Examples with AuditEvent org.graylog2.audit.jersey.AuditEvent used on opensource projects

Example 41 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class GrokResource method bulkUpdatePatterns.

@PUT
@Timed
@ApiOperation("Add a list of new patterns")
@AuditEvent(type = AuditEventTypes.GROK_PATTERN_IMPORT_CREATE)
public Response bulkUpdatePatterns(@ApiParam(name = "patterns", required = true) @NotNull GrokPatternList patternList, // deprecated. used to drop all existing patterns before import
@Deprecated @QueryParam("replace") @DefaultValue("false") boolean deprecatedDropAllExisting, @ApiParam(name = "import-strategy", value = "Strategy to apply when importing.") @QueryParam("import-strategy") ImportStrategy importStrategy) throws ValidationException {
    checkPermission(RestPermissions.INPUTS_CREATE);
    try {
        if (!grokPatternService.validateAll(patternList.patterns())) {
            throw new ValidationException("Invalid pattern contained. Did not save any patterns.");
        }
    } catch (GrokException | IllegalArgumentException e) {
        throw new ValidationException("Invalid pattern. Did not save any patterns\n" + e.getMessage());
    }
    ImportStrategy resolvedStrategy = importStrategy != null ? importStrategy : deprecatedDropAllExisting ? ImportStrategy.DROP_ALL_EXISTING : ImportStrategy.ABORT_ON_CONFLICT;
    grokPatternService.saveAll(patternList.patterns(), resolvedStrategy);
    return Response.accepted().build();
}

Example 42 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class GrokResource method createPattern.

@POST
@Timed
@ApiOperation(value = "Add a new named pattern", response = GrokPattern.class)
@AuditEvent(type = AuditEventTypes.GROK_PATTERN_CREATE)
public Response createPattern(@ApiParam(name = "pattern", required = true) @Valid @NotNull GrokPattern pattern) throws ValidationException {
    checkPermission(RestPermissions.INPUTS_CREATE);
    // remove the ID from the pattern, this is only used to create new patterns
    final GrokPattern newPattern = grokPatternService.save(pattern.toBuilder().id(null).build());
    final URI patternUri = getUriBuilderToSelf().path(GrokResource.class, "listPattern").build(newPattern.id());
    return Response.created(patternUri).entity(newPattern).build();
}

Example 43 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class GrokResource method bulkUpdatePatternsFromTextFile.

@POST
@Consumes(MediaType.TEXT_PLAIN)
@Timed
@ApiOperation("Add a list of new patterns")
@AuditEvent(type = AuditEventTypes.GROK_PATTERN_IMPORT_CREATE)
public Response bulkUpdatePatternsFromTextFile(@ApiParam(name = "patterns", required = true) @NotNull InputStream patternsFile, // deprecated. used to drop all existing patterns before import
@Deprecated @QueryParam("replace") @DefaultValue("false") boolean deprecatedDropAllExisting, @ApiParam(name = "import-strategy", value = "Strategy to apply when importing.") @QueryParam("import-strategy") ImportStrategy importStrategy) throws ValidationException, IOException {
    checkPermission(RestPermissions.INPUTS_CREATE);
    final List<GrokPattern> grokPatterns = readGrokPatterns(patternsFile);
    if (!grokPatterns.isEmpty()) {
        try {
            if (!grokPatternService.validateAll(grokPatterns)) {
                throw new ValidationException("Invalid pattern contained. Did not save any patterns.");
            }
        } catch (GrokException | IllegalArgumentException e) {
            throw new ValidationException("Invalid pattern. Did not save any patterns\n" + e.getMessage());
        }
        ImportStrategy resolvedStrategy = importStrategy != null ? importStrategy : deprecatedDropAllExisting ? ImportStrategy.DROP_ALL_EXISTING : ImportStrategy.ABORT_ON_CONFLICT;
        grokPatternService.saveAll(grokPatterns, resolvedStrategy);
    }
    return Response.accepted().build();
}

Example 44 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class SessionsResource method terminateSession.

@DELETE
@ApiOperation(value = "Terminate an existing session", notes = "Destroys the session with the given ID: the equivalent of logging out.")
@Path("/{sessionId}")
@RequiresAuthentication
@AuditEvent(type = AuditEventTypes.SESSION_DELETE)
public void terminateSession(@ApiParam(name = "sessionId", required = true) @PathParam("sessionId") String sessionId) {
    final Subject subject = getSubject();
    securityManager.logout(subject);
}

Example 45 with AuditEvent

use of org.graylog2.audit.jersey.AuditEvent in project graylog2-server by Graylog2.

the class ContentPackResource method deleteContentPackInstallationById.

@DELETE
@Path("{contentPackId}/installations/{installationId}")
@Timed
@ApiOperation(value = "Uninstall a content pack installation")
@ApiResponses(value = { @ApiResponse(code = 500, message = "Error loading content packs") })
@AuditEvent(type = AuditEventTypes.CONTENT_PACK_UNINSTALL)
@JsonView(ContentPackView.HttpView.class)
public Response deleteContentPackInstallationById(@ApiParam(name = "contentPackId", value = "Content pack ID", required = true) @PathParam("contentPackId") ModelId contentPackId, @ApiParam(name = "installationId", value = "Installation ID", required = true) @PathParam("installationId") String installationId) {
    checkPermission(RestPermissions.CONTENT_PACK_UNINSTALL, contentPackId.toString());
    final ContentPackInstallation installation = contentPackInstallationPersistenceService.findById(new ObjectId(installationId)).orElseThrow(() -> new NotFoundException("Couldn't find installation " + installationId));
    final ContentPack contentPack = contentPackPersistenceService.findByIdAndRevision(installation.contentPackId(), installation.contentPackRevision()).orElseThrow(() -> new NotFoundException("Couldn't find content pack " + installation.contentPackId() + " rev " + installation.contentPackRevision()));
    final ContentPackUninstallation removedInstallation = contentPackService.uninstallContentPack(contentPack, installation);
    return Response.ok(ImmutableMap.of("content_pack", contentPack, "uninstalled", removedInstallation)).build();
}