oober 0.3.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 106071adcf657c015f8581464b25d729e1108484
+  data.tar.gz: 5aefffa324bcce20b8ba80c53c35345edf515bba
+SHA512:
+  metadata.gz: f16b4e6da2ed97bad77b35c620b41fb7b20132e53f0e36b75351160d53572989c851acfda1dcd17afd100a4528c4a614aa84e665680d856ff8ea75889e2d034c
+  data.tar.gz: c779fdf9e0a51f413bdaae2c5a8ceb57e289229fd895674278c4e0e9ba8dd073d47eb8ce43158e885aca3440ed18a9695a8ac0ec9aa7e719f6dcf840db566a3f

data/.gitignore

@@ -0,0 +1,12 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+/vendor/bundle/
+/log/
+/spec/fixtures/nope/

data/.rspec

@@ -0,0 +1,2 @@
+--format documentation
+--color

data/.travis.yml

@@ -0,0 +1,4 @@
+language: ruby
+rvm:
+  - 2.2.2
+before_install: gem install bundler -v 1.10.6

data/Gemfile

@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in oober.gemspec
+gemspec
+

data/Guardfile

@@ -0,0 +1,55 @@
+# A sample Guardfile
+# More info at https://github.com/guard/guard#readme
+
+## Uncomment and set this to only include directories you want to watch
+# directories %w(app lib config test spec features) \
+#  .select{|d| Dir.exists?(d) ? d : UI.warning("Directory #{d} does not exist")}
+
+## Note: if you are using the `directories` clause above and you are not
+## watching the project directory ('.'), then you will want to move
+## the Guardfile to a watched dir and symlink it back, e.g.
+#
+#  $ mkdir config
+#  $ mv Guardfile config/
+#  $ ln -s config/Guardfile .
+#
+# and, you'll have to watch "config/Guardfile" instead of "Guardfile"
+
+guard :bundler do
+  require 'guard/bundler'
+  require 'guard/bundler/verify'
+  helper = Guard::Bundler::Verify.new
+
+  files = ['Gemfile','oober.gemspec']
+  #files += Dir['*.gemspec'] if files.any? { |f| helper.uses_gemspec?(f) }
+
+  # Assume files are symlinked from somewhere
+  files.each { |file| watch(helper.real_path(file)) }
+end
+
+# Note: The cmd option is now required due to the increasing number of ways
+#       rspec may be run, below are examples of the most common uses.
+#  * bundler: 'bundle exec rspec'
+#  * bundler binstubs: 'bin/rspec'
+#  * spring: 'bin/rspec' (This will use spring if running and you have
+#                          installed the spring binstubs per the docs)
+#  * zeus: 'zeus rspec' (requires the server to be started separately)
+#  * 'just' rspec: 'rspec'
+
+guard :rspec, cmd: "bundle exec rspec" do
+  require "guard/rspec/dsl"
+  dsl = Guard::RSpec::Dsl.new(self)
+
+  # Feel free to open issues for suggestions and improvements
+
+  # RSpec files
+  rspec = dsl.rspec
+  watch(rspec.spec_helper) { rspec.spec_dir }
+  watch(rspec.spec_support) { rspec.spec_dir }
+  watch(rspec.spec_files)
+
+  # Ruby files
+  ruby = dsl.ruby
+  dsl.watch_spec_files_for(ruby.lib_files)
+
+end

data/README.md

@@ -0,0 +1,87 @@
+# Oober
+
+Oober is a simplified [TAXII](https://taxiiproject.github.io/) client for extracting and exporting structured cyber threat intelligence.
+
+Oober currently supports extracting data from [STIX](https://stixproject.github.io/)-formatted messages and exporting them via [CEF](https://protect724.hp.com/docs/DOC-1072) to a syslog receiver (and potentially ArcSight if you're into that sort of thing).
+
+## Installation
+
+you can install the gem and executables to your current ruby runtime with:
+
+    $ gem install oober
+
+If you plan on wrapping your own clients, adding extractors (it's super easy!), or starting a threat-polling repo, add the following to your 'Gemfile'
+
+    gem 'oober'
+
+and then
+
+    $ bundle install
+
+If you want to hack on oober, check the DEVELOPMENT section below
+
+## Configuration
+Oober currently is pretty configurable, but currently only supports extracting STIX messages from an http/basic_auth TAXII endpoint and transforming those into CEF-formatted syslog messages. If that's what you want to do, you're in luck.
+
+In the config, you specify the TAXII discovery endpoint, the credentials and feed name you'd like to poll. Then you describe what items to select/iterate over out of that feed, what data elements to extract from those items, and how you'd like to store the results. Finally, you can provide the address/port of a syslog server to send your extracted messages. Sample configurations in the 'samples/' directory.
+
+Element selection is specified in extractor_configs[]/select. This should be an XPath query of the deepest element you would like to iterate over.
+
+Extractions are specified as XPath queries under extractor_configs[]/extractions[]. Each extraction has an "origin" XPath and a "target". Data elements are extracted from the "origin" expression and emitted as hash values under the key name specified in "target". The whole message/content block should be available from the starting path of the 'select' node.
+
+Default hash key/values can be specified under extractor_configs[]/defaults. These defaults will be merged over in extraction, so you could potentially overwrite an extracted value if there is a key collision.
+
+There's a logstash.conf in the samples/ directory for running a syslog receiver on localhost:1999 if you'd like to inspect things as they would be sent over the wire. If you'd like to go a little deeper into logstash specifically, there's a CEF codec available from the logstash plugins repository. A JSON/tcp exporter is also on the horizon.
+
+## CLI Usage
+The CLI will automatically load a config file from ~/.oober.json unless you specify another file with the --config option.
+
+Command line help is documented with Thor. To access the help info:
+
+    $ oober help <command>
+
+To poll a feed:
+
+    $ oober poll --config /path/to/some.json
+
+To download raw messages (useful for developing configs):
+
+    $ oober download --dir /path/to/output/dir
+
+You can interactively test xpath queries against those downloaded messages with:
+
+    $ oober xpath /path/to/some/files*xml
+
+And for convenience purposes, there's an interactive pry console. The console will instantiate your client in the 'client' local variable.
+
+    $ oober console
+
+## Library Usage
+Oober can be used in your code as a client library/interface.
+
+- Oober.configure('filename.json') will instantiate a client with your extractor/exporter config
+- '#get_blocks' will download message blocks
+- '#extract_blocks' will extract hashes from the content blocks (but not transform them into the specified target format)
+- '#transform_extracts' will pass your extracted hashes and create instances of your target format
+
+## Development
+
+Other extractors should be pretty easy to implement. I plan on taking a swing at IODEF at some point.
+
+Other exporters should also be pretty easy to implement. This could be used to dump data into another webservice, database, file format, etc. JSON/tcp is probably next priority to make use of a logstash/elk stack. I think this will probably break some things at the outermost API layer, so please lock your versions while we're still in 0.X semver territory.
+
+Work on the TAXII protocol bindings themselves will happen in the 'ruby-taxii' gem. If there's breakage for different server types, then I'll handle it over there. Oober will remain scoped to what's within the TAXII Content_Block.
+
+## Security
+
+Please be advised - there's nothing (currently) in the extractor framework preventing you from doing unsafe things in your xpath queries. You will be running these queries against content packages provided by third parties, some of which could be dangerous. This inherent vulnerability is also exacerbated by the fact that only HTTP/basic is currently supported in ruby-taxii, but even when that gets resolved, you're still interacting with potentially hostile content in a murky context. It is HIGHLY recommended that you lock down the system/network access environment as much as possible.
+
+The config was intended to be used in a stateless manner, so you should be able to run from ephemeral instances just fine.
+
+## Contributing
+
+Unit tests and docs mostly missing. Need to try things out before I get more opinionated.
+
+I'll take pull requests on the development branch. Otherwise, open an issue and I'll try to get to it.
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/ryanbreed/oober.

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/oober

@@ -0,0 +1,12 @@
+#!/usr/bin/env ruby
+$LOAD_PATH.push(File.join(File.dirname(__FILE__), "..", "lib"))
+
+require 'thor'
+require 'readline'
+require 'pry'
+
+require 'oober'
+
+require 'oober/cli'
+
+Oober::Cli.start(ARGV)

data/lib/oober.rb

@@ -0,0 +1,22 @@
+require 'ipaddr'
+require 'hashie'
+require 'taxii'
+require 'cef'
+require 'json'
+require 'thor'
+
+require 'oober/version'
+require 'oober/cef_logger'
+require 'oober/extractor/stix'
+
+module Oober
+  def self.configure(path=File.join(ENV['HOME'],'.oober.json'))
+    configuration   = JSON.parse(File.read(path))
+    export_klass    = Module.const_get(configuration.delete('exporter'))
+    extractor_klass = Module.const_get(configuration.delete('extractor'))
+    export_klass.new(
+      Hashie.symbolize_keys(configuration)
+            .merge( extractor: extractor_klass)
+    )
+  end
+end

data/lib/oober/cef_logger.rb

@@ -0,0 +1,68 @@
+module Oober
+  class CefLogger < Hashie::Dash
+    property :feed_name
+
+    property :exporter
+    property :extractor
+
+    property :extractor_configs, default: []
+
+    property :export_config,
+      required: true,
+      message: 'needs to point to a valid CEF config'
+    property :taxii_config,
+      required: true,
+      message: 'needs to point to a valid ruby-taxii PollClient config'
+
+    def event_defaults
+      @event_defaults ||= {
+        name: self.feed_name,
+        deviceProduct: self.class.name,
+        deviceVersion: Oober::VERSION,
+        receiptTime: Time.new
+      }
+    end
+
+    def cef
+      @cef ||= CEF.logger(export_config)
+    end
+
+    def taxii
+      @taxii ||= Taxii::PollClient.new(taxii_config)
+    end
+
+    def get_blocks
+      taxii.get_content_blocks(self.request_message)
+    end
+
+    def extractor_pipeline(blocks=get_blocks)
+      extractors = blocks.flat_map do |block|
+        extractor_configs.map { |conf| extractor.new(conf.merge(data: block)) }
+      end
+      extractors.reject {|ext| ext.selected.empty? }
+    end
+
+    def extract_blocks(blocks=get_blocks)
+      extractor_pipeline(blocks).flat_map(&:extract)
+                                .map {|extracted| extracted.merge(event_defaults)}
+    end
+
+    def transform_extracts(events=extract_blocks)
+      events.map {|event| CEF::Event.new(event) }
+    end
+
+    def poll_messages
+      transform_extracts(extract_blocks).each do |transformed_event|
+        cef.emit(transformed_event)
+      end
+    end
+
+    def request_message
+      full_results = Taxii::Messages::Parameters::Poll.new(response_type: 'FULL')
+      req = Taxii::Messages::PollRequest.new(collection_name: feed_name, poll_parameters: full_results)
+      req.to_xml
+    end
+
+
+  end
+end

data/lib/oober/cli.rb

@@ -0,0 +1,113 @@
+def list_children(node)
+  puts 'Children: '
+  grouped = node.children.group_by {|n| name_of(n)}
+  puts grouped.map {|n,c| format('%s: %d',n,c.size) }.join(', ')
+end
+
+def name_of(node)
+  format('%s:%s',node.namespace.prefix, node.name)
+end
+
+module Oober
+  class Cli < Thor
+    class_option :config, default: File.join(ENV['HOME'],'.oober.json')
+
+    desc 'poll_feed', 'poll a feed/exporter configuration'
+    option :warn, type: :boolean, default: false
+    def poll_feed
+      oob=Oober.configure(options[:config])
+      errored_blocks = []      
+      oob.extract_blocks.each do |extracted_hash|
+        begin
+          event = CEF::Event.new(extracted_hash)
+          oob.cef.emit(event)
+        rescue Exception  => exception
+          if options[:warn]
+            errored_blocks.push([extracted_hash,exception])
+          end
+        else
+          puts event.to_cef
+        end
+        errored_blocks.each do |blk|
+          event, error = blk
+          STDERR.puts "ERROR: #{error.to_s}"
+          STDERR.puts "ERRORED MESSAGE: #{JSON.pretty_generate(event)}"
+        end
+      end
+    end
+
+    desc 'download_feed', 'download raw data for a feed/exporter config'
+    option :dir, default: 'tmp'
+    def download_feed
+      oob=Oober.configure(options[:config])
+      data_blocks = oob.get_blocks
+      data_blocks.each_with_index do |block,index|
+        filename = format('%s_%08d.%08d.xml',
+                          oob.feed_name,
+                          Time.new.to_i,
+                          index)
+        file_path = File.join(options[:dir],filename)
+        FileUtils.mkdir_p(options[:dir]) unless Dir.exist?(options[:dir])
+        File.open(file_path, 'w') do |file|
+          file.puts(block)
+        end
+      end
+    end
+
+    desc 'console', 'interactive pry session'
+    def console
+      if File.exist?(options[:config])
+        begin
+          client = Oober.configure(options[:config]) 
+          puts 'your oober client is in the local variable "client"'
+        rescue JSON::ParserError => e
+          puts "invalid config #{options[:config]}"
+        end
+      end
+      binding.pry
+    end
+
+    desc 'xpath FILE(s)', 'interactively test XPath queries against FILE(s)'
+    option :dir, default: 'tmp'
+    option :separator, type: :string, default: '----%s/%d----'
+    def xpath(*files)
+      xmls=files.map do |filename|
+        filedata = File.read(filename)
+        Nokogiri::XML(filedata,nil,nil,Nokogiri::XML::ParseOptions::DEFAULT_XML|Nokogiri::XML::ParseOptions::NOBLANKS)
+      end
+
+      file_xmls=Hash[files.zip(xmls)]
+
+      while query = Readline.readline(format('XPath Query[%d]> ',files.size), true)
+        if matched = query.match(%r{\A(children|save) (.*)})
+          cmd   = matched[1]
+          query = matched[2]
+        else
+          q   = query
+          cmd = nil
+        end
+
+        file_xmls.each do |filename, xml|
+          begin
+            [*xml.xpath(q)].each_with_index do |node,index|
+              puts format(options[:separator],filename,index)
+              case cmd
+                when nil
+                  puts node.to_s
+                when /save/
+                  fname = File.join(options[:dir],format('saved_%012d.xml',index))
+                  File.open(fname,'w') {|f| f.puts node.children.first.to_s }
+                when /children/
+                  list_children(node)
+                else
+                  puts "unknown operation: #{cmd}"
+              end
+            end
+          rescue Nokogiri::XML::XPath::SyntaxError => e
+            #puts "could not get #{q}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/oober/extractor/stix.rb

@@ -0,0 +1,50 @@
+module Oober
+  module Extractor
+    class Stix < Hashie::Dash
+
+      property :data
+      property :select,      default: '/'
+      property :extractions, default: []
+      property :defaults,    default: {}
+      property :description, default: ""
+
+      def xml
+        @xml ||= Nokogiri::XML(data,nil,nil,parse_options)
+      end
+
+      def selected
+        @selected ||= begin
+          xml.xpath(self.select).to_a
+        rescue Nokogiri::XML::XPath::SyntaxError => e
+          []
+        end
+      end
+
+      def parse_options
+        @parse_options ||= Nokogiri::XML::ParseOptions::DEFAULT_XML|Nokogiri::XML::ParseOptions::NOBLANKS
+      end
+
+      def extract
+        selected.map {|node| extract_selection(node)}
+      end
+
+      def extract_selection(node)
+        mapped_values = extractions.map {|extraction| extract_value(extraction.merge(node: node)) }
+        Hash[*mapped_values.flatten].merge(defaults)
+      end
+
+      def extract_value(node: nil, origin: nil, target: nil)
+          target_key = target.to_sym
+          target_val = ''
+          begin
+            target_val = [*node.xpath(origin)].first.to_s.strip
+          rescue Exception => e
+            STDERR.puts "FAILED TO EXTRACT #{origin}"
+            STDERR.puts e.backtrace
+            STDERR.puts e
+          end
+          [target_key, target_val]
+        end
+      end
+    end
+  end

data/lib/oober/version.rb

@@ -0,0 +1,3 @@
+module Oober
+  VERSION = '0.3.1'
+end

data/oober.gemspec

@@ -0,0 +1,35 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'oober/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'oober'
+  spec.version       = Oober::VERSION
+  spec.authors       = ['Ryan Breed']
+  spec.email         = ['opensource@breed.org']
+
+  spec.summary       = %q{ simplified interface for polling TAXII services and exporting structured data }
+  spec.description   = %q{ flexible TAXII client for integrating cyber threat information with all your stuff }
+  spec.homepage      = 'https://github.com/ryanbreed/oober'
+
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.bindir        = 'bin'
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'hashie',     '~> 3.4'
+  spec.add_dependency 'thor',       '~> 0.19'
+  spec.add_dependency 'cef',        '2.1.1.pre'
+  spec.add_dependency 'ruby-taxii', '0.3.1'
+
+  spec.add_development_dependency 'bundler', '~> 1.10'
+  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec'
+  spec.add_development_dependency 'guard'
+  spec.add_development_dependency 'guard-bundler'
+  spec.add_development_dependency 'guard-rspec'
+  spec.add_development_dependency 'simplecov'
+
+end

data/samples/hail-a-taxii.json

@@ -0,0 +1,168 @@
+{
+  "feed_name"     : "guest.MalwareDomainList_Hostlist",
+  "exporter"  : "Oober::CefLogger",
+  "extractor" : "Oober::Extractor::Stix",
+  "export_config" : {
+    "type"     : "CEF::Loggers::SyslogUdp",
+    "config"   : {
+      "receiver" : "127.0.0.1",
+      "port"     : 1999
+    }
+  },
+  "taxii_config"  : {
+    "user" : "guest",
+    "pass" : "guest",
+    "url"  : "http://hailataxii.com/taxii-discovery-service"
+  },
+  "extractor_configs" : [
+    {
+      "description" : "Malware Domain List IP Addresses",
+      "select"        : "/stix:STIX_Package/stix:Observables/cybox:Observable/cybox:Object/cybox:Properties[@xsi:type=\"AddressObj:AddressObjectType\"][@category=\"ipv4-addr\"]",
+      "defaults" : {
+        "deviceCustomString1Label" : "TLP",
+        "deviceEventCategory"      : "stix:Observables",
+        "deviceCustomString3Label" : "Obervable ID"
+      },
+      "extractions" : [
+        {
+          "origin" : "/stix:STIX_Package/stix:STIX_Header/stix:Handling/marking:Marking/marking:Marking_Structure[@xsi:type=\"tlpMarking:TLPMarkingStructureType\"]/@color",
+          "target" : "deviceCustomString1"
+        },
+        {
+          "origin" : "@xsi:type",
+          "target" : "deviceEventClassId"
+        },
+        {
+          "origin" : "@category",
+          "target" : "fileType"
+        },
+        {
+          "origin" : "../../cybox:Description/text()",
+          "target" : "message"
+        },
+        {
+          "origin" : "../../../cybox:Observable/@id",
+          "target" : "deviceCustomString3"
+        },
+        {
+          "origin" : "AddressObj:Address_Value/text()",
+          "target" : "sourceAddress"
+        }
+      ]
+    },
+    {
+      "description" : "Malware Domain List URLs",
+      "select"        : "/stix:STIX_Package/stix:Observables/cybox:Observable/cybox:Object/cybox:Properties[@xsi:type=\"URIObj:URIObjectType\"][@type=\"URL\"]/URIObj:Value[@condition=\"Equals\"]/..",
+      "defaults" : {
+        "deviceCustomString1Label" : "TLP",
+        "deviceEventCategory" : "stix:Observables",
+        "deviceCustomString3Label" : "Obervable ID"
+      },
+      "extractions" : [
+        {
+          "origin" : "/stix:STIX_Package/stix:STIX_Header/stix:Handling/marking:Marking/marking:Marking_Structure[@xsi:type=\"tlpMarking:TLPMarkingStructureType\"]/@color",
+          "target" : "deviceCustomString1"
+        },
+        {
+          "origin" : "@xsi:type",
+          "target" : "deviceEventClassId"
+        },
+        {
+          "origin" : "@type",
+          "target" : "fileType"
+        },
+        {
+          "origin" : "../../cybox:Description/text()",
+          "target" : "message"
+        },
+        {
+          "origin" : "../../../cybox:Observable/@id",
+          "target" : "deviceCustomString3"
+        },
+        {
+          "origin" : "URIObj:Value/text()",
+          "target" : "requestURL"
+        }
+      ]
+    },
+    {
+      "description" : "Malware Domain List Domain Names",
+      "select"        : "/stix:STIX_Package/stix:Observables/cybox:Observable/cybox:Object/cybox:Properties[@xsi:type=\"DomainNameObj:DomainNameObjectType\"]/DomainNameObj:Value[@condition=\"Equals\"]/..",
+      "defaults" : {
+        "deviceCustomString1Label" : "TLP",
+        "deviceCustomString3Label" : "Obervable ID",
+        "deviceEventCategory" : "stix:Observables",
+        "fileType" : "DNS Domain"
+      },
+      "extractions" : [
+        {
+          "origin" : "/stix:STIX_Package/stix:STIX_Header/stix:Handling/marking:Marking/marking:Marking_Structure[@xsi:type=\"tlpMarking:TLPMarkingStructureType\"]/@color",
+          "target" : "deviceCustomString1"
+        },
+        {
+          "origin" : "@xsi:type",
+          "target" : "deviceEventClassId"
+        },
+        {
+          "origin" : "../../cybox:Description/text()",
+          "target" : "message"
+        },
+        {
+          "origin" : "../../../cybox:Observable/@id",
+          "target" : "deviceCustomString3"
+        },
+        {
+          "origin" : "DomainNameObj:Value/text()",
+          "target" : "sourceDnsDomain"
+        }
+      ]
+    },
+    {
+      "select"        : "/stix:STIX_Package/stix:Indicators",
+      "defaults" : {
+        "deviceEventCategory"      : "stix:Indicators",
+        "deviceCustomString1Label" : "TLP",
+        "deviceCustomString2Label" : "Indicated TTP",
+        "deviceCustomString3Label" : "Observable ID"
+      },
+      "extractions" : [
+        {
+          "origin" : "descendant::indicator:Producer/stixCommon:Identity/stixCommon:Name/text()",
+          "target" : "deviceProcessName"
+        },
+        {
+          "origin" : "/stix:STIX_Package/@id",
+          "target" : "devicePayloadId"
+        },
+        {
+          "origin" : "/stix:STIX_Package/stix:STIX_Header/stix:Handling/marking:Marking/marking:Marking_Structure[@xsi:type=\"tlpMarking:TLPMarkingStructureType\"]/@color",
+          "target" : "deviceCustomString1"
+        },
+        {
+          "origin" : "descendant::stixCommon:TTP[@xsi:type=\"ttp:TTPType\"]/@idref",
+          "target" : "deviceCustomString2"
+        },
+        {
+          "origin" : "descendant::indicator:Observable/@idref",
+          "target" : "deviceCustomString3"
+        },
+        {
+          "origin" : "/stix:STIX_Package/@timestamp",
+          "target" : "endTime"
+        },
+        {
+          "origin" : "descendant::stix:Indicator/@id",
+          "target" : "externalId"
+        },
+        {
+          "origin" : "descendant::indicator:Description/text()",
+          "target" : "message"
+        },
+        {
+          "origin" : "descendant::indicator:Title/text()",
+          "target" : "reason"
+        }
+      ]
+    }
+  ]
+}

data/samples/logstash.conf

@@ -0,0 +1,10 @@
+input {
+  udp {
+    port => 1999
+    host => "127.0.0.1"
+
+  }
+}
+output {
+  stdout { codec => json }
+}

metadata

@@ -0,0 +1,216 @@
+--- !ruby/object:Gem::Specification
+name: oober
+version: !ruby/object:Gem::Version
+  version: 0.3.1
+platform: ruby
+authors:
+- Ryan Breed
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-10-20 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: hashie
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+- !ruby/object:Gem::Dependency
+  name: thor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.19'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.19'
+- !ruby/object:Gem::Dependency
+  name: cef
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 2.1.1.pre
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 2.1.1.pre
+- !ruby/object:Gem::Dependency
+  name: ruby-taxii
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.3.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.3.1
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard-bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: guard-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: " flexible TAXII client for integrating cyber threat information with
+  all your stuff "
+email:
+- opensource@breed.org
+executables:
+- oober
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- Gemfile
+- Guardfile
+- README.md
+- Rakefile
+- bin/oober
+- lib/oober.rb
+- lib/oober/cef_logger.rb
+- lib/oober/cli.rb
+- lib/oober/extractor/stix.rb
+- lib/oober/version.rb
+- oober.gemspec
+- samples/hail-a-taxii.json
+- samples/logstash.conf
+homepage: https://github.com/ryanbreed/oober
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.5.1
+signing_key: 
+specification_version: 4
+summary: simplified interface for polling TAXII services and exporting structured
+  data
+test_files: []