logstash-codec-cef 6.2.1-java → 6.2.4-java

Sign up to get free protection for your applications and to get access to all the features.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +12 -2
  3. data/docs/index.asciidoc +94 -5
  4. data/lib/logstash/codecs/cef.rb +19 -39
  5. data/logstash-codec-cef.gemspec +3 -2
  6. data/spec/codecs/cef_spec.rb +24 -1
  7. metadata +19 -6
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: f530caa2c56a19a914e3482cb063a998b8e43807975e1523b2c73156aa7e2fbe
4
- data.tar.gz: d8cada7fc621d62b5ec0ccc3e8e8c8c6dfc401fbbecfa7a5b70c43eed9cd0cea
3
+ metadata.gz: b204281f8d8ab5b22fc8f75231d3a31dd2ab4c2254c7bd4dca981bc996f5f38d
4
+ data.tar.gz: 8e255e40a7967fcd0326bbbd2db40511faaf55ce55222790feaa1b19b20fe3af
5
5
  SHA512:
6
- metadata.gz: 9aff57924314652538bcfb860bbded217955dbfede94f523069b2525e514d44711db5c7884dede93c38723b9b3eb5d5d5782b82bc5e7f0a624f97a664f601f26
7
- data.tar.gz: a53cece29e66a40be33b49e0abaf898519bca82d611d56f0bfa3db034cece00d368741c3cd3afab3ccab888ab2c138ba97cca232d8a49ac1c28477459fdfc3ef
6
+ metadata.gz: 3be6e9d4a944e9eecf8d75dd8e4880c32f12c89eca25b17d1ba33bc33ed95179d34ff8af373f8d3fbd3d9a5c81d64fb4317f4955b0fd92d81aa752473ff94f0e
7
+ data.tar.gz: a24d876f0aeeafeb1d24f2be62dca556f433bf6945ff88cf5d44d1cf97270127429ec68ed9c964b579a39d167d9e2558ccd3fdf567a8e8104a8bb9dec1db30cf
data/CHANGELOG.md CHANGED
@@ -1,12 +1,22 @@
1
+ ## 6.2.4
2
+ - [DOC] Emphasize importance of delimiter setting for byte stream inputs [#95](https://github.com/logstash-plugins/logstash-codec-cef/pull/95)
3
+
4
+ ## 6.2.3
5
+ - Feat: event_factory support [#94](https://github.com/logstash-plugins/logstash-codec-cef/pull/94)
6
+
7
+ ## 6.2.2
8
+ - Fixed invalid Field Reference that could occur when ECS mode was enabled and the CEF field `fileHash` was parsed.
9
+ - Added expanded mapping for numbered `deviceCustom*` and `deviceCustom*Label` fields so that all now include numbers 1 through 15. [#89](https://github.com/logstash-plugins/logstash-codec-cef/pull/89).
10
+
1
11
  ## 6.2.1
2
12
  - Added field mapping to docs.
3
- - Fixed ECS mapping of `deviceMacAddress` field.
13
+ - Fixed ECS mapping of `deviceMacAddress` field. [#88](https://github.com/logstash-plugins/logstash-codec-cef/pull/88).
4
14
 
5
15
  ## 6.2.0
6
16
  - Introduce ECS Compatibility mode [#83](https://github.com/logstash-plugins/logstash-codec-cef/pull/83).
7
17
 
8
18
  ## 6.1.2
9
- - Added error log with full payload when something bad happens in decoding a message[#84](https://github.com/logstash-plugins/logstash-codec-cef/pull/84)
19
+ - Added error log with full payload when something bad happens in decoding a message [#84](https://github.com/logstash-plugins/logstash-codec-cef/pull/84)
10
20
 
11
21
  ## 6.1.1
12
22
  - Improved encoding performance, especially when encoding many extension fields [#81](https://github.com/logstash-plugins/logstash-codec-cef/pull/81)
data/docs/index.asciidoc CHANGED
@@ -166,6 +166,28 @@ The following is a mapping between these fields.
166
166
  |`deviceCustomFloatingPoint3Label` (`cfp3Label`)|`[cef][device_custom_floating_point_3][label]`
167
167
  |`deviceCustomFloatingPoint4` (`cfp4`) |`[cef][device_custom_floating_point_4][value]`
168
168
  |`deviceCustomFloatingPoint4Label` (`cfp4Label`)|`[cef][device_custom_floating_point_4][label]`
169
+ |`deviceCustomFloatingPoint5` (`cfp5`) |`[cef][device_custom_floating_point_5][value]`
170
+ |`deviceCustomFloatingPoint5Label` (`cfp5Label`)|`[cef][device_custom_floating_point_5][label]`
171
+ |`deviceCustomFloatingPoint6` (`cfp6`) |`[cef][device_custom_floating_point_6][value]`
172
+ |`deviceCustomFloatingPoint6Label` (`cfp6Label`)|`[cef][device_custom_floating_point_6][label]`
173
+ |`deviceCustomFloatingPoint7` (`cfp7`) |`[cef][device_custom_floating_point_7][value]`
174
+ |`deviceCustomFloatingPoint7Label` (`cfp7Label`)|`[cef][device_custom_floating_point_7][label]`
175
+ |`deviceCustomFloatingPoint8` (`cfp8`) |`[cef][device_custom_floating_point_8][value]`
176
+ |`deviceCustomFloatingPoint8Label` (`cfp8Label`)|`[cef][device_custom_floating_point_8][label]`
177
+ |`deviceCustomFloatingPoint9` (`cfp9`) |`[cef][device_custom_floating_point_9][value]`
178
+ |`deviceCustomFloatingPoint9Label` (`cfp9Label`)|`[cef][device_custom_floating_point_9][label]`
179
+ |`deviceCustomFloatingPoint10` (`cfp10`) |`[cef][device_custom_floating_point_10][value]`
180
+ |`deviceCustomFloatingPoint10Label` (`cfp10Label`)|`[cef][device_custom_floating_point_10][label]`
181
+ |`deviceCustomFloatingPoint11` (`cfp11`) |`[cef][device_custom_floating_point_11][value]`
182
+ |`deviceCustomFloatingPoint11Label` (`cfp11Label`)|`[cef][device_custom_floating_point_11][label]`
183
+ |`deviceCustomFloatingPoint12` (`cfp12`) |`[cef][device_custom_floating_point_12][value]`
184
+ |`deviceCustomFloatingPoint12Label` (`cfp12Label`)|`[cef][device_custom_floating_point_12][label]`
185
+ |`deviceCustomFloatingPoint13` (`cfp13`) |`[cef][device_custom_floating_point_13][value]`
186
+ |`deviceCustomFloatingPoint13Label` (`cfp13Label`)|`[cef][device_custom_floating_point_13][label]`
187
+ |`deviceCustomFloatingPoint14` (`cfp14`) |`[cef][device_custom_floating_point_14][value]`
188
+ |`deviceCustomFloatingPoint14Label` (`cfp14Label`)|`[cef][device_custom_floating_point_14][label]`
189
+ |`deviceCustomFloatingPoint15` (`cfp15`) |`[cef][device_custom_floating_point_15][value]`
190
+ |`deviceCustomFloatingPoint15Label` (`cfp15Label`)|`[cef][device_custom_floating_point_15][label]`
169
191
  |`deviceCustomIPv6Address1` (`c6a1`) |`[cef][device_custom_ipv6_address_1][value]`
170
192
  |`deviceCustomIPv6Address1Label` (`c6a1Label`) |`[cef][device_custom_ipv6_address_1][label]`
171
193
  |`deviceCustomIPv6Address2` (`c6a2`) |`[cef][device_custom_ipv6_address_2][value]`
@@ -174,12 +196,58 @@ The following is a mapping between these fields.
174
196
  |`deviceCustomIPv6Address3Label` (`c6a3Label`) |`[cef][device_custom_ipv6_address_3][label]`
175
197
  |`deviceCustomIPv6Address4` (`c6a4`) |`[cef][device_custom_ipv6_address_4][value]`
176
198
  |`deviceCustomIPv6Address4Label` (`c6a4Label`) |`[cef][device_custom_ipv6_address_4][label]`
199
+ |`deviceCustomIPv6Address5` (`c6a5`) |`[cef][device_custom_ipv6_address_5][value]`
200
+ |`deviceCustomIPv6Address5Label` (`c6a5Label`) |`[cef][device_custom_ipv6_address_5][label]`
201
+ |`deviceCustomIPv6Address6` (`c6a6`) |`[cef][device_custom_ipv6_address_6][value]`
202
+ |`deviceCustomIPv6Address6Label` (`c6a6Label`) |`[cef][device_custom_ipv6_address_6][label]`
203
+ |`deviceCustomIPv6Address7` (`c6a7`) |`[cef][device_custom_ipv6_address_7][value]`
204
+ |`deviceCustomIPv6Address7Label` (`c6a7Label`) |`[cef][device_custom_ipv6_address_7][label]`
205
+ |`deviceCustomIPv6Address8` (`c6a8`) |`[cef][device_custom_ipv6_address_8][value]`
206
+ |`deviceCustomIPv6Address8Label` (`c6a8Label`) |`[cef][device_custom_ipv6_address_8][label]`
207
+ |`deviceCustomIPv6Address9` (`c6a9`) |`[cef][device_custom_ipv6_address_9][value]`
208
+ |`deviceCustomIPv6Address9Label` (`c6a9Label`) |`[cef][device_custom_ipv6_address_9][label]`
209
+ |`deviceCustomIPv6Address10` (`c6a10`) |`[cef][device_custom_ipv6_address_10][value]`
210
+ |`deviceCustomIPv6Address10Label` (`c6a10Label`)|`[cef][device_custom_ipv6_address_10][label]`
211
+ |`deviceCustomIPv6Address11` (`c6a11`) |`[cef][device_custom_ipv6_address_11][value]`
212
+ |`deviceCustomIPv6Address11Label` (`c6a11Label`)|`[cef][device_custom_ipv6_address_11][label]`
213
+ |`deviceCustomIPv6Address12` (`c6a12`) |`[cef][device_custom_ipv6_address_12][value]`
214
+ |`deviceCustomIPv6Address12Label` (`c6a12Label`)|`[cef][device_custom_ipv6_address_12][label]`
215
+ |`deviceCustomIPv6Address13` (`c6a13`) |`[cef][device_custom_ipv6_address_13][value]`
216
+ |`deviceCustomIPv6Address13Label` (`c6a13Label`)|`[cef][device_custom_ipv6_address_13][label]`
217
+ |`deviceCustomIPv6Address14` (`c6a14`) |`[cef][device_custom_ipv6_address_14][value]`
218
+ |`deviceCustomIPv6Address14Label` (`c6a14Label`)|`[cef][device_custom_ipv6_address_14][label]`
219
+ |`deviceCustomIPv6Address15` (`c6a15`) |`[cef][device_custom_ipv6_address_15][value]`
220
+ |`deviceCustomIPv6Address15Label` (`c6a15Label`)|`[cef][device_custom_ipv6_address_15][label]`
177
221
  |`deviceCustomNumber1` (`cn1`) |`[cef][device_custom_number_1][value]`
178
222
  |`deviceCustomNumber1Label` (`cn1Label`) |`[cef][device_custom_number_1][label]`
179
223
  |`deviceCustomNumber2` (`cn2`) |`[cef][device_custom_number_2][value]`
180
224
  |`deviceCustomNumber2Label` (`cn2Label`) |`[cef][device_custom_number_2][label]`
181
225
  |`deviceCustomNumber3` (`cn3`) |`[cef][device_custom_number_3][value]`
182
226
  |`deviceCustomNumber3Label` (`cn3Label`) |`[cef][device_custom_number_3][label]`
227
+ |`deviceCustomNumber4` (`cn4`) |`[cef][device_custom_number_4][value]`
228
+ |`deviceCustomNumber4Label` (`cn4Label`) |`[cef][device_custom_number_4][label]`
229
+ |`deviceCustomNumber5` (`cn5`) |`[cef][device_custom_number_5][value]`
230
+ |`deviceCustomNumber5Label` (`cn5Label`) |`[cef][device_custom_number_5][label]`
231
+ |`deviceCustomNumber6` (`cn6`) |`[cef][device_custom_number_6][value]`
232
+ |`deviceCustomNumber6Label` (`cn6Label`) |`[cef][device_custom_number_6][label]`
233
+ |`deviceCustomNumber7` (`cn7`) |`[cef][device_custom_number_7][value]`
234
+ |`deviceCustomNumber7Label` (`cn7Label`) |`[cef][device_custom_number_7][label]`
235
+ |`deviceCustomNumber8` (`cn8`) |`[cef][device_custom_number_8][value]`
236
+ |`deviceCustomNumber8Label` (`cn8Label`) |`[cef][device_custom_number_8][label]`
237
+ |`deviceCustomNumber9` (`cn9`) |`[cef][device_custom_number_9][value]`
238
+ |`deviceCustomNumber9Label` (`cn9Label`) |`[cef][device_custom_number_9][label]`
239
+ |`deviceCustomNumber10` (`cn10`) |`[cef][device_custom_number_10][value]`
240
+ |`deviceCustomNumber10Label` (`cn10Label`) |`[cef][device_custom_number_10][label]`
241
+ |`deviceCustomNumber11` (`cn11`) |`[cef][device_custom_number_11][value]`
242
+ |`deviceCustomNumber11Label` (`cn11Label`) |`[cef][device_custom_number_11][label]`
243
+ |`deviceCustomNumber12` (`cn12`) |`[cef][device_custom_number_12][value]`
244
+ |`deviceCustomNumber12Label` (`cn12Label`) |`[cef][device_custom_number_12][label]`
245
+ |`deviceCustomNumber13` (`cn13`) |`[cef][device_custom_number_13][value]`
246
+ |`deviceCustomNumber13Label` (`cn13Label`) |`[cef][device_custom_number_13][label]`
247
+ |`deviceCustomNumber14` (`cn14`) |`[cef][device_custom_number_14][value]`
248
+ |`deviceCustomNumber14Label` (`cn14Label`) |`[cef][device_custom_number_14][label]`
249
+ |`deviceCustomNumber15` (`cn15`) |`[cef][device_custom_number_15][value]`
250
+ |`deviceCustomNumber15Label` (`cn15Label`) |`[cef][device_custom_number_15][label]`
183
251
  |`deviceCustomString1` (`cs1`) |`[cef][device_custom_string_1][value]`
184
252
  |`deviceCustomString1Label` (`cs1Label`) |`[cef][device_custom_string_1][label]`
185
253
  |`deviceCustomString2` (`cs2`) |`[cef][device_custom_string_2][value]`
@@ -192,6 +260,24 @@ The following is a mapping between these fields.
192
260
  |`deviceCustomString5Label` (`cs5Label`) |`[cef][device_custom_string_5][label]`
193
261
  |`deviceCustomString6` (`cs6`) |`[cef][device_custom_string_6][value]`
194
262
  |`deviceCustomString6Label` (`cs6Label`) |`[cef][device_custom_string_6][label]`
263
+ |`deviceCustomString7` (`cs7`) |`[cef][device_custom_string_7][value]`
264
+ |`deviceCustomString7Label` (`cs7Label`) |`[cef][device_custom_string_7][label]`
265
+ |`deviceCustomString8` (`cs8`) |`[cef][device_custom_string_8][value]`
266
+ |`deviceCustomString8Label` (`cs8Label`) |`[cef][device_custom_string_8][label]`
267
+ |`deviceCustomString9` (`cs9`) |`[cef][device_custom_string_9][value]`
268
+ |`deviceCustomString9Label` (`cs9Label`) |`[cef][device_custom_string_9][label]`
269
+ |`deviceCustomString10` (`cs10`) |`[cef][device_custom_string_10][value]`
270
+ |`deviceCustomString10Label` (`cs10Label`) |`[cef][device_custom_string_10][label]`
271
+ |`deviceCustomString11` (`cs11`) |`[cef][device_custom_string_11][value]`
272
+ |`deviceCustomString11Label` (`cs11Label`) |`[cef][device_custom_string_11][label]`
273
+ |`deviceCustomString12` (`cs12`) |`[cef][device_custom_string_12][value]`
274
+ |`deviceCustomString12Label` (`cs12Label`) |`[cef][device_custom_string_12][label]`
275
+ |`deviceCustomString13` (`cs13`) |`[cef][device_custom_string_13][value]`
276
+ |`deviceCustomString13Label` (`cs13Label`) |`[cef][device_custom_string_13][label]`
277
+ |`deviceCustomString14` (`cs14`) |`[cef][device_custom_string_14][value]`
278
+ |`deviceCustomString14Label` (`cs14Label`) |`[cef][device_custom_string_14][label]`
279
+ |`deviceCustomString15` (`cs15`) |`[cef][device_custom_string_15][value]`
280
+ |`deviceCustomString15Label` (`cs15Label`) |`[cef][device_custom_string_15][label]`
195
281
  |`deviceDirection` |`[network][direction]`
196
282
  .2+|`deviceDnsDomain` |`[observer][registered_domain]`
197
283
 
@@ -242,7 +328,7 @@ The following is a mapping between these fields.
242
328
  |`eventOutcome` (`outcome`) |`[event][outcome]`
243
329
  |`externalId` |`[cef][external_id]`
244
330
  |`fileCreateTime` |`[file][created]`
245
- |`fileHash` |`[file][hash]]`
331
+ |`fileHash` |`[file][hash]`
246
332
  |`fileId` |`[file][inode]`
247
333
  |`fileModificationTime` |`[file][mtime]`
248
334
 
@@ -355,14 +441,19 @@ not include timezone information, this `default_timezone` is used instead.
355
441
  If your input puts a delimiter between each CEF event, you'll want to set
356
442
  this to be that delimiter.
357
443
 
358
- For example, with the TCP input, you probably want to put this:
444
+ NOTE: Byte stream inputs such as TCP require delimiter to be specified. Otherwise input can be truncated or incorrectly split.
359
445
 
446
+ **Example**
447
+
448
+ [source,ruby]
449
+ -----
360
450
  input {
361
451
  tcp {
362
452
  codec => cef { delimiter => "\r\n" }
363
453
  # ...
364
454
  }
365
455
  }
456
+ -----
366
457
 
367
458
  This setting allows the following character sequences to have special meaning:
368
459
 
@@ -398,9 +489,7 @@ If the codec handles data from a variety of sources, the ECS recommendation is t
398
489
  ** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
399
490
  ** Otherwise, the default value is `disabled`.
400
491
 
401
- Controls this plugin's compatibility with the
402
- {ecs-ref}[Elastic Common Schema (ECS)]
403
- (ECS)].
492
+ Controls this plugin's compatibility with the {ecs-ref}[Elastic Common Schema (ECS)].
404
493
 
405
494
  [id="plugins-{type}s-{plugin}-fields"]
406
495
  ===== `fields`
data/lib/logstash/codecs/cef.rb CHANGED
@@ -6,6 +6,7 @@ require "json"
6
6
  require "time"
7
7
 
8
8
  require 'logstash/plugin_mixins/ecs_compatibility_support'
9
+ require 'logstash/plugin_mixins/event_support/event_factory_adapter'
9
10
 
10
11
  # Implementation of a Logstash codec for the ArcSight Common Event Format (CEF)
11
12
  # Based on Revision 20 of Implementing ArcSight CEF, dated from June 05, 2013
@@ -16,7 +17,8 @@ require 'logstash/plugin_mixins/ecs_compatibility_support'
16
17
  class LogStash::Codecs::CEF < LogStash::Codecs::Base
17
18
  config_name "cef"
18
19
 
19
- include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1)
20
+ include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1, :v8 => :v1)
21
+ include LogStash::PluginMixins::EventSupport::EventFactoryAdapter
20
22
 
21
23
  InvalidTimestamp = Class.new(StandardError)
22
24
 
@@ -201,7 +203,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
201
203
 
202
204
  def handle(data, &block)
203
205
  original_data = data.dup
204
- event = LogStash::Event.new
206
+ event = event_factory.new_event
205
207
  event.set(raw_data_field, data) unless raw_data_field.nil?
206
208
 
207
209
  @utf8_charset.convert(data)
@@ -282,7 +284,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
282
284
  rescue => e
283
285
  @logger.error("Failed to decode CEF payload. Generating failure event with payload in message field.",
284
286
  :exception => e.class, :message => e.message, :backtrace => e.backtrace, :original_data => original_data)
285
- yield LogStash::Event.new("message" => data, "tags" => ["_cefparsefailure"])
287
+ yield event_factory.new_event("message" => data, "tags" => ["_cefparsefailure"])
286
288
  end
287
289
 
288
290
  public
@@ -408,40 +410,18 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
408
410
  CEFField.new("destinationZoneURI", ecs_field: "[cef][destination][zone][uri]"),
409
411
  CEFField.new("deviceAction", key: "act", ecs_field: "[event][action]"),
410
412
  CEFField.new("deviceAddress", key: "dvc", ecs_field: "[#{@device}][ip]"),
411
- CEFField.new("deviceCustomFloatingPoint1", key: "cfp1", ecs_field: "[cef][device_custom_floating_point_1][value]"),
412
- CEFField.new("deviceCustomFloatingPoint1Label", key: "cfp1Label", ecs_field: "[cef][device_custom_floating_point_1][label]"),
413
- CEFField.new("deviceCustomFloatingPoint2", key: "cfp2", ecs_field: "[cef][device_custom_floating_point_2][value]"),
414
- CEFField.new("deviceCustomFloatingPoint2Label", key: "cfp2Label", ecs_field: "[cef][device_custom_floating_point_2][label]"),
415
- CEFField.new("deviceCustomFloatingPoint3", key: "cfp3", ecs_field: "[cef][device_custom_floating_point_3][value]"),
416
- CEFField.new("deviceCustomFloatingPoint3Label", key: "cfp3Label", ecs_field: "[cef][device_custom_floating_point_3][label]"),
417
- CEFField.new("deviceCustomFloatingPoint4", key: "cfp4", ecs_field: "[cef][device_custom_floating_point_4][value]"),
418
- CEFField.new("deviceCustomFloatingPoint4Label", key: "cfp4Label", ecs_field: "[cef][device_custom_floating_point_4][label]"),
419
- CEFField.new("deviceCustomIPv6Address1", key: "c6a1", ecs_field: "[cef][device_custom_ipv6_address_1][value]"),
420
- CEFField.new("deviceCustomIPv6Address1Label", key: "c6a1Label", ecs_field: "[cef][device_custom_ipv6_address_1][label]"),
421
- CEFField.new("deviceCustomIPv6Address2", key: "c6a2", ecs_field: "[cef][device_custom_ipv6_address_2][value]"),
422
- CEFField.new("deviceCustomIPv6Address2Label", key: "c6a2Label", ecs_field: "[cef][device_custom_ipv6_address_2][label]"),
423
- CEFField.new("deviceCustomIPv6Address3", key: "c6a3", ecs_field: "[cef][device_custom_ipv6_address_3][value]"),
424
- CEFField.new("deviceCustomIPv6Address3Label", key: "c6a3Label", ecs_field: "[cef][device_custom_ipv6_address_3][label]"),
425
- CEFField.new("deviceCustomIPv6Address4", key: "c6a4", ecs_field: "[cef][device_custom_ipv6_address_4][value]"),
426
- CEFField.new("deviceCustomIPv6Address4Label", key: "c6a4Label", ecs_field: "[cef][device_custom_ipv6_address_4][label]"),
427
- CEFField.new("deviceCustomNumber1", key: "cn1", ecs_field: "[cef][device_custom_number_1][value]"),
428
- CEFField.new("deviceCustomNumber1Label", key: "cn1Label", ecs_field: "[cef][device_custom_number_1][label]"),
429
- CEFField.new("deviceCustomNumber2", key: "cn2", ecs_field: "[cef][device_custom_number_2][value]"),
430
- CEFField.new("deviceCustomNumber2Label", key: "cn2Label", ecs_field: "[cef][device_custom_number_2][label]"),
431
- CEFField.new("deviceCustomNumber3", key: "cn3", ecs_field: "[cef][device_custom_number_3][value]"),
432
- CEFField.new("deviceCustomNumber3Label", key: "cn3Label", ecs_field: "[cef][device_custom_number_3][label]"),
433
- CEFField.new("deviceCustomString1", key: "cs1", ecs_field: "[cef][device_custom_string_1][value]"),
434
- CEFField.new("deviceCustomString1Label", key: "cs1Label", ecs_field: "[cef][device_custom_string_1][label]"),
435
- CEFField.new("deviceCustomString2", key: "cs2", ecs_field: "[cef][device_custom_string_2][value]"),
436
- CEFField.new("deviceCustomString2Label", key: "cs2Label", ecs_field: "[cef][device_custom_string_2][label]"),
437
- CEFField.new("deviceCustomString3", key: "cs3", ecs_field: "[cef][device_custom_string_3][value]"),
438
- CEFField.new("deviceCustomString3Label", key: "cs3Label", ecs_field: "[cef][device_custom_string_3][label]"),
439
- CEFField.new("deviceCustomString4", key: "cs4", ecs_field: "[cef][device_custom_string_4][value]"),
440
- CEFField.new("deviceCustomString4Label", key: "cs4Label", ecs_field: "[cef][device_custom_string_4][label]"),
441
- CEFField.new("deviceCustomString5", key: "cs5", ecs_field: "[cef][device_custom_string_5][value]"),
442
- CEFField.new("deviceCustomString5Label", key: "cs5Label", ecs_field: "[cef][device_custom_string_5][label]"),
443
- CEFField.new("deviceCustomString6", key: "cs6", ecs_field: "[cef][device_custom_string_6][value]"),
444
- CEFField.new("deviceCustomString6Label", key: "cs6Label", ecs_field: "[cef][device_custom_string_6][label]"),
413
+ (1..15).map do |idx|
414
+ [
415
+ CEFField.new("deviceCustomFloatingPoint#{idx}", key: "cfp#{idx}", ecs_field: "[cef][device_custom_floating_point_#{idx}][value]"),
416
+ CEFField.new("deviceCustomFloatingPoint#{idx}Label", key: "cfp#{idx}Label", ecs_field: "[cef][device_custom_floating_point_#{idx}][label]"),
417
+ CEFField.new("deviceCustomIPv6Address#{idx}", key: "c6a#{idx}", ecs_field: "[cef][device_custom_ipv6_address_#{idx}][value]"),
418
+ CEFField.new("deviceCustomIPv6Address#{idx}Label", key: "c6a#{idx}Label", ecs_field: "[cef][device_custom_ipv6_address_#{idx}][label]"),
419
+ CEFField.new("deviceCustomNumber#{idx}", key: "cn#{idx}", ecs_field: "[cef][device_custom_number_#{idx}][value]"),
420
+ CEFField.new("deviceCustomNumber#{idx}Label", key: "cn#{idx}Label", ecs_field: "[cef][device_custom_number_#{idx}][label]"),
421
+ CEFField.new("deviceCustomString#{idx}", key: "cs#{idx}", ecs_field: "[cef][device_custom_string_#{idx}][value]"),
422
+ CEFField.new("deviceCustomString#{idx}Label", key: "cs#{idx}Label", ecs_field: "[cef][device_custom_string_#{idx}][label]"),
423
+ ]
424
+ end,
445
425
  CEFField.new("deviceDirection", ecs_field: "[network][direction]"),
446
426
  CEFField.new("deviceDnsDomain", ecs_field: "[#{@device}][registered_domain]", priority: 10),
447
427
  CEFField.new("deviceEventCategory", key: "cat", ecs_field: "[cef][category]"),
@@ -468,7 +448,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
468
448
  CEFField.new("eventOutcome", key: "outcome", ecs_field: "[event][outcome]"),
469
449
  CEFField.new("externalId", ecs_field: "[cef][external_id]"),
470
450
  CEFField.new("fileCreateTime", ecs_field: "[file][created]"),
471
- CEFField.new("fileHash", ecs_field: "[file][hash]]"),
451
+ CEFField.new("fileHash", ecs_field: "[file][hash]"),
472
452
  CEFField.new("fileId", ecs_field: "[file][inode]"),
473
453
  CEFField.new("fileModificationTime", ecs_field: "[file][mtime]", normalize: :timestamp),
474
454
  CEFField.new("fileName", key: "fname", ecs_field: "[file][name]"),
@@ -517,7 +497,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
517
497
  CEFField.new("startTime", key: "start", ecs_field: "[event][start]", normalize: :timestamp),
518
498
  CEFField.new("transportProtocol", key: "proto", ecs_field: "[network][transport]"),
519
499
  CEFField.new("type", ecs_field: "[cef][type]"),
520
- ].sort_by(&:priority).each do |cef|
500
+ ].flatten.sort_by(&:priority).each do |cef|
521
501
  field_name = ecs_select[disabled:cef.name, v1:cef.ecs_field]
522
502
 
523
503
  # whether the source is a cef_key or cef_name, normalize to field_name
data/logstash-codec-cef.gemspec CHANGED
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-codec-cef'
4
- s.version = '6.2.1'
4
+ s.version = '6.2.4'
5
5
  s.platform = 'java'
6
6
  s.licenses = ['Apache License (2.0)']
7
7
  s.summary = "Reads the ArcSight Common Event Format (CEF)."
@@ -22,7 +22,8 @@ Gem::Specification.new do |s|
22
22
 
23
23
  # Gem dependencies
24
24
  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
25
- s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~>1.1'
25
+ s.add_runtime_dependency "logstash-mixin-ecs_compatibility_support", '~> 1.3'
26
+ s.add_runtime_dependency "logstash-mixin-event_support", '~> 1.0'
26
27
 
27
28
  s.add_development_dependency 'logstash-devutils'
28
29
  s.add_development_dependency 'insist'
data/spec/codecs/cef_spec.rb CHANGED
@@ -780,6 +780,29 @@ describe LogStash::Codecs::CEF do
780
780
  end
781
781
  end
782
782
 
783
+ let(:log_with_fileHash) { "Syslogdate Sysloghost CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|fileHash=1bad1dea" }
784
+ it 'decodes fileHash to [file][hash]' do
785
+ decode_one(subject, log_with_fileHash) do |e|
786
+ validate(e)
787
+ insist { e.get(ecs_select[disabled:"fileHash", v1:"[file][hash]"]) } == "1bad1dea"
788
+ end
789
+ end
790
+
791
+ let(:log_with_custom_typed_fields) { "Syslogdate Sysloghost CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|cfp15=3.1415926 cfp15Label=pi c6a12=::1 c6a12Label=localhost cn7=8191 cn7Label=mersenne cs4=silly cs4Label=theory" }
792
+ it 'decodes to mapped numbered fields' do
793
+ decode_one(subject, log_with_custom_typed_fields) do |e|
794
+ validate(e)
795
+ insist { e.get(ecs_select[disabled: "deviceCustomFloatingPoint15", v1: "[cef][device_custom_floating_point_15][value]"]) } == "3.1415926"
796
+ insist { e.get(ecs_select[disabled: "deviceCustomFloatingPoint15Label", v1: "[cef][device_custom_floating_point_15][label]"]) } == "pi"
797
+ insist { e.get(ecs_select[disabled: "deviceCustomIPv6Address12", v1: "[cef][device_custom_ipv6_address_12][value]"]) } == "::1"
798
+ insist { e.get(ecs_select[disabled: "deviceCustomIPv6Address12Label", v1: "[cef][device_custom_ipv6_address_12][label]"]) } == "localhost"
799
+ insist { e.get(ecs_select[disabled: "deviceCustomNumber7", v1: "[cef][device_custom_number_7][value]"]) } == "8191"
800
+ insist { e.get(ecs_select[disabled: "deviceCustomNumber7Label", v1: "[cef][device_custom_number_7][label]"]) } == "mersenne"
801
+ insist { e.get(ecs_select[disabled: "deviceCustomString4", v1: "[cef][device_custom_string_4][value]"]) } == "silly"
802
+ insist { e.get(ecs_select[disabled: "deviceCustomString4Label", v1: "[cef][device_custom_string_4][label]"]) } == "theory"
803
+ end
804
+ end
805
+
783
806
  context 'with UTF-8 message' do
784
807
  let(:message) { 'CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=192.168.1.11 target=aaaaaああああaaaa msg=Description Omitted' }
785
808
 
@@ -850,7 +873,7 @@ describe LogStash::Codecs::CEF do
850
873
 
851
874
  let(:results) { [] }
852
875
 
853
- ecs_compatibility_matrix(:disabled,:v1) do |ecs_select|
876
+ ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|
854
877
  before(:each) do
855
878
  allow_any_instance_of(described_class).to receive(:ecs_compatibility).and_return(ecs_compatibility)
856
879
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-codec-cef
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.2.1
4
+ version: 6.2.4
5
5
  platform: java
6
6
  authors:
7
7
  - Elastic
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-04-28 00:00:00.000000000 Z
11
+ date: 2022-03-15 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  requirement: !ruby/object:Gem::Requirement
@@ -35,7 +35,7 @@ dependencies:
35
35
  requirements:
36
36
  - - "~>"
37
37
  - !ruby/object:Gem::Version
38
- version: '1.1'
38
+ version: '1.3'
39
39
  name: logstash-mixin-ecs_compatibility_support
40
40
  prerelease: false
41
41
  type: :runtime
@@ -43,7 +43,21 @@ dependencies:
43
43
  requirements:
44
44
  - - "~>"
45
45
  - !ruby/object:Gem::Version
46
- version: '1.1'
46
+ version: '1.3'
47
+ - !ruby/object:Gem::Dependency
48
+ requirement: !ruby/object:Gem::Requirement
49
+ requirements:
50
+ - - "~>"
51
+ - !ruby/object:Gem::Version
52
+ version: '1.0'
53
+ name: logstash-mixin-event_support
54
+ prerelease: false
55
+ type: :runtime
56
+ version_requirements: !ruby/object:Gem::Requirement
57
+ requirements:
58
+ - - "~>"
59
+ - !ruby/object:Gem::Version
60
+ version: '1.0'
47
61
  - !ruby/object:Gem::Dependency
48
62
  requirement: !ruby/object:Gem::Requirement
49
63
  requirements:
@@ -113,8 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
113
127
  - !ruby/object:Gem::Version
114
128
  version: '0'
115
129
  requirements: []
116
- rubyforge_project:
117
- rubygems_version: 2.6.13
130
+ rubygems_version: 3.1.6
118
131
  signing_key:
119
132
  specification_version: 4
120
133
  summary: Reads the ArcSight Common Event Format (CEF).