fluent-plugin-jfrog-siem 2.0.7 → 2.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1de86065fece9f251b49bc69e3ae44fce255f3ea1362cbc6f1397a8d4fd01581
-  data.tar.gz: dbeb11c0337e979bfdbb8ba8b7f5df89868f479f1aec9c57cbe4271ade6b7859
+  metadata.gz: 74c423ae40c052a7a8f53ff8f8d744ffcaa2032553f9c331866fdc1b186ce076
+  data.tar.gz: e7e096bda67598350f0502f91f0602542d616fb0406dfa1f1274a7b82ab0f0e0
 SHA512:
-  metadata.gz: 55e58bbb623f54ed8099541b2fc0b28ff609e2693af9d2ae405ecfc55f7c41cbe42acaea3532294e69ef76391d745a159dc1bf0e4c174ca3f90efe215f60be83
-  data.tar.gz: b1b2a632f52a89156c46e362b065aea36dc53dc82aeb68e1283857071a779c7b743d962e5d448edf282041a5daba37fae6a4a80459e01929a3febb08d2824e3a
+  metadata.gz: ecc3e648b0a7f9d68262e0aed5a403c3c3ebc7ab345234f7156997079c37a3ed5548a33cac35f80be129bfd5cfae665672ed64db58ed197b2340af61a702d099
+  data.tar.gz: cc261ed12d53934671349002785cb037b064a4abac399bf7dca783568a4586da8dcb4c9d665e6cd885654aca0a6fe1f51a7f3aaaffbba04f6627a53bb0115d45

data/Gemfile.lock

@@ -1,41 +1,49 @@
 PATH
   remote: .
   specs:
-    fluent-plugin-jfrog-siem (1.0.0)
-      concurrent-ruby (~> 1.1.8)
+    fluent-plugin-jfrog-siem (2.0.9)
       concurrent-ruby-edge
       fluentd (>= 0.14.10, < 2)
+      rest-client (~> 2.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    base64 (0.2.0)
     concurrent-ruby (1.1.8)
     concurrent-ruby-edge (0.6.0)
       concurrent-ruby (~> 1.1.6)
-    cool.io (1.7.1)
+    cool.io (1.9.0)
+    csv (3.3.0)
     diff-lcs (1.4.4)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
-    fluentd (1.13.1)
+    drb (2.2.1)
+    fluentd (1.17.1)
+      base64 (~> 0.2)
       bundler
       cool.io (>= 1.4.5, < 2.0.0)
-      http_parser.rb (>= 0.5.1, < 0.7.0)
+      csv (~> 3.2)
+      drb (~> 2.2)
+      http_parser.rb (>= 0.5.1, < 0.9.0)
+      logger (~> 1.6)
       msgpack (>= 1.3.1, < 2.0.0)
-      serverengine (>= 2.2.2, < 3.0.0)
-      sigdump (~> 0.2.2)
-      strptime (>= 0.2.2, < 1.0.0)
+      serverengine (>= 2.3.2, < 3.0.0)
+      sigdump (~> 0.2.5)
+      strptime (>= 0.2.4, < 1.0.0)
       tzinfo (>= 1.0, < 3.0)
       tzinfo-data (~> 1.0)
-      webrick (>= 1.4.2, < 1.8.0)
+      webrick (~> 1.4)
       yajl-ruby (~> 1.0)
     http-accept (1.7.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
-    http_parser.rb (0.6.0)
+    http_parser.rb (0.8.0)
+    logger (1.6.1)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2021.0225)
-    msgpack (1.4.2)
+    msgpack (1.7.3)
     netrc (0.11.0)
     power_assert (2.0.0)
     rake (12.3.3)
@@ -57,28 +65,31 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
     rspec-support (3.10.2)
-    serverengine (2.2.4)
+    serverengine (2.4.0)
+      base64 (~> 0.1)
+      logger (~> 1.4)
       sigdump (~> 0.2.2)
-    sigdump (0.2.4)
+    sigdump (0.2.5)
     strptime (0.2.5)
     test-unit (3.4.2)
       power_assert
-    tzinfo (2.0.4)
+    tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2021.1)
+    tzinfo-data (1.2024.2)
       tzinfo (>= 1.0.0)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.7)
-    webrick (1.7.0)
-    yajl-ruby (1.4.1)
+    webrick (1.9.0)
+    yajl-ruby (1.4.3)
 
 PLATFORMS
+  arm64-darwin-23
   x86_64-darwin-20
+  x86_64-linux
 
 DEPENDENCIES
   bundler (~> 2.0)
-  concurrent-ruby (~> 1.1.8)
   concurrent-ruby-edge
   fluent-plugin-jfrog-siem!
   rake (~> 12.0)
@@ -87,4 +98,4 @@ DEPENDENCIES
   test-unit (~> 3.0)
 
 BUNDLED WITH
-   2.2.3
+   2.4.19

data/fluent-plugin-jfrog-siem.gemspec

@@ -3,9 +3,9 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name    = "fluent-plugin-jfrog-siem"
-  spec.version = "2.0.7"
-  spec.authors = ["Mahitha Byreddy", "Sudhindra Rao","Giridharan Ramasamy"]
-  spec.email   = ["mahithab@jfrog.com", "sudhindrar@jfrog.com", "girir@jfrog.com"]
+  spec.version = "2.0.9"
+  spec.authors = ["Mahitha Byreddy", "Ben Harosh"]
+  spec.email   = ["partner-support@jfrog.com"]
 
   spec.summary       = %q{JFrog SIEM fluent input plugin will send the SIEM events from JFrog Xray to Fluentd}
   spec.description   = %q{JFrog SIEM fluent input plugin will send the SIEM events from JFrog Xray to Fluentd which can then be delivered to whatever output plugin specified}
@@ -24,12 +24,10 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", "~> 12.0"
   spec.add_development_dependency "test-unit", "~> 3.0"
   spec.add_development_dependency "rest-client", "~> 2.0"
-  spec.add_development_dependency "concurrent-ruby", "~> 1.1.8" , "< 1.1.10"
   spec.add_development_dependency "concurrent-ruby-edge", '>= 0'
   spec.add_development_dependency 'rspec', '~> 3.10.0'
 
   spec.add_runtime_dependency "rest-client", "~> 2.0"
-  spec.add_runtime_dependency "concurrent-ruby", "~> 1.1.8" , "< 1.1.10"
   spec.add_runtime_dependency "concurrent-ruby-edge", '>= 0'
   spec.add_runtime_dependency "fluentd", [">= 0.14.10", "< 2"]
 end

data/lib/fluent/plugin/xray.rb

@@ -90,6 +90,7 @@ class Xray
     cve = []
     cvss_v2_list = []
     cvss_v3_list = []
+    cvss_v4_list = []
     policy_list = []
     rule_list = []
     impacted_artifact_url_list = []
@@ -105,20 +106,32 @@ class Xray
         if properties[index].key?('cvss_v3')
           cvss_v3_list.push(properties[index]['cvss_v3'])
         end
+        if properties[index].key?('cvss_v4')
+          cvss_v4_list.push(properties[index]['cvss_v4'])
+        end
       end
 
       detailResp_json["cve"] = cve.sort.reverse[0]
       cvss_v2 = cvss_v2_list.sort.reverse[0]
       cvss_v3 = cvss_v3_list.sort.reverse[0]
+      cvss_v4 = cvss_v4_list.sort.reverse[0]
+      # cvss_v4 is only a fallback so the reported score doesn't change for violations that also have v3/v2
       if !cvss_v3.nil?
         cvss = cvss_v3
       elsif !cvss_v2.nil?
         cvss = cvss_v2
+      elsif !cvss_v4.nil?
+        cvss = cvss_v4
+      end
+      if !cvss.nil?
+        cvss_score = cvss[0..2]
+        detailResp_json["cvss_score"] = cvss_score
+        # A score without a vector (e.g. "2.4") has no ':' to take the version from
+        cvss_version_part = cvss.split(':')[1]
+        if !cvss_version_part.nil?
+          detailResp_json["cvss_version"] = cvss_version_part[0..2]
+        end
       end
-      cvss_score = cvss[0..2]
-      cvss_version = cvss.split(':')[1][0..2]
-      detailResp_json["cvss_score"] = cvss_score
-      detailResp_json["cvss_version"] = cvss_version
     end
 
     if detailResp_json.key?('matched_policies')
@@ -135,7 +148,7 @@ class Xray
       detailResp_json['rules'] = rule_list
     end
 
-    detailResp_json['impacted_artifacts'].each do |impacted_artifact|
+    (detailResp_json['impacted_artifacts'] || []).each do |impacted_artifact|
       matchdata = impacted_artifact.match /default\/(?<repo_name>[^\/]*)\/(?<path>.*)/
       if matchdata
         impacted_artifact_url = matchdata['repo_name'] + ":" + matchdata['path'] + " "

data/spec/data_normalization_spec.rb

@@ -0,0 +1,300 @@
+# spec/data_normalization_spec.rb
+#
+# Tests for Xray#data_normalization covering JOBS-2850:
+#   When violation properties lack cvss_v2 / cvss_v3 (e.g. Security violations
+#   for issues with no CVSS score, or only a CVSS v4 score) the method must NOT
+#   raise NoMethodError on `cvss[0..2]`.
+#
+# Expected results before the fix:
+#   - Violations without CVSS v2/v3 data   → FAIL  (demonstrates the bug)
+#   - CVSS score without a vector          → FAIL
+#   - Missing impacted_artifacts           → FAIL
+#   - Security-with-CVSS v2/v3 tests       → PASS  (existing logic is correct)
+
+[
+  File.join(File.dirname(__FILE__), '..'),
+  File.join(File.dirname(__FILE__), '..', 'lib/fluent/plugin'),
+  File.join(File.dirname(__FILE__), '..', 'spec'),
+].each do |dir|
+  $LOAD_PATH.unshift(dir) unless $LOAD_PATH.include?(dir)
+end
+
+require 'spec_helper'
+
+RSpec.describe Xray, '#data_normalization' do
+  # Build an Xray instance with all dummy/nil params — we only need the method.
+  # Constructor signature: (jpd_url, username, api_key, token, wait_interval,
+  #                         batch_size, pos_file_path, router, tag)
+  subject(:xray) do
+    Xray.new(nil, nil, nil, nil, nil, nil, nil, nil, nil)
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: License violation — properties have no cvss_v2 / cvss_v3
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'License violation without CVSS data' do
+    let(:license_violation) do
+      {
+        'issue_id'           => 'Apache-2.0',
+        'type'               => 'License',
+        'properties'         => [{ 'license' => 'Apache-2.0' }],
+        'impacted_artifacts' => ['default/maven-repo-1/com/example/foo/bar.jar']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      # BUG: cvss is nil → cvss[0..2] raises NoMethodError undefined method '[]' for nil
+      expect { xray.data_normalization(license_violation) }.not_to raise_error
+    end
+
+    it 'returns a Hash' do
+      result = xray.data_normalization(license_violation)
+      expect(result).to be_a(Hash)
+    end
+
+    it 'does not set cvss_score when CVSS data is absent' do
+      result = xray.data_normalization(license_violation)
+      expect(result).not_to have_key('cvss_score')
+    end
+
+    it 'does not set cvss_version when CVSS data is absent' do
+      result = xray.data_normalization(license_violation)
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: Operational Risk violation — properties have no cvss_v2 / cvss_v3
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Operational Risk violation without CVSS data' do
+    let(:op_risk_violation) do
+      {
+        'issue_id'           => 'EOL-component-1234',
+        'type'               => 'Operational Risk',
+        'properties'         => [{ 'end_of_life' => 'true' }],
+        'impacted_artifacts' => ['default/npm-repo/lodash/-/lodash-4.0.0.tgz']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      # BUG: same as License — cvss stays nil, cvss[0..2] crashes
+      expect { xray.data_normalization(op_risk_violation) }.not_to raise_error
+    end
+
+    it 'returns a Hash' do
+      result = xray.data_normalization(op_risk_violation)
+      expect(result).to be_a(Hash)
+    end
+
+    it 'does not set cvss_score when CVSS data is absent' do
+      result = xray.data_normalization(op_risk_violation)
+      expect(result).not_to have_key('cvss_score')
+    end
+
+    it 'does not set cvss_version when CVSS data is absent' do
+      result = xray.data_normalization(op_risk_violation)
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: Security violation with a CVE but no CVSS data at all
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with a CVE but without CVSS data' do
+    let(:security_violation_no_cvss) do
+      {
+        'issue_id'           => 'SIEMTEST-NOCVSS-1',
+        'type'               => 'Security',
+        'properties'         => [{ 'cve' => 'CVE-2099-28500' }],
+        'impacted_artifacts' => ['default/npm-siem-test/siem-mit-pkg/-/siem-mit-pkg-1.0.0.tgz']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      expect { xray.data_normalization(security_violation_no_cvss) }.not_to raise_error
+    end
+
+    it 'still sets the cve' do
+      result = xray.data_normalization(security_violation_no_cvss)
+      expect(result['cve']).to eq('CVE-2099-28500')
+    end
+
+    it 'does not set cvss_score or cvss_version' do
+      result = xray.data_normalization(security_violation_no_cvss)
+      expect(result).not_to have_key('cvss_score')
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: Security violation with only a CVSS v4 score
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with only CVSS v4 data' do
+    let(:security_violation_v4) do
+      {
+        'issue_id'           => 'XRAY-1073490',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2026-84445',
+            'cwe'     => ['CWE-129', 'CWE-248'],
+            'cvss_v4' => '8.7/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
+          }
+        ],
+        'impacted_artifacts' => ['default/build-info/some-build']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      expect { xray.data_normalization(security_violation_v4) }.not_to raise_error
+    end
+
+    it 'sets cvss_score from cvss_v4' do
+      result = xray.data_normalization(security_violation_v4)
+      expect(result['cvss_score']).to eq('8.7')
+    end
+
+    it 'sets cvss_version from cvss_v4' do
+      result = xray.data_normalization(security_violation_v4)
+      expect(result['cvss_version']).to eq('4.0')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation with both CVSS v3 and v4 — v3 is kept
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with both CVSS v3 and v4 (v3 kept)' do
+    let(:security_violation_v3_v4) do
+      {
+        'issue_id'           => 'CVE-2024-5678',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2024-5678',
+            'cvss_v3' => '7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H',
+            'cvss_v4' => '8.7/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
+          }
+        ],
+        'impacted_artifacts' => ['default/maven-repo/some-lib/1.0/some-lib-1.0.jar']
+      }
+    end
+
+    it 'uses cvss_v3, not cvss_v4' do
+      result = xray.data_normalization(security_violation_v3_v4)
+      expect(result['cvss_score']).to eq('7.5')
+      expect(result['cvss_version']).to eq('3.1')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation with a CVSS score but no vector (e.g. custom issues)
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with a CVSS score but no vector' do
+    let(:security_violation_score_only) do
+      {
+        'issue_id'           => 'CUSTOM-ISSUE-1',
+        'type'               => 'Security',
+        'properties'         => [{ 'cve' => 'CVE-2017-1000386', 'cvss_v2' => '2.4' }],
+        'impacted_artifacts' => ['default/maven-repo/aero/aero/0.2.3/aero-0.2.3.jar']
+      }
+    end
+
+    it 'does not raise an error' do
+      expect { xray.data_normalization(security_violation_score_only) }.not_to raise_error
+    end
+
+    it 'sets cvss_score' do
+      result = xray.data_normalization(security_violation_score_only)
+      expect(result['cvss_score']).to eq('2.4')
+    end
+
+    it 'does not set cvss_version' do
+      result = xray.data_normalization(security_violation_score_only)
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Violation without impacted_artifacts (key absent or null)
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Violation without impacted_artifacts' do
+    it 'does not raise an error when the key is absent' do
+      violation = { 'issue_id' => 'CVE-2099-28500', 'type' => 'Security', 'properties' => [{ 'cve' => 'CVE-2099-28500' }] }
+      expect { xray.data_normalization(violation) }.not_to raise_error
+    end
+
+    it 'sets an empty impacted_artifacts_url when the value is null' do
+      violation = { 'issue_id' => 'CVE-2099-28500', 'type' => 'Security', 'impacted_artifacts' => nil }
+      result = xray.data_normalization(violation)
+      expect(result['impacted_artifacts_url']).to eq([])
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation WITH CVSS v3 only (existing behaviour must keep working)
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with CVSS v3 data' do
+    let(:security_violation_v3) do
+      {
+        'issue_id'           => 'CVE-2021-44228',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2021-44228',
+            'cvss_v3' => '9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
+          }
+        ],
+        'impacted_artifacts' => ['default/maven-repo/log4j/core/2.14.1/log4j-core-2.14.1.jar']
+      }
+    end
+
+    it 'does not raise an error' do
+      expect { xray.data_normalization(security_violation_v3) }.not_to raise_error
+    end
+
+    it 'sets cvss_score to the leading numeric score (e.g. "9.8")' do
+      result = xray.data_normalization(security_violation_v3)
+      expect(result['cvss_score']).to eq('9.8')
+    end
+
+    it 'sets cvss_version to the CVSS major.minor version (e.g. "3.1")' do
+      result = xray.data_normalization(security_violation_v3)
+      expect(result['cvss_version']).to eq('3.1')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation WITH both CVSS v2 AND v3 — v3 must be preferred
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with both CVSS v2 and v3 (v3 preferred)' do
+    let(:security_violation_both) do
+      {
+        'issue_id'           => 'CVE-2020-1234',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2020-1234',
+            'cvss_v2' => '7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P',
+            'cvss_v3' => '9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
+          }
+        ],
+        'impacted_artifacts' => ['default/maven-repo/some-lib/1.0/some-lib-1.0.jar']
+      }
+    end
+
+    it 'does not raise an error' do
+      expect { xray.data_normalization(security_violation_both) }.not_to raise_error
+    end
+
+    it 'uses cvss_v3 score (not cvss_v2) when both are present' do
+      result = xray.data_normalization(security_violation_both)
+      # v3 score is 9.8; v2 score is 7.5 — the result must reflect v3
+      expect(result['cvss_score']).to eq('9.8')
+    end
+
+    it 'sets cvss_version from cvss_v3 when both are present' do
+      result = xray.data_normalization(security_violation_both)
+      expect(result['cvss_version']).to eq('3.1')
+    end
+  end
+end

metadata

@@ -1,16 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-jfrog-siem
 version: !ruby/object:Gem::Version
-  version: 2.0.7
+  version: 2.0.9
 platform: ruby
 authors:
 - Mahitha Byreddy
-- Sudhindra Rao
-- Giridharan Ramasamy
+- Ben Harosh
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-10-23 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -68,26 +67,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: concurrent-ruby
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.1.8
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 1.1.10
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.1.8
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 1.1.10
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby-edge
   requirement: !ruby/object:Gem::Requirement
@@ -130,26 +109,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-- !ruby/object:Gem::Dependency
-  name: concurrent-ruby
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.1.8
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 1.1.10
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.1.8
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: 1.1.10
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby-edge
   requirement: !ruby/object:Gem::Requirement
@@ -187,9 +146,7 @@ dependencies:
 description: JFrog SIEM fluent input plugin will send the SIEM events from JFrog Xray
   to Fluentd which can then be delivered to whatever output plugin specified
 email:
-- mahithab@jfrog.com
-- sudhindrar@jfrog.com
-- girir@jfrog.com
+- partner-support@jfrog.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -206,6 +163,7 @@ files:
 - lib/fluent/plugin/test_violations.rb
 - lib/fluent/plugin/violations.json
 - lib/fluent/plugin/xray.rb
+- spec/data_normalization_spec.rb
 - spec/position_file_spec.rb
 - spec/spec_helper.rb
 - spec/xray_spec.rb
@@ -230,12 +188,13 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: JFrog SIEM fluent input plugin will send the SIEM events from JFrog Xray
   to Fluentd
 test_files:
+- spec/data_normalization_spec.rb
 - spec/position_file_spec.rb
 - spec/spec_helper.rb
 - spec/xray_spec.rb