fluent-plugin-jfrog-siem 0.1.2 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/Gemfile +0 -1
  3. data/README.md +37 -20
  4. data/elastic.conf +18 -0
  5. data/fluent-plugin-jfrog-siem.gemspec +1 -1
  6. data/splunk.conf +18 -0
  7. metadata +4 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 21e5ec70320becee95a0bc6f26444c577692b7938b87c0b5390574413c1e96ac
4
- data.tar.gz: 59b66d00c11cf67b505b45d8a2e075ac8fcf53696088fd13dd774f99ac5003ca
3
+ metadata.gz: cd2cc7532e266f9d58b4dbbf18479c1f34fd975649f7aa5ab9e5e671f449025b
4
+ data.tar.gz: fa8943afc154c4d6136ac1605f5bf85a240ce6ac58bf3ee61f42eb162f447aa6
5
5
  SHA512:
6
- metadata.gz: 83bcea5adf47522832440a61aeb7b26fcf408ba52342239de09e8c5945dc795ec06a9547c13cc5bbca836167e6dd0eecc5a9d282a74d806d61c83b59394517ec
7
- data.tar.gz: a29a7ebb9d13b70bb200be4479f3059bca238c7354271aa00ae48c38293bea963e8428cbde188718e2c053f62a6c6dea7d4f86bf87f7cd22f4bbf6e8e842e4fd
6
+ metadata.gz: b47739ce004b1d48fddd026188aed933e4397b3730eb1d9bde1511f8bd623dc687246fa0ad85a91e814aa46175e5b0aee44213e12f18be97f078fb71b44904f7
7
+ data.tar.gz: a377d04e8b41cb108402036158d82632390db472cc4e7a97655110465e79a939e2bc90a25945b4932463f0561294c6f4af46fe70fa730141a403e1665a960a6e
data/Gemfile CHANGED
@@ -1,3 +1,2 @@
1
1
  source "https://rubygems.org"
2
-
3
2
  gemspec
data/README.md CHANGED
@@ -19,19 +19,7 @@ bundle install
19
19
  This will install the gem shown below from source.
20
20
 
21
21
 
22
- ## Installation
23
-
24
- ### RubyGems
25
-
26
- ```
27
- $ gem install rest-client
28
- ```
29
- ```
30
- $ gem install thread
31
- ```
32
- ```
33
- $ gem install fluent-plugin-jfrog-siem
34
- ```
22
+ ## Development
35
23
 
36
24
  ### Bundler
37
25
 
@@ -47,7 +35,7 @@ And then execute:
47
35
  $ bundle
48
36
  ```
49
37
 
50
- ## Configuration
38
+ ### Configuration
51
39
 
52
40
  You can generate configuration template:
53
41
 
@@ -57,23 +45,52 @@ $ fluent-plugin-config-format input jfrog-siem
57
45
 
58
46
  You can copy and paste generated documents here.
59
47
 
60
- ###Setup & configuration parameters
48
+ ## Installation
61
49
 
62
- Xray setup is required. Obtain JPD url and access token for API
50
+ ### RubyGems
51
+ ```
52
+ $ gem install rest-client
53
+ ```
54
+ ```
55
+ $ gem install thread
56
+ ```
57
+ ```
58
+ $ gem install fluent-plugin-jfrog-siem
59
+ ```
60
+
61
+ ### Setup & configuration
62
+ Fluentd is the supported log collector for this integration.
63
+ For Fluentd setup and information, read the JFrog log analytics repository's [README.](https://github.com/jfrog/log-analytics/blob/master/README.md)
64
+
65
+ #### Fluentd Output
66
+ Download fluentd conf for different log-vendors. For example
67
+ Splunk:
63
68
 
69
+ Splunk setup can be found at [README.](https://github.com/jfrog/log-analytics-splunk/blob/master/README.md)
70
+ ````text
71
+ wget https://raw.githubusercontent.com/jfrog/log-analytics/master/fluentd/plugins/input/fluent-plugin-jfrog-siem/splunk.conf
72
+ ````
73
+ Elasticsearch:
74
+
75
+ Elasticsearch Kibana setup can be found at [README.](https://github.com/jfrog/log-analytics-elastic/blob/master/README.md)
76
+ ````text
77
+ wget https://raw.githubusercontent.com/jfrog/log-analytics/master/fluentd/plugins/input/fluent-plugin-jfrog-siem/elastic.conf
78
+ ````
79
+
80
+ #### Configuration parameters
81
+ Integration is done by setting up Xray. Obtain JPD url and access token for API. Configure the source directive parameters specified below
64
82
  * **tag** (string) (required): The value is the tag assigned to the generated events.
65
83
  * **jpd_url** (string) (required): JPD url required to pull Xray SIEM violations
66
84
  * **access_token** (string) (required): [Access token](https://www.jfrog.com/confluence/display/JFROG/Access+Tokens) to authenticate Xray
67
85
  * **pos_file** (string) (required): Position file to record last SIEM violation pulled
68
86
  * **batch_size** (integer) (optional): Batch size for processing violations
69
- * Default value: `25`.
87
+ * Default value: `25`
70
88
  * **thread_count** (integer) (optional): Number of workers to process violation records in thread pool
71
- * Default value: `5`.
89
+ * Default value: `5`
72
90
  * **wait_interval** (integer) (optional): Wait interval between pulling new events
73
- * Default value: `60`.
91
+ * Default value: `60`
74
92
 
75
93
  ## Copyright
76
-
77
94
  * Copyright(c) 2020 - JFrog
78
95
  * License
79
96
  * Apache License, Version 2.0
data/elastic.conf ADDED
@@ -0,0 +1,18 @@
1
+ <source>
2
+ @type jfrog_siem
3
+ tag elastic_jfrog
4
+ jpd_url <jpd_url>
5
+ access_token <access_token>
6
+ pos_file "elastic_pos.txt"
7
+ </source>
8
+ <match elastic*>
9
+ @type elasticsearch
10
+ @id elasticsearch
11
+ host elasticsearch
12
+ port 9200
13
+ user <username>
14
+ password <password>
15
+ index_name xray_siem
16
+ include_tag_key true
17
+ type_name fluentd
18
+ </match>
data/fluent-plugin-jfrog-siem.gemspec CHANGED
@@ -3,7 +3,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
3
3
 
4
4
  Gem::Specification.new do |spec|
5
5
  spec.name = "fluent-plugin-jfrog-siem"
6
- spec.version = "0.1.2"
6
+ spec.version = "0.1.3"
7
7
  spec.authors = ["John Peterson", "Mahitha Byreddy"]
8
8
  spec.email = ["johnp@jfrog.com", "mahithab@jfrog.com"]
9
9
 
data/splunk.conf ADDED
@@ -0,0 +1,18 @@
1
+ <source>
2
+ @type jfrog_siem
3
+ tag splunk_jfrog
4
+ jpd_url <jpd_url>
5
+ access_token <access_token>
6
+ pos_file "splunk_pos.txt"
7
+ </source>
8
+ <match splunk*>
9
+ @type splunk_hec
10
+ host HEC_HOST
11
+ port HEC_PORT
12
+ token HEC_TOKEN
13
+ format json
14
+ sourcetype_key log_source
15
+ use_fluentd_time false
16
+ index violations
17
+ flush_interval 10s
18
+ </match>
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: fluent-plugin-jfrog-siem
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.2
4
+ version: 0.1.3
5
5
  platform: ruby
6
6
  authors:
7
7
  - John Peterson
@@ -9,7 +9,7 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2020-11-17 00:00:00.000000000 Z
12
+ date: 2021-01-21 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: bundler
@@ -100,8 +100,10 @@ files:
100
100
  - LICENSE
101
101
  - README.md
102
102
  - Rakefile
103
+ - elastic.conf
103
104
  - fluent-plugin-jfrog-siem.gemspec
104
105
  - lib/fluent/plugin/in_jfrog_siem.rb
106
+ - splunk.conf
105
107
  - test/helper.rb
106
108
  - test/plugin/test_in_jfrog_siem.rb
107
109
  homepage: https://github.com/jfrog/log-analytics