Examples with LookupKV org.apache.metron.enrichment.lookup.LookupKV used on opensource projects

Example 1 with LookupKV

use of org.apache.metron.enrichment.lookup.LookupKV in project metron by apache.

the class StixExtractor method main.

public static void main(String[] args) throws IOException {
    File file = new File("/tmp/sample.xml");
    /*if (args.length > 0) {
            file = new File(args[0]);
        } else {
            try {
                URL url = XML2Object.class.getClass().getResource(
                        "/org/mitre/stix/examples/sample.xml");
                file = new File(url.toURI());
            } catch (URISyntaxException e) {
                throw new RuntimeException(e);
            }
        }*/
    String line = FileUtils.readFileToString(file);
    StixExtractor extractor = new StixExtractor();
    for (LookupKV results : extractor.extract(line)) {
        System.out.println(results);
    }
}

Example 2 with LookupKV

use of org.apache.metron.enrichment.lookup.LookupKV in project metron by apache.

the class StixExtractor method extract.

@Override
public Iterable<LookupKV> extract(String line) throws IOException {
    STIXPackage stixPackage = STIXPackage.fromXMLString(line.replaceAll("\"Equal\"", "\"Equals\""));
    List<LookupKV> ret = new ArrayList<>();
    for (Observable o : getObservables(stixPackage)) {
        ObjectType obj = o.getObject();
        if (obj != null) {
            ObjectPropertiesType props = obj.getProperties();
            if (props != null) {
                ObjectTypeHandler handler = ObjectTypeHandlers.getHandlerByInstance(props);
                if (handler != null) {
                    if (LOG.isDebugEnabled()) {
                        LOG.debug("Found {} for properties {}", handler.getTypeClass().getCanonicalName(), props.toXMLString());
                    }
                    Iterable<LookupKV> extractions = handler.extract(props, config);
                    for (LookupKV extraction : extractions) {
                        ret.add(extraction);
                    }
                } else if (LOG.isDebugEnabled()) {
                    LOG.debug("Did not find a handler for properties {} of type {}", props.toXMLString(), props.getClass());
                }
            }
        }
    }
    return ret;
}

Example 3 with LookupKV

use of org.apache.metron.enrichment.lookup.LookupKV in project metron by apache.

the class AddressHandler method extract.

@Override
public Iterable<LookupKV> extract(final Address type, Map<String, Object> config) throws IOException {
    List<LookupKV> ret = new ArrayList<>();
    final CategoryTypeEnum category = type.getCategory();
    if (!SUPPORTED_CATEGORIES.contains(category)) {
        return ret;
    }
    String typeStr = getType();
    if (config != null) {
        if (config.containsKey(SPECIFIC_CATEGORY_CONFIG)) {
            List<CategoryTypeEnum> categories = new ArrayList<>();
            for (String c : Splitter.on(",").split(config.get(SPECIFIC_CATEGORY_CONFIG).toString())) {
                categories.add(CategoryTypeEnum.valueOf(c));
            }
            EnumSet<CategoryTypeEnum> specificCategories = EnumSet.copyOf(categories);
            if (!specificCategories.contains(category)) {
                return ret;
            }
        }
        if (config.containsKey(TYPE_CONFIG)) {
            typeStr = config.get(TYPE_CONFIG).toString();
        }
    }
    StringObjectPropertyType value = type.getAddressValue();
    for (String token : StixExtractor.split(value)) {
        final String indicatorType = typeStr + ":" + category;
        LookupKV results = new LookupKV(new EnrichmentKey(indicatorType, token), new EnrichmentValue(new HashMap<String, Object>() {

            {
                put("source-type", "STIX");
                put("indicator-type", indicatorType);
                put("source", type.toXMLString());
            }
        }));
        ret.add(results);
    }
    return ret;
}

Example 4 with LookupKV

use of org.apache.metron.enrichment.lookup.LookupKV in project metron by apache.

the class DomainHandler method extract.

@Override
public Iterable<LookupKV> extract(final DomainName type, Map<String, Object> config) throws IOException {
    List<LookupKV> ret = new ArrayList<>();
    String typeStr = getType();
    if (config != null) {
        Object o = config.get(TYPE_CONFIG);
        if (o != null) {
            typeStr = o.toString();
        }
    }
    final DomainNameTypeEnum domainType = type.getType();
    if (domainType == null || SUPPORTED_TYPES.contains(domainType)) {
        StringObjectPropertyType value = type.getValue();
        for (String token : StixExtractor.split(value)) {
            final String indicatorType = typeStr + ":" + DomainNameTypeEnum.FQDN;
            LookupKV results = new LookupKV(new EnrichmentKey(indicatorType, token), new EnrichmentValue(new HashMap<String, Object>() {

                {
                    put("source-type", "STIX");
                    put("indicator-type", indicatorType);
                    put("source", type.toXMLString());
                }
            }));
            ret.add(results);
        }
    }
    return ret;
}

Example 5 with LookupKV

use of org.apache.metron.enrichment.lookup.LookupKV in project metron by apache.

the class URIHandler method extract.

@Override
public Iterable<LookupKV> extract(URIObjectType type, Map<String, Object> config) throws IOException {
    List<LookupKV> ret = new ArrayList<>();
    if (type != null) {
        AnyURIObjectPropertyType val = type.getValue();
        if (val != null) {
            Object v = val.getValue();
            if (v != null) {
                final String indicatorType = getType();
                LookupKV results = new LookupKV(new EnrichmentKey(indicatorType, v.toString()), new EnrichmentValue(new HashMap<String, Object>() {

                    {
                        put("source-type", "STIX");
                        put("uri", v.toString());
                        put("indicator-type", indicatorType);
                        put("source", type.toXMLString());
                    }
                }));
                ret.add(results);
            }
        }
    }
    return ret;
}