logstash-filter-threats_classifier 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +2 -0
  3. data/CONTRIBUTORS +11 -0
  4. data/Gemfile +2 -0
  5. data/LICENSE +11 -0
  6. data/README.md +64 -0
  7. data/lib/logstash/filters/center-client.rb +213 -0
  8. data/lib/logstash/filters/classification-request.rb +17 -0
  9. data/lib/logstash/filters/classifier-cache.rb +51 -0
  10. data/lib/logstash/filters/classifier.rb +335 -0
  11. data/lib/logstash/filters/cognito-client.rb +48 -0
  12. data/lib/logstash/filters/elastic-db.rb +128 -0
  13. data/lib/logstash/filters/field-handler.rb +127 -0
  14. data/lib/logstash/filters/local-classifier.rb +94 -0
  15. data/lib/logstash/filters/plugin-logic.rb +166 -0
  16. data/lib/logstash/filters/response.rb +36 -0
  17. data/lib/logstash/filters/threats_classifier.rb +230 -0
  18. data/lib/logstash/filters/utils.rb +46 -0
  19. data/logstash-filter-threats_classifier.gemspec +38 -0
  20. data/spec/filters/bulk-processor_spec.rb +92 -0
  21. data/spec/filters/classifier-cache_spec.rb +44 -0
  22. data/spec/filters/classifier_spec.rb +78 -0
  23. data/spec/filters/cognito-client_spec.rb +20 -0
  24. data/spec/filters/field-handler_spec.rb +101 -0
  25. data/spec/filters/local-classifier_spec.rb +46 -0
  26. data/spec/filters/plugin-logic_spec.rb +127 -0
  27. data/spec/filters/threats-classifier_spec.rb +103 -0
  28. data/spec/filters/utils_spec.rb +74 -0
  29. data/spec/spec_helper.rb +2 -0
  30. metadata +256 -0
data/spec/filters/utils_spec.rb ADDED
@@ -0,0 +1,74 @@
1
+ require_relative '../spec_helper'
2
+ require "logstash/event"
3
+ require "logstash/filters/utils"
4
+
5
+ describe LogStash::Filters::Empow::Utils do
6
+
7
+ describe "test internal tagging" do
8
+ it "test error" do
9
+ event = LogStash::Event.new("data" => "a b c")
10
+
11
+ LogStash::Filters::Empow::Utils.add_error(event, "my_msg")
12
+
13
+ expect(event.get("empow_errors")).to contain_exactly("my_msg")
14
+ end
15
+
16
+ it "test warn" do
17
+ event = LogStash::Event.new("data" => "a b c")
18
+
19
+ LogStash::Filters::Empow::Utils.add_warn(event, "my_msg")
20
+
21
+ expect(event.get("empow_warnings")).to contain_exactly("my_msg")
22
+ end
23
+ end
24
+ #json = '{ "a": "True", "b": "true", "c": "1", "d": 1, "e": "False", "f": "0", "g": "TRUE" }'
25
+ describe "test is truthy" do
26
+ it "string TRUE" do
27
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("TRUE")).to eq(true)
28
+ end
29
+
30
+ it "string true" do
31
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("true")).to eq(true)
32
+ end
33
+
34
+ it "string 1" do
35
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("1")).to eq(true)
36
+ end
37
+
38
+ it "string 11" do
39
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean("11")).to be_nil
40
+ end
41
+
42
+ it "string 0" do
43
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean('0')).to eq(false)
44
+ end
45
+
46
+ it "int 0" do
47
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(0)).to eq(false)
48
+ end
49
+
50
+ it "int 1" do
51
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(1)).to eq(true)
52
+ end
53
+
54
+ it "int 11" do
55
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(11)).to be_nil
56
+ end
57
+
58
+ it "boolean true" do
59
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(true)).to eq(true)
60
+ end
61
+
62
+ it "boolean false" do
63
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(false)).to eq(false)
64
+ end
65
+
66
+ it "nil" do
67
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean(nil)).to be_nil
68
+ end
69
+
70
+ it "empty string" do
71
+ expect(LogStash::Filters::Empow::Utils.convert_to_boolean('')).to be_nil
72
+ end
73
+ end
74
+ end
data/spec/spec_helper.rb ADDED
@@ -0,0 +1,2 @@
1
+ # encoding: utf-8
2
+ require "logstash/devutils/rspec/spec_helper"
metadata ADDED
@@ -0,0 +1,256 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: logstash-filter-threats_classifier
3
+ version: !ruby/object:Gem::Version
4
+ version: 1.0.4
5
+ platform: ruby
6
+ authors:
7
+ - empow
8
+ - Assaf Abulafia
9
+ - Rami Cohen
10
+ autorequire:
11
+ bindir: bin
12
+ cert_chain: []
13
+ date: 2019-05-01 00:00:00.000000000 Z
14
+ dependencies:
15
+ - !ruby/object:Gem::Dependency
16
+ requirement: !ruby/object:Gem::Requirement
17
+ requirements:
18
+ - - ">="
19
+ - !ruby/object:Gem::Version
20
+ version: '1.60'
21
+ - - "<="
22
+ - !ruby/object:Gem::Version
23
+ version: '2.99'
24
+ name: logstash-core-plugin-api
25
+ prerelease: false
26
+ type: :runtime
27
+ version_requirements: !ruby/object:Gem::Requirement
28
+ requirements:
29
+ - - ">="
30
+ - !ruby/object:Gem::Version
31
+ version: '1.60'
32
+ - - "<="
33
+ - !ruby/object:Gem::Version
34
+ version: '2.99'
35
+ - !ruby/object:Gem::Dependency
36
+ requirement: !ruby/object:Gem::Requirement
37
+ requirements:
38
+ - - "~>"
39
+ - !ruby/object:Gem::Version
40
+ version: '1.8'
41
+ - - ">="
42
+ - !ruby/object:Gem::Version
43
+ version: 1.8.0
44
+ name: rest-client
45
+ prerelease: false
46
+ type: :runtime
47
+ version_requirements: !ruby/object:Gem::Requirement
48
+ requirements:
49
+ - - "~>"
50
+ - !ruby/object:Gem::Version
51
+ version: '1.8'
52
+ - - ">="
53
+ - !ruby/object:Gem::Version
54
+ version: 1.8.0
55
+ - !ruby/object:Gem::Dependency
56
+ requirement: !ruby/object:Gem::Requirement
57
+ requirements:
58
+ - - "~>"
59
+ - !ruby/object:Gem::Version
60
+ version: '1.1'
61
+ - - ">="
62
+ - !ruby/object:Gem::Version
63
+ version: 1.1.0
64
+ name: lru_redux
65
+ prerelease: false
66
+ type: :runtime
67
+ version_requirements: !ruby/object:Gem::Requirement
68
+ requirements:
69
+ - - "~>"
70
+ - !ruby/object:Gem::Version
71
+ version: '1.1'
72
+ - - ">="
73
+ - !ruby/object:Gem::Version
74
+ version: 1.1.0
75
+ - !ruby/object:Gem::Dependency
76
+ requirement: !ruby/object:Gem::Requirement
77
+ requirements:
78
+ - - "~>"
79
+ - !ruby/object:Gem::Version
80
+ version: '1.8'
81
+ - - ">="
82
+ - !ruby/object:Gem::Version
83
+ version: '1.8'
84
+ name: json
85
+ prerelease: false
86
+ type: :runtime
87
+ version_requirements: !ruby/object:Gem::Requirement
88
+ requirements:
89
+ - - "~>"
90
+ - !ruby/object:Gem::Version
91
+ version: '1.8'
92
+ - - ">="
93
+ - !ruby/object:Gem::Version
94
+ version: '1.8'
95
+ - !ruby/object:Gem::Dependency
96
+ requirement: !ruby/object:Gem::Requirement
97
+ requirements:
98
+ - - ">="
99
+ - !ruby/object:Gem::Version
100
+ version: '0'
101
+ name: hashie
102
+ prerelease: false
103
+ type: :runtime
104
+ version_requirements: !ruby/object:Gem::Requirement
105
+ requirements:
106
+ - - ">="
107
+ - !ruby/object:Gem::Version
108
+ version: '0'
109
+ - !ruby/object:Gem::Dependency
110
+ requirement: !ruby/object:Gem::Requirement
111
+ requirements:
112
+ - - "~>"
113
+ - !ruby/object:Gem::Version
114
+ version: '3'
115
+ name: aws-sdk
116
+ prerelease: false
117
+ type: :development
118
+ version_requirements: !ruby/object:Gem::Requirement
119
+ requirements:
120
+ - - "~>"
121
+ - !ruby/object:Gem::Version
122
+ version: '3'
123
+ - !ruby/object:Gem::Dependency
124
+ requirement: !ruby/object:Gem::Requirement
125
+ requirements:
126
+ - - ">="
127
+ - !ruby/object:Gem::Version
128
+ version: '0'
129
+ name: logstash-devutils
130
+ prerelease: false
131
+ type: :development
132
+ version_requirements: !ruby/object:Gem::Requirement
133
+ requirements:
134
+ - - ">="
135
+ - !ruby/object:Gem::Version
136
+ version: '0'
137
+ - !ruby/object:Gem::Dependency
138
+ requirement: !ruby/object:Gem::Requirement
139
+ requirements:
140
+ - - "~>"
141
+ - !ruby/object:Gem::Version
142
+ version: '0.7'
143
+ name: timecop
144
+ prerelease: false
145
+ type: :development
146
+ version_requirements: !ruby/object:Gem::Requirement
147
+ requirements:
148
+ - - "~>"
149
+ - !ruby/object:Gem::Version
150
+ version: '0.7'
151
+ - !ruby/object:Gem::Dependency
152
+ requirement: !ruby/object:Gem::Requirement
153
+ requirements:
154
+ - - "~>"
155
+ - !ruby/object:Gem::Version
156
+ version: '1.22'
157
+ - - ">="
158
+ - !ruby/object:Gem::Version
159
+ version: 1.21.0
160
+ name: webmock
161
+ prerelease: false
162
+ type: :development
163
+ version_requirements: !ruby/object:Gem::Requirement
164
+ requirements:
165
+ - - "~>"
166
+ - !ruby/object:Gem::Version
167
+ version: '1.22'
168
+ - - ">="
169
+ - !ruby/object:Gem::Version
170
+ version: 1.21.0
171
+ - !ruby/object:Gem::Dependency
172
+ requirement: !ruby/object:Gem::Requirement
173
+ requirements:
174
+ - - ">="
175
+ - !ruby/object:Gem::Version
176
+ version: '0'
177
+ name: elasticsearch
178
+ prerelease: false
179
+ type: :development
180
+ version_requirements: !ruby/object:Gem::Requirement
181
+ requirements:
182
+ - - ">="
183
+ - !ruby/object:Gem::Version
184
+ version: '0'
185
+ description:
186
+ email: ''
187
+ executables: []
188
+ extensions: []
189
+ extra_rdoc_files: []
190
+ files:
191
+ - CHANGELOG.md
192
+ - CONTRIBUTORS
193
+ - Gemfile
194
+ - LICENSE
195
+ - README.md
196
+ - lib/logstash/filters/center-client.rb
197
+ - lib/logstash/filters/classification-request.rb
198
+ - lib/logstash/filters/classifier-cache.rb
199
+ - lib/logstash/filters/classifier.rb
200
+ - lib/logstash/filters/cognito-client.rb
201
+ - lib/logstash/filters/elastic-db.rb
202
+ - lib/logstash/filters/field-handler.rb
203
+ - lib/logstash/filters/local-classifier.rb
204
+ - lib/logstash/filters/plugin-logic.rb
205
+ - lib/logstash/filters/response.rb
206
+ - lib/logstash/filters/threats_classifier.rb
207
+ - lib/logstash/filters/utils.rb
208
+ - logstash-filter-threats_classifier.gemspec
209
+ - spec/filters/bulk-processor_spec.rb
210
+ - spec/filters/classifier-cache_spec.rb
211
+ - spec/filters/classifier_spec.rb
212
+ - spec/filters/cognito-client_spec.rb
213
+ - spec/filters/field-handler_spec.rb
214
+ - spec/filters/local-classifier_spec.rb
215
+ - spec/filters/plugin-logic_spec.rb
216
+ - spec/filters/threats-classifier_spec.rb
217
+ - spec/filters/utils_spec.rb
218
+ - spec/spec_helper.rb
219
+ homepage: http://www.empow.co
220
+ licenses:
221
+ - Apache-2.0
222
+ metadata:
223
+ logstash_plugin: 'true'
224
+ logstash_group: filter
225
+ post_install_message:
226
+ rdoc_options: []
227
+ require_paths:
228
+ - lib
229
+ required_ruby_version: !ruby/object:Gem::Requirement
230
+ requirements:
231
+ - - ">="
232
+ - !ruby/object:Gem::Version
233
+ version: '0'
234
+ required_rubygems_version: !ruby/object:Gem::Requirement
235
+ requirements:
236
+ - - ">="
237
+ - !ruby/object:Gem::Version
238
+ version: '0'
239
+ requirements: []
240
+ rubyforge_project:
241
+ rubygems_version: 2.6.13
242
+ signing_key:
243
+ specification_version: 4
244
+ summary: Returns classification information for attacks from the empow classification
245
+ center, based on information in log strings
246
+ test_files:
247
+ - spec/filters/bulk-processor_spec.rb
248
+ - spec/filters/classifier-cache_spec.rb
249
+ - spec/filters/classifier_spec.rb
250
+ - spec/filters/cognito-client_spec.rb
251
+ - spec/filters/field-handler_spec.rb
252
+ - spec/filters/local-classifier_spec.rb
253
+ - spec/filters/plugin-logic_spec.rb
254
+ - spec/filters/threats-classifier_spec.rb
255
+ - spec/filters/utils_spec.rb
256
+ - spec/spec_helper.rb