fluent-plugin-twistlock-syslog 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 62d3bfe07dfc4bf1a5860a676260c0206b60eec0e22782be0173add3e8979b66
+  data.tar.gz: 742634d44f0c3083930a33fb3fbd2e5d0fc064060f5c3dbd51852b54f096b069
+SHA512:
+  metadata.gz: 692797d8e84d71f0375b1e10fb7d9ccc6bf7bd0aa12cafb6cf453a5b17526dafd3297ee1ef65c78729a4228f3f91baddde20b27a124fee0b9feb1e2206538f9a
+  data.tar.gz: 90c94079781fc2a9427467f047572722116fd60fe4b9644545d04c1601107f3b23a7905952cdb7b431947cf12e69d4eb163f1f06ede412f6013a68d595f5bde9

data/Rakefile

@@ -0,0 +1,11 @@
+#!/usr/bin/env rake
+require "bundler/gem_tasks"
+
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/test_*.rb'
+  test.verbose = true
+end
+
+task :default => :test

data/lib/fluent/plugin/filter_twistlock_syslog.rb

@@ -0,0 +1,44 @@
+require 'fluent/plugin/filter'
+require 'digest'
+
+module Fluent::Plugin
+  class TwistlockSyslogFilter < Filter
+    # Register this filter as "twistlock-syslog"
+    Fluent::Plugin.register_filter('twistlock_syslog', self)
+    config_param :key_path, :string, default: '/fluentd/etc/private.pem'
+    config_param :key_name, :string, default: 'message'
+
+    def configure(conf)
+      super
+      unless File.file?(@key_path)
+        raise Fluent::ConfigError, "Private key file must be present. #{@key_path} Please check."
+      end
+    end
+    def start
+      super
+      @private_key = OpenSSL::PKey::RSA.new(File.read(@key_path))
+    end
+    def filter(tag, time, record)
+      message = record[@key_name][0..-2]
+      begin
+        message.split(/(?<!\\|=)"\s/).each { |in_msg|
+          keymap = in_msg.split('="')
+          record[keymap[0]] = keymap[1]
+        }
+        record.delete("ident")
+        record.delete("pid")
+        record.delete("time")
+        if record.key?("host_name")
+          record["host"] = record["host_name"]
+          record.delete("host_name")
+        end
+        signature = @private_key.sign(OpenSSL::Digest::SHA256.new, record[@key_name])
+        record["signature"] = Base64.encode64(signature)
+      rescue Exception => e
+        log.warn "Unable to map record with message=#{record[@key_name]}"
+        log.warn e.backtrace.inspect
+      end
+      record.sort_by { |key, strings| strings.length }
+    end
+  end
+end

metadata

@@ -0,0 +1,95 @@
+--- !ruby/object:Gem::Specification
+name: fluent-plugin-twistlock-syslog
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- nronix
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-06-13 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fluentd
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.10.58
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.10.58
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.2
+- !ruby/object:Gem::Dependency
+  name: test-unit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.0.8
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.0.8
+description: Filter plugin for Fluent to convert twistlock syslog message to hashmap
+  for better SIEM data
+email: nikhilrao37@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- Rakefile
+- lib/fluent/plugin/filter_twistlock_syslog.rb
+homepage: https://github.com/nronix/fluentd-filter-twistlock-syslog
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.4
+signing_key:
+specification_version: 4
+summary: Filter plugin for Fluent to convert twistlock syslog message to hashmap for
+  better SIEM data
+test_files: []