logstash-codec-idmef 0.9.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ad1c943dcf4ab893042f3a2f1422dfa0a65ab106f70ea36f5b64c7588d5200bf
-  data.tar.gz: eb60b7f7dbe4171f683a474f20ed3f11d0c694d63d5a195c03330c31ccae6810
+  metadata.gz: 687a8fdbf7434f7a0cc7062d44463550a7b6f5922bb41086fc01ccd8db0711a1
+  data.tar.gz: d3c65c530b4e8b74eca83a9c6ba3eaf1ba9293a22860ea256447407cd13e8f69
 SHA512:
-  metadata.gz: f4f99f78a379d0feb60e3b05af8397eeb1fe7c840ac678c69a63edb7259cda2dce303825e33f75e5811506f39644a4db18986764fdb1b918db9302a9efc27f50
-  data.tar.gz: 005b837b9f15b6e09bb321884e63f018ab2270dd1a94d4c2498f4c06bff3a870b6b54f261b4cda22946e68d42bec2e605f4b10ce04ad3269b3312511ca9fba78
+  metadata.gz: f416eeb9bc08f9d9c6c1d8241a3377ddb92fc47421f62053b5f1f791fb2a8f9b0683e0065c0630488724c23eb3dc9fafbab471acdf8a5c87843faccbb83cf970
+  data.tar.gz: bc4d4fba048ac2ece7058b86af575b4d5ee43217236834e0ab2d1f62b0fe0288a95d8654d0ba40efda50ec23ef7ad07cd3315afaad7095af8b390ba73d46973a

data/CHANGELOG.md

@@ -1,2 +1,5 @@
+## 0.9.1
+ - Fix various DTD issues
+
 ## 0.9.0
  - Initial release

data/lib/logstash/codecs/idmef.rb

@@ -1,6 +1,7 @@
 # encoding: utf-8
 require "logstash/codecs/base"
 
+require 'socket'
 require 'nokogiri'
 require 'json'
 require 'date'
@@ -253,7 +254,7 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
                           :name => "AdditionalData",
                           "meaning" => { :type => :attr, :name => "meaning" },
                           "type" => { :type => :attr, :name => "type" },
-                          "data" => { :type => :value }
+                          "data" => { :type => :list_value, :name => :type }
                         }
   # RFC 4765: CorrelationAlert Class
   IDMEFCorrelationAlert = { :type => :class,
@@ -328,7 +329,7 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
                   value = v
               end
           end
-          if value.kind_of?(Array)
+          if value.kind_of?(Array) or value.to_s.empty?
               next
           end
           if value.kind_of?(String)
@@ -373,20 +374,15 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
                  if rfc[name][:format] == :datetime
                    value = DateTime.parse(value.to_s).strftime("%FT%T%:z")
                  end
-                 no = Nokogiri::XML::Node.new(rfc[name][:name], doc)
+                 n = rfc[name][:name] == :type ? curr["type"] : rfc[name][:name]
+                 no = Nokogiri::XML::Node.new(n, doc)
                  no.content = value.to_s
                  curr << no
-                 curr = no
               elsif ne_t == :attr
                  if rfc[name][:format] == :datetime
                    value = DateTime.parse(value.to_s).strftime("%FT%T%:z")
                  end
                  curr[rfc[name][:name]] = value.to_s
-              elsif ne_t == :value
-                 if rfc[name][:format] == :datetime
-                   value = DateTime.parse(value.to_s).strftime("%FT%T%:z")
-                 end
-                 curr.content = value.to_s
               end
               rfc.each do |kk, vv|
                   if vv.respond_to?(:each_pair) && vv[:default] && vv[:type] == :attr && !curr[vv[:name]]
@@ -418,12 +414,11 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
     @utf8_charset.logger = self.logger
 
     @local_paths = {
-      "alert.classification.text" => ["$rule_name", "$event", "$message"],
-      "alert.detect_time" => "$@timestamp",
-      "alert.create_time" => "$@timestamp",
-      "alert.analyzer_time" => "$@timestamp",
       "alert.analyzer(0).name" => ["$product", "$devname"],
       "alert.analyzer(0).manufacturer" => "$vendor",
+      "alert.create_time" => "$@timestamp",
+      "alert.detect_time" => "$@timestamp",
+      "alert.analyzer_time" => "$@timestamp",
       "alert.source(0).node.address(0).address" => ["$srcip", "$src"],
       "alert.source(0).node.name" => ["$shost", "$srchost", "$shostname", "$srchostname", "$sname", "$srcname"],
       "alert.source(0).service.port" => ["$spt", "$sport", "$s_port"],
@@ -436,6 +431,7 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
       "alert.target(0).user.user_id(0).number" => ["$uid", "$dstuid", "$duid"],
       "alert.target(0).process.name" => ["$proc", "$process"],
       "alert.target(0).process.pid" => ["$dpid", "$pid"],
+      "alert.classification.text" => ["$rule_name", "$event", "$message"],
       "alert.assessment.impact.severity" => ["$severity", "$level"],
       "alert.assessment.action.description" => ["$action"],
     }
@@ -454,13 +450,14 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
     # Copy event
     e = event.clone
 
+    # Set messageid and analyzerid
+    p = { "%s.messageid" % @type => java.util.UUID.randomUUID.to_s,
+          "%s.analyzer(0).analyzerid" % @type => Socket.gethostname.to_s
+        }
+    xml = idmefpaths_to_xml(e, p)
+    
     # Set paths
-    xml = idmefpaths_to_xml(e, @allpaths)
-
-    # Set messageid
-    if !@allpaths.key?("%s.messageid" % @type)
-      xml = idmefpaths_to_xml(e, {"%s.messageid" % @type => java.util.UUID.randomUUID.to_s}, xml)
-    end
+    xml = idmefpaths_to_xml(e, @allpaths, xml)
 
     # Set Additional data
     if @additionaldata
@@ -474,8 +471,8 @@ class LogStash::Codecs::IDMEF < LogStash::Codecs::Base
           t = "string"
         end
         p = { "alert.additional_data(%d).meaning" % idx => key,
-              "alert.additional_data(%d).data" % idx => value.to_s,
               "alert.additional_data(%d).type" % idx => t,
+              "alert.additional_data(%d).data" % idx => value.to_s,
             }
         xml = idmefpaths_to_xml(e, p , xml)
         idx = idx + 1

data/logstash-codec-idmef.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-codec-idmef'
-  s.version         = '0.9.0'
+  s.version         = '0.9.1'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Create IDMEF in XML"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/codecs/idmef_spec.rb

@@ -9,7 +9,7 @@ describe LogStash::Codecs::IDMEF do
   context "encode IDMEF" do
     subject(:codec) { LogStash::Codecs::IDMEF.new }
 
-    let(:expected_result)   { %Q(<?xml version="1.0"?><idmef:IDMEF-Message xmlns:idmef="http://iana.org/idmef"><idmef:Alert messageid="67a63ad4-11b9-4ee2-8aee-d1c032a13b35"><idmef:Classification text="Login attempt"/><idmef:DetectTime>2020-05-24T09:05:26+00:00</idmef:DetectTime><idmef:CreateTime>2020-05-24T09:05:26+00:00</idmef:CreateTime><idmef:AnalyzerTime>2020-05-24T09:05:26+00:00</idmef:AnalyzerTime><idmef:Target decoy="unknown"><idmef:Node category="unknown"><idmef:name category="unknown">localhost.localdomain</idmef:name></idmef:Node></idmef:Target><idmef:AdditionalData meaning="@version" type="string">1</idmef:AdditionalData></idmef:Alert></idmef:IDMEF-Message>\n) }
+    let(:expected_result)   { %Q(<?xml version=\"1.0\"?><idmef:IDMEF-Message xmlns:idmef=\"http://iana.org/idmef\"><idmef:Alert messageid=\"67a63ad4-11b9-4ee2-8aee-d1c032a13b35\"><idmef:Analyzer analyzerid=\"localhost.localdomain\"/><idmef:CreateTime>2020-05-24T09:05:26+00:00</idmef:CreateTime><idmef:DetectTime>2020-05-24T09:05:26+00:00</idmef:DetectTime><idmef:AnalyzerTime>2020-05-24T09:05:26+00:00</idmef:AnalyzerTime><idmef:Target decoy=\"unknown\"><idmef:Node category=\"unknown\"><idmef:name>localhost.localdomain</idmef:name></idmef:Node></idmef:Target><idmef:Classification text=\"Login attempt\"/><idmef:AdditionalData meaning=\"@version\" type=\"string\"><idmef:string>1</idmef:string></idmef:AdditionalData></idmef:Alert></idmef:IDMEF-Message>\n)}
     let(:results) { []}
                       
     it "should return proper IDMEF XML from event" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logstash-codec-idmef
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Prelude Team