logstash_auditor 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4a48638193dc463da2061eabdf14e5c0fdd301ef
-  data.tar.gz: 22fece4261c92559d60f777a1523b2d2e3ed2f66
+  metadata.gz: 030aece775d1f1ce076e855a14509541b9033677
+  data.tar.gz: 7b324939d42281d8081c63fc2c34fcfa827b0024
 SHA512:
-  metadata.gz: 7c02dcd0bb18389ca6679c76e22fb7178e39ff9566ec730b202b6321aac09c3528ba61bda10e2a4fac1179e9d04d3fa07ef1c8965abb105b89df782c766a58b6
-  data.tar.gz: a29d438577478f3d09907eb0e9adc14b6974121f177f7c24b07e3b911fab84bf465399296de059c9a585a8804e428eecfbdf58c5e6f5b0b26fb7496c52c23e37
+  metadata.gz: 8ddc607e7296a894cea671daba9408a25dc6782634f9256b7bba979ec3a2960a7ec7ad69658f3ddef78242d8dd34db7a6eabfe956f19c2c676ba5f73fa6f8665
+  data.tar.gz: e6b6cfa9edfda84fd7d70ec929bdf1c906bea5eb3c0b0535d3cdbc0a017560c64dcc7e42dc5e15b4ba536a59ed11eac8e1b3b81a6ca9e7bcab835d15bcc13c8b

data/README.md

@@ -50,14 +50,13 @@ Initialize and configure the auditor so:
 @iut = LogstashAuditor::LogstashAuditor.new
 @logstash_configuration =
 { "host_url" => "http://localhost:8080",
-  "use_ssl"  => false,
   "username" => "something",
   "password" => "something",
   "timeout"  => 3}
 @iut.configure(@valid_logstash_configuration)
 ```
 
-Audit using the API methods, e.g.:
+Audit using the inherited API methods, e.g.:
 
 ```
 @iut.event(flow_id, "This is a test event")

data/lib/logstash_auditor/auditor.rb

@@ -1,105 +1,45 @@
-require 'json'
 require "net/http"
-require "uri"
+require "soar_auditor_api"
 
 module LogstashAuditor
-  class LogstashAuditor
-    attr_reader :has_been_configured
-    attr_reader :configuration
+  class LogstashAuditor < SoarAuditorApi::SoarAuditorAPI
 
-    def initialize
-      @has_been_configured = false
-    end
-
-    def configure(configuration = nil)
-      raise ArgumentError, "No configuration provided" if configuration == nil
-      raise ArgumentError, "Invalid configuration provided" unless configuration_is_good(configuration)
-
-      @configuration = configuration
-      @has_been_configured = true
-    end
-
-    def debug(data)
-      event(data)
-    end
-
-    def info(data)
-      event(data)
-    end
-
-    def error(data)
-      event(data)
-    end
-
-    def warn(data)
-      event(data)
-    end
-
-    def fatal(data)
-      event(data)
-    end
-
-    def <<(data)
-      event(data)
+    #inversion of control method required by the SoarAuditorAPI
+    def configuration_is_valid(configuration)
+      required_parameters = ["host_url", "username", "password"]
+      required_parameters.each { |parameter| return false unless configuration.include?(parameter) }
+      return true
     end
 
-    def event(data)
-      data = { "message" => data }
-      send_event( data )
+    #inversion of control method required by the SoarAuditorAPI
+    def audit(audit_data)
+      request = create_request(audit_data)
+      http    = create_http_transport
+      send_request_to_server(http, request)
     end
 
     private
 
-    def send_event(data)
+    def create_http_transport
       uri = URI.parse(@configuration["host_url"])
       http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = true if uri.is_a?(URI::HTTPS)
       http.read_timeout = @configuration["timeout"]
       http.open_timeout = @configuration["timeout"]
+      return http
+    end
 
-      if @configuration["use_ssl"]
-        http.use_ssl = true
-        http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-      end
-
-      request = Net::HTTP::Post.new(uri.request_uri, initheader = {'Content-Type' =>'application/json'})
+    def create_request(audit_data)
+      request = Net::HTTP::Post.new("/", initheader = {'Content-Type' => 'application/json'})
       request.basic_auth(@configuration["username"], @configuration["password"])
-      request.body = data.to_json
-
-      response = http.request(request)
-
-      case response.code
-      when "200"
-        return :success
-      when "401"
-        puts "Authorization failure contacting to logstash"
-      else
-        puts "Failure " + response.code + " communicating with logstash"
-      end
-      return :failure
+      request.body = audit_data
+      return request
     end
 
-    def configuration_is_good(configuration)
-      unless configuration.include?("host_url")
-        puts "Parameter host_url not provided in configuration"
-        return false
-      end
-      unless configuration.include?("use_ssl")
-        puts "Parameter use_ssl not provided in configuration"
-        return false
-      end
-      unless configuration.include?("username")
-        puts "Parameter username not provided in configuration"
-        return false
-      end
-      unless configuration.include?("password")
-        puts "Parameter password not provided in configuration"
-        return false
-      end
-      unless configuration.include?("timeout")
-        puts "Parameter timeout not provided in configuration"
-        return false
-      end
-      return true
+    def send_request_to_server(http, request)
+      response = http.request(request) rescue nil
+      raise StandardError, 'Failed to create connection' if response.nil?
+      raise StandardError, "Server rejected post with error code #{response.code}" unless response.code == "200"
     end
   end
 end

data/lib/logstash_auditor/version.rb

@@ -1,3 +1,3 @@
 module LogstashAuditor
-  VERSION = "0.0.5"
+  VERSION = "0.0.6"
 end

data/logstash_auditor.gemspec

@@ -26,5 +26,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "elasticsearch", "~> 1"
 
   spec.add_dependency "http", "~> 2"
-  
+  spec.add_dependency "soar_auditor_api", "~> 0.0"
+
 end

data/sanity/sanity.rb

@@ -5,16 +5,15 @@ class Main
     @iut = LogstashAuditor::LogstashAuditor.new
     @valid_logstash_configuration =
     { "host_url" => "http://localhost:8080",
-      "use_ssl"  => false,
-      "username" => "something",
-      "password" => "something",
+      "username" => "auditorusername",
+      "password" => "auditorpassword",
       "timeout"  => 3}
     @iut.configure(@valid_logstash_configuration)
 
     require 'digest'
     flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
 
-    @iut.event(flow_id, "This is a test event")
+    @iut.warn(flow_id, "This is a test event")
   end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash_auditor
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - Barney de Villiers
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-05-18 00:00:00.000000000 Z
+date: 2016-05-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -94,6 +94,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2'
+- !ruby/object:Gem::Dependency
+  name: soar_auditor_api
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.0'
 description: Logstash implementation of SOAR architecture auditing allowing easy publishing
   of events to a centralized logstash collection engine
 email: