@Override
public Map<String, Object> getFieldMap(String sourceType) {
SensorEnrichmentConfig config = getConfigurations().getSensorEnrichmentConfig(sourceType);
if (config != null) {
return config.getThreatIntel().getFieldMap();
} else {
LOG.info("Unable to retrieve sensor config: " + sourceType);
return null;
}
}
@Override
protected Map<String, ConfigHandler> getFieldToHandlerMap(String sensorType) {
if (sensorType != null) {
SensorEnrichmentConfig config = getConfigurations().getSensorEnrichmentConfig(sensorType);
if (config != null) {
return config.getThreatIntel().getEnrichmentConfigs();
} else {
LOG.info("Unable to retrieve a sensor enrichment config of " + sensorType);
}
} else {
LOG.error("Trying to retrieve a field map with sensor type of null");
}
return new HashMap<>();
}
@Override
public JSONObject joinMessages(Map<String, JSONObject> streamMessageMap) {
JSONObject ret = super.joinMessages(streamMessageMap);
LOG.trace("Received joined messages: {}", ret);
boolean isAlert = ret.containsKey("is_alert");
if (!isAlert) {
for (Object key : ret.keySet()) {
if (key.toString().startsWith("threatintels") && !key.toString().endsWith(".ts")) {
isAlert = true;
break;
}
}
} else {
Object isAlertObj = ret.get("is_alert");
isAlert = ConversionUtils.convert(isAlertObj, Boolean.class);
if (!isAlert) {
ret.remove("is_alert");
}
}
if (isAlert) {
ret.put("is_alert", "true");
String sourceType = MessageUtils.getSensorType(ret);
SensorEnrichmentConfig config = getConfigurations().getSensorEnrichmentConfig(sourceType);
ThreatTriageConfig triageConfig = null;
if (config != null) {
triageConfig = config.getThreatIntel().getTriageConfig();
if (LOG.isDebugEnabled()) {
LOG.debug(sourceType + ": Found sensor enrichment config.");
}
} else {
LOG.debug(sourceType + ": Unable to find threat config.");
}
if (triageConfig != null) {
if (LOG.isDebugEnabled()) {
LOG.debug(sourceType + ": Found threat triage config: " + triageConfig);
}
if (LOG.isDebugEnabled()
&& (triageConfig.getRiskLevelRules() == null
|| triageConfig.getRiskLevelRules().isEmpty())) {
LOG.debug(sourceType + ": Empty rules!");
}
ThreatTriageProcessor threatTriageProcessor =
new ThreatTriageProcessor(config, functionResolver, stellarContext);
Double triageLevel = threatTriageProcessor.apply(ret);
if (LOG.isDebugEnabled()) {
String rules = Joiner.on('\n').join(triageConfig.getRiskLevelRules().entrySet());
LOG.debug(
"Marked " + sourceType + " as triage level " + triageLevel + " with rules " + rules);
}
if (triageLevel != null && triageLevel > 0) {
ret.put("threat.triage.level", triageLevel);
}
} else {
LOG.debug(sourceType + ": Unable to find threat triage config!");
}
}
return ret;
}
