コード例 #1
0
 @Override
 public Map<String, Object> getFieldMap(String sourceType) {
   SensorEnrichmentConfig config = getConfigurations().getSensorEnrichmentConfig(sourceType);
   if (config != null) {
     return config.getThreatIntel().getFieldMap();
   } else {
     LOG.info("Unable to retrieve sensor config: " + sourceType);
     return null;
   }
 }
コード例 #2
0
 @Override
 protected Map<String, ConfigHandler> getFieldToHandlerMap(String sensorType) {
   if (sensorType != null) {
     SensorEnrichmentConfig config = getConfigurations().getSensorEnrichmentConfig(sensorType);
     if (config != null) {
       return config.getThreatIntel().getEnrichmentConfigs();
     } else {
       LOG.info("Unable to retrieve a sensor enrichment config of " + sensorType);
     }
   } else {
     LOG.error("Trying to retrieve a field map with sensor type of null");
   }
   return new HashMap<>();
 }
コード例 #3
0
  @Override
  public JSONObject joinMessages(Map<String, JSONObject> streamMessageMap) {
    JSONObject ret = super.joinMessages(streamMessageMap);
    LOG.trace("Received joined messages: {}", ret);
    boolean isAlert = ret.containsKey("is_alert");
    if (!isAlert) {
      for (Object key : ret.keySet()) {
        if (key.toString().startsWith("threatintels") && !key.toString().endsWith(".ts")) {
          isAlert = true;
          break;
        }
      }
    } else {
      Object isAlertObj = ret.get("is_alert");
      isAlert = ConversionUtils.convert(isAlertObj, Boolean.class);
      if (!isAlert) {
        ret.remove("is_alert");
      }
    }
    if (isAlert) {
      ret.put("is_alert", "true");
      String sourceType = MessageUtils.getSensorType(ret);
      SensorEnrichmentConfig config = getConfigurations().getSensorEnrichmentConfig(sourceType);
      ThreatTriageConfig triageConfig = null;
      if (config != null) {
        triageConfig = config.getThreatIntel().getTriageConfig();
        if (LOG.isDebugEnabled()) {
          LOG.debug(sourceType + ": Found sensor enrichment config.");
        }
      } else {
        LOG.debug(sourceType + ": Unable to find threat config.");
      }
      if (triageConfig != null) {
        if (LOG.isDebugEnabled()) {
          LOG.debug(sourceType + ": Found threat triage config: " + triageConfig);
        }

        if (LOG.isDebugEnabled()
            && (triageConfig.getRiskLevelRules() == null
                || triageConfig.getRiskLevelRules().isEmpty())) {
          LOG.debug(sourceType + ": Empty rules!");
        }

        ThreatTriageProcessor threatTriageProcessor =
            new ThreatTriageProcessor(config, functionResolver, stellarContext);
        Double triageLevel = threatTriageProcessor.apply(ret);
        if (LOG.isDebugEnabled()) {
          String rules = Joiner.on('\n').join(triageConfig.getRiskLevelRules().entrySet());
          LOG.debug(
              "Marked " + sourceType + " as triage level " + triageLevel + " with rules " + rules);
        }
        if (triageLevel != null && triageLevel > 0) {
          ret.put("threat.triage.level", triageLevel);
        }
      } else {
        LOG.debug(sourceType + ": Unable to find threat triage config!");
      }
    }

    return ret;
  }