logstash-input-okta_enterprise 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1d974e643ea6fdb2db49ce72df98178204b06c19
-  data.tar.gz: 97c6674bfc1266e7fbb3e8399ca89d7357470070
+  metadata.gz: ce6c6e85bc6e41ec22d49a462c890c236cd849d9
+  data.tar.gz: 35076593da897161c67f167c7e69c6cc7086bac3
 SHA512:
-  metadata.gz: 662645fd23e65b811a0435c6da01c44d494e4352d6e46618e825406150ee187329f3878cb46d7bc6ee617572861fe8af35c3b434047d20e77beb76e1ac95f30a
-  data.tar.gz: f8c76352d65ca9acd5b123fb93133906b54bf05333cdcd8f554e1558f4f3a39b8244b8da136771d7dd09172e8b0e834a74da049cdc7f78036c9e13ea592c916e
+  metadata.gz: c66d8cd501e49cef03cc7c2f4f0c48983717a420cecd8e0265a81f605c27a2026703192d2c61605de6b044d08f58d26366e920d194f63ef8b9386bd416978a2b
+  data.tar.gz: ed20984c1ffad649c57e46b694234c3ccf77c53423240a61b7b8185bc12cbf53d6aab1e1a20ff4553535860cf8386baba68b4abf9157537e2f1eec6b216ed8c3

data/lib/logstash/inputs/okta_enterprise.rb

@@ -9,6 +9,7 @@ require "base64"
 require "cgi"
 
 MAX_AUTH_TOKEN_FILE_SIZE = 1 * 2**10
+FIXNUM_RESET_SIZE = 2**63 - 100000000000000000 # Size at which to reset the noise counter
 
 # This Logstash input plugin allows you to call an the Okta HTTP API to ship to other SIEMS.
 # This plugin is based on the http_poller plugin, however the plugin needed to retain a state.
@@ -150,7 +151,7 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
   # Format: File path
   config :auth_token_env, :validate => :string
 
-   # The base filename to store the pointer to the current location in the logs
+  # The base filename to store the pointer to the current location in the logs
   # This file will be renamed with each new reference to limit loss of this data
   # The location will need at least write and execute privs for the logstash user
   # This parameter is not required, however on start logstash will ship all logs to your SIEM.
@@ -168,6 +169,14 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
   # If this setting is omitted, the data will be stored at the root (top level) of the event.
   config :target, :validate => :string
 
+  # The throttle value to use for noisy log lines (at the info level)
+  # Currently just one log statement (successful HTTP connects)
+  # The value is used to mod a counter, so set it appropriately for log levels
+  # NOTE: This value will be ignored when the log level is debug or trace
+  #
+  # Format: Integer
+  config :log_throttle, :validate => :number, :required => false
+
   public
   Schedule_types = %w(cron every at in)
   def register
@@ -233,6 +242,26 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
       @filter = CGI.escape(@filter)
     end
 
+    @noisy_log = method(:open_log)
+    if (@log_throttle)
+      if (@log_throttle > FIXNUM_RESET_SIZE)
+        raise LogStash::ConfigurationError, "Config log_throttle must be" + 
+          "less than #{FIXNUM_RESET_SIZE}."
+      end
+      @noisy_log = method(:throttled_log)
+      @throttle_counter = 0
+    end
+    if (@logger.debug?)
+      @noisy_log = method(:open_log)
+    end
+    begin
+      if (@logger.trace?)
+        @noisy_log = method(:open_log)
+      end
+    rescue NoMethodError
+      # Do nothing b/c it doesn't really matter, it retains compatability with 2.4 vs higher
+    end
+
     if (@state_file_base)
       dir_name = File.dirname(@state_file_base)
       ## Generally the state file directory will have the correct permissions
@@ -459,7 +488,7 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
         @logger.debug("Continue status", :continue => @continue  )
       end
 
-      @logger.info("Successful response returned", :code => response.code, :headers => response.headers)
+      @noisy_log.call("Successful response returned",:code => response.code, :headers => response.headers)
       @logger.debug("Response body", :body => response.body)
 
     when 401
@@ -592,6 +621,23 @@ class LogStash::Inputs::OktaEnterprise < LogStash::Inputs::Base
 
   end
 
+  private
+  def throttled_log(message, vars = {})
+    if (@throttle_counter < 3 or @throttle_counter % @log_throttle == 0 or @throttle_counter >= FIXNUM_RESET_SIZE)
+      @logger.info(message, vars)
+
+      if (@throttle_counter >= FIXNUM_RESET_SIZE)
+        @throttle_counter = 0
+      end
+    end
+    @throttle_counter += 1
+  end
+
+  private
+  def open_log(message, vars)
+    @logger.info(message, vars)
+  end
+
   public
   def stop
     # nothing to do in this case so it is not necessary to define stop

data/logstash-input-okta_enterprise.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-input-okta_enterprise'
-  s.version       = '0.5.0'
+  s.version       = '0.6.0'
   s.licenses      = ['Apache License (2.0)']
   s.summary       = 'This plugin fetches log events from Okta'
   s.description   = 'This plugin fetches log events from Okta'

data/spec/inputs/okta_enterprise_spec.rb

@@ -88,6 +88,49 @@ describe LogStash::Inputs::OktaEnterprise do
         include_examples("configuration errors")
       end
     end
+    context "logger throttle management" do
+      let(:throttle_opts) {
+        throttle_opts = default_opts.merge({"log_throttle" => 100000}).clone
+        throttle_opts
+      }
+
+      context "a number too large is used" do
+        let(:opts) { 
+          throttle_opts["log_throttle"] = 2**63-1 
+          throttle_opts
+        }
+        include_examples("configuration errors")
+      end
+      context "when no throttle is set" do
+        let(:opts) { default_opts }
+        it "sets the logger function to open_log" do
+          subject.register
+          expect(subject.instance_variable_get("@noisy_log")).to eql(subject.method(:open_log))
+        end
+      end
+      context "when a throttle is set" do
+        let(:opts) { throttle_opts }
+        it "sets the logger function to throttled_log" do
+          subject.register
+          expect(subject.instance_variable_get("@noisy_log")).to eql(subject.method(:throttled_log))
+        end
+
+        context "when log level is debug" do
+          it "sets the logger function to open_log" do
+            allow(subject.instance_variable_get("@logger")).to receive(:debug?) { true }
+            subject.register
+            expect(subject.instance_variable_get("@noisy_log")).to eql(subject.method(:open_log))
+          end
+        end
+        context "when log level is trace" do
+          it "sets the logger function to open_log" do
+            allow(subject.instance_variable_get("@logger")).to receive(:trace?) { true }
+            subject.register
+            expect(subject.instance_variable_get("@noisy_log")).to eql(subject.method(:open_log))
+          end
+        end
+      end
+    end
   end
 
   describe "instances" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-okta_enterprise
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Security Risk Advisors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-12-14 00:00:00.000000000 Z
+date: 2018-11-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement