class Fluent::Plugin::JfrogSiemInput

Public Instance Methods

call_home(jpd_url) click to toggle source

call home functionality

# File lib/fluent/plugin/in_jfrog_siem.rb, line 104
def call_home(jpd_url)
  call_home_json = { "productId": "jfrogLogAnalytics/v0.5.1", "features": [ { "featureId": "Platform/Xray" }, { "featureId": "Channel/xrayeventsiem" } ] }
  response = RestClient::Request.new(
      :method => :post,
      :url => jpd_url + "/artifactory/api/system/usage",
      :payload => call_home_json.to_json,
      :user => @username,
      :password => @apikey,
      :headers => { :accept => :json, :content_type => :json}
  ).execute do |response, request, result|
    puts "Posting call home information"
  end
end
configure(conf) click to toggle source

`configure` is called before `start`. 'conf' is a `Hash` that includes the configuration parameters. If the configuration is invalid, raise `Fluent::ConfigError`.

Calls superclass method
# File lib/fluent/plugin/in_jfrog_siem.rb, line 43
def configure(conf)
  super
  if @tag == ""
    raise Fluent::ConfigError, "Must define a tag for the SIEM data."
  end

  if @jpd_url == ""
    raise Fluent::ConfigError, "Must define the JPD URL to pull Xray SIEM violations."
  end

  if @username == ""
    raise Fluent::ConfigError, "Must define the username to use for authentication."
  end

  if @apikey == ""
    raise Fluent::ConfigError, "Must define the API Key to use for authentication."
  end

  if @wait_interval < 1
    raise Fluent::ConfigError, "Wait interval must be greater than 1 to wait between pulling new events."
  end

  if @from_date == ""
    puts "From date not specified, so getting violations from current date if pos_file doesn't exist"
  end

end
get_last_item_create_date() click to toggle source

pull the last item create date from the pos_file return created_date_string

# File lib/fluent/plugin/in_jfrog_siem.rb, line 119
def get_last_item_create_date()
  recent_pos_file = get_recent_pos_file()
  if recent_pos_file != nil
    last_created_date_string = IO.readlines(recent_pos_file).last
    return DateTime.parse(last_created_date_string).strftime("%Y-%m-%dT%H:%M:%SZ")
  else
    return DateTime.now.strftime("%Y-%m-%dT%H:%M:%SZ")
  end
end
get_recent_pos_file() click to toggle source
# File lib/fluent/plugin/in_jfrog_siem.rb, line 129
def get_recent_pos_file()
  pos_file = @pos_file_path + "*.siem.pos"
  return Dir.glob(pos_file).sort.last
end
run() click to toggle source
# File lib/fluent/plugin/in_jfrog_siem.rb, line 87
def run
  # call_home(@jpd_url)

  last_created_date = get_last_item_create_date()

  if (@from_date != "")
    last_created_date = DateTime.parse(@from_date).strftime("%Y-%m-%dT%H:%M:%SZ")
  end
  date_since = last_created_date
  puts "Getting queries from #{date_since}"
  xray = Xray.new(@jpd_url, @username, @apikey, @wait_interval, @batch_size, @pos_file_path, router, @tag)
  violations_channel = xray.violations(date_since)
  xray.violation_details(violations_channel)
  sleep 100
end
shutdown() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_jfrog_siem.rb, line 80
def shutdown
  @running = false
  @thread.join
  super
end
start() click to toggle source

`start` is called when starting and after `configure` is successfully completed.

Calls superclass method
# File lib/fluent/plugin/in_jfrog_siem.rb, line 73
def start
  super
  @running = true
  @thread = Thread.new(&method(:run))
end