logstash-codec-cef 6.2.1-java → 6.2.4-java

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +12 -2
  3. data/docs/index.asciidoc +94 -5
  4. data/lib/logstash/codecs/cef.rb +19 -39
  5. data/logstash-codec-cef.gemspec +3 -2
  6. data/spec/codecs/cef_spec.rb +24 -1
  7. metadata +19 -6
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: f530caa2c56a19a914e3482cb063a998b8e43807975e1523b2c73156aa7e2fbe
4
- data.tar.gz: d8cada7fc621d62b5ec0ccc3e8e8c8c6dfc401fbbecfa7a5b70c43eed9cd0cea
3
+ metadata.gz: b204281f8d8ab5b22fc8f75231d3a31dd2ab4c2254c7bd4dca981bc996f5f38d
4
+ data.tar.gz: 8e255e40a7967fcd0326bbbd2db40511faaf55ce55222790feaa1b19b20fe3af
5
5
  SHA512:
6
- metadata.gz: 9aff57924314652538bcfb860bbded217955dbfede94f523069b2525e514d44711db5c7884dede93c38723b9b3eb5d5d5782b82bc5e7f0a624f97a664f601f26
7
- data.tar.gz: a53cece29e66a40be33b49e0abaf898519bca82d611d56f0bfa3db034cece00d368741c3cd3afab3ccab888ab2c138ba97cca232d8a49ac1c28477459fdfc3ef
6
+ metadata.gz: 3be6e9d4a944e9eecf8d75dd8e4880c32f12c89eca25b17d1ba33bc33ed95179d34ff8af373f8d3fbd3d9a5c81d64fb4317f4955b0fd92d81aa752473ff94f0e
7
+ data.tar.gz: a24d876f0aeeafeb1d24f2be62dca556f433bf6945ff88cf5d44d1cf97270127429ec68ed9c964b579a39d167d9e2558ccd3fdf567a8e8104a8bb9dec1db30cf
data/CHANGELOG.md CHANGED
@@ -1,12 +1,22 @@
1
+ ## 6.2.4
2
+ - [DOC] Emphasize importance of delimiter setting for byte stream inputs [#95](https://github.com/logstash-plugins/logstash-codec-cef/pull/95)
3
+
4
+ ## 6.2.3
5
+ - Feat: event_factory support [#94](https://github.com/logstash-plugins/logstash-codec-cef/pull/94)
6
+
7
+ ## 6.2.2
8
+ - Fixed invalid Field Reference that could occur when ECS mode was enabled and the CEF field `fileHash` was parsed.
9
+ - Added expanded mapping for numbered `deviceCustom*` and `deviceCustom*Label` fields so that all now include numbers 1 through 15. [#89](https://github.com/logstash-plugins/logstash-codec-cef/pull/89).
10
+
1
11
  ## 6.2.1
2
12
  - Added field mapping to docs.
3
- - Fixed ECS mapping of `deviceMacAddress` field.
13
+ - Fixed ECS mapping of `deviceMacAddress` field. [#88](https://github.com/logstash-plugins/logstash-codec-cef/pull/88).
4
14
 
5
15
  ## 6.2.0
6
16
  - Introduce ECS Compatibility mode [#83](https://github.com/logstash-plugins/logstash-codec-cef/pull/83).
7
17
 
8
18
  ## 6.1.2
9
- - Added error log with full payload when something bad happens in decoding a message[#84](https://github.com/logstash-plugins/logstash-codec-cef/pull/84)
19
+ - Added error log with full payload when something bad happens in decoding a message [#84](https://github.com/logstash-plugins/logstash-codec-cef/pull/84)
10
20
 
11
21
  ## 6.1.1
12
22
  - Improved encoding performance, especially when encoding many extension fields [#81](https://github.com/logstash-plugins/logstash-codec-cef/pull/81)
data/docs/index.asciidoc CHANGED
@@ -166,6 +166,28 @@ The following is a mapping between these fields.
166
166
  |`deviceCustomFloatingPoint3Label` (`cfp3Label`)|`[cef][device_custom_floating_point_3][label]`
167
167
  |`deviceCustomFloatingPoint4` (`cfp4`) |`[cef][device_custom_floating_point_4][value]`
168
168
  |`deviceCustomFloatingPoint4Label` (`cfp4Label`)|`[cef][device_custom_floating_point_4][label]`
169
+ |`deviceCustomFloatingPoint5` (`cfp5`) |`[cef][device_custom_floating_point_5][value]`
170
+ |`deviceCustomFloatingPoint5Label` (`cfp5Label`)|`[cef][device_custom_floating_point_5][label]`
171
+ |`deviceCustomFloatingPoint6` (`cfp6`) |`[cef][device_custom_floating_point_6][value]`
172
+ |`deviceCustomFloatingPoint6Label` (`cfp6Label`)|`[cef][device_custom_floating_point_6][label]`
173
+ |`deviceCustomFloatingPoint7` (`cfp7`) |`[cef][device_custom_floating_point_7][value]`
174
+ |`deviceCustomFloatingPoint7Label` (`cfp7Label`)|`[cef][device_custom_floating_point_7][label]`
175
+ |`deviceCustomFloatingPoint8` (`cfp8`) |`[cef][device_custom_floating_point_8][value]`
176
+ |`deviceCustomFloatingPoint8Label` (`cfp8Label`)|`[cef][device_custom_floating_point_8][label]`
177
+ |`deviceCustomFloatingPoint9` (`cfp9`) |`[cef][device_custom_floating_point_9][value]`
178
+ |`deviceCustomFloatingPoint9Label` (`cfp9Label`)|`[cef][device_custom_floating_point_9][label]`
179
+ |`deviceCustomFloatingPoint10` (`cfp10`) |`[cef][device_custom_floating_point_10][value]`
180
+ |`deviceCustomFloatingPoint10Label` (`cfp10Label`)|`[cef][device_custom_floating_point_10][label]`
181
+ |`deviceCustomFloatingPoint11` (`cfp11`) |`[cef][device_custom_floating_point_11][value]`
182
+ |`deviceCustomFloatingPoint11Label` (`cfp11Label`)|`[cef][device_custom_floating_point_11][label]`
183
+ |`deviceCustomFloatingPoint12` (`cfp12`) |`[cef][device_custom_floating_point_12][value]`
184
+ |`deviceCustomFloatingPoint12Label` (`cfp12Label`)|`[cef][device_custom_floating_point_12][label]`
185
+ |`deviceCustomFloatingPoint13` (`cfp13`) |`[cef][device_custom_floating_point_13][value]`
186
+ |`deviceCustomFloatingPoint13Label` (`cfp13Label`)|`[cef][device_custom_floating_point_13][label]`
187
+ |`deviceCustomFloatingPoint14` (`cfp14`) |`[cef][device_custom_floating_point_14][value]`
188
+ |`deviceCustomFloatingPoint14Label` (`cfp14Label`)|`[cef][device_custom_floating_point_14][label]`
189
+ |`deviceCustomFloatingPoint15` (`cfp15`) |`[cef][device_custom_floating_point_15][value]`
190
+ |`deviceCustomFloatingPoint15Label` (`cfp15Label`)|`[cef][device_custom_floating_point_15][label]`
169
191
  |`deviceCustomIPv6Address1` (`c6a1`) |`[cef][device_custom_ipv6_address_1][value]`
170
192
  |`deviceCustomIPv6Address1Label` (`c6a1Label`) |`[cef][device_custom_ipv6_address_1][label]`
171
193
  |`deviceCustomIPv6Address2` (`c6a2`) |`[cef][device_custom_ipv6_address_2][value]`
@@ -174,12 +196,58 @@ The following is a mapping between these fields.
174
196
  |`deviceCustomIPv6Address3Label` (`c6a3Label`) |`[cef][device_custom_ipv6_address_3][label]`
175
197
  |`deviceCustomIPv6Address4` (`c6a4`) |`[cef][device_custom_ipv6_address_4][value]`
176
198
  |`deviceCustomIPv6Address4Label` (`c6a4Label`) |`[cef][device_custom_ipv6_address_4][label]`
199
+ |`deviceCustomIPv6Address5` (`c6a5`) |`[cef][device_custom_ipv6_address_5][value]`
200
+ |`deviceCustomIPv6Address5Label` (`c6a5Label`) |`[cef][device_custom_ipv6_address_5][label]`
201
+ |`deviceCustomIPv6Address6` (`c6a6`) |`[cef][device_custom_ipv6_address_6][value]`
202
+ |`deviceCustomIPv6Address6Label` (`c6a6Label`) |`[cef][device_custom_ipv6_address_6][label]`
203
+ |`deviceCustomIPv6Address7` (`c6a7`) |`[cef][device_custom_ipv6_address_7][value]`
204
+ |`deviceCustomIPv6Address7Label` (`c6a7Label`) |`[cef][device_custom_ipv6_address_7][label]`
205
+ |`deviceCustomIPv6Address8` (`c6a8`) |`[cef][device_custom_ipv6_address_8][value]`
206
+ |`deviceCustomIPv6Address8Label` (`c6a8Label`) |`[cef][device_custom_ipv6_address_8][label]`
207
+ |`deviceCustomIPv6Address9` (`c6a9`) |`[cef][device_custom_ipv6_address_9][value]`
208
+ |`deviceCustomIPv6Address9Label` (`c6a9Label`) |`[cef][device_custom_ipv6_address_9][label]`
209
+ |`deviceCustomIPv6Address10` (`c6a10`) |`[cef][device_custom_ipv6_address_10][value]`
210
+ |`deviceCustomIPv6Address10Label` (`c6a10Label`)|`[cef][device_custom_ipv6_address_10][label]`
211
+ |`deviceCustomIPv6Address11` (`c6a11`) |`[cef][device_custom_ipv6_address_11][value]`
212
+ |`deviceCustomIPv6Address11Label` (`c6a11Label`)|`[cef][device_custom_ipv6_address_11][label]`
213
+ |`deviceCustomIPv6Address12` (`c6a12`) |`[cef][device_custom_ipv6_address_12][value]`
214
+ |`deviceCustomIPv6Address12Label` (`c6a12Label`)|`[cef][device_custom_ipv6_address_12][label]`
215
+ |`deviceCustomIPv6Address13` (`c6a13`) |`[cef][device_custom_ipv6_address_13][value]`
216
+ |`deviceCustomIPv6Address13Label` (`c6a13Label`)|`[cef][device_custom_ipv6_address_13][label]`
217
+ |`deviceCustomIPv6Address14` (`c6a14`) |`[cef][device_custom_ipv6_address_14][value]`
218
+ |`deviceCustomIPv6Address14Label` (`c6a14Label`)|`[cef][device_custom_ipv6_address_14][label]`
219
+ |`deviceCustomIPv6Address15` (`c6a15`) |`[cef][device_custom_ipv6_address_15][value]`
220
+ |`deviceCustomIPv6Address15Label` (`c6a15Label`)|`[cef][device_custom_ipv6_address_15][label]`
177
221
  |`deviceCustomNumber1` (`cn1`) |`[cef][device_custom_number_1][value]`
178
222
  |`deviceCustomNumber1Label` (`cn1Label`) |`[cef][device_custom_number_1][label]`
179
223
  |`deviceCustomNumber2` (`cn2`) |`[cef][device_custom_number_2][value]`
180
224
  |`deviceCustomNumber2Label` (`cn2Label`) |`[cef][device_custom_number_2][label]`
181
225
  |`deviceCustomNumber3` (`cn3`) |`[cef][device_custom_number_3][value]`
182
226
  |`deviceCustomNumber3Label` (`cn3Label`) |`[cef][device_custom_number_3][label]`
227
+ |`deviceCustomNumber4` (`cn4`) |`[cef][device_custom_number_4][value]`
228
+ |`deviceCustomNumber4Label` (`cn4Label`) |`[cef][device_custom_number_4][label]`
229
+ |`deviceCustomNumber5` (`cn5`) |`[cef][device_custom_number_5][value]`
230
+ |`deviceCustomNumber5Label` (`cn5Label`) |`[cef][device_custom_number_5][label]`
231
+ |`deviceCustomNumber6` (`cn6`) |`[cef][device_custom_number_6][value]`
232
+ |`deviceCustomNumber6Label` (`cn6Label`) |`[cef][device_custom_number_6][label]`
233
+ |`deviceCustomNumber7` (`cn7`) |`[cef][device_custom_number_7][value]`
234
+ |`deviceCustomNumber7Label` (`cn7Label`) |`[cef][device_custom_number_7][label]`
235
+ |`deviceCustomNumber8` (`cn8`) |`[cef][device_custom_number_8][value]`
236
+ |`deviceCustomNumber8Label` (`cn8Label`) |`[cef][device_custom_number_8][label]`
237
+ |`deviceCustomNumber9` (`cn9`) |`[cef][device_custom_number_9][value]`
238
+ |`deviceCustomNumber9Label` (`cn9Label`) |`[cef][device_custom_number_9][label]`
239
+ |`deviceCustomNumber10` (`cn10`) |`[cef][device_custom_number_10][value]`
240
+ |`deviceCustomNumber10Label` (`cn10Label`) |`[cef][device_custom_number_10][label]`
241
+ |`deviceCustomNumber11` (`cn11`) |`[cef][device_custom_number_11][value]`
242
+ |`deviceCustomNumber11Label` (`cn11Label`) |`[cef][device_custom_number_11][label]`
243
+ |`deviceCustomNumber12` (`cn12`) |`[cef][device_custom_number_12][value]`
244
+ |`deviceCustomNumber12Label` (`cn12Label`) |`[cef][device_custom_number_12][label]`
245
+ |`deviceCustomNumber13` (`cn13`) |`[cef][device_custom_number_13][value]`
246
+ |`deviceCustomNumber13Label` (`cn13Label`) |`[cef][device_custom_number_13][label]`
247
+ |`deviceCustomNumber14` (`cn14`) |`[cef][device_custom_number_14][value]`
248
+ |`deviceCustomNumber14Label` (`cn14Label`) |`[cef][device_custom_number_14][label]`
249
+ |`deviceCustomNumber15` (`cn15`) |`[cef][device_custom_number_15][value]`
250
+ |`deviceCustomNumber15Label` (`cn15Label`) |`[cef][device_custom_number_15][label]`
183
251
  |`deviceCustomString1` (`cs1`) |`[cef][device_custom_string_1][value]`
184
252
  |`deviceCustomString1Label` (`cs1Label`) |`[cef][device_custom_string_1][label]`
185
253
  |`deviceCustomString2` (`cs2`) |`[cef][device_custom_string_2][value]`
@@ -192,6 +260,24 @@ The following is a mapping between these fields.
192
260
  |`deviceCustomString5Label` (`cs5Label`) |`[cef][device_custom_string_5][label]`
193
261
  |`deviceCustomString6` (`cs6`) |`[cef][device_custom_string_6][value]`
194
262
  |`deviceCustomString6Label` (`cs6Label`) |`[cef][device_custom_string_6][label]`
263
+ |`deviceCustomString7` (`cs7`) |`[cef][device_custom_string_7][value]`
264
+ |`deviceCustomString7Label` (`cs7Label`) |`[cef][device_custom_string_7][label]`
265
+ |`deviceCustomString8` (`cs8`) |`[cef][device_custom_string_8][value]`
266
+ |`deviceCustomString8Label` (`cs8Label`) |`[cef][device_custom_string_8][label]`
267
+ |`deviceCustomString9` (`cs9`) |`[cef][device_custom_string_9][value]`
268
+ |`deviceCustomString9Label` (`cs9Label`) |`[cef][device_custom_string_9][label]`
269
+ |`deviceCustomString10` (`cs10`) |`[cef][device_custom_string_10][value]`
270
+ |`deviceCustomString10Label` (`cs10Label`) |`[cef][device_custom_string_10][label]`
271
+ |`deviceCustomString11` (`cs11`) |`[cef][device_custom_string_11][value]`
272
+ |`deviceCustomString11Label` (`cs11Label`) |`[cef][device_custom_string_11][label]`
273
+ |`deviceCustomString12` (`cs12`) |`[cef][device_custom_string_12][value]`
274
+ |`deviceCustomString12Label` (`cs12Label`) |`[cef][device_custom_string_12][label]`
275
+ |`deviceCustomString13` (`cs13`) |`[cef][device_custom_string_13][value]`
276
+ |`deviceCustomString13Label` (`cs13Label`) |`[cef][device_custom_string_13][label]`
277
+ |`deviceCustomString14` (`cs14`) |`[cef][device_custom_string_14][value]`
278
+ |`deviceCustomString14Label` (`cs14Label`) |`[cef][device_custom_string_14][label]`
279
+ |`deviceCustomString15` (`cs15`) |`[cef][device_custom_string_15][value]`
280
+ |`deviceCustomString15Label` (`cs15Label`) |`[cef][device_custom_string_15][label]`
195
281
  |`deviceDirection` |`[network][direction]`
196
282
  .2+|`deviceDnsDomain` |`[observer][registered_domain]`
197
283
 
@@ -242,7 +328,7 @@ The following is a mapping between these fields.
242
328
  |`eventOutcome` (`outcome`) |`[event][outcome]`
243
329
  |`externalId` |`[cef][external_id]`
244
330
  |`fileCreateTime` |`[file][created]`
245
- |`fileHash` |`[file][hash]]`
331
+ |`fileHash` |`[file][hash]`
246
332
  |`fileId` |`[file][inode]`
247
333
  |`fileModificationTime` |`[file][mtime]`
248
334
 
@@ -355,14 +441,19 @@ not include timezone information, this `default_timezone` is used instead.
355
441
  If your input puts a delimiter between each CEF event, you'll want to set
356
442
  this to be that delimiter.
357
443
 
358
- For example, with the TCP input, you probably want to put this:
444
+ NOTE: Byte stream inputs such as TCP require delimiter to be specified. Otherwise input can be truncated or incorrectly split.
359
445
 
446
+ **Example**
447
+
448
+ [source,ruby]
449
+ -----
360
450
  input {
361
451
  tcp {
362
452
  codec => cef { delimiter => "\r\n" }
363
453
  # ...
364
454
  }
365
455
  }
456
+ -----
366
457
 
367
458
  This setting allows the following character sequences to have special meaning:
368
459
 
@@ -398,9 +489,7 @@ If the codec handles data from a variety of sources, the ECS recommendation is t
398
489
  ** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
399
490
  ** Otherwise, the default value is `disabled`.
400
491
 
401
- Controls this plugin's compatibility with the
402
- {ecs-ref}[Elastic Common Schema (ECS)]
403
- (ECS)].
492
+ Controls this plugin's compatibility with the {ecs-ref}[Elastic Common Schema (ECS)].
404
493
 
405
494
  [id="plugins-{type}s-{plugin}-fields"]
406
495
  ===== `fields`
data/lib/logstash/codecs/cef.rb CHANGED
@@ -6,6 +6,7 @@ require "json"
6
6
  require "time"
7
7
 
8
8
  require 'logstash/plugin_mixins/ecs_compatibility_support'
9
+ require 'logstash/plugin_mixins/event_support/event_factory_adapter'
9
10
 
10
11
  # Implementation of a Logstash codec for the ArcSight Common Event Format (CEF)
11
12
  # Based on Revision 20 of Implementing ArcSight CEF, dated from June 05, 2013
@@ -16,7 +17,8 @@ require 'logstash/plugin_mixins/ecs_compatibility_support'
16
17
  class LogStash::Codecs::CEF < LogStash::Codecs::Base
17
18
  config_name "cef"
18
19
 
19
- include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1)
20
+ include LogStash::PluginMixins::ECSCompatibilitySupport(:disabled, :v1, :v8 => :v1)
21
+ include LogStash::PluginMixins::EventSupport::EventFactoryAdapter
20
22
 
21
23
  InvalidTimestamp = Class.new(StandardError)
22
24
 
@@ -201,7 +203,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
201
203
 
202
204
  def handle(data, &block)
203
205
  original_data = data.dup
204
- event = LogStash::Event.new
206
+ event = event_factory.new_event
205
207
  event.set(raw_data_field, data) unless raw_data_field.nil?
206
208
 
207
209
  @utf8_charset.convert(data)
@@ -282,7 +284,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
282
284
  rescue => e
283
285
  @logger.error("Failed to decode CEF payload. Generating failure event with payload in message field.",
284
286
  :exception => e.class, :message => e.message, :backtrace => e.backtrace, :original_data => original_data)
285
- yield LogStash::Event.new("message" => data, "tags" => ["_cefparsefailure"])
287
+ yield event_factory.new_event("message" => data, "tags" => ["_cefparsefailure"])
286
288
  end
287
289
 
288
290
  public
@@ -408,40 +410,18 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
408
410
  CEFField.new("destinationZoneURI", ecs_field: "[cef][destination][zone][uri]"),
409
411
  CEFField.new("deviceAction", key: "act", ecs_field: "[event][action]"),
410
412
  CEFField.new("deviceAddress", key: "dvc", ecs_field: "[#{@device}][ip]"),
411
- CEFField.new("deviceCustomFloatingPoint1", key: "cfp1", ecs_field: "[cef][device_custom_floating_point_1][value]"),
412
- CEFField.new("deviceCustomFloatingPoint1Label", key: "cfp1Label", ecs_field: "[cef][device_custom_floating_point_1][label]"),
413
- CEFField.new("deviceCustomFloatingPoint2", key: "cfp2", ecs_field: "[cef][device_custom_floating_point_2][value]"),
414
- CEFField.new("deviceCustomFloatingPoint2Label", key: "cfp2Label", ecs_field: "[cef][device_custom_floating_point_2][label]"),
415
- CEFField.new("deviceCustomFloatingPoint3", key: "cfp3", ecs_field: "[cef][device_custom_floating_point_3][value]"),
416
- CEFField.new("deviceCustomFloatingPoint3Label", key: "cfp3Label", ecs_field: "[cef][device_custom_floating_point_3][label]"),
417
- CEFField.new("deviceCustomFloatingPoint4", key: "cfp4", ecs_field: "[cef][device_custom_floating_point_4][value]"),
418
- CEFField.new("deviceCustomFloatingPoint4Label", key: "cfp4Label", ecs_field: "[cef][device_custom_floating_point_4][label]"),
419
- CEFField.new("deviceCustomIPv6Address1", key: "c6a1", ecs_field: "[cef][device_custom_ipv6_address_1][value]"),
420
- CEFField.new("deviceCustomIPv6Address1Label", key: "c6a1Label", ecs_field: "[cef][device_custom_ipv6_address_1][label]"),
421
- CEFField.new("deviceCustomIPv6Address2", key: "c6a2", ecs_field: "[cef][device_custom_ipv6_address_2][value]"),
422
- CEFField.new("deviceCustomIPv6Address2Label", key: "c6a2Label", ecs_field: "[cef][device_custom_ipv6_address_2][label]"),
423
- CEFField.new("deviceCustomIPv6Address3", key: "c6a3", ecs_field: "[cef][device_custom_ipv6_address_3][value]"),
424
- CEFField.new("deviceCustomIPv6Address3Label", key: "c6a3Label", ecs_field: "[cef][device_custom_ipv6_address_3][label]"),
425
- CEFField.new("deviceCustomIPv6Address4", key: "c6a4", ecs_field: "[cef][device_custom_ipv6_address_4][value]"),
426
- CEFField.new("deviceCustomIPv6Address4Label", key: "c6a4Label", ecs_field: "[cef][device_custom_ipv6_address_4][label]"),
427
- CEFField.new("deviceCustomNumber1", key: "cn1", ecs_field: "[cef][device_custom_number_1][value]"),
428
- CEFField.new("deviceCustomNumber1Label", key: "cn1Label", ecs_field: "[cef][device_custom_number_1][label]"),
429
- CEFField.new("deviceCustomNumber2", key: "cn2", ecs_field: "[cef][device_custom_number_2][value]"),
430
- CEFField.new("deviceCustomNumber2Label", key: "cn2Label", ecs_field: "[cef][device_custom_number_2][label]"),
431
- CEFField.new("deviceCustomNumber3", key: "cn3", ecs_field: "[cef][device_custom_number_3][value]"),
432
- CEFField.new("deviceCustomNumber3Label", key: "cn3Label", ecs_field: "[cef][device_custom_number_3][label]"),
433
- CEFField.new("deviceCustomString1", key: "cs1", ecs_field: "[cef][device_custom_string_1][value]"),
434
- CEFField.new("deviceCustomString1Label", key: "cs1Label", ecs_field: "[cef][device_custom_string_1][label]"),
435
- CEFField.new("deviceCustomString2", key: "cs2", ecs_field: "[cef][device_custom_string_2][value]"),
436
- CEFField.new("deviceCustomString2Label", key: "cs2Label", ecs_field: "[cef][device_custom_string_2][label]"),
437
- CEFField.new("deviceCustomString3", key: "cs3", ecs_field: "[cef][device_custom_string_3][value]"),
438
- CEFField.new("deviceCustomString3Label", key: "cs3Label", ecs_field: "[cef][device_custom_string_3][label]"),
439
- CEFField.new("deviceCustomString4", key: "cs4", ecs_field: "[cef][device_custom_string_4][value]"),
440
- CEFField.new("deviceCustomString4Label", key: "cs4Label", ecs_field: "[cef][device_custom_string_4][label]"),
441
- CEFField.new("deviceCustomString5", key: "cs5", ecs_field: "[cef][device_custom_string_5][value]"),
442
- CEFField.new("deviceCustomString5Label", key: "cs5Label", ecs_field: "[cef][device_custom_string_5][label]"),
443
- CEFField.new("deviceCustomString6", key: "cs6", ecs_field: "[cef][device_custom_string_6][value]"),
444
- CEFField.new("deviceCustomString6Label", key: "cs6Label", ecs_field: "[cef][device_custom_string_6][label]"),
413
+ (1..15).map do |idx|
414
+ [
415
+ CEFField.new("deviceCustomFloatingPoint#{idx}", key: "cfp#{idx}", ecs_field: "[cef][device_custom_floating_point_#{idx}][value]"),
416
+ CEFField.new("deviceCustomFloatingPoint#{idx}Label", key: "cfp#{idx}Label", ecs_field: "[cef][device_custom_floating_point_#{idx}][label]"),
417
+ CEFField.new("deviceCustomIPv6Address#{idx}", key: "c6a#{idx}", ecs_field: "[cef][device_custom_ipv6_address_#{idx}][value]"),
418
+ CEFField.new("deviceCustomIPv6Address#{idx}Label", key: "c6a#{idx}Label", ecs_field: "[cef][device_custom_ipv6_address_#{idx}][label]"),
419
+ CEFField.new("deviceCustomNumber#{idx}", key: "cn#{idx}", ecs_field: "[cef][device_custom_number_#{idx}][value]"),
420
+ CEFField.new("deviceCustomNumber#{idx}Label", key: "cn#{idx}Label", ecs_field: "[cef][device_custom_number_#{idx}][label]"),
421
+ CEFField.new("deviceCustomString#{idx}", key: "cs#{idx}", ecs_field: "[cef][device_custom_string_#{idx}][value]"),
422
+ CEFField.new("deviceCustomString#{idx}Label", key: "cs#{idx}Label", ecs_field: "[cef][device_custom_string_#{idx}][label]"),
423
+ ]
424
+ end,
445
425
  CEFField.new("deviceDirection", ecs_field: "[network][direction]"),
446
426
  CEFField.new("deviceDnsDomain", ecs_field: "[#{@device}][registered_domain]", priority: 10),
447
427
  CEFField.new("deviceEventCategory", key: "cat", ecs_field: "[cef][category]"),
@@ -468,7 +448,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
468
448
  CEFField.new("eventOutcome", key: "outcome", ecs_field: "[event][outcome]"),
469
449
  CEFField.new("externalId", ecs_field: "[cef][external_id]"),
470
450
  CEFField.new("fileCreateTime", ecs_field: "[file][created]"),
471
- CEFField.new("fileHash", ecs_field: "[file][hash]]"),
451
+ CEFField.new("fileHash", ecs_field: "[file][hash]"),
472
452
  CEFField.new("fileId", ecs_field: "[file][inode]"),
473
453
  CEFField.new("fileModificationTime", ecs_field: "[file][mtime]", normalize: :timestamp),
474
454
  CEFField.new("fileName", key: "fname", ecs_field: "[file][name]"),
@@ -517,7 +497,7 @@ class LogStash::Codecs::CEF < LogStash::Codecs::Base
517
497
  CEFField.new("startTime", key: "start", ecs_field: "[event][start]", normalize: :timestamp),
518
498
  CEFField.new("transportProtocol", key: "proto", ecs_field: "[network][transport]"),
519
499
  CEFField.new("type", ecs_field: "[cef][type]"),
520
- ].sort_by(&:priority).each do |cef|
500
+ ].flatten.sort_by(&:priority).each do |cef|
521
501
  field_name = ecs_select[disabled:cef.name, v1:cef.ecs_field]
522
502
 
523
503
  # whether the source is a cef_key or cef_name, normalize to field_name
data/logstash-codec-cef.gemspec CHANGED
@@ -1,7 +1,7 @@
1
1
  Gem::Specification.new do |s|
2
2
 
3
3
  s.name = 'logstash-codec-cef'
4
- s.version = '6.2.1'
4
+ s.version = '6.2.4'
5
5
  s.platform = 'java'
6
6
  s.licenses = ['Apache License (2.0)']
7
7
  s.summary = "Reads the ArcSight Common Event Format (CEF)."
@@ -22,7 +22,8 @@ Gem::Specification.new do |s|
22
22
 
23
23
  # Gem dependencies
24
24
  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
25
- s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~>1.1'
25
+ s.add_runtime_dependency "logstash-mixin-ecs_compatibility_support", '~> 1.3'
26
+ s.add_runtime_dependency "logstash-mixin-event_support", '~> 1.0'
26
27
 
27
28
  s.add_development_dependency 'logstash-devutils'
28
29
  s.add_development_dependency 'insist'
data/spec/codecs/cef_spec.rb CHANGED
@@ -780,6 +780,29 @@ describe LogStash::Codecs::CEF do
780
780
  end
781
781
  end
782
782
 
783
+ let(:log_with_fileHash) { "Syslogdate Sysloghost CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|fileHash=1bad1dea" }
784
+ it 'decodes fileHash to [file][hash]' do
785
+ decode_one(subject, log_with_fileHash) do |e|
786
+ validate(e)
787
+ insist { e.get(ecs_select[disabled:"fileHash", v1:"[file][hash]"]) } == "1bad1dea"
788
+ end
789
+ end
790
+
791
+ let(:log_with_custom_typed_fields) { "Syslogdate Sysloghost CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|cfp15=3.1415926 cfp15Label=pi c6a12=::1 c6a12Label=localhost cn7=8191 cn7Label=mersenne cs4=silly cs4Label=theory" }
792
+ it 'decodes to mapped numbered fields' do
793
+ decode_one(subject, log_with_custom_typed_fields) do |e|
794
+ validate(e)
795
+ insist { e.get(ecs_select[disabled: "deviceCustomFloatingPoint15", v1: "[cef][device_custom_floating_point_15][value]"]) } == "3.1415926"
796
+ insist { e.get(ecs_select[disabled: "deviceCustomFloatingPoint15Label", v1: "[cef][device_custom_floating_point_15][label]"]) } == "pi"
797
+ insist { e.get(ecs_select[disabled: "deviceCustomIPv6Address12", v1: "[cef][device_custom_ipv6_address_12][value]"]) } == "::1"
798
+ insist { e.get(ecs_select[disabled: "deviceCustomIPv6Address12Label", v1: "[cef][device_custom_ipv6_address_12][label]"]) } == "localhost"
799
+ insist { e.get(ecs_select[disabled: "deviceCustomNumber7", v1: "[cef][device_custom_number_7][value]"]) } == "8191"
800
+ insist { e.get(ecs_select[disabled: "deviceCustomNumber7Label", v1: "[cef][device_custom_number_7][label]"]) } == "mersenne"
801
+ insist { e.get(ecs_select[disabled: "deviceCustomString4", v1: "[cef][device_custom_string_4][value]"]) } == "silly"
802
+ insist { e.get(ecs_select[disabled: "deviceCustomString4Label", v1: "[cef][device_custom_string_4][label]"]) } == "theory"
803
+ end
804
+ end
805
+
783
806
  context 'with UTF-8 message' do
784
807
  let(:message) { 'CEF:0|security|threatmanager|1.0|100|trojan successfully stopped|10|src=192.168.1.11 target=aaaaaああああaaaa msg=Description Omitted' }
785
808
 
@@ -850,7 +873,7 @@ describe LogStash::Codecs::CEF do
850
873
 
851
874
  let(:results) { [] }
852
875
 
853
- ecs_compatibility_matrix(:disabled,:v1) do |ecs_select|
876
+ ecs_compatibility_matrix(:disabled, :v1, :v8 => :v1) do |ecs_select|
854
877
  before(:each) do
855
878
  allow_any_instance_of(described_class).to receive(:ecs_compatibility).and_return(ecs_compatibility)
856
879
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: logstash-codec-cef
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.2.1
4
+ version: 6.2.4
5
5
  platform: java
6
6
  authors:
7
7
  - Elastic
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-04-28 00:00:00.000000000 Z
11
+ date: 2022-03-15 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  requirement: !ruby/object:Gem::Requirement
@@ -35,7 +35,7 @@ dependencies:
35
35
  requirements:
36
36
  - - "~>"
37
37
  - !ruby/object:Gem::Version
38
- version: '1.1'
38
+ version: '1.3'
39
39
  name: logstash-mixin-ecs_compatibility_support
40
40
  prerelease: false
41
41
  type: :runtime
@@ -43,7 +43,21 @@ dependencies:
43
43
  requirements:
44
44
  - - "~>"
45
45
  - !ruby/object:Gem::Version
46
- version: '1.1'
46
+ version: '1.3'
47
+ - !ruby/object:Gem::Dependency
48
+ requirement: !ruby/object:Gem::Requirement
49
+ requirements:
50
+ - - "~>"
51
+ - !ruby/object:Gem::Version
52
+ version: '1.0'
53
+ name: logstash-mixin-event_support
54
+ prerelease: false
55
+ type: :runtime
56
+ version_requirements: !ruby/object:Gem::Requirement
57
+ requirements:
58
+ - - "~>"
59
+ - !ruby/object:Gem::Version
60
+ version: '1.0'
47
61
  - !ruby/object:Gem::Dependency
48
62
  requirement: !ruby/object:Gem::Requirement
49
63
  requirements:
@@ -113,8 +127,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
113
127
  - !ruby/object:Gem::Version
114
128
  version: '0'
115
129
  requirements: []
116
- rubyforge_project:
117
- rubygems_version: 2.6.13
130
+ rubygems_version: 3.1.6
118
131
  signing_key:
119
132
  specification_version: 4
120
133
  summary: Reads the ArcSight Common Event Format (CEF).