class Unified2::Extra

Extra

Constants

EXTRA_TYPES

Type 1: True-Client-IP/XFF IPv4 address Type 2: True-Client-IP/XFF IPv6 address Type 3: ??? Type 4: HTTP Gzip decompressed data Type 5: SMTP filename Type 6: SMTP MAIL FROM addresses Type 7: SMTP RCPT TO addresses Type 8: SMTP Email headers Type 9: HTTP Request URI Type 10: HTTP Request Hostname Type 11: Packet's IPv6 Source IP Address Type 12: Packet's IPv6 Destination IP Address

Attributes

data[R]

Build methods defaults

data_type[R]

Build methods defaults

extra[R]

Build methods defaults

header[R]

Build methods defaults

length[R]

Build methods defaults

timestamp[R]

Build methods defaults

type_id[R]

Build methods defaults

value[R]

Build methods defaults

Public Class Methods

new(data) click to toggle source

Initialize Extra object

@param [Hash] data Extra data hash

# File lib/unified2/extra.rb, line 85
def initialize(data)
  extra = data[:data]
  @header = extra[:header]
  @data = extra[:data]

  @timestamp = Time.at(@data[:event_second].to_i)
  @value = @data[:blob].to_s
  @length = @data[:blob_length].to_i
  @type_id = @data[:extra_type].to_i
  @data_type = @data[:data_type].to_i
  @type = EXTRA_TYPES[@type_id.to_i]
end

Public Instance Methods

blank?() click to toggle source

Blank?

@return [true, false] Check is extra value is blank

# File lib/unified2/extra.rb, line 103
def blank?
  return true unless @value
  false
end
description() click to toggle source

Description

@return [String] Extra data description

# File lib/unified2/extra.rb, line 113
def description
  @type.last
end
name() click to toggle source

Name

@return [String] Extra data name

# File lib/unified2/extra.rb, line 122
def name
  @type.first
end
to_h() click to toggle source
# File lib/unified2/extra.rb, line 126
def to_h
 to_h = {
  :value => value,
  :header => {
    :type => header[:event_type],
    :length => header[:event_length],
  },
  :length => length,
  :name => name,
  :description => description,
  :timestamp => timestamp.to_s,
  :type_id => type_id,
  :data_type => data_type
 }
end