logstash_auditor 0.0.6 → 0.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +14 -18
- data/lib/logstash_auditor/version.rb +1 -1
- data/sanity/Gemfile +1 -1
- data/sanity/sanity.rb +3 -3
- metadata +1 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 6c3d76abc5788824b821f1770ec008c16437abb5
|
4
|
+
data.tar.gz: 7117c44fa990fe9a1e1f8a0f242bd2078dcfddaf
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 0397b01c9e3d5791b38b66138bd3ce812ea828c448c6bfbde7ea5b49ff33ff23239925cabf02b2f65bcbe2c8b32808ad8715528f3a1045e5b136743d126fa2d7
|
7
|
+
data.tar.gz: c45df64e14df881cddfd6966f8200e83db91f169999612fe2defba11cf55f19744388bee95e89a41068565a83adcd4a6f779abd2cac894190cfecd049ae338a7
|
data/README.md
CHANGED
@@ -5,6 +5,7 @@ This gem provides the logstash auditor that can be plugged into the SOAR archite
|
|
5
5
|
## State of the API
|
6
6
|
|
7
7
|
This auditor is to be extended with NFR support pending behavioural specifications.
|
8
|
+
Note that the interface for auditors is still not completely stable and therefore subject to change.
|
8
9
|
|
9
10
|
## Installation
|
10
11
|
|
@@ -46,42 +47,41 @@ Debugging the docker image:
|
|
46
47
|
|
47
48
|
Initialize and configure the auditor so:
|
48
49
|
|
49
|
-
```
|
50
|
+
```ruby
|
50
51
|
@iut = LogstashAuditor::LogstashAuditor.new
|
51
52
|
@logstash_configuration =
|
52
53
|
{ "host_url" => "http://localhost:8080",
|
53
|
-
"username" => "
|
54
|
-
"password" => "
|
54
|
+
"username" => "auditorusername",
|
55
|
+
"password" => "auditorpassword",
|
55
56
|
"timeout" => 3}
|
56
|
-
@iut.configure(@
|
57
|
+
@iut.configure(@logstash_configuration)
|
57
58
|
```
|
58
59
|
|
59
|
-
Audit using the inherited
|
60
|
+
Audit using the API methods inherited from SoarAuditorApi::SoarAuditorAPI, e.g.:
|
60
61
|
|
61
|
-
```
|
62
|
-
@iut.
|
62
|
+
```ruby
|
63
|
+
@iut.warn("#{flow_id}:This is a test event")
|
63
64
|
```
|
64
65
|
|
65
66
|
## Detailed example
|
66
67
|
|
67
|
-
```
|
68
|
+
```ruby
|
68
69
|
require 'logstash_auditor'
|
69
70
|
|
70
71
|
class Main
|
71
72
|
def test_sanity
|
72
73
|
@iut = LogstashAuditor::LogstashAuditor.new
|
73
|
-
@
|
74
|
+
@logstash_configuration =
|
74
75
|
{ "host_url" => "http://localhost:8080",
|
75
|
-
"
|
76
|
-
"
|
77
|
-
"password" => "something",
|
76
|
+
"username" => "auditorusername",
|
77
|
+
"password" => "auditorpassword",
|
78
78
|
"timeout" => 3}
|
79
|
-
@iut.configure(@
|
79
|
+
@iut.configure(@logstash_configuration)
|
80
80
|
|
81
81
|
require 'digest'
|
82
82
|
flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
|
83
83
|
|
84
|
-
@iut.
|
84
|
+
@iut.warn("#{flow_id}:This is a test event")
|
85
85
|
end
|
86
86
|
end
|
87
87
|
|
@@ -93,10 +93,6 @@ main.test_sanity
|
|
93
93
|
|
94
94
|
Bug reports and feature requests are welcome by email to barney dot de dot villiers at hetzner dot co dot za. This gem is sponsored by Hetzner (Pty) Ltd (http://hetzner.co.za)
|
95
95
|
|
96
|
-
## Notes
|
97
|
-
|
98
|
-
The interface for auditors is still not stable and therefore subject to change.
|
99
|
-
|
100
96
|
## License
|
101
97
|
|
102
98
|
The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
|
data/sanity/Gemfile
CHANGED
data/sanity/sanity.rb
CHANGED
@@ -3,17 +3,17 @@ require 'logstash_auditor'
|
|
3
3
|
class Main
|
4
4
|
def test_sanity
|
5
5
|
@iut = LogstashAuditor::LogstashAuditor.new
|
6
|
-
@
|
6
|
+
@logstash_configuration =
|
7
7
|
{ "host_url" => "http://localhost:8080",
|
8
8
|
"username" => "auditorusername",
|
9
9
|
"password" => "auditorpassword",
|
10
10
|
"timeout" => 3}
|
11
|
-
@iut.configure(@
|
11
|
+
@iut.configure(@logstash_configuration)
|
12
12
|
|
13
13
|
require 'digest'
|
14
14
|
flow_id = Digest::SHA256.hexdigest("#{Time.now.to_i}#{rand(4000000)}")
|
15
15
|
|
16
|
-
@iut.warn(flow_id
|
16
|
+
@iut.warn("#{flow_id}:This is a test event")
|
17
17
|
end
|
18
18
|
end
|
19
19
|
|