logstash_auditor 0.0.10 → 0.0.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +6 -4
- data/lib/logstash_auditor/auditor.rb +1 -1
- data/lib/logstash_auditor/version.rb +1 -1
- data/logstash_auditor.gemspec +1 -1
- data/sanity/Gemfile +1 -1
- data/sanity/sanity.rb +1 -4
- metadata +4 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7078c71ac9bc1d415fc2ef731c8b1b4144f28ffc
|
|
4
|
+
data.tar.gz: 52a20a155a37a954ce73001673268ade2875ea23
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 6eea2c171322c362df0bb31cedef093bb9a27b81474cf85a61ff0ddf4533e33bb8260b653fe80c9f1c2e069a73eabf874b767f476ee93dd19402db49962d3d4b
|
|
7
|
+
data.tar.gz: 36cbc1877230476134423fcf7255700b61209ac627b0daec195f018c23d8b84fc81a2183febe4648f7dc5797b189312a508536719013bbd4f9617878c7bee03f
|
data/README.md
CHANGED
|
@@ -23,6 +23,11 @@ Or install it yourself as:
|
|
|
23
23
|
|
|
24
24
|
$ gem install logstash_auditor
|
|
25
25
|
|
|
26
|
+
## Configuration of Logstash Server
|
|
27
|
+
|
|
28
|
+
The logstash server must be configured using the configuration in the folder spec/support/logstash_conf.d
|
|
29
|
+
This configuration is used by the docker image during the TDD tests which ensures that this gem and the server configuration is compatible.
|
|
30
|
+
|
|
26
31
|
## Testing
|
|
27
32
|
|
|
28
33
|
Behavioural driven testing can be performed by testing against a local ELK docker image:
|
|
@@ -79,10 +84,7 @@ class Main
|
|
|
79
84
|
"timeout" => 3}
|
|
80
85
|
@iut.configure(@logstash_configuration)
|
|
81
86
|
|
|
82
|
-
|
|
83
|
-
flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
|
|
84
|
-
|
|
85
|
-
@iut.warn("#{flow_id}:#{Time.now.utc.iso8601(3)}::test1234")
|
|
87
|
+
@iut.warn("#{SecureRandom.hex(32)}:#{Time.now.utc.iso8601(3)}:test1234")
|
|
86
88
|
end
|
|
87
89
|
end
|
|
88
90
|
|
|
@@ -5,7 +5,7 @@ module LogstashAuditor
|
|
|
5
5
|
class LogstashAuditor < SoarAuditorApi::AuditorAPI
|
|
6
6
|
|
|
7
7
|
#inversion of control method required by the AuditorAPI
|
|
8
|
-
def configuration_is_valid(configuration)
|
|
8
|
+
def configuration_is_valid?(configuration)
|
|
9
9
|
required_parameters = ["host_url", "username", "password"]
|
|
10
10
|
required_parameters.each { |parameter| return false unless configuration.include?(parameter) }
|
|
11
11
|
return true
|
data/logstash_auditor.gemspec
CHANGED
data/sanity/Gemfile
CHANGED
data/sanity/sanity.rb
CHANGED
|
@@ -11,10 +11,7 @@ class Main
|
|
|
11
11
|
"timeout" => 3}
|
|
12
12
|
@iut.configure(@logstash_configuration)
|
|
13
13
|
|
|
14
|
-
|
|
15
|
-
flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
|
|
16
|
-
|
|
17
|
-
@iut.warn("#{flow_id}:#{Time.now.utc.iso8601(3)}::test1234")
|
|
14
|
+
@iut.warn("#{SecureRandom.hex(32)}:#{Time.now.utc.iso8601(3)}:test1234")
|
|
18
15
|
end
|
|
19
16
|
end
|
|
20
17
|
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash_auditor
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
4
|
+
version: 0.0.11
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Barney de Villiers
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2016-05-
|
|
11
|
+
date: 2016-05-26 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: bundler
|
|
@@ -100,14 +100,14 @@ dependencies:
|
|
|
100
100
|
requirements:
|
|
101
101
|
- - "~>"
|
|
102
102
|
- !ruby/object:Gem::Version
|
|
103
|
-
version: 0.0.
|
|
103
|
+
version: 0.0.5
|
|
104
104
|
type: :runtime
|
|
105
105
|
prerelease: false
|
|
106
106
|
version_requirements: !ruby/object:Gem::Requirement
|
|
107
107
|
requirements:
|
|
108
108
|
- - "~>"
|
|
109
109
|
- !ruby/object:Gem::Version
|
|
110
|
-
version: 0.0.
|
|
110
|
+
version: 0.0.5
|
|
111
111
|
description: Logstash implementation of SOAR architecture auditing allowing easy publishing
|
|
112
112
|
of events to a centralized logstash collection engine
|
|
113
113
|
email:
|