fluent-plugin-parser-winevt_xml 0.2.0 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c3d11e84c92255ce5fbe0813857d38a5f59824985a0453b0f2fd7880d0a9000
-  data.tar.gz: 0fae4fa404654a30cfa0c101a34074c3ece238be70bdb79cd19ceeea3a1206e0
+  metadata.gz: cf661a22efc8f59fea1349378dd616e3492f8f744a4b2828ca92bcaa07104ee8
+  data.tar.gz: 225be6df196b003016e6ff05ecba7d0860e154ee5e666d8361dd48ea9f40536d
 SHA512:
-  metadata.gz: 7b08784bd72df92216146953b49dd69d559e6d40373326e54f72cca6ca981b192901aca427ca3a61064c37ab9aebb82379bf6be72675021748e784f95c62f486
-  data.tar.gz: 9a0c3fede86321a65baa5373123a085c72a6bbb81e146b29383bd9c979d4c71e5f865bb97387743619e87f56bcfdfd375e193dd3015525bd323c3d5f2e95d07a
+  metadata.gz: 8cfb8dd8e674678fcda0d78f56b6ed782e36aae204039d895525905438ad4b2c6fbb0156e439694af778ebd34ba9e2d3028e12871582cbc50c44b06a953a047c
+  data.tar.gz: f7092485efbcc4ccf2e45448c604f4cc63663922567aa48200a091fc7e92f14ad4b12fd384d6a760df250574c25643d95624963ca482cc0120e9bd52a36ec049

data/.github/workflows/linux-test.yaml

@@ -0,0 +1,34 @@
+name: Testing on Ubuntu
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.experimental }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.0', '2.7', '2.6']
+        os: [ubuntu-latest]
+        experimental: [false]
+        include:
+          - ruby: head
+            os: ubuntu-latest
+            experimental: true
+
+    name: Unit testing with Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+      - name: Install dependencies
+        run: bundle install
+      - name: Run tests
+        run: bundle exec rake test

data/.github/workflows/macos-test.yaml

@@ -0,0 +1,28 @@
+name: Testing on macOS
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.0', '2.7', '2.6']
+        os: [macos-latest]
+
+    name: Unit testing with Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+      - name: Install dependencies
+        run: bundle install
+      - name: Run tests
+        run: bundle exec rake test

data/.github/workflows/windows-test.yaml

@@ -0,0 +1,28 @@
+name: Testing on Windows
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.0', '2.7', '2.6']
+        os:
+          - windows-latest
+    name: Unit testing with Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+      - name: Install dependencies
+        run: ridk exec bundle install
+      - name: Run tests
+        run: bundle exec rake test

data/README.md

@@ -22,9 +22,14 @@ gem install fluent-plugin-parser-winevt_xml
 ```aconf
 <parse>
   @type winevt_xml
+  preserve_qualifiers true
 </parse>
 ```
 
+#### preserve_qualifiers
+
+Preserve Qualifiers key instead of calculating actual EventID with Qualifiers. Default is `true`.
+
 ### parser_winevt_sax
 
 This plugin is a bit faster than `winevt_xml`.
@@ -32,9 +37,14 @@ This plugin is a bit faster than `winevt_xml`.
 ```aconf
 <parse>
   @type winevt_sax
+  preserve_qualifiers true
 </parse>
 ```
 
+#### preserve_qualifiers
+
+Preserve Qualifiers key instead of calculating actual EventID with Qualifiers. Default is `true`.
+
 ## Copyright
 
 ### Copyright

data/appveyor.yml

@@ -1,4 +1,5 @@
 version: '{build}'
+image: Visual Studio 2019
 
 # init:
 #   - ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
@@ -20,5 +21,9 @@ branches:
 # https://www.appveyor.com/docs/installed-software/#ruby
 environment:
   matrix:
-    - ruby_version: "24-x64"
-    - ruby_version: "24"
+    - ruby_version: "30-x64"
+    - ruby_version: "30"
+    - ruby_version: "27-x64"
+    - ruby_version: "27"
+    - ruby_version: "26-x64"
+    - ruby_version: "26"

data/fluent-plugin-parser-winevt_xml.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-parser-winevt_xml"
-  spec.version       = "0.2.0"
+  spec.version       = "0.2.3"
   spec.authors       = ["Hiroshi Hatake", "Masahiro Nakagawa"]
   spec.email         = ["cosmo0920.oucc@gmail.com", "repeatedly@gmail.com"]
   spec.summary       = %q{Fluentd Parser plugin to parse XML rendered windows event log.}
@@ -19,7 +19,7 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"
-  spec.add_development_dependency "test-unit", "~> 3.2.0"
+  spec.add_development_dependency "test-unit", "~> 3.4.0"
   spec.add_runtime_dependency "fluentd", [">= 0.14.12", "< 2"]
-  spec.add_runtime_dependency "nokogiri", "~> 1.10"
+  spec.add_runtime_dependency "nokogiri", [">= 1.12.5", "< 1.13"]
 end

data/lib/fluent/plugin/parser_winevt_sax.rb

@@ -6,12 +6,18 @@ module Fluent::Plugin
   class WinevtSAXparser < Parser
     Fluent::Plugin.register_parser('winevt_sax', self)
 
+    config_param :preserve_qualifiers, :bool, default: true
+
     def winevt_xml?
       true
     end
 
+    def preserve_qualifiers?
+      @preserve_qualifiers
+    end
+
     def parse(text)
-      evtxml = WinevtXMLDocument.new
+      evtxml = WinevtXMLDocument.new(@preserve_qualifiers)
       parser = Nokogiri::XML::SAX::Parser.new(evtxml)
       parser.parse(text)
       time = @estimate_current_event ? Fluent::EventTime.now : nil

data/lib/fluent/plugin/parser_winevt_xml.rb

@@ -5,18 +5,43 @@ module Fluent::Plugin
   class WinevtXMLparser < Parser
     Fluent::Plugin.register_parser('winevt_xml', self)
 
+    config_param :preserve_qualifiers, :bool, default: true
+
     def winevt_xml?
       true
     end
 
+    def preserve_qualifiers?
+      @preserve_qualifiers
+    end
+
+    def MAKELONG(low, high)
+      (low & 0xffff) | (high & 0xffff) << 16
+    end
+
+    def event_id(system_elem)
+      return (system_elem/'EventID').text rescue nil if @preserve_qualifiers
+
+      qualifiers = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
+      if qualifiers
+        event_id = (system_elem/'EventID').text
+        event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
+        event_id.to_s
+      else
+        (system_elem/'EventID').text rescue nil
+      end
+    end
+
     def parse(text)
       record = {}
       doc = Nokogiri::XML(text)
       system_elem                     = doc/'Event'/'System'
       record["ProviderName"]          = (system_elem/"Provider").attribute("Name").text rescue nil
       record["ProviderGUID"]          = (system_elem/"Provider").attribute("Guid").text rescue nil
-      record["EventID"]               = (system_elem/'EventID').text rescue nil
-      record["Qualifiers"]            = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
+      if @preserve_qualifiers
+        record["Qualifiers"]            = (system_elem/'EventID').attribute("Qualifiers").text rescue nil
+      end
+      record["EventID"]               = event_id(system_elem)
       record["Level"]                 = (system_elem/'Level').text rescue nil
       record["Task"]                  = (system_elem/'Task').text rescue nil
       record["Opcode"]                = (system_elem/'Opcode').text rescue nil

data/lib/fluent/plugin/winevt_sax_document.rb

@@ -1,12 +1,35 @@
 require 'nokogiri'
 
 class WinevtXMLDocument < Nokogiri::XML::SAX::Document
-  attr_reader :result
-
-  def initialize
+  def initialize(preserve_qualifiers)
     @stack = []
     @result = {}
-    super
+    @preserve_qualifiers = preserve_qualifiers
+    super()
+  end
+
+  def MAKELONG(low, high)
+    (low & 0xffff) | (high & 0xffff) << 16
+  end
+
+  def event_id
+    if @result.has_key?("Qualifiers")
+      qualifiers = @result.delete("Qualifiers")
+      event_id = @result['EventID']
+      event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
+      @result['EventID'] = event_id.to_s
+    else
+      @result['EventID']
+    end
+  end
+
+  def result
+    return @result if @preserve_qualifiers
+
+    if @result
+      @result['EventID'] = event_id
+    end
+    @result
   end
 
   def start_document
@@ -16,7 +39,7 @@ class WinevtXMLDocument < Nokogiri::XML::SAX::Document
     @stack << name
 
     if name == "Provider"
-      @result["PrividerName"] = attributes[0][1] rescue nil
+      @result["ProviderName"] = attributes[0][1] rescue nil
       @result["ProviderGUID"] = attributes[1][1] rescue nil
     elsif name == "EventID"
       @result["Qualifiers"] = attributes[0][1] rescue nil

data/test/data/eventlog-with-qualifiers.xml

@@ -0,0 +1 @@
+<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-SPP' Guid='{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}' EventSourceName='Software Protection Platform Service'/><EventID Qualifiers='49152'>16394</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2020-01-16T09:57:18.013693700Z'/><EventRecordID>150731</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>DESKTOP-G457RDR</Computer><Security/></System><EventData></EventData></Event>

data/test/plugin/test_parser_winevt_sax.rb

@@ -1,4 +1,4 @@
-require 'helper'
+require_relative '../helper'
 
 class WinevtSAXparserTest < Test::Unit::TestCase
 
@@ -16,7 +16,7 @@ class WinevtSAXparserTest < Test::Unit::TestCase
   def test_parse
     d = create_driver
     xml = XMLLOG
-    expected = {"PrividerName"      => "Microsoft-Windows-Security-Auditing",
+    expected = {"ProviderName"      => "Microsoft-Windows-Security-Auditing",
                 "ProviderGUID"      => "{54849625-5478-4994-A5BA-3E3B0328C30D}",
                 "EventID"           => "4624",
                 "Qualifiers"        => nil,
@@ -40,4 +40,40 @@ class WinevtSAXparserTest < Test::Unit::TestCase
 
     assert_true(d.instance.winevt_xml?)
   end
+
+  class QualifiersTest < self
+    def setup
+      @xml = File.open(File.join(__dir__, "..", "data", "eventlog-with-qualifiers.xml"))
+    end
+
+    def teardown
+      @xml.close
+    end
+
+    def test_parse_without_qualifiers
+      d = create_driver CONFIG + %[preserve_qualifiers false]
+      expected = {"ActivityID"        => nil,
+                  "Channel"           => "Application",
+                  "Computer"          => "DESKTOP-G457RDR",
+                  "EventID"           => "3221241866",
+                  "EventRecordID"     => "150731",
+                  "Keywords"          => "0x80000000000000",
+                  "Level"             => "4",
+                  "Opcode"            => "0",
+                  "ProcessID"         => "0",
+                  "ProviderGUID"      => "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
+                  "ProviderName"      => "Microsoft-Windows-Security-SPP",
+                  "RelatedActivityID" => nil,
+                  "Task"              => "0",
+                  "ThreadID"          => "0",
+                  "TimeCreated"       => "2020-01-16T09:57:18.013693700Z",
+                  "UserID"            => nil,
+                  "Version"           => "0"}
+      d.instance.parse(@xml) do |time, record|
+        assert_equal(expected, record)
+      end
+
+      assert_true(d.instance.winevt_xml?)
+    end
+  end
 end

data/test/plugin/test_parser_winevt_xml.rb

@@ -1,4 +1,4 @@
-require 'helper'
+require_relative '../helper'
 
 class WinevtXMLparserTest < Test::Unit::TestCase
 
@@ -7,7 +7,7 @@ class WinevtXMLparserTest < Test::Unit::TestCase
   end
 
   CONFIG = %[]
-  XMLLOG = File.open(File.join(__dir__, "..", "data", "eventlog.xml") )
+  XMLLOG = File.open(File.join(__dir__, "..", "data", "eventlog.xml"))
 
   def create_driver(conf = CONFIG)
     Fluent::Test::Driver::Parser.new(Fluent::Plugin::WinevtXMLparser).configure(conf)
@@ -37,7 +37,44 @@ class WinevtXMLparserTest < Test::Unit::TestCase
     d.instance.parse(xml) do |time, record|
       assert_equal(expected, record)
     end
+    xml.close
 
     assert_true(d.instance.winevt_xml?)
   end
+
+  class QualifiersTest < self
+    def setup
+      @xml = File.open(File.join(__dir__, "..", "data", "eventlog-with-qualifiers.xml"))
+    end
+
+    def teardown
+      @xml.close
+    end
+
+    def test_without_qualifiers
+      d = create_driver CONFIG + %[preserve_qualifiers false]
+      expected = {"ActivityID"        => nil,
+                  "Channel"           => "Application",
+                  "Computer"          => "DESKTOP-G457RDR",
+                  "EventID"           => "3221241866",
+                  "EventRecordID"     => "150731",
+                  "Keywords"          => "0x80000000000000",
+                  "Level"             => "4",
+                  "Opcode"            => "0",
+                  "ProcessID"         => "0",
+                  "ProviderGUID"      => "{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}",
+                  "ProviderName"      => "Microsoft-Windows-Security-SPP",
+                  "RelatedActivityID" => nil,
+                  "Task"              => "0",
+                  "ThreadID"          => "0",
+                  "TimeCreated"       => "2020-01-16T09:57:18.013693700Z",
+                  "UserID"            => nil,
+                  "Version"           => "0"}
+      d.instance.parse(@xml) do |time, record|
+        assert_equal(expected, record)
+      end
+
+      assert_true(d.instance.winevt_xml?)
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-parser-winevt_xml
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.3
 platform: ruby
 authors:
 - Hiroshi Hatake
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-11 00:00:00.000000000 Z
+date: 2021-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -45,14 +45,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.4.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.4.0
 - !ruby/object:Gem::Dependency
   name: fluentd
   requirement: !ruby/object:Gem::Requirement
@@ -77,16 +77,22 @@ dependencies:
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.12.5
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: '1.13'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.12.5
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '1.10'
+        version: '1.13'
 description: Fluentd Parser plugin to parse XML rendered windows event log.
 email:
 - cosmo0920.oucc@gmail.com
@@ -95,8 +101,10 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/linux-test.yaml"
+- ".github/workflows/macos-test.yaml"
+- ".github/workflows/windows-test.yaml"
 - ".gitignore"
-- ".travis.yml"
 - Gemfile
 - LICENSE
 - README.md
@@ -106,6 +114,7 @@ files:
 - lib/fluent/plugin/parser_winevt_sax.rb
 - lib/fluent/plugin/parser_winevt_xml.rb
 - lib/fluent/plugin/winevt_sax_document.rb
+- test/data/eventlog-with-qualifiers.xml
 - test/data/eventlog.xml
 - test/helper.rb
 - test/plugin/test_parser_winevt_sax.rb
@@ -129,11 +138,12 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.2.22
 signing_key: 
 specification_version: 4
 summary: Fluentd Parser plugin to parse XML rendered windows event log.
 test_files:
+- test/data/eventlog-with-qualifiers.xml
 - test/data/eventlog.xml
 - test/helper.rb
 - test/plugin/test_parser_winevt_sax.rb

data/.travis.yml

@@ -1,16 +0,0 @@
-language: ruby
-
-rvm:
-  - 2.3
-  - 2.4.5
-  - 2.5.3
-  - 2.6.0
-
-gemfile:
- - Gemfile
-
-before_install:
-  - gem update --system=2.7.8
-
-script: bundle exec rake test
-sudo: false