Examples with StixExtractor org.apache.metron.dataloads.extractor.stix.StixExtractor used on opensource projects

Example 1 with StixExtractor

use of org.apache.metron.dataloads.extractor.stix.StixExtractor in project metron by apache.

the class TaxiiIntegrationTest method testTaxii.

@Test
public void testTaxii() throws Exception {
    final MockHBaseTableProvider provider = new MockHBaseTableProvider();
    final Configuration config = HBaseConfiguration.create();
    Extractor extractor = new TransformFilterExtractorDecorator(new StixExtractor());
    TaxiiHandler handler = new TaxiiHandler(TaxiiConnectionConfig.load(taxiiConnectionConfig), extractor, config) {

        @Override
        protected synchronized Table createHTable(String tableInfo) throws IOException {
            return provider.addToCache("threat_intel", "cf");
        }
    };
    // UnitTestHelper.verboseLogging();
    handler.run();
    Set<String> maliciousDomains;
    {
        MockHTable table = (MockHTable) provider.getTable(config, "threat_intel");
        maliciousDomains = getIndicators("domainname:FQDN", table.getPutLog(), "cf");
    }
    assertTrue(maliciousDomains.contains("www.office-112.com"));
    assertEquals(numStringsMatch(MockTaxiiService.pollMsg, "DomainNameObj:Value condition=\"Equals\""), maliciousDomains.size());
    Set<String> maliciousAddresses;
    {
        MockHTable table = (MockHTable) provider.getTable(config, "threat_intel");
        maliciousAddresses = getIndicators("address:IPV_4_ADDR", table.getPutLog(), "cf");
    }
    assertTrue(maliciousAddresses.contains("94.102.53.142"));
    assertEquals(numStringsMatch(MockTaxiiService.pollMsg, "AddressObj:Address_Value condition=\"Equal\""), maliciousAddresses.size());
    MockHBaseTableProvider.clear();
    // Ensure that the handler can be run multiple times without connection issues.
    handler.run();
}