Examples with AuditEvent org.graylog2.audit.jersey.AuditEvent used on opensource projects

Example 31 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class UsersResource method revokeToken.

@DELETE
@Path("{userId}/tokens/{idOrToken}")
@ApiOperation("Removes a token for a user")
@AuditEvent(type = AuditEventTypes.USER_ACCESS_TOKEN_DELETE)
public void revokeToken(@ApiParam(name = "userId", required = true) @PathParam("userId") String userId, @ApiParam(name = "idOrToken", required = true) @PathParam("idOrToken") String idOrToken) {
    final User user = loadUserById(userId);
    final String username = user.getName();
    if (!isPermitted(USERS_TOKENREMOVE, username)) {
        throw new ForbiddenException("Not allowed to remove tokens for user " + username);
    }
    // The endpoint supports both, deletion by token ID and deletion by using the token value itself.
    // The latter should not be used anymore because the plain text token will be part of the URL and URLs
    // will most probably be logged. We keep the old behavior for backwards compatibility.
    // TODO: Remove support for old behavior in 4.0
    final AccessToken accessToken = Optional.ofNullable(accessTokenService.loadById(idOrToken)).orElse(accessTokenService.load(idOrToken));
    if (accessToken != null) {
        accessTokenService.destroy(accessToken);
    } else {
        throw new NotFoundException("Couldn't find access token for user " + username);
    }
}

Example 32 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class StreamResource method create.

@POST
@Timed
@ApiOperation(value = "Create a stream")
@RequiresPermissions(RestPermissions.STREAMS_CREATE)
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@AuditEvent(type = AuditEventTypes.STREAM_CREATE)
public Response create(@ApiParam(name = "JSON body", required = true) final CreateStreamRequest cr, @Context UserContext userContext) throws ValidationException {
    // Create stream.
    final Stream stream = streamService.create(cr, getCurrentUser().getName());
    stream.setDisabled(true);
    final IndexSet indexSet = stream.getIndexSet();
    if (!indexSet.getConfig().isWritable()) {
        throw new BadRequestException("Assigned index set must be writable!");
    } else if (!indexSet.getConfig().isRegularIndex()) {
        throw new BadRequestException("Assigned index set is not usable");
    }
    final Set<StreamRule> streamRules = cr.rules().stream().map(streamRule -> streamRuleService.create(null, streamRule)).collect(Collectors.toSet());
    final String id = streamService.saveWithRulesAndOwnership(stream, streamRules, userContext.getUser());
    final Map<String, String> result = ImmutableMap.of("stream_id", id);
    final URI streamUri = getUriBuilderToSelf().path(StreamResource.class).path("{streamId}").build(id);
    return Response.created(streamUri).entity(result).build();
}

Example 33 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class StreamResource method resume.

@POST
@Path("/{streamId}/resume")
@Timed
@ApiOperation(value = "Resume a stream")
@ApiResponses(value = { @ApiResponse(code = 404, message = "Stream not found."), @ApiResponse(code = 400, message = "Invalid or missing Stream id.") })
@AuditEvent(type = AuditEventTypes.STREAM_START)
public void resume(@ApiParam(name = "streamId", required = true) @PathParam("streamId") @NotEmpty String streamId) throws NotFoundException, ValidationException {
    checkAnyPermission(new String[] { RestPermissions.STREAMS_CHANGESTATE, RestPermissions.STREAMS_EDIT }, streamId);
    checkNotEditableStream(streamId, "The stream cannot be resumed.");
    final Stream stream = streamService.load(streamId);
    streamService.resume(stream);
}

Example 34 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class StreamAlertConditionResource method delete.

@DELETE
@Timed
@Path("{conditionId}")
@ApiOperation(value = "Delete an alert condition")
@ApiResponses(value = { @ApiResponse(code = 404, message = "Stream not found."), @ApiResponse(code = 400, message = "Invalid ObjectId.") })
@AuditEvent(type = AuditEventTypes.ALERT_CONDITION_DELETE)
public void delete(@ApiParam(name = "streamId", value = "The stream id this alert condition belongs to.", required = true) @PathParam("streamId") String streamid, @ApiParam(name = "conditionId", value = "The alert condition id to be deleted", required = true) @PathParam("conditionId") String conditionId) throws NotFoundException {
    checkPermission(RestPermissions.STREAMS_EDIT, streamid);
    final Stream stream = streamService.load(streamid);
    streamService.removeAlertCondition(stream, conditionId);
}

Example 35 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class StreamAlertConditionResource method update.

@PUT
@Timed
@Path("{conditionId}")
@ApiOperation(value = "Modify an alert condition")
@ApiResponses(value = { @ApiResponse(code = 404, message = "Stream not found."), @ApiResponse(code = 400, message = "Invalid ObjectId.") })
@AuditEvent(type = AuditEventTypes.ALERT_CONDITION_UPDATE)
public void update(@ApiParam(name = "streamId", value = "The stream id the alert condition belongs to.", required = true) @PathParam("streamId") String streamid, @ApiParam(name = "conditionId", value = "The alert condition id.", required = true) @PathParam("conditionId") String conditionid, @ApiParam(name = "JSON body", required = true) @Valid @NotNull CreateConditionRequest ccr) throws NotFoundException, ValidationException {
    checkPermission(RestPermissions.STREAMS_EDIT, streamid);
    final Stream stream = streamService.load(streamid);
    AlertCondition alertCondition = streamService.getAlertCondition(stream, conditionid);
    try {
        final AlertCondition updatedCondition = alertService.updateFromRequest(alertCondition, convertConfigurationInRequest(ccr));
        streamService.updateAlertCondition(stream, updatedCondition);
    } catch (ConfigurationException e) {
        throw new BadRequestException("Invalid alert condition parameters", e);
    }
}