Search in sources :

Example 1 with MockHTable

use of org.apache.metron.hbase.mock.MockHTable in project metron by apache.

the class TaxiiIntegrationTest method testTaxii.

@Test
public void testTaxii() throws Exception {
    final MockHBaseTableProvider provider = new MockHBaseTableProvider();
    final Configuration config = HBaseConfiguration.create();
    Extractor extractor = new TransformFilterExtractorDecorator(new StixExtractor());
    TaxiiHandler handler = new TaxiiHandler(TaxiiConnectionConfig.load(taxiiConnectionConfig), extractor, config) {

        @Override
        protected synchronized HTableInterface createHTable(String tableInfo) throws IOException {
            return provider.addToCache("threat_intel", "cf");
        }
    };
    // UnitTestHelper.verboseLogging();
    handler.run();
    Set<String> maliciousDomains;
    {
        MockHTable table = (MockHTable) provider.getTable(config, "threat_intel");
        maliciousDomains = getIndicators("domainname:FQDN", table.getPutLog(), "cf");
    }
    Assert.assertTrue(maliciousDomains.contains("www.office-112.com"));
    Assert.assertEquals(numStringsMatch(MockTaxiiService.pollMsg, "DomainNameObj:Value condition=\"Equals\""), maliciousDomains.size());
    Set<String> maliciousAddresses;
    {
        MockHTable table = (MockHTable) provider.getTable(config, "threat_intel");
        maliciousAddresses = getIndicators("address:IPV_4_ADDR", table.getPutLog(), "cf");
    }
    Assert.assertTrue(maliciousAddresses.contains("94.102.53.142"));
    Assert.assertEquals(numStringsMatch(MockTaxiiService.pollMsg, "AddressObj:Address_Value condition=\"Equal\""), maliciousAddresses.size());
    MockHBaseTableProvider.clear();
    // Ensure that the handler can be run multiple times without connection issues.
    handler.run();
}
Also used : TransformFilterExtractorDecorator(org.apache.metron.dataloads.extractor.TransformFilterExtractorDecorator) StixExtractor(org.apache.metron.dataloads.extractor.stix.StixExtractor) HBaseConfiguration(org.apache.hadoop.hbase.HBaseConfiguration) Configuration(org.apache.hadoop.conf.Configuration) MockHBaseTableProvider(org.apache.metron.hbase.mock.MockHBaseTableProvider) StixExtractor(org.apache.metron.dataloads.extractor.stix.StixExtractor) Extractor(org.apache.metron.dataloads.extractor.Extractor) MockHTable(org.apache.metron.hbase.mock.MockHTable)

Example 2 with MockHTable

use of org.apache.metron.hbase.mock.MockHTable in project metron by apache.

the class UpdateControllerIntegrationTest method test.

@Test
public void test() throws Exception {
    String guid = "bro_2";
    ResultActions result = this.mockMvc.perform(post(searchUrl + "/findOne").with(httpBasic(user, password)).with(csrf()).contentType(MediaType.parseMediaType("application/json;charset=UTF-8")).content(findMessage0));
    try {
        result.andExpect(status().isOk()).andExpect(content().contentType(MediaType.parseMediaType("application/json;charset=UTF-8"))).andExpect(jsonPath("$.source:type").value("bro")).andExpect(jsonPath("$.guid").value(guid)).andExpect(jsonPath("$.project").doesNotExist()).andExpect(jsonPath("$.timestamp").value(2));
    } catch (Throwable t) {
        System.err.println(result.andReturn().getResponse().getContentAsString());
        throw t;
    }
    MockHTable table = (MockHTable) MockHBaseTableProvider.getFromCache(TABLE);
    Assert.assertEquals(0, table.size());
    this.mockMvc.perform(patch(updateUrl + "/patch").with(httpBasic(user, password)).with(csrf()).contentType(MediaType.parseMediaType("application/json;charset=UTF-8")).content(patch)).andExpect(status().isOk());
    this.mockMvc.perform(post(searchUrl + "/findOne").with(httpBasic(user, password)).with(csrf()).contentType(MediaType.parseMediaType("application/json;charset=UTF-8")).content(findMessage0)).andExpect(status().isOk()).andExpect(content().contentType(MediaType.parseMediaType("application/json;charset=UTF-8"))).andExpect(jsonPath("$.source:type").value("bro")).andExpect(jsonPath("$.guid").value(guid)).andExpect(jsonPath("$.project").value("metron")).andExpect(jsonPath("$.timestamp").value(2));
    Assert.assertEquals(1, table.size());
    {
        // ensure hbase is up to date
        Get g = new Get(new HBaseDao.Key(guid, "bro").toBytes());
        Result r = table.get(g);
        NavigableMap<byte[], byte[]> columns = r.getFamilyMap(CF.getBytes());
        Assert.assertEquals(1, columns.size());
    }
    this.mockMvc.perform(post(updateUrl + "/replace").with(httpBasic(user, password)).with(csrf()).contentType(MediaType.parseMediaType("application/json;charset=UTF-8")).content(replace)).andExpect(status().isOk());
    this.mockMvc.perform(post(searchUrl + "/findOne").with(httpBasic(user, password)).with(csrf()).contentType(MediaType.parseMediaType("application/json;charset=UTF-8")).content(findMessage0)).andExpect(status().isOk()).andExpect(content().contentType(MediaType.parseMediaType("application/json;charset=UTF-8"))).andExpect(jsonPath("$.source:type").value("bro")).andExpect(jsonPath("$.guid").value(guid)).andExpect(jsonPath("$.project").doesNotExist()).andExpect(jsonPath("$.timestamp").value(200));
    Assert.assertEquals(1, table.size());
    {
        // ensure hbase is up to date
        Get g = new Get(new HBaseDao.Key(guid, "bro").toBytes());
        Result r = table.get(g);
        NavigableMap<byte[], byte[]> columns = r.getFamilyMap(CF.getBytes());
        Assert.assertEquals(2, columns.size());
    }
}
Also used : HBaseDao(org.apache.metron.indexing.dao.HBaseDao) NavigableMap(java.util.NavigableMap) Get(org.apache.hadoop.hbase.client.Get) ResultActions(org.springframework.test.web.servlet.ResultActions) MockHTable(org.apache.metron.hbase.mock.MockHTable) Result(org.apache.hadoop.hbase.client.Result) SearchIntegrationTest(org.apache.metron.indexing.dao.SearchIntegrationTest) Test(org.junit.Test) SpringBootTest(org.springframework.boot.test.context.SpringBootTest)

Example 3 with MockHTable

use of org.apache.metron.hbase.mock.MockHTable in project metron by apache.

the class HBaseProfilerClientTest method setup.

@Before
public void setup() throws Exception {
    table = new MockHTable(tableName, columnFamily);
    executor = new DefaultStellarStatefulExecutor();
    // used to write values to be read during testing
    RowKeyBuilder rowKeyBuilder = new SaltyRowKeyBuilder();
    ColumnBuilder columnBuilder = new ValueOnlyColumnBuilder(columnFamily);
    profileWriter = new ProfileWriter(rowKeyBuilder, columnBuilder, table);
    // what we're actually testing
    client = new HBaseProfilerClient(table, rowKeyBuilder, columnBuilder);
}
Also used : SaltyRowKeyBuilder(org.apache.metron.profiler.hbase.SaltyRowKeyBuilder) ValueOnlyColumnBuilder(org.apache.metron.profiler.hbase.ValueOnlyColumnBuilder) DefaultStellarStatefulExecutor(org.apache.metron.stellar.common.DefaultStellarStatefulExecutor) SaltyRowKeyBuilder(org.apache.metron.profiler.hbase.SaltyRowKeyBuilder) RowKeyBuilder(org.apache.metron.profiler.hbase.RowKeyBuilder) ColumnBuilder(org.apache.metron.profiler.hbase.ColumnBuilder) ValueOnlyColumnBuilder(org.apache.metron.profiler.hbase.ValueOnlyColumnBuilder) MockHTable(org.apache.metron.hbase.mock.MockHTable) Before(org.junit.Before)

Example 4 with MockHTable

use of org.apache.metron.hbase.mock.MockHTable in project metron by apache.

the class ThreatIntelAdapterTest method setup.

@Before
public void setup() throws Exception {
    final MockHTable trackerTable = (MockHTable) MockHBaseTableProvider.addToCache(atTableName, cf);
    final MockHTable threatIntelTable = (MockHTable) MockHBaseTableProvider.addToCache(threatIntelTableName, cf);
    EnrichmentHelper.INSTANCE.load(threatIntelTable, cf, new ArrayList<LookupKV<EnrichmentKey, EnrichmentValue>>() {

        {
            add(new LookupKV<>(new EnrichmentKey("10.0.2.3", "10.0.2.3"), new EnrichmentValue(new HashMap<>())));
        }
    });
    BloomAccessTracker bat = new BloomAccessTracker(threatIntelTableName, 100, 0.03);
    PersistentAccessTracker pat = new PersistentAccessTracker(threatIntelTableName, "0", trackerTable, cf, bat, 0L);
    lookup = new EnrichmentLookup(threatIntelTable, cf, pat);
    JSONParser jsonParser = new JSONParser();
    expectedMessage = (JSONObject) jsonParser.parse(expectedMessageString);
}
Also used : EnrichmentLookup(org.apache.metron.enrichment.lookup.EnrichmentLookup) LookupKV(org.apache.metron.enrichment.lookup.LookupKV) HashMap(java.util.HashMap) BloomAccessTracker(org.apache.metron.enrichment.lookup.accesstracker.BloomAccessTracker) PersistentAccessTracker(org.apache.metron.enrichment.lookup.accesstracker.PersistentAccessTracker) JSONParser(org.json.simple.parser.JSONParser) MockHTable(org.apache.metron.hbase.mock.MockHTable) EnrichmentKey(org.apache.metron.enrichment.converter.EnrichmentKey) EnrichmentValue(org.apache.metron.enrichment.converter.EnrichmentValue) Before(org.junit.Before)

Example 5 with MockHTable

use of org.apache.metron.hbase.mock.MockHTable in project metron by apache.

the class SimpleHBaseEnrichmentWriterTest method getValues.

public static List<LookupKV<EnrichmentKey, EnrichmentValue>> getValues() throws IOException {
    MockHTable table = (MockHTable) MockHBaseTableProvider.getFromCache(TABLE_NAME);
    Assert.assertNotNull(table);
    List<LookupKV<EnrichmentKey, EnrichmentValue>> ret = new ArrayList<>();
    EnrichmentConverter converter = new EnrichmentConverter();
    for (Result r : table.getScanner(Bytes.toBytes(TABLE_CF))) {
        ret.add(converter.fromResult(r, TABLE_CF));
    }
    return ret;
}
Also used : EnrichmentConverter(org.apache.metron.enrichment.converter.EnrichmentConverter) LookupKV(org.apache.metron.enrichment.lookup.LookupKV) ArrayList(java.util.ArrayList) MockHTable(org.apache.metron.hbase.mock.MockHTable) Result(org.apache.hadoop.hbase.client.Result)

Aggregations

MockHTable (org.apache.metron.hbase.mock.MockHTable)9 LookupKV (org.apache.metron.enrichment.lookup.LookupKV)6 EnrichmentKey (org.apache.metron.enrichment.converter.EnrichmentKey)5 EnrichmentValue (org.apache.metron.enrichment.converter.EnrichmentValue)5 Before (org.junit.Before)4 Result (org.apache.hadoop.hbase.client.Result)3 Test (org.junit.Test)3 ArrayList (java.util.ArrayList)2 HashMap (java.util.HashMap)2 EnrichmentConverter (org.apache.metron.enrichment.converter.EnrichmentConverter)2 ConfigUploadComponent (org.apache.metron.enrichment.integration.components.ConfigUploadComponent)2 EnrichmentLookup (org.apache.metron.enrichment.lookup.EnrichmentLookup)2 BloomAccessTracker (org.apache.metron.enrichment.lookup.accesstracker.BloomAccessTracker)2 PersistentAccessTracker (org.apache.metron.enrichment.lookup.accesstracker.PersistentAccessTracker)2 KafkaComponent (org.apache.metron.integration.components.KafkaComponent)2 ZKServerComponent (org.apache.metron.integration.components.ZKServerComponent)2 JSONParser (org.json.simple.parser.JSONParser)2 ImmutableList (com.google.common.collect.ImmutableList)1 File (java.io.File)1 IOException (java.io.IOException)1