logstash-filter-threats_classifier 1.0.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (30) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +2 -0
  3. data/CONTRIBUTORS +11 -0
  4. data/Gemfile +2 -0
  5. data/LICENSE +11 -0
  6. data/README.md +64 -0
  7. data/lib/logstash/filters/center-client.rb +213 -0
  8. data/lib/logstash/filters/classification-request.rb +17 -0
  9. data/lib/logstash/filters/classifier-cache.rb +51 -0
  10. data/lib/logstash/filters/classifier.rb +335 -0
  11. data/lib/logstash/filters/cognito-client.rb +48 -0
  12. data/lib/logstash/filters/elastic-db.rb +128 -0
  13. data/lib/logstash/filters/field-handler.rb +127 -0
  14. data/lib/logstash/filters/local-classifier.rb +94 -0
  15. data/lib/logstash/filters/plugin-logic.rb +166 -0
  16. data/lib/logstash/filters/response.rb +36 -0
  17. data/lib/logstash/filters/threats_classifier.rb +230 -0
  18. data/lib/logstash/filters/utils.rb +46 -0
  19. data/logstash-filter-threats_classifier.gemspec +38 -0
  20. data/spec/filters/bulk-processor_spec.rb +92 -0
  21. data/spec/filters/classifier-cache_spec.rb +44 -0
  22. data/spec/filters/classifier_spec.rb +78 -0
  23. data/spec/filters/cognito-client_spec.rb +20 -0
  24. data/spec/filters/field-handler_spec.rb +101 -0
  25. data/spec/filters/local-classifier_spec.rb +46 -0
  26. data/spec/filters/plugin-logic_spec.rb +127 -0
  27. data/spec/filters/threats-classifier_spec.rb +103 -0
  28. data/spec/filters/utils_spec.rb +74 -0
  29. data/spec/spec_helper.rb +2 -0
  30. metadata +256 -0
data/spec/filters/utils_spec.rb ADDED
@@ -0,0 +1,74 @@
1
+ require_relative '../spec_helper'
2
+ require "logstash/event"
3
+ require "logstash/filters/utils"
4
+
5
+ describe LogStash::Filters::Empow::Utils do
6
+
7
+ describe "test internal tagging" do
8
+ it "test error" do
9
+ event = LogStash::Event.new("data" => "a b c")
10
+
11
+ LogStash::Filters::Empow::Utils.add_error(event, "my_msg")
12
+
13
+ expect(event.get("empow_errors")).to contain_exactly("my_msg")
14
+ end
15
+
16
+ it "test warn" do
17
+ event = LogStash::Event.new("data" => "a b c")
18
+
19
+ LogStash::Filters::Empow::Utils.add_warn(event, "my_msg")
20
+
21
+ expect(event.get("empow_warnings")).to contain_exactly("my_msg")
22
+ end
23
+ end
24
+ #json = '{ "a": "True", "b": "true", "c": "1", "d": 1, "e": "False", "f": "0", "g": "TRUE" }'
25
+ describe "test is truthy" do
26
+ it "string TRUE" do
27
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("TRUE")).to eq(true)
28
+ end
29
+
30
+ it "string true" do
31
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("true")).to eq(true)
32
+ end
33
+
34
+ it "string 1" do
35
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("1")).to eq(true)
36
+ end
37
+
38
+ it "string 11" do
39
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("11")).to be_nil
40
+ end
41
+
42
+ it "string 0" do
43
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean('0')).to eq(false)
44
+ end
45
+
46
+ it "int 0" do
47
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(0)).to eq(false)
48
+ end
49
+
50
+ it "int 1" do
51
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(1)).to eq(true)
52
+ end
53
+
54
+ it "int 11" do
55
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(11)).to be_nil
56
+ end
57
+
58
+ it "boolean true" do
59
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(true)).to eq(true)
60
+ end
61
+
62
+ it "boolean false" do
63
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(false)).to eq(false)
64
+ end
65
+
66
+ it "nil" do
67
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(nil)).to be_nil
68
+ end
69
+
70
+ it "empty string" do
71
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean('')).to be_nil
72
+ end
73
+ end
74
+ end
data/spec/spec_helper.rb ADDED
@@ -0,0 +1,2 @@
1
+ # encoding: utf-8
2
+ require "logstash/devutils/rspec/spec_helper"
metadata ADDED
@@ -0,0 +1,256 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: logstash-filter-threats_classifier
3
+ version: !ruby/object:Gem::Version
4
+ version: 1.0.4
5
+ platform: ruby
6
+ authors:
7
+ - empow
8
+ - Assaf Abulafia
9
+ - Rami Cohen
10
+ autorequire:
11
+ bindir: bin
12
+ cert_chain: []
13
+ date: 2019-05-01 00:00:00.000000000 Z
14
+ dependencies:
15
+ - !ruby/object:Gem::Dependency
16
+ requirement: !ruby/object:Gem::Requirement
17
+ requirements:
18
+ - - ">="
19
+ - !ruby/object:Gem::Version
20
+ version: '1.60'
21
+ - - "<="
22
+ - !ruby/object:Gem::Version
23
+ version: '2.99'
24
+ name: logstash-core-plugin-api
25
+ prerelease: false
26
+ type: :runtime
27
+ version_requirements: !ruby/object:Gem::Requirement
28
+ requirements:
29
+ - - ">="
30
+ - !ruby/object:Gem::Version
31
+ version: '1.60'
32
+ - - "<="
33
+ - !ruby/object:Gem::Version
34
+ version: '2.99'
35
+ - !ruby/object:Gem::Dependency
36
+ requirement: !ruby/object:Gem::Requirement
37
+ requirements:
38
+ - - "~>"
39
+ - !ruby/object:Gem::Version
40
+ version: '1.8'
41
+ - - ">="
42
+ - !ruby/object:Gem::Version
43
+ version: 1.8.0
44
+ name: rest-client
45
+ prerelease: false
46
+ type: :runtime
47
+ version_requirements: !ruby/object:Gem::Requirement
48
+ requirements:
49
+ - - "~>"
50
+ - !ruby/object:Gem::Version
51
+ version: '1.8'
52
+ - - ">="
53
+ - !ruby/object:Gem::Version
54
+ version: 1.8.0
55
+ - !ruby/object:Gem::Dependency
56
+ requirement: !ruby/object:Gem::Requirement
57
+ requirements:
58
+ - - "~>"
59
+ - !ruby/object:Gem::Version
60
+ version: '1.1'
61
+ - - ">="
62
+ - !ruby/object:Gem::Version
63
+ version: 1.1.0
64
+ name: lru_redux
65
+ prerelease: false
66
+ type: :runtime
67
+ version_requirements: !ruby/object:Gem::Requirement
68
+ requirements:
69
+ - - "~>"
70
+ - !ruby/object:Gem::Version
71
+ version: '1.1'
72
+ - - ">="
73
+ - !ruby/object:Gem::Version
74
+ version: 1.1.0
75
+ - !ruby/object:Gem::Dependency
76
+ requirement: !ruby/object:Gem::Requirement
77
+ requirements:
78
+ - - "~>"
79
+ - !ruby/object:Gem::Version
80
+ version: '1.8'
81
+ - - ">="
82
+ - !ruby/object:Gem::Version
83
+ version: '1.8'
84
+ name: json
85
+ prerelease: false
86
+ type: :runtime
87
+ version_requirements: !ruby/object:Gem::Requirement
88
+ requirements:
89
+ - - "~>"
90
+ - !ruby/object:Gem::Version
91
+ version: '1.8'
92
+ - - ">="
93
+ - !ruby/object:Gem::Version
94
+ version: '1.8'
95
+ - !ruby/object:Gem::Dependency
96
+ requirement: !ruby/object:Gem::Requirement
97
+ requirements:
98
+ - - ">="
99
+ - !ruby/object:Gem::Version
100
+ version: '0'
101
+ name: hashie
102
+ prerelease: false
103
+ type: :runtime
104
+ version_requirements: !ruby/object:Gem::Requirement
105
+ requirements:
106
+ - - ">="
107
+ - !ruby/object:Gem::Version
108
+ version: '0'
109
+ - !ruby/object:Gem::Dependency
110
+ requirement: !ruby/object:Gem::Requirement
111
+ requirements:
112
+ - - "~>"
113
+ - !ruby/object:Gem::Version
114
+ version: '3'
115
+ name: aws-sdk
116
+ prerelease: false
117
+ type: :development
118
+ version_requirements: !ruby/object:Gem::Requirement
119
+ requirements:
120
+ - - "~>"
121
+ - !ruby/object:Gem::Version
122
+ version: '3'
123
+ - !ruby/object:Gem::Dependency
124
+ requirement: !ruby/object:Gem::Requirement
125
+ requirements:
126
+ - - ">="
127
+ - !ruby/object:Gem::Version
128
+ version: '0'
129
+ name: logstash-devutils
130
+ prerelease: false
131
+ type: :development
132
+ version_requirements: !ruby/object:Gem::Requirement
133
+ requirements:
134
+ - - ">="
135
+ - !ruby/object:Gem::Version
136
+ version: '0'
137
+ - !ruby/object:Gem::Dependency
138
+ requirement: !ruby/object:Gem::Requirement
139
+ requirements:
140
+ - - "~>"
141
+ - !ruby/object:Gem::Version
142
+ version: '0.7'
143
+ name: timecop
144
+ prerelease: false
145
+ type: :development
146
+ version_requirements: !ruby/object:Gem::Requirement
147
+ requirements:
148
+ - - "~>"
149
+ - !ruby/object:Gem::Version
150
+ version: '0.7'
151
+ - !ruby/object:Gem::Dependency
152
+ requirement: !ruby/object:Gem::Requirement
153
+ requirements:
154
+ - - "~>"
155
+ - !ruby/object:Gem::Version
156
+ version: '1.22'
157
+ - - ">="
158
+ - !ruby/object:Gem::Version
159
+ version: 1.21.0
160
+ name: webmock
161
+ prerelease: false
162
+ type: :development
163
+ version_requirements: !ruby/object:Gem::Requirement
164
+ requirements:
165
+ - - "~>"
166
+ - !ruby/object:Gem::Version
167
+ version: '1.22'
168
+ - - ">="
169
+ - !ruby/object:Gem::Version
170
+ version: 1.21.0
171
+ - !ruby/object:Gem::Dependency
172
+ requirement: !ruby/object:Gem::Requirement
173
+ requirements:
174
+ - - ">="
175
+ - !ruby/object:Gem::Version
176
+ version: '0'
177
+ name: elasticsearch
178
+ prerelease: false
179
+ type: :development
180
+ version_requirements: !ruby/object:Gem::Requirement
181
+ requirements:
182
+ - - ">="
183
+ - !ruby/object:Gem::Version
184
+ version: '0'
185
+ description:
186
+ email: ''
187
+ executables: []
188
+ extensions: []
189
+ extra_rdoc_files: []
190
+ files:
191
+ - CHANGELOG.md
192
+ - CONTRIBUTORS
193
+ - Gemfile
194
+ - LICENSE
195
+ - README.md
196
+ - lib/logstash/filters/center-client.rb
197
+ - lib/logstash/filters/classification-request.rb
198
+ - lib/logstash/filters/classifier-cache.rb
199
+ - lib/logstash/filters/classifier.rb
200
+ - lib/logstash/filters/cognito-client.rb
201
+ - lib/logstash/filters/elastic-db.rb
202
+ - lib/logstash/filters/field-handler.rb
203
+ - lib/logstash/filters/local-classifier.rb
204
+ - lib/logstash/filters/plugin-logic.rb
205
+ - lib/logstash/filters/response.rb
206
+ - lib/logstash/filters/threats_classifier.rb
207
+ - lib/logstash/filters/utils.rb
208
+ - logstash-filter-threats_classifier.gemspec
209
+ - spec/filters/bulk-processor_spec.rb
210
+ - spec/filters/classifier-cache_spec.rb
211
+ - spec/filters/classifier_spec.rb
212
+ - spec/filters/cognito-client_spec.rb
213
+ - spec/filters/field-handler_spec.rb
214
+ - spec/filters/local-classifier_spec.rb
215
+ - spec/filters/plugin-logic_spec.rb
216
+ - spec/filters/threats-classifier_spec.rb
217
+ - spec/filters/utils_spec.rb
218
+ - spec/spec_helper.rb
219
+ homepage: http://www.empow.co
220
+ licenses:
221
+ - Apache-2.0
222
+ metadata:
223
+ logstash_plugin: 'true'
224
+ logstash_group: filter
225
+ post_install_message:
226
+ rdoc_options: []
227
+ require_paths:
228
+ - lib
229
+ required_ruby_version: !ruby/object:Gem::Requirement
230
+ requirements:
231
+ - - ">="
232
+ - !ruby/object:Gem::Version
233
+ version: '0'
234
+ required_rubygems_version: !ruby/object:Gem::Requirement
235
+ requirements:
236
+ - - ">="
237
+ - !ruby/object:Gem::Version
238
+ version: '0'
239
+ requirements: []
240
+ rubyforge_project:
241
+ rubygems_version: 2.6.13
242
+ signing_key:
243
+ specification_version: 4
244
+ summary: Returns classification information for attacks from the empow classification
245
+ center, based on information in log strings
246
+ test_files:
247
+ - spec/filters/bulk-processor_spec.rb
248
+ - spec/filters/classifier-cache_spec.rb
249
+ - spec/filters/classifier_spec.rb
250
+ - spec/filters/cognito-client_spec.rb
251
+ - spec/filters/field-handler_spec.rb
252
+ - spec/filters/local-classifier_spec.rb
253
+ - spec/filters/plugin-logic_spec.rb
254
+ - spec/filters/threats-classifier_spec.rb
255
+ - spec/filters/utils_spec.rb
256
+ - spec/spec_helper.rb