class Fluent::Plugin::JfrogSiemInput
Public Instance Methods
call_home(jpd_url)
click to toggle source
call home functionality
# File lib/fluent/plugin/in_jfrog_siem.rb, line 104 def call_home(jpd_url) call_home_json = { "productId": "jfrogLogAnalytics/v0.5.1", "features": [ { "featureId": "Platform/Xray" }, { "featureId": "Channel/xrayeventsiem" } ] } response = RestClient::Request.new( :method => :post, :url => jpd_url + "/artifactory/api/system/usage", :payload => call_home_json.to_json, :user => @username, :password => @apikey, :headers => { :accept => :json, :content_type => :json} ).execute do |response, request, result| puts "Posting call home information" end end
configure(conf)
click to toggle source
`configure` is called before `start`. 'conf' is a `Hash` that includes the configuration parameters. If the configuration is invalid, raise `Fluent::ConfigError`.
Calls superclass method
# File lib/fluent/plugin/in_jfrog_siem.rb, line 43 def configure(conf) super if @tag == "" raise Fluent::ConfigError, "Must define a tag for the SIEM data." end if @jpd_url == "" raise Fluent::ConfigError, "Must define the JPD URL to pull Xray SIEM violations." end if @username == "" raise Fluent::ConfigError, "Must define the username to use for authentication." end if @apikey == "" raise Fluent::ConfigError, "Must define the API Key to use for authentication." end if @wait_interval < 1 raise Fluent::ConfigError, "Wait interval must be greater than 1 to wait between pulling new events." end if @from_date == "" puts "From date not specified, so getting violations from current date if pos_file doesn't exist" end end
get_last_item_create_date()
click to toggle source
pull the last item create date from the pos_file return created_date_string
# File lib/fluent/plugin/in_jfrog_siem.rb, line 119 def get_last_item_create_date() recent_pos_file = get_recent_pos_file() if recent_pos_file != nil last_created_date_string = IO.readlines(recent_pos_file).last return DateTime.parse(last_created_date_string).strftime("%Y-%m-%dT%H:%M:%SZ") else return DateTime.now.strftime("%Y-%m-%dT%H:%M:%SZ") end end
get_recent_pos_file()
click to toggle source
# File lib/fluent/plugin/in_jfrog_siem.rb, line 129 def get_recent_pos_file() pos_file = @pos_file_path + "*.siem.pos" return Dir.glob(pos_file).sort.last end
run()
click to toggle source
# File lib/fluent/plugin/in_jfrog_siem.rb, line 87 def run # call_home(@jpd_url) last_created_date = get_last_item_create_date() if (@from_date != "") last_created_date = DateTime.parse(@from_date).strftime("%Y-%m-%dT%H:%M:%SZ") end date_since = last_created_date puts "Getting queries from #{date_since}" xray = Xray.new(@jpd_url, @username, @apikey, @wait_interval, @batch_size, @pos_file_path, router, @tag) violations_channel = xray.violations(date_since) xray.violation_details(violations_channel) sleep 100 end
shutdown()
click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_jfrog_siem.rb, line 80 def shutdown @running = false @thread.join super end
start()
click to toggle source
`start` is called when starting and after `configure` is successfully completed.
Calls superclass method
# File lib/fluent/plugin/in_jfrog_siem.rb, line 73 def start super @running = true @thread = Thread.new(&method(:run)) end