, @batch_size, @pos_file_path, router, @tag)
         violations_channel = xray.violations(date_since)
         xray.violation_details(violations_channel)
         sleep 100

data/lib/fluent/plugin/xray.rb

@@ -4,10 +4,11 @@ require 'json'
 require "fluent/plugin/position_file"
 
 class Xray
-  def initialize(jpd_url, username, api_key, wait_interval, batch_size, pos_file_path, router, tag)
+  def initialize(jpd_url, username, api_key, token, wait_interval, batch_size, pos_file_path, router, tag)
     @jpd_url = jpd_url
     @username = username
     @api_key = api_key
+    @token = token
     @wait_interval = wait_interval
     @batch_size = batch_size
     @pos_file_path = pos_file_path
@@ -48,6 +49,7 @@ class Xray
     begin
       detailResp_json = data_normalization(get_violations_detail(xray_violation_detail_url))
       time = Fluent::Engine.now
+      puts detailResp_json
       @router.emit(@tag, time, detailResp_json)
     rescue => e
       puts "error: #{e}"
@@ -56,18 +58,28 @@ class Xray
   end
 
   def get_violations_detail(xray_violation_detail_url)
-    response = RestClient::Request.new(
-        :method => :get,
-        :url => @jpd_url + xray_violation_detail_url[xray_violation_detail_url.index('/xray/'),xray_violation_detail_url.length],
-        :user => @username,
-        :password => @api_key
-    ).execute do |response, request, result|
+    if !@token.nil? && @token != ''
+      response = RestClient::Request.new(
+          :method => :get,
+          :url => @jpd_url + xray_violation_detail_url[xray_violation_detail_url.index('/xray/'),xray_violation_detail_url.length],
+          :headers => { :accept => :json, :content_type => :json, Authorization:'Bearer ' + @token }
+      )
+    elsif !@api_key.nil? && @api_key != ''
+      response = RestClient::Request.new(
+          :method => :get,
+          :url => @jpd_url + xray_violation_detail_url[xray_violation_detail_url.index('/xray/'),xray_violation_detail_url.length],
+          :user => @username,
+          :password => @api_key
+      )
+    end
+
+    response.execute do |response, request, result|
       case response.code
       when 200
         return JSON.parse(response.to_s)
       else
         puts "error: #{response.to_json}"
-        raise Fluent::ConfigError, "Cannot reach Artifactory URL to pull Xray SIEM violations."
+        raise Fluent::ConfigError, "Cannot reach Artifactory URL to pull Xray SIEM violations details."
       end
     end
   end
@@ -138,14 +150,24 @@ class Xray
 
   private
   def get_violations(xray_json)
-    response = RestClient::Request.new(
-        :method => :post,
-        :url => @jpd_url + "/xray/api/v1/violations",
-        :payload => xray_json.to_json,
-        :user => @username,
-        :password => @api_key,
-        :headers => { :accept => :json, :content_type => :json }
-    ).execute do |response, request, result|
+    if !@token.nil? && @token != ''
+      response = RestClient::Request.new(
+          :method => :post,
+          :url => @jpd_url + "/xray/api/v1/violations",
+          :payload => xray_json.to_json,
+          :headers => { :accept => :json, :content_type => :json, Authorization:'Bearer ' + @token }
+      )
+    elsif !@api_key.nil? && @api_key != ''
+      response = RestClient::Request.new(
+          :method => :post,
+          :url => @jpd_url + "/xray/api/v1/violations",
+          :payload => xray_json.to_json,
+          :user => @username,
+          :password => @api_key,
+          :headers => { :accept => :json, :content_type => :json }
+      )
+    end
+    response.execute do |response, request, result|
       case response.code
       when 200
         return JSON.parse(response.to_str)

data/test/plugin/test_in_jfrog_siem.rb

@@ -13,10 +13,10 @@ class JfrogSiemInputTest < Test::Unit::TestCase
   # Default configuration for tests
   CONFIG = %[
      tag "jfrog.xray.siem.vulnerabilities"
-     jpd_url "JPDURL"
+     jpd_url "http://34.83.118.33"
      username "admin"
-     apikey "APIKEY"
-     pos_file_path "#{ENV['JF_PRODUCT_DATA_INTERNAL']}/log/"
+     apikey "AKCp8nyNhxdAisCXoS5ktgrrcWkLGJbsCU8RkSS4xxMH5DQcxttm4k4G7KbkUhmcFxJizXLFF"
+     pos_file_path "/Users/mahithab/Jfrog/fluent-plugin-jfrog-siem/fluentd/plugins/input/fluent-plugin-jfrog-siem/"
      wait_interval 10
      from_date "2016-01-01"
      batch_size 25

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-jfrog-siem
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.4
 platform: ruby
 authors:
 - Mahitha Byreddy
 - Sudhindra Rao
 - Giridharan Ramasamy
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-03-16 00:00:00.000000000 Z
+date: 2022-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -202,7 +202,7 @@ homepage: https://github.com/jfrog/fluent-plugin-jfrog-siem
 licenses:
 - Apache-2.0
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -217,8 +217,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: JFrog SIEM fluent input plugin will send the SIEM events from JFrog Xray
   to Fluentd