logstash_auditor 0.0.6 → 0.0.7
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +14 -18
- data/lib/logstash_auditor/version.rb +1 -1
- data/sanity/Gemfile +1 -1
- data/sanity/sanity.rb +3 -3
- metadata +1 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 6c3d76abc5788824b821f1770ec008c16437abb5
|
4
|
+
data.tar.gz: 7117c44fa990fe9a1e1f8a0f242bd2078dcfddaf
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 0397b01c9e3d5791b38b66138bd3ce812ea828c448c6bfbde7ea5b49ff33ff23239925cabf02b2f65bcbe2c8b32808ad8715528f3a1045e5b136743d126fa2d7
|
7
|
+
data.tar.gz: c45df64e14df881cddfd6966f8200e83db91f169999612fe2defba11cf55f19744388bee95e89a41068565a83adcd4a6f779abd2cac894190cfecd049ae338a7
|
data/README.md
CHANGED
@@ -5,6 +5,7 @@ This gem provides the logstash auditor that can be plugged into the SOAR archite
|
|
5
5
|
## State of the API
|
6
6
|
|
7
7
|
This auditor is to be extended with NFR support pending behavioural specifications.
|
8
|
+
Note that the interface for auditors is still not completely stable and therefore subject to change.
|
8
9
|
|
9
10
|
## Installation
|
10
11
|
|
@@ -46,42 +47,41 @@ Debugging the docker image:
|
|
46
47
|
|
47
48
|
Initialize and configure the auditor so:
|
48
49
|
|
49
|
-
```
|
50
|
+
```ruby
|
50
51
|
@iut = LogstashAuditor::LogstashAuditor.new
|
51
52
|
@logstash_configuration =
|
52
53
|
{ "host_url" => "http://localhost:8080",
|
53
|
-
"username" => "
|
54
|
-
"password" => "
|
54
|
+
"username" => "auditorusername",
|
55
|
+
"password" => "auditorpassword",
|
55
56
|
"timeout" => 3}
|
56
|
-
@iut.configure(@
|
57
|
+
@iut.configure(@logstash_configuration)
|
57
58
|
```
|
58
59
|
|
59
|
-
Audit using the inherited
|
60
|
+
Audit using the API methods inherited from SoarAuditorApi::SoarAuditorAPI, e.g.:
|
60
61
|
|
61
|
-
```
|
62
|
-
@iut.
|
62
|
+
```ruby
|
63
|
+
@iut.warn("#{flow_id}:This is a test event")
|
63
64
|
```
|
64
65
|
|
65
66
|
## Detailed example
|
66
67
|
|
67
|
-
```
|
68
|
+
```ruby
|
68
69
|
require 'logstash_auditor'
|
69
70
|
|
70
71
|
class Main
|
71
72
|
def test_sanity
|
72
73
|
@iut = LogstashAuditor::LogstashAuditor.new
|
73
|
-
@
|
74
|
+
@logstash_configuration =
|
74
75
|
{ "host_url" => "http://localhost:8080",
|
75
|
-
"
|
76
|
-
"
|
77
|
-
"password" => "something",
|
76
|
+
"username" => "auditorusername",
|
77
|
+
"password" => "auditorpassword",
|
78
78
|
"timeout" => 3}
|
79
|
-
@iut.configure(@
|
79
|
+
@iut.configure(@logstash_configuration)
|
80
80
|
|
81
81
|
require 'digest'
|
82
82
|
flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
|
83
83
|
|
84
|
-
@iut.
|
84
|
+
@iut.warn("#{flow_id}:This is a test event")
|
85
85
|
end
|
86
86
|
end
|
87
87
|
|
@@ -93,10 +93,6 @@ main.test_sanity
|
|
93
93
|
|
94
94
|
Bug reports and feature requests are welcome by email to barney dot de dot villiers at hetzner dot co dot za. This gem is sponsored by Hetzner (Pty) Ltd (http://hetzner.co.za)
|
95
95
|
|
96
|
-
## Notes
|
97
|
-
|
98
|
-
The interface for auditors is still not stable and therefore subject to change.
|
99
|
-
|
100
96
|
## License
|
101
97
|
|
102
98
|
The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
|
data/sanity/Gemfile
CHANGED
data/sanity/sanity.rb
CHANGED
@@ -3,17 +3,17 @@ require 'logstash_auditor'
|
|
3
3
|
class Main
|
4
4
|
def test_sanity
|
5
5
|
@iut = LogstashAuditor::LogstashAuditor.new
|
6
|
-
@
|
6
|
+
@logstash_configuration =
|
7
7
|
{ "host_url" => "http://localhost:8080",
|
8
8
|
"username" => "auditorusername",
|
9
9
|
"password" => "auditorpassword",
|
10
10
|
"timeout" => 3}
|
11
|
-
@iut.configure(@
|
11
|
+
@iut.configure(@logstash_configuration)
|
12
12
|
|
13
13
|
require 'digest'
|
14
14
|
flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
|
15
15
|
|
16
|
-
@iut.warn(flow_id
|
16
|
+
@iut.warn("#{flow_id}:This is a test event")
|
17
17
|
end
|
18
18
|
end
|
19
19
|
|