Examples with MappedMessage org.graylog.plugins.cef.parser.MappedMessage used on opensource projects

Example 1 with MappedMessage

use of org.graylog.plugins.cef.parser.MappedMessage in project graylog2-server by Graylog2.

the class CEFCodecTest method decideSourceWithShortDeviceAddressReturnsExtensionValue.

@Test
public void decideSourceWithShortDeviceAddressReturnsExtensionValue() throws Exception {
    final MappedMessage cefMessage = mock(MappedMessage.class);
    when(cefMessage.mappedExtensions()).thenReturn(Collections.singletonMap("dvc", "128.66.23.42"));
    final RawMessage rawMessage = new RawMessage(new byte[0], new InetSocketAddress("example.com", 12345));
    assertEquals("128.66.23.42", codec.decideSource(cefMessage, rawMessage));
}

Example 2 with MappedMessage

use of org.graylog.plugins.cef.parser.MappedMessage in project graylog2-server by Graylog2.

the class CEFCodecTest method decideSourceWithFullDeviceAddressReturnsExtensionValue.

@Test
public void decideSourceWithFullDeviceAddressReturnsExtensionValue() throws Exception {
    final MappedMessage cefMessage = mock(MappedMessage.class);
    when(cefMessage.mappedExtensions()).thenReturn(Collections.singletonMap("deviceAddress", "128.66.23.42"));
    final RawMessage rawMessage = new RawMessage(new byte[0], new InetSocketAddress("example.com", 12345));
    assertEquals("128.66.23.42", codec.decideSource(cefMessage, rawMessage));
}

Example 3 with MappedMessage

use of org.graylog.plugins.cef.parser.MappedMessage in project graylog2-server by Graylog2.

the class CEFParserFunction method evaluate.

@Override
public CEFParserResult evaluate(FunctionArgs args, EvaluationContext context) {
    final String cef = valueParam.required(args, context);
    final boolean useFullNames = useFullNamesParam.optional(args, context).orElse(false);
    final CEFParser parser = CEFParserFactory.create();
    if (cef == null || cef.isEmpty()) {
        LOG.debug("NULL or empty parameter passed to CEF parser function. Not evaluating.");
        return null;
    }
    LOG.debug("Running CEF parser for [{}].", cef);
    final MappedMessage message;
    try (Timer.Context timer = parseTime.time()) {
        message = new MappedMessage(parser.parse(cef.trim()), useFullNames);
    } catch (Exception e) {
        LOG.error("Error while parsing CEF message: {}", cef, e);
        return null;
    }
    final Map<String, Object> fields = new HashMap<>();
    /*
          * Add all CEF standard fields. We are prefixing with cef_ to avoid overwriting existing fields or to be
          * overwritten ourselves later in the processing. The user is encouraged to run another pipeline function
          * to clean up field names if desired.
         */
    fields.put("cef_version", message.cefVersion());
    fields.put("device_vendor", message.deviceVendor());
    fields.put("device_product", message.deviceProduct());
    fields.put("device_version", message.deviceVersion());
    fields.put("device_event_class_id", message.deviceEventClassId());
    fields.put("name", message.name());
    fields.put("severity", message.severity());
    // Add all custom CEF fields.
    fields.putAll(message.mappedExtensions());
    return new CEFParserResult(fields);
}

Example 4 with MappedMessage

use of org.graylog.plugins.cef.parser.MappedMessage in project graylog2-server by Graylog2.

the class CEFCodecTest method decideSourceWithoutDeviceAddressReturnsCEFHostname.

@Test
public void decideSourceWithoutDeviceAddressReturnsCEFHostname() throws Exception {
    final MappedMessage cefMessage = mock(MappedMessage.class);
    when(cefMessage.host()).thenReturn("128.66.23.42");
    when(cefMessage.mappedExtensions()).thenReturn(Collections.emptyMap());
    final RawMessage rawMessage = new RawMessage(new byte[0], new InetSocketAddress("example.com", 12345));
    assertEquals("128.66.23.42", codec.decideSource(cefMessage, rawMessage));
}

Example 5 with MappedMessage

use of org.graylog.plugins.cef.parser.MappedMessage in project graylog2-server by Graylog2.

the class CEFCodecTest method decideSourceWithoutDeviceAddressReturnsRawMessageRemoteAddress.

@Test
public void decideSourceWithoutDeviceAddressReturnsRawMessageRemoteAddress() throws Exception {
    final MappedMessage cefMessage = mock(MappedMessage.class);
    when(cefMessage.mappedExtensions()).thenReturn(Collections.emptyMap());
    final RawMessage rawMessage = new RawMessage(new byte[0], new InetSocketAddress("128.66.23.42", 12345));
    // The hostname is unresolved, so we have to add the leading slash. Oh, Java...
    assertEquals("/128.66.23.42", codec.decideSource(cefMessage, rawMessage));
}