diff --git a/.travis.yml b/.travis.yml
index deb12632..fcd13cfc 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,7 +10,7 @@ before_install:
# Create .splunkrc file with default credentials
- echo host=localhost >> $HOME/.splunkrc
- echo username=admin >> $HOME/.splunkrc
- - echo password=changeme >> $HOME/.splunkrc
+ - echo password=changed! >> $HOME/.splunkrc
# Set env vars for TCP/UDP tests (we've punched these through Docker)
- export TEST_TCP_PORT=10667
- export TEST_UDP_PORT=10668
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 349fc689..5206d386 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
# Splunk Logging for Java Changelog
+## Version 1.8.0
+
+* Update JSON serialization- message property should not be encoded as a string
+* Changed underlying HTTP client to OkHttp. This change should decrease memory
+ usage and increase performance.
+* Updated Gradle build plugins to latest versions
+
## Version 1.7.3
* Update Log4j dependency version to 2.10.0 [#114](https://github.com/splunk/splunk-library-javalogging/pull/114).
diff --git a/README.md b/README.md
index f511c269..3ec6069a 100644
--- a/README.md
+++ b/README.md
@@ -1,71 +1,71 @@
-# Splunk Logging for Java
-
-#### Version 1.7.3
-
-Splunk logging for Java enables you to log events to HTTP Event Collector or to a TCP input on a Splunk Enterprise instance within your Java applications. You can use three major Java logging frameworks: [Logback](http://logback.qos.ch), [Log4j 2](http://logging.apache.org/log4j/2.x/), and [java.util.logging](https://docs.oracle.com/javase/7/docs/api/java/util/logging/package-summary.html). Splunk logging for Java is also enabled for [Simple Logging Facade for Java (SLF4J)](http://www.slf4j.org).
-
-Splunk logging for Java provides:
-
-* Appender classes that package events into the proper format for the input type you're using (HTTP Event Collector or TCP).
-
-* Handler classes that export the logging events.
-
-* An optional error handler to catch failures for HTTP Event Collector events.
-
-* Example configuration files for all three frameworks that show how to configure the frameworks to write to HTTP Event Collector or TCP ports.
-
-* Support for batching events (sent to HTTP Event Collector only).
-
-### Requirements
-
-Here's what you need to get going with the Splunk SDK for Java.
-
-#### Splunk
-
-If you haven't already installed Splunk, download it
-[here](http://www.splunk.com/download). For more about installing and running
-Splunk and system requirements, see
-[Installing & Running Splunk](http://dev.splunk.com/view/SP-CAAADRV).
-
-#### Java
-
-You'll need Java version 7 or higher, from [OpenJDK](https://openjdk.java.net) or [Oracle](https://www.oracle.com/technetwork/java).
-
-## Documentation and resources
-
-* For more information about installing and using Splunk logging for Java, see
- [Overview of Splunk logging for Java](http://dev.splunk.com/goto/sdk-slj).
-
-* For reference documentation, see the
- [Splunk logging for Java API reference](https://docs.splunk.com/DocumentationStatic/JavaLogging/1.6.2/index.html).
-
-* For all things developer with Splunk, see the
- [Splunk Developer Portal](http://dev.splunk.com).
-
-* For more about about Splunk in general, see
- [Splunk>Docs](http://docs.splunk.com/Documentation/Splunk).
-
-## License
-
-Splunk logging for Java is licensed under the Apache License 2.0.
-
-See the [LICENSE file](/license.md) for details.
-
-## Contributions
-
-[Get the Splunk Java Logging Framework from GitHub](https://github.com/splunk/splunk-library-javalogging)
-and clone the resources to your computer. For example, use the following
-command:
-
- git clone https://github.com/splunk/splunk-library-javalogging.git
-
-## Support
-
-The Splunk logging for Java is community-supported.
-
-1. You can find help through our community on [Splunk Answers](http://answers.splunk.com/) (use the "logging-library-java" tag to identify your questions).
-2. File issues on [GitHub](https://github.com/splunk/splunk-library-javalogging/issues).
-
-## Contact us
-
-You can reach the Dev Platform team at [devinfo@splunk.com](mailto:devinfo@splunk.com).
+# Splunk Logging for Java
+
+#### Version 1.8.0
+
+Splunk logging for Java enables you to log events to HTTP Event Collector or to a TCP input on a Splunk Enterprise instance within your Java applications. You can use three major Java logging frameworks: [Logback](http://logback.qos.ch), [Log4j 2](http://logging.apache.org/log4j/2.x/), and [java.util.logging](https://docs.oracle.com/javase/7/docs/api/java/util/logging/package-summary.html). Splunk logging for Java is also enabled for [Simple Logging Facade for Java (SLF4J)](http://www.slf4j.org).
+
+Splunk logging for Java provides:
+
+* Appender classes that package events into the proper format for the input type you're using (HTTP Event Collector or TCP).
+
+* Handler classes that export the logging events.
+
+* An optional error handler to catch failures for HTTP Event Collector events.
+
+* Example configuration files for all three frameworks that show how to configure the frameworks to write to HTTP Event Collector or TCP ports.
+
+* Support for batching events (sent to HTTP Event Collector only).
+
+### Requirements
+
+Here's what you need to get going with Splunk logging for Java.
+
+#### Splunk
+
+If you haven't already installed Splunk, download it
+[here](http://www.splunk.com/download). For more about installing and running
+Splunk and system requirements, see [Installing & Running Splunk](http://dev.splunk.com/view/SP-CAAADRV). Splunk logging for Java is tested with Splunk Enterprise 7.0 and 7.2.
+
+#### Java
+
+You'll need Java version 8 or higher, from [OpenJDK](https://openjdk.java.net) or [Oracle](https://www.oracle.com/technetwork/java).
+
+## Documentation and resources
+
+* For more information about installing and using Splunk logging for Java, see
+ [Overview of Splunk logging for Java](http://dev.splunk.com/goto/sdk-slj).
+
+* For reference documentation, see the
+ [Splunk logging for Java API reference](https://docs.splunk.com
+ /DocumentationStatic/JavaLogging/1.8.0/index.html).
+
+* For all things developer with Splunk, see the
+ [Splunk Developer Portal](http://dev.splunk.com).
+
+* For more about about Splunk in general, see
+ [Splunk>Docs](http://docs.splunk.com/Documentation/Splunk).
+
+## License
+
+Splunk logging for Java is licensed under the Apache License 2.0.
+
+See the [LICENSE file](/license.md) for details.
+
+## Contributions
+
+[Get the Splunk Java Logging Framework from GitHub](https://github.com/splunk/splunk-library-javalogging)
+and clone the resources to your computer. For example, use the following
+command:
+
+ git clone https://github.com/splunk/splunk-library-javalogging.git
+
+## Support
+
+The Splunk logging for Java is community-supported.
+
+1. You can find help through our community on [Splunk Answers](http://answers.splunk.com/) (use the "logging-library-java" tag to identify your questions).
+2. File issues on [GitHub](https://github.com/splunk/splunk-library-javalogging/issues).
+
+## Contact us
+
+You can reach the Dev Platform team at [devinfo@splunk.com](mailto:devinfo@splunk.com).
diff --git a/pom.xml b/pom.xml
index a7da2093..a5103c1c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
com.splunk.logging
splunk-library-javalogging
- 1.7.3
+ 1.8.0
jar
Splunk Logging for Java
@@ -30,12 +30,25 @@
maven-compiler-plugin
- 3.1
+ 3.8.1
-
- 1.6
+
+ 8
+
+ org.apache.maven.plugins
+ maven-source-plugin
+ 3.1.0
+
+
+ attach-sources
+
+ jar
+
+
+
+
biz.aQute.bnd
bnd-maven-plugin
@@ -61,7 +74,7 @@
org.apache.maven.plugins
maven-surefire-plugin
- 2.18.1
+ 2.22.2
**/*.class
@@ -75,11 +88,11 @@
org.apache.maven.plugins
maven-javadoc-plugin
+ 3.1.1
attach-javadocs
- -Xdoclint:syntax
-Xdoclint:syntax
@@ -98,7 +111,7 @@
org.apache.maven.plugins
maven-surefire-plugin
- 2.18.1
+ 2.22.2
**/HttpEventCollector_*.class
@@ -115,7 +128,7 @@
org.apache.maven.plugins
maven-surefire-plugin
- 2.18.1
+ 2.22.2
**/HttpEventCollectorUnitTest.class
@@ -129,18 +142,10 @@
StressTest
-
- maven-compiler-plugin
- 3.1
-
-
- 1.6
-
-
org.apache.maven.plugins
maven-surefire-plugin
- 2.18.1
+ 2.22.2
**/HttpLoggerStressTest.class
@@ -165,62 +170,52 @@
junit
junit
- 4.11
+ 4.12
test
org.slf4j
slf4j-api
- 1.7.5
+ 1.7.29
test
ch.qos.logback
logback-classic
- 1.1.11
+ 1.2.3
provided
ch.qos.logback
logback-core
- 1.1.11
+ 1.2.3
provided
ch.qos.logback
logback-access
- 1.1.11
+ 1.2.3
provided
- org.apache.httpcomponents
- httpclient
- 4.5.5
-
-
-
- org.apache.httpcomponents
- httpasyncclient
- 4.1.3
+ com.squareup.okhttp3
+ okhttp
+ 3.14.3
org.apache.logging.log4j
log4j-api
- 2.10.0
+ provided
+ 2.12.1
org.apache.logging.log4j
log4j-core
- 2.10.0
-
-
-
- com.googlecode.json-simple
- json-simple
- 1.1.1
+ provided
+ 2.12.1
@@ -233,18 +228,58 @@
com.google.code.gson
gson
- 2.2.4
+ 2.8.6
org.apache.commons
commons-lang3
- 3.0
+ 3.9
test
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+
+ 8
+
+
+
+ org.apache.maven.plugins
+ maven-source-plugin
+
+
+ attach-sources
+
+ jar
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-javadoc-plugin
+
+
+ attach-javadocs
+
+ jar
+
+
+
+
+
+
+
+
+
+
The Apache Software License, Version 2.0
diff --git a/src/main/java/com/splunk/logging/EventBodySerializer.java b/src/main/java/com/splunk/logging/EventBodySerializer.java
index f89987e2..27447a4c 100644
--- a/src/main/java/com/splunk/logging/EventBodySerializer.java
+++ b/src/main/java/com/splunk/logging/EventBodySerializer.java
@@ -1,9 +1,5 @@
package com.splunk.logging;
-import java.io.Serializable;
-import java.util.Map;
-import org.json.simple.JSONObject;
-
/**
*
* Define the interface to allow users to define their own event body serializer for HTTP event adapter:
@@ -16,37 +12,4 @@ String serializeEventBody(
HttpEventCollectorEventInfo eventInfo,
Object formattedMessage
);
-
- class Default implements EventBodySerializer {
-
- @Override
- public String serializeEventBody(
- final HttpEventCollectorEventInfo eventInfo,
- final Object formattedMessage
- ) {
- final JSONObject body = new JSONObject();
- HttpEventCollectorSender.putIfPresent(body, "severity", eventInfo.getSeverity());
- HttpEventCollectorSender.putIfPresent(body, "message", formattedMessage);
- HttpEventCollectorSender.putIfPresent(body, "logger", eventInfo.getLoggerName());
- HttpEventCollectorSender.putIfPresent(body, "thread", eventInfo.getThreadName());
- // add an exception record if and only if there is one
- // in practice, the message also has the exception information attached
- if (eventInfo.getExceptionMessage() != null) {
- HttpEventCollectorSender.putIfPresent(body, "exception", eventInfo.getExceptionMessage());
- }
-
- // add properties if and only if there are any
- final Map props = eventInfo.getProperties();
- if (props != null && !props.isEmpty()) {
- body.put("properties", props);
- }
- // add marker if and only if there is one
- final Serializable marker = eventInfo.getMarker();
- if (marker != null) {
- HttpEventCollectorSender.putIfPresent(body, "marker", marker.toString());
- }
-
- return body.toString();
- }
- }
}
diff --git a/src/main/java/com/splunk/logging/HttpEventCollectorErrorHandler.java b/src/main/java/com/splunk/logging/HttpEventCollectorErrorHandler.java
index b722c188..d84cbe86 100644
--- a/src/main/java/com/splunk/logging/HttpEventCollectorErrorHandler.java
+++ b/src/main/java/com/splunk/logging/HttpEventCollectorErrorHandler.java
@@ -18,8 +18,9 @@
* under the License.
*/
-import org.json.simple.JSONObject;
-import org.json.simple.parser.JSONParser;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
import java.util.List;
/**
@@ -42,7 +43,7 @@ public class HttpEventCollectorErrorHandler {
public static class ServerErrorException extends Exception {
private String reply;
private long errorCode = -1;
- private String errorText = "unknown error";
+ private String errorText;
/**
* Create an exception with server error reply
@@ -50,12 +51,11 @@ public static class ServerErrorException extends Exception {
*/
public ServerErrorException(final String serverReply) {
reply = serverReply;
- JSONParser jsonParser = new JSONParser();
try {
// read server reply
- JSONObject json = (JSONObject)jsonParser.parse(serverReply);
- errorCode = (Long)json.get("code");
- errorText = (String)json.get("text");
+ JsonObject json = JsonParser.parseString(serverReply).getAsJsonObject();
+ errorCode = json.get("code").getAsLong();
+ errorText = json.get("text").getAsString();
} catch (Exception e) {
errorText = e.getMessage();
}
@@ -82,6 +82,12 @@ public String getErrorText() {
return errorText;
}
+ @Override
+ public String getMessage() {
+ return getErrorText();
+ }
+
+
@Override public String toString() {
return getReply();
}
diff --git a/src/main/java/com/splunk/logging/HttpEventCollectorLog4jAppender.java b/src/main/java/com/splunk/logging/HttpEventCollectorLog4jAppender.java
index 010b0f25..5562b74d 100644
--- a/src/main/java/com/splunk/logging/HttpEventCollectorLog4jAppender.java
+++ b/src/main/java/com/splunk/logging/HttpEventCollectorLog4jAppender.java
@@ -17,12 +17,16 @@
import java.io.Serializable;
import java.nio.charset.Charset;
-import java.util.Dictionary;
-import java.util.Hashtable;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.TimeUnit;
+import com.splunk.logging.hec.MetadataTags;
import org.apache.logging.log4j.core.appender.AbstractAppender;
import org.apache.logging.log4j.core.Filter;
import org.apache.logging.log4j.core.Layout;
+import org.apache.logging.log4j.core.config.Property;
import org.apache.logging.log4j.core.layout.PatternLayout;
import org.apache.logging.log4j.core.LogEvent;
import org.apache.logging.log4j.core.config.plugins.Plugin;
@@ -71,13 +75,13 @@ private HttpEventCollectorLog4jAppender(final String name,
final String disableCertificateValidation,
final String eventBodySerializer)
{
- super(name, filter, layout, ignoreExceptions);
- Dictionary metadata = new Hashtable();
- metadata.put(HttpEventCollectorSender.MetadataHostTag, host != null ? host : "");
- metadata.put(HttpEventCollectorSender.MetadataIndexTag, index != null ? index : "");
- metadata.put(HttpEventCollectorSender.MetadataSourceTag, source != null ? source : "");
- metadata.put(HttpEventCollectorSender.MetadataSourceTypeTag, sourcetype != null ? sourcetype : "");
- metadata.put(HttpEventCollectorSender.MetadataMessageFormatTag, messageFormat != null ? messageFormat : "");
+ super(name, filter, layout, ignoreExceptions, Property.EMPTY_ARRAY);
+ Map metadata = new HashMap<>();
+ metadata.put(MetadataTags.HOST, host != null ? host : "");
+ metadata.put(MetadataTags.INDEX, index != null ? index : "");
+ metadata.put(MetadataTags.SOURCE, source != null ? source : "");
+ metadata.put(MetadataTags.SOURCETYPE, sourcetype != null ? sourcetype : "");
+ metadata.put(MetadataTags.MESSAGEFORMAT, messageFormat != null ? messageFormat : "");
this.sender = new HttpEventCollectorSender(url, token, channel, type, batchInterval, batchCount, batchSize, sendMode, metadata);
@@ -124,7 +128,7 @@ public static HttpEventCollectorLog4jAppender createAppender(
@PluginAttribute("name") final String name,
@PluginAttribute("source") final String source,
@PluginAttribute("sourcetype") final String sourcetype,
- @PluginAttribute(HttpEventCollectorSender.MetadataMessageFormatTag) final String messageFormat,
+ @PluginAttribute("messageFormat") final String messageFormat,
@PluginAttribute("host") final String host,
@PluginAttribute("index") final String index,
@PluginAttribute(value = "ignoreExceptions", defaultBoolean = true) final String ignoreExceptions,
@@ -165,7 +169,12 @@ public static HttpEventCollectorLog4jAppender createAppender(
if (layout == null)
{
- layout = PatternLayout.createLayout("%m", null, null, null, Charset.forName("UTF-8"), true, false, null, null);
+ layout = PatternLayout.newBuilder()
+ .withPattern("%m")
+ .withCharset(StandardCharsets.UTF_8)
+ .withAlwaysWriteExceptions(true)
+ .withNoConsoleNoAnsi(false)
+ .build();
}
final boolean ignoreExceptionsBool = Boolean.getBoolean(ignoreExceptions);
@@ -201,15 +210,15 @@ public void append(final LogEvent event)
getLayout().toSerializable(event).toString(),
includeLoggerName ? event.getLoggerName() : null,
includeThreadName ? event.getThreadName() : null,
- includeMDC ? event.getContextMap() : null,
+ includeMDC ? event.getContextData().toMap() : null,
(!includeException || event.getThrown() == null) ? null : event.getThrown().getMessage(),
includeMarker ? event.getMarker() : null
);
}
@Override
- public void stop() {
+ public boolean stop(long timeout, TimeUnit timeUnit) {
this.sender.close();
- super.stop();
+ return super.stop(timeout, timeUnit);
}
}
diff --git a/src/main/java/com/splunk/logging/HttpEventCollectorLogbackAppender.java b/src/main/java/com/splunk/logging/HttpEventCollectorLogbackAppender.java
index 62369ea6..a2e5f9de 100644
--- a/src/main/java/com/splunk/logging/HttpEventCollectorLogbackAppender.java
+++ b/src/main/java/com/splunk/logging/HttpEventCollectorLogbackAppender.java
@@ -19,10 +19,9 @@
import ch.qos.logback.classic.spi.ILoggingEvent;
import ch.qos.logback.core.AppenderBase;
import ch.qos.logback.core.Layout;
+import com.splunk.logging.hec.MetadataTags;
-import java.util.Collections;
-import java.util.Dictionary;
-import java.util.Hashtable;
+import java.util.*;
/**
* Logback Appender which writes its events to Splunk http event collector rest endpoint.
@@ -59,21 +58,21 @@ public void start() {
return;
// init events sender
- Dictionary metadata = new Hashtable();
+ Map metadata = new HashMap<>();
if (_host != null)
- metadata.put(HttpEventCollectorSender.MetadataHostTag, _host);
+ metadata.put(MetadataTags.HOST, _host);
if (_index != null)
- metadata.put(HttpEventCollectorSender.MetadataIndexTag, _index);
+ metadata.put(MetadataTags.INDEX, _index);
if (_source != null)
- metadata.put(HttpEventCollectorSender.MetadataSourceTag, _source);
+ metadata.put(MetadataTags.SOURCE, _source);
if (_sourcetype != null)
- metadata.put(HttpEventCollectorSender.MetadataSourceTypeTag, _sourcetype);
+ metadata.put(MetadataTags.SOURCETYPE, _sourcetype);
if (_messageFormat != null)
- metadata.put(HttpEventCollectorSender.MetadataMessageFormatTag, _messageFormat);
+ metadata.put(MetadataTags.MESSAGEFORMAT, _messageFormat);
this.sender = new HttpEventCollectorSender(
_url, _token, _channel, _type, _batchInterval, _batchCount, _batchSize, _sendMode, metadata);
diff --git a/src/main/java/com/splunk/logging/HttpEventCollectorLoggingHandler.java b/src/main/java/com/splunk/logging/HttpEventCollectorLoggingHandler.java
index 23386277..543665e4 100644
--- a/src/main/java/com/splunk/logging/HttpEventCollectorLoggingHandler.java
+++ b/src/main/java/com/splunk/logging/HttpEventCollectorLoggingHandler.java
@@ -80,9 +80,9 @@
* com.splunk.logging.HttpEventCollectorLoggingHandler.send_mode=sequential
*/
-import java.util.Dictionary;
-import java.util.Hashtable;
-import java.util.Locale;
+import com.splunk.logging.hec.MetadataTags;
+
+import java.util.*;
import java.util.logging.Handler;
import java.util.logging.LogManager;
import java.util.logging.LogRecord;
@@ -113,22 +113,22 @@ public final class HttpEventCollectorLoggingHandler extends Handler {
/** HttpEventCollectorLoggingHandler c-or */
public HttpEventCollectorLoggingHandler() {
// read configuration settings
- Dictionary metadata = new Hashtable();
- metadata.put(HttpEventCollectorSender.MetadataHostTag,
- getConfigurationProperty(HttpEventCollectorSender.MetadataHostTag, ""));
+ Map metadata = new HashMap<>();
+ metadata.put(MetadataTags.HOST,
+ getConfigurationProperty(MetadataTags.HOST, ""));
- metadata.put(HttpEventCollectorSender.MetadataIndexTag,
- getConfigurationProperty(HttpEventCollectorSender.MetadataIndexTag, ""));
+ metadata.put(MetadataTags.INDEX,
+ getConfigurationProperty(MetadataTags.INDEX, ""));
- metadata.put(HttpEventCollectorSender.MetadataSourceTag,
- getConfigurationProperty(HttpEventCollectorSender.MetadataSourceTag, ""));
+ metadata.put(MetadataTags.SOURCE,
+ getConfigurationProperty(MetadataTags.SOURCE, ""));
- metadata.put(HttpEventCollectorSender.MetadataSourceTypeTag,
- getConfigurationProperty(HttpEventCollectorSender.MetadataSourceTypeTag, ""));
+ metadata.put(MetadataTags.SOURCETYPE,
+ getConfigurationProperty(MetadataTags.SOURCETYPE, ""));
// Extract message format value
- metadata.put(HttpEventCollectorSender.MetadataMessageFormatTag,
- getConfigurationProperty(HttpEventCollectorSender.MetadataMessageFormatTag, ""));
+ metadata.put(MetadataTags.MESSAGEFORMAT,
+ getConfigurationProperty(MetadataTags.MESSAGEFORMAT, ""));
// http event collector endpoint properties
String url = getConfigurationProperty(UrlConfTag, null);
diff --git a/src/main/java/com/splunk/logging/HttpEventCollectorSender.java b/src/main/java/com/splunk/logging/HttpEventCollectorSender.java
index 39ff893a..fc3c25bd 100644
--- a/src/main/java/com/splunk/logging/HttpEventCollectorSender.java
+++ b/src/main/java/com/splunk/logging/HttpEventCollectorSender.java
@@ -18,45 +18,23 @@
* under the License.
*/
-import org.apache.http.HttpResponse;
-import org.apache.http.client.config.CookieSpecs;
-import org.apache.http.client.config.RequestConfig;
-import org.apache.http.client.methods.HttpPost;
-import org.apache.http.concurrent.FutureCallback;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLContexts;
-import org.apache.http.conn.ssl.TrustStrategy;
-import org.apache.http.entity.StringEntity;
-import org.apache.http.impl.nio.client.CloseableHttpAsyncClient;
-import org.apache.http.impl.nio.client.HttpAsyncClients;
-import org.apache.http.util.EntityUtils;
-
-import org.json.simple.JSONObject;
-
-import javax.net.ssl.SSLContext;
+import com.google.gson.*;
+import com.splunk.logging.hec.MetadataTags;
+import com.splunk.logging.serialization.EventInfoTypeAdapter;
+import com.splunk.logging.serialization.HecJsonSerializer;
+import okhttp3.*;
+
+import javax.net.ssl.*;
import java.io.IOException;
import java.io.Serializable;
-import java.security.cert.X509Certificate;
-import java.util.Dictionary;
-import java.util.Timer;
-import java.util.TimerTask;
-import java.util.List;
-import java.util.LinkedList;
-import java.util.Map;
-import java.util.Locale;
-
+import java.security.cert.CertificateException;
+import java.util.*;
/**
* This is an internal helper class that sends logging events to Splunk http event collector.
*/
public class HttpEventCollectorSender extends TimerTask implements HttpEventCollectorMiddleware.IHttpSender {
- public static final String MetadataTimeTag = "time";
- public static final String MetadataHostTag = "host";
- public static final String MetadataIndexTag = "index";
- public static final String MetadataSourceTag = "source";
- public static final String MetadataSourceTypeTag = "sourcetype";
- public static final String MetadataMessageFormatTag = "messageFormat";
private static final String SPLUNKREQUESTCHANNELTag = "X-Splunk-Request-Channel";
private static final String AuthorizationHeaderTag = "Authorization";
private static final String AuthorizationHeaderScheme = "Splunk %s";
@@ -65,6 +43,12 @@ public class HttpEventCollectorSender extends TimerTask implements HttpEventColl
private static final String HttpContentType = "application/json; profile=urn:splunk:event:1.0; charset=utf-8";
private static final String SendModeSequential = "sequential";
private static final String SendModeSParallel = "parallel";
+ private static final Gson gson = new GsonBuilder()
+ .registerTypeAdapter(HttpEventCollectorEventInfo.class, new EventInfoTypeAdapter())
+ .create();
+
+ private final HecJsonSerializer serializer;
+
/**
* Sender operation mode. Parallel means that all HTTP requests are
@@ -90,16 +74,14 @@ public enum SendMode
private String type;
private long maxEventsBatchCount;
private long maxEventsBatchSize;
- private Dictionary metadata;
private Timer timer;
private List eventsBatch = new LinkedList();
private long eventsBatchSize = 0; // estimated total size of events batch
- private CloseableHttpAsyncClient httpClient;
+ private static OkHttpClient httpClient = null;
private boolean disableCertificateValidation = false;
private SendMode sendMode = SendMode.Sequential;
private HttpEventCollectorMiddleware middleware = new HttpEventCollectorMiddleware();
private final MessageFormat messageFormat;
- private EventBodySerializer eventBodySerializer;
/**
* Initialize HttpEventCollectorSender
@@ -116,7 +98,7 @@ public HttpEventCollectorSender(
final String Url, final String token, final String channel, final String type,
long delay, long maxEventsBatchCount, long maxEventsBatchSize,
String sendModeStr,
- Dictionary metadata) {
+ Map metadata) {
this.url = Url + HttpEventCollectorUriPath;
this.token = token;
this.channel = channel;
@@ -135,9 +117,9 @@ public HttpEventCollectorSender(
}
this.maxEventsBatchCount = maxEventsBatchCount;
this.maxEventsBatchSize = maxEventsBatchSize;
- this.metadata = metadata;
- final String format = metadata.get(MetadataMessageFormatTag);
+ serializer = new HecJsonSerializer(metadata);
+ final String format = metadata.get(MetadataTags.MESSAGEFORMAT);
// Get MessageFormat enum from format string. Do this once per instance in constructor to avoid expensive operation in
// each event sender call
this.messageFormat = MessageFormat.fromFormat(format);
@@ -198,29 +180,31 @@ public synchronized void send(final String message) {
* Flush all pending events
*/
public synchronized void flush() {
- flush(false);
- }
-
- public synchronized void flush(boolean close) {
if (eventsBatch.size() > 0) {
- postEventsAsync(eventsBatch, close);
- } else if (close) {
- this.stopHttpClient();
+ postEventsAsync(eventsBatch);
}
// Clear the batch. A new list should be created because events are
// sending asynchronously and "previous" instance of eventsBatch object
// is still in use.
- eventsBatch = new LinkedList();
+ eventsBatch = new LinkedList<>();
eventsBatchSize = 0;
}
+ public synchronized void flush(boolean close) {
+ flush();
+ if (close) {
+ stopHttpClient();
+ }
+ }
+
/**
* Close events sender
*/
void close() {
if (timer != null)
timer.cancel();
- flush(true);
+ flush();
+ stopHttpClient();
super.cancel();
}
@@ -241,43 +225,25 @@ public void disableCertificateValidation() {
}
public void setEventBodySerializer(EventBodySerializer eventBodySerializer) {
- this.eventBodySerializer = eventBodySerializer;
+ serializer.setEventBodySerializer(eventBodySerializer);
}
- @SuppressWarnings("unchecked")
- public static void putIfPresent(JSONObject collection, String tag, Object value) {
+ public static void putIfPresent(JsonObject collection, String tag, Object value) {
if (value != null) {
if (value instanceof String && ((String) value).length() == 0) {
// Do not add blank string
return;
}
- collection.put(tag, value);
+ collection.add(tag, gson.toJsonTree(value));
}
}
- @SuppressWarnings("unchecked")
- private String serializeEventInfo(HttpEventCollectorEventInfo eventInfo) {
- // create event json content
- //
- // cf: http://dev.splunk.com/view/event-collector/SP-CAAAE6P
- //
- JSONObject event = new JSONObject();
- // event timestamp and metadata
- putIfPresent(event, MetadataTimeTag, String.format(Locale.US, "%.3f", eventInfo.getTime()));
- putIfPresent(event, MetadataHostTag, metadata.get(MetadataHostTag));
- putIfPresent(event, MetadataIndexTag, metadata.get(MetadataIndexTag));
- putIfPresent(event, MetadataSourceTag, metadata.get(MetadataSourceTag));
- putIfPresent(event, MetadataSourceTypeTag, metadata.get(MetadataSourceTypeTag));
-
- // Parse message on the basis of format
- final Object parsedMessage = this.messageFormat.parse(eventInfo.getMessage());
-
- if (eventBodySerializer == null) {
- eventBodySerializer = new EventBodySerializer.Default();
- }
- event.put("event", eventBodySerializer.serializeEventBody(eventInfo, parsedMessage));
- return event.toString();
+ private void stopHttpClient() {
+ if (httpClient != null) {
+ httpClient.dispatcher().executorService().shutdown();
+ httpClient = null;
+ }
}
private void startHttpClient() {
@@ -285,55 +251,55 @@ private void startHttpClient() {
// http client is already started
return;
}
- // limit max number of async requests in sequential mode, 0 means "use
- // default limit"
- int maxConnTotal = sendMode == SendMode.Sequential ? 1 : 0;
- if (! disableCertificateValidation) {
- // create an http client that validates certificates
- httpClient = HttpAsyncClients.custom()
- .setDefaultRequestConfig(RequestConfig.custom().setCookieSpec(CookieSpecs.STANDARD).build())
- .setMaxConnTotal(maxConnTotal)
- .build();
- } else {
- // create strategy that accepts all certificates
- TrustStrategy acceptingTrustStrategy = new TrustStrategy() {
- public boolean isTrusted(X509Certificate[] certificate,
- String type) {
- return true;
- }
- };
- SSLContext sslContext = null;
- try {
- sslContext = SSLContexts.custom().loadTrustMaterial(
- null, acceptingTrustStrategy).build();
- httpClient = HttpAsyncClients.custom()
- .setDefaultRequestConfig(RequestConfig.custom().setCookieSpec(CookieSpecs.STANDARD).build())
- .setMaxConnTotal(maxConnTotal)
- .setHostnameVerifier(SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER)
- .setSSLContext(sslContext)
- .build();
- } catch (Exception e) { }
+
+ OkHttpClient.Builder builder = new OkHttpClient.Builder();
+
+ // limit max number of async requests in sequential mode
+ if (sendMode == SendMode.Sequential) {
+ Dispatcher dispatcher = new Dispatcher();
+ dispatcher.setMaxRequests(1);
+ builder.dispatcher(dispatcher);
}
- httpClient.start();
- }
- // Currently we never close http client. This method is added for symmetry
- // with startHttpClient.
- private void stopHttpClient() throws SecurityException {
- if (httpClient != null) {
+ if (disableCertificateValidation) {
+ final TrustManager[] trustAllCerts = new TrustManager[]{
+ new X509TrustManager() {
+ @Override
+ public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
+ }
+
+ @Override
+ public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
+ }
+
+ @Override
+ public java.security.cert.X509Certificate[] getAcceptedIssuers() {
+ return new java.security.cert.X509Certificate[]{};
+ }
+ }
+ };
+
try {
- httpClient.close();
- } catch (IOException e) { }
- httpClient = null;
+ // install the all-trusting trust manager
+ final SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
+ sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
+ // create an ssl socket factory with the all-trusting manager
+ final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
+ builder.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0]);
+ } catch (Exception ignored) { /* nop */ }
+
+ builder.hostnameVerifier(new HostnameVerifier() {
+ @Override
+ public boolean verify(String hostname, SSLSession session) {
+ return true;
+ }
+ });
}
- }
- private void postEventsAsync(final List events) {
- postEventsAsync(events, false);
+ httpClient = builder.build();
}
- private void postEventsAsync(final List events, final boolean close) {
- final HttpEventCollectorSender sender = this;
+ private void postEventsAsync(final List events) {
this.middleware.postEvents(events, this, new HttpEventCollectorMiddleware.IHttpSenderCallback() {
@Override
@@ -343,19 +309,13 @@ public void completed(int statusCode, String reply) {
events,
new HttpEventCollectorErrorHandler.ServerErrorException(reply));
}
- if (close) {
- sender.stopHttpClient();
- }
}
@Override
public void failed(Exception ex) {
HttpEventCollectorErrorHandler.error(
- eventsBatch,
+ events,
new HttpEventCollectorErrorHandler.ServerErrorException(ex.getMessage()));
- if (close) {
- sender.stopHttpClient();
- }
}
});
}
@@ -363,45 +323,43 @@ public void failed(Exception ex) {
public void postEvents(final List events,
final HttpEventCollectorMiddleware.IHttpSenderCallback callback) {
startHttpClient(); // make sure http client is started
- final String encoding = "utf-8";
// convert events list into a string
StringBuilder eventsBatchString = new StringBuilder();
- for (HttpEventCollectorEventInfo eventInfo : events)
- eventsBatchString.append(serializeEventInfo(eventInfo));
+ for (HttpEventCollectorEventInfo eventInfo : events) {
+ eventsBatchString.append(serializer.serialize(eventInfo));
+ }
// create http request
- final HttpPost httpPost = new HttpPost(url);
- httpPost.setHeader(
- AuthorizationHeaderTag,
- String.format(AuthorizationHeaderScheme, token));
+ Request.Builder requestBldr = new Request.Builder()
+ .url(url)
+ .addHeader(AuthorizationHeaderTag, String.format(AuthorizationHeaderScheme, token))
+ .post(RequestBody.create(MediaType.parse(HttpContentType), eventsBatchString.toString()));
+
if ("Raw".equalsIgnoreCase(type) && channel != null && !channel.trim().equals("")) {
- httpPost.setHeader(SPLUNKREQUESTCHANNELTag, channel);
+ requestBldr.addHeader(SPLUNKREQUESTCHANNELTag, channel);
}
- StringEntity entity = new StringEntity(eventsBatchString.toString(), encoding);
- entity.setContentType(HttpContentType);
- httpPost.setEntity(entity);
- httpClient.execute(httpPost, new FutureCallback() {
+
+ httpClient.newCall(requestBldr.build()).enqueue(new Callback() {
@Override
- public void completed(HttpResponse response) {
+ public void onResponse(Call call, final Response response) {
String reply = "";
- int httpStatusCode = response.getStatusLine().getStatusCode();
+ int httpStatusCode = response.code();
// read reply only in case of a server error
- if (httpStatusCode != 200) {
- try {
- reply = EntityUtils.toString(response.getEntity(), encoding);
- } catch (IOException e) {
- reply = e.getMessage();
+ try (ResponseBody body = response.body()) {
+ if (httpStatusCode != 200 && body != null) {
+ try {
+ reply = body.string();
+ } catch (IOException e) {
+ reply = e.getMessage();
+ }
}
}
callback.completed(httpStatusCode, reply);
}
@Override
- public void failed(Exception ex) {
+ public void onFailure(Call call, IOException ex) {
callback.failed(ex);
}
-
- @Override
- public void cancelled() {}
});
}
}
diff --git a/src/main/java/com/splunk/logging/MessageFormat.java b/src/main/java/com/splunk/logging/MessageFormat.java
index d27add07..f50b0708 100644
--- a/src/main/java/com/splunk/logging/MessageFormat.java
+++ b/src/main/java/com/splunk/logging/MessageFormat.java
@@ -1,6 +1,9 @@
package com.splunk.logging;
-import org.json.simple.JSONValue;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonSyntaxException;
/**
*
@@ -57,13 +60,13 @@ Object parse(final String message) {
* @return the parsed message JSON object or input message if parsing fails
*/
private Object parseJsonEventMessage(final String message) {
- final Object jsonObject = JSONValue.parse(message);
- if (jsonObject == null) {
+ Gson gson = new GsonBuilder().create();
+ try {
+ return gson.fromJson(message, JsonObject.class);
+ } catch (JsonSyntaxException e) {
// If JSON parsing failed then it is likely a text message or a malformed JSON message.
// Return input message string in such an event.
return message;
- } else {
- return jsonObject;
}
}
@@ -84,4 +87,4 @@ static MessageFormat fromFormat(String format) {
}
return TEXT;
}
-}
\ No newline at end of file
+}
diff --git a/src/main/java/com/splunk/logging/SplunkCimLogEvent.java b/src/main/java/com/splunk/logging/SplunkCimLogEvent.java
index 9cd2ee84..861c374b 100644
--- a/src/main/java/com/splunk/logging/SplunkCimLogEvent.java
+++ b/src/main/java/com/splunk/logging/SplunkCimLogEvent.java
@@ -1,2240 +1,2242 @@
-package com.splunk.logging;
-
-/*
- * Copyright 2013-2014 Splunk, Inc.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"): you may
- * not use this file except in compliance with the License. You may obtain
- * a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations
- * under the License.
- */
-
-
-import java.util.LinkedHashMap;
-import java.util.regex.Pattern;
-
-/**
- * SplunkCimLogEvent encapsulates the best practice logging semantics recommended by Splunk.
- *
- * It produces events of key, value pairs, properly formatted and quoted for logging with any of Java's standard
- * logging libraries (logback, log4j, java.util.logging, etc.) and indexing by Splunk. The class has convenience
- * methods to set the fields defined in the standard Splunk Common Information Model.
- *
- * SplunkCimLogEvent adds no timestamp to its fields, leaving you free to configure whatever timestamp
- * format you prefer in your logging configuration.
- *
- *
- * Logger logger = LoggerFactory.getLogger("splunk.logger");
- * SplunkCimLogEvent event = new SplunkCimLogEvent("Failed Login", "sshd:failure");
- * event.setAuthApp("jane");
- * event.setAuthUser("jane");
- * event.addField("somefieldname", "foobar");
- * logger.info(event.toString());
- *
- *
- * @see Splunk
- * CIM
- * @see Splunk
- * Logging Best Practices
- */
-public class SplunkCimLogEvent {
- /**
- * Delimiters to use in formatting the event.
- */
- private static final String KVDELIM = "=";
- private static final String PAIRDELIM = " ";
- private static final char QUOTE = '"';
-
- private LinkedHashMap entries;
-
- /**
- * @param eventName event name
- * @param eventID event ID
- */
- public SplunkCimLogEvent(String eventName, String eventID) {
- entries = new LinkedHashMap();
-
- addField(PREFIX_NAME, eventName);
- addField(PREFIX_EVENT_ID, eventID);
- }
-
- /**
- * Add a key value pair. The value may be any Java object which returns a sensible
- * result from its toString method.
- *
- * For logging exceptions, consider using addThrowableWithStacktrace instead.
- *
- * @param key key
- * @param value value
- */
- public void addField(String key, Object value) {
- entries.put(key, value);
- }
-
- /**
- * Logs an exception with its stacktrace nicely formatted for indexing and searching by Splunk.
- *
- * @param throwable
- * the Throwable object to add to the event
- */
- public void addThrowableWithStacktrace(Throwable throwable) {
-
- addThrowableWithStacktrace(throwable, Integer.MAX_VALUE);
- }
-
- /**
- * Logs an exception with the first stacktraceDepth elements of its stacktrace nicely
- * formatted for indexing and searching by Splunk,
- *
- *
- * @param throwable
- * the Throwable object to add to the event
- * @param stacktraceDepth
- * maximum number of stacktrace elements to log
- */
-
- public void addThrowableWithStacktrace(Throwable throwable, int stacktraceDepth) {
- addField(THROWABLE_CLASS, throwable.getClass().getCanonicalName());
- addField(THROWABLE_MESSAGE, throwable.getMessage());
-
- StackTraceElement[] elements = throwable.getStackTrace();
- StringBuilder sb = new StringBuilder();
- for (int depth = 0; depth < elements.length && depth < stacktraceDepth; depth++) {
- if (depth > 0)
- sb.append(",");
- sb.append(elements[depth].toString());
- }
-
- addField(THROWABLE_STACKTRACE_ELEMENTS, sb.toString());
- }
-
- private static final Pattern DOUBLE_QUOTE = Pattern.compile("\"");
- @Override
- public String toString() {
- StringBuilder output = new StringBuilder();
-
- boolean first = true;
- for (String key : entries.keySet()) {
- if (!first) {
- output.append(PAIRDELIM);
- } else {
- first = false;
- }
- String value = entries.get(key).toString();
-
- // Escape any " that appear in the key or value.
- key = DOUBLE_QUOTE.matcher(key).replaceAll("\\\\\"");
- value = DOUBLE_QUOTE.matcher(value).replaceAll("\\\\\"");
-
- output.append(QUOTE).append(key).append(KVDELIM).append(value).append(QUOTE);
- }
-
- return output.toString();
- }
-
-
- /**
- * Event prefix fields
- */
- private static final String PREFIX_NAME = "name";
- private static final String PREFIX_EVENT_ID = "event_id";
-
- /**
- * Java Throwable type fields
- */
- private static final String THROWABLE_CLASS = "throwable_class";
- private static final String THROWABLE_MESSAGE = "throwable_message";
- private static final String THROWABLE_STACKTRACE_ELEMENTS = "stacktrace_elements";
-
- /**
- * Splunk Common Information Model(CIM) Fields
- */
-
- // ------------------
- // Account management
- // ------------------
-
- /**
- * The domain containing the user that is affected by the account management event.
- */
- public void setAcManagementDestNtDomain(String acManagementDestNtDomain) {
- addField(AC_MANAGEMENT_DEST_NT_DOMAIN, acManagementDestNtDomain);
- }
- public static String AC_MANAGEMENT_DEST_NT_DOMAIN = "dest_nt_domain";
-
- /**
- * Description of the account management change performed.
- */
- public void setAcManagementSignature(String acManagementSignature) {
- addField(AC_MANAGEMENT_SIGNATURE, acManagementSignature);
- }
- public static String AC_MANAGEMENT_SIGNATURE = "signature";
-
- /**
- * The NT source of the destination. In the case of an account management
- * event, this is the domain that contains the user that generated the
- * event.
- */
- public void setAcManagementSrcNtDomain(String acManagementSrcNtDomain) {
- addField(AC_MANAGEMENT_SRC_NT_DOMAIN, acManagementSrcNtDomain);
- }
- public static String AC_MANAGEMENT_SRC_NT_DOMAIN = "src_nt_domain";
-
- // ----------------------------------
- // Authentication - Access protection
- // ----------------------------------
-
- /**
- * The action performed on the resource. success, failure
- */
- public void setAuthAction(String authAction) {
- addField(AUTH_ACTION, authAction);
- }
- public static String AUTH_ACTION = "action";
- /**
- * The application involved in the event (such as ssh, spunk, win:local).
- */
- public void setAuthApp(String authApp) {
- addField(AUTH_APP, authApp);
- }
- public static String AUTH_APP = "app";
-
- /**
- * The target involved in the authentication. If your field is named
- * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
- * to make it CIM-compliant.
- */
- public void setAuthDest(String authDest) {
- addField(AUTH_DEST, authDest);
- }
- public static String AUTH_DEST = "dest";
-
- /**
- * The source involved in the authentication. In the case of endpoint
- * protection authentication the src is the client. If your field is named
- * src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src to
- * make it CIM-compliant.. It is required for all events dealing with
- * endpoint protection (Authentication, change analysis, malware, system
- * center, and update). Note: Do not confuse this with the event source or
- * sourcetype fields.
- */
- public void setAuthSrc(String authSrc) {
- addField(AUTH_SRC, authSrc);
- }
- public static String AUTH_SRC = "src";
-
- /**
- * In privilege escalation events, src_user represents the user who
- * initiated the privilege escalation.
- */
- public void setAuthSrcUser(String authSrcUser) {
- addField(AUTH_SRC_USER, authSrcUser);
- }
- public static String AUTH_SRC_USER = "src_user";
-
- /**
- * The name of the user involved in the event, or who initiated the event.
- * For authentication privilege escalation events this should represent the
- * user targeted by the escalation.
- */
- public void setAuthUser(String authUser) {
- addField(AUTH_USER, authUser);
- }
- public static String AUTH_USER = "user";
-
- // ----------------------------------
- // Change analysis - Endpoint protection
- // ----------------------------------
-
- /**
- * The action performed on the resource.
- */
- public void setChangeEndpointProtectionAction(
- String changeEndpointProtectionAction) {
- addField(CHANGE_ENDPOINT_PROTECTION_ACTION,
- changeEndpointProtectionAction);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_ACTION = "action";
-
- /**
- * The type of change discovered in the change analysis event.
- */
- public void setChangeEndpointProtectionChangeType(
- String changeEndpointProtectionChangeType) {
- addField(CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE,
- changeEndpointProtectionChangeType);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE = "change_type";
-
- /**
- * The host that was affected by the change. If your field is named
- * dest_host,dest_ip,dest_ipv6, or dest_nt_host you can alias it as dest to
- * make it CIM-compliant.
- */
- public void setChangeEndpointProtectionDest(
- String changeEndpointProtectionDest) {
- addField(CHANGE_ENDPOINT_PROTECTION_DEST, changeEndpointProtectionDest);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_DEST = "dest";
-
- /**
- * The hash signature of the modified resource.
- */
- public void setChangeEndpointProtectionHash(
- String changeEndpointProtectionHash) {
- addField(CHANGE_ENDPOINT_PROTECTION_HASH, changeEndpointProtectionHash);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_HASH = "hash";
-
- /**
- * The group ID of the modified resource.
- */
- public void setChangeEndpointProtectionGid(long changeEndpointProtectionGid) {
- addField(CHANGE_ENDPOINT_PROTECTION_GID, changeEndpointProtectionGid);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_GID = "gid";
-
- /**
- * Indicates whether or not the modified resource is a directory.
- */
- public void setChangeEndpointProtectionIsdr(
- boolean changeEndpointProtectionIsdr) {
- addField(CHANGE_ENDPOINT_PROTECTION_ISDR, changeEndpointProtectionIsdr);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_ISDR = "isdr";
-
- /**
- * The permissions mode of the modified resource.
- */
- public void setChangeEndpointProtectionMode(
- long changeEndpointProtectionMode) {
- addField(CHANGE_ENDPOINT_PROTECTION_MODE, changeEndpointProtectionMode);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_MODE = "mode";
-
- /**
- * The modification time of the modified resource.
- */
- public void setChangeEndpointProtectionModtime(
- String changeEndpointProtectionModtime) {
- addField(CHANGE_ENDPOINT_PROTECTION_MODTIME,
- changeEndpointProtectionModtime);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_MODTIME = "modtime";
-
- /**
- * The file path of the modified resource.
- */
- public void setChangeEndpointProtectionPath(
- String changeEndpointProtectionPath) {
- addField(CHANGE_ENDPOINT_PROTECTION_PATH, changeEndpointProtectionPath);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_PATH = "path";
-
- /**
- * The size of the modified resource.
- */
- public void setChangeEndpointProtectionSize(
- long changeEndpointProtectionSize) {
- addField(CHANGE_ENDPOINT_PROTECTION_SIZE, changeEndpointProtectionSize);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_SIZE = "size";
-
- /**
- * The user ID of the modified resource.
- */
- public void setChangeEndpointProtectionUid(long changeEndpointProtectionUid) {
- addField(CHANGE_ENDPOINT_PROTECTION_UID, changeEndpointProtectionUid);
- }
- public static String CHANGE_ENDPOINT_PROTECTION_UID = "uid";
-
- // ----------------------------------
- // Change analysis - Network protection
- // ----------------------------------
-
- /**
- * The type of change observed.
- */
- public void setChangeNetworkProtectionAction(
- String changeNetworkProtectionAction) {
- addField(CHANGE_NETWORK_PROTECTION_ACTION, changeNetworkProtectionAction);
- }
- public static String CHANGE_NETWORK_PROTECTION_ACTION = "action";
-
- /**
- * The command that initiated the change.
- */
- public void setChangeNetworkProtectionCommand(
- String changeNetworkProtectionCommand) {
- addField(CHANGE_NETWORK_PROTECTION_COMMAND,
- changeNetworkProtectionCommand);
- }
- public static String CHANGE_NETWORK_PROTECTION_COMMAND = "command";
-
- /**
- * The device that is directly affected by the change.
- */
- public void setChangeNetworkProtectionDvc(String changeNetworkProtectionDvc) {
- addField(CHANGE_NETWORK_PROTECTION_DVC, changeNetworkProtectionDvc);
- }
- public static String CHANGE_NETWORK_PROTECTION_DVC = "dvc";
-
- /**
- * The user that initiated the change.
- */
- public void setChangeNetworkProtectionUser(
- String changeNetworkProtectionUser) {
- addField(CHANGE_NETWORK_PROTECTION_USER, changeNetworkProtectionUser);
- }
- public static String CHANGE_NETWORK_PROTECTION_USER = "user";
-
- // ----------------------------------
- // Common event fields
- // ----------------------------------
-
- /**
- * A device-specific classification provided as part of the event.
- */
- public void setCommonCategory(String commonCategory) {
- addField(COMMON_CATEGORY, commonCategory);
- }
- public static String COMMON_CATEGORY = "category";
-
- /**
- * A device-specific classification provided as part of the event.
- */
- public void setCommonCount(String commonCount) {
- addField(COMMON_COUNT, commonCount);
- }
- public static String COMMON_COUNT = "count";
-
- /**
- * The free-form description of a particular event.
- */
- public void setCommonDesc(String commonDesc) {
- addField(COMMON_DESC, commonDesc);
- }
- public static String COMMON_DESC = "desc";
-
- /**
- * The name of a given DHCP pool on a DHCP server.
- */
- public void setCommonDhcpPool(String commonDhcpPool) {
- addField(COMMON_DHCP_POOL, commonDhcpPool);
- }
- public static String COMMON_DHCP_POOL = "dhcp_pool";
-
- /**
- * The amount of time the event lasted.
- */
- public void setCommonDuration(long commonDuration) {
- addField(COMMON_DURATION, commonDuration);
- }
- public static String COMMON_DURATION = "duration";
-
- /**
- * The fully qualified domain name of the device transmitting or recording
- * the log record.
- */
- public void setCommonDvcHost(String commonDvcHost) {
- addField(COMMON_DVC_HOST, commonDvcHost);
- }
- public static String COMMON_DVC_HOST = "dvc_host";
-
- /**
- * The IPv4 address of the device reporting the event.
- */
- public void setCommonDvcIp(String commonDvcIp) {
- addField(COMMON_DVC_IP, commonDvcIp);
- }
- public static String COMMON_DVC_IP = "dvc_ip";
-
- /**
- * The IPv6 address of the device reporting the event.
- */
- public void setCommonDvcIp6(String commonDvcIp6) {
- addField(COMMON_DVC_IP6, commonDvcIp6);
- }
- public static String COMMON_DVC_IP6 = "dvc_ip6";
-
- /**
- * The free-form description of the device's physical location.
- */
- public void setCommonDvcLocation(String commonDvcLocation) {
- addField(COMMON_DVC_LOCATION, commonDvcLocation);
- }
- public static String COMMON_DVC_LOCATION = "dvc_location";
-
- /**
- * The MAC (layer 2) address of the device reporting the event.
- */
- public void setCommonDvcMac(String commonDvcMac) {
- addField(COMMON_DVC_MAC, commonDvcMac);
- }
- public static String COMMON_DVC_MAC = "dvc_mac";
-
- /**
- * The Windows NT domain of the device recording or transmitting the event.
- */
- public void setCommonDvcNtDomain(String commonDvcNtDomain) {
- addField(COMMON_DVC_NT_DOMAIN, commonDvcNtDomain);
- }
- public static String COMMON_DVC_NT_DOMAIN = "dvc_nt_domain";
-
- /**
- * The Windows NT host name of the device recording or transmitting the
- * event.
- */
- public void setCommonDvcNtHost(String commonDvcNtHost) {
- addField(COMMON_DVC_NT_HOST, commonDvcNtHost);
- }
- public static String COMMON_DVC_NT_HOST = "dvc_nt_host";
-
- /**
- * Time at which the device recorded the event.
- */
- public void setCommonDvcTime(long commonDvcTime) {
- addField(COMMON_DVC_TIME, commonDvcTime);
- }
- public static String COMMON_DVC_TIME = "dvc_time";
-
- /**
- * The event's specified end time.
- */
- public void setCommonEndTime(long commonEndTime) {
- addField(COMMON_END_TIME, commonEndTime);
- }
- public static String COMMON_END_TIME = "end_time";
-
- /**
- * A unique identifier that identifies the event. This is unique to the
- * reporting device.
- */
- public void setCommonEventId(long commonEventId) {
- addField(COMMON_EVENT_ID, commonEventId);
- }
- public static String COMMON_EVENT_ID = "event_id";
-
- /**
- * The length of the datagram, event, message, or packet.
- */
- public void setCommonLength(long commonLength) {
- addField(COMMON_LENGTH, commonLength);
- }
- public static String COMMON_LENGTH = "length";
-
- /**
- * The log-level that was set on the device and recorded in the event.
- */
- public void setCommonLogLevel(String commonLogLevel) {
- addField(COMMON_LOG_LEVEL, commonLogLevel);
- }
- public static String COMMON_LOG_LEVEL = "log_level";
-
- /**
- * The name of the event as reported by the device. The name should not
- * contain information that's already being parsed into other fields from
- * the event, such as IP addresses.
- */
- public void setCommonName(String commonName) {
- addField(COMMON_NAME, commonName);
- }
- public static String COMMON_NAME = "name";
-
- /**
- * An integer assigned by the device operating system to the process
- * creating the record.
- */
- public void setCommonPid(long commonPid) {
- addField(COMMON_PID, commonPid);
- }
- public static String COMMON_PID = "pid";
-
- /**
- * An environment-specific assessment of the event's importance, based on
- * elements such as event severity, business function of the affected
- * system, or other locally defined variables.
- */
- public void setCommonPriority(long commonPriority) {
- addField(COMMON_PRIORITY, commonPriority);
- }
- public static String COMMON_PRIORITY = "priority";
-
- /**
- * The product that generated the event.
- */
- public void setCommonProduct(String commonProduct) {
- addField(COMMON_PRODUCT, commonProduct);
- }
- public static String COMMON_PRODUCT = "product";
-
- /**
- * The version of the product that generated the event.
- */
- public void setCommonProductVersion(long commonProductVersion) {
- addField(COMMON_PRODUCT_VERSION, commonProductVersion);
- }
- public static String COMMON_PRODUCT_VERSION = "product_version";
-
- /**
- * The result root cause, such as connection refused, timeout, crash, and so
- * on.
- */
- public void setCommonReason(String commonReason) {
- addField(COMMON_REASON, commonReason);
- }
- public static String COMMON_REASON = "reason";
-
- /**
- * The action result. Often is a binary choice: succeeded and failed,
- * allowed and denied, and so on.
- */
- public void setCommonResult(String commonResult) {
- addField(COMMON_RESULT, commonResult);
- }
- public static String COMMON_RESULT = "result";
-
- /**
- * The severity (or priority) of an event as reported by the originating
- * device.
- */
- public void setCommonSeverity(String commonSeverity) {
- addField(COMMON_SEVERITY, commonSeverity);
- }
- public static String COMMON_SEVERITY = "severity";
-
- /**
- * The event's specified start time.
- */
- public void setCommonStartTime(long commonStartTime) {
- addField(COMMON_START_TIME, commonStartTime);
- }
- public static String COMMON_START_TIME = "start_time";
-
- /**
- * The transaction identifier.
- */
- public void setCommonTransactionId(String commonTransactionId) {
- addField(COMMON_TRANSACTION_ID, commonTransactionId);
- }
- public static String COMMON_TRANSACTION_ID = "transaction_id";
-
- /**
- * A uniform record locator (a web address, in other words) included in a
- * record.
- */
- public void setCommonUrl(String commonUrl) {
- addField(COMMON_URL, commonUrl);
- }
- public static String COMMON_URL = "url";
-
- /**
- * The vendor who made the product that generated the event.
- */
- public void setCommonVendor(String commonVendor) {
- addField(COMMON_VENDOR, commonVendor);
- }
- public static String COMMON_VENDOR = "vendor";
-
- // ----------------------------------
- // DNS protocol
- // ----------------------------------
-
- /**
- * The DNS domain that has been queried.
- */
- public void setDnsDestDomain(String dnsDestDomain) {
- addField(DNS_DEST_DOMAIN, dnsDestDomain);
- }
- public static String DNS_DEST_DOMAIN = "dest_domain";
-
- /**
- * The remote DNS resource record being acted upon.
- */
- public void setDnsDestRecord(String dnsDestRecord) {
- addField(DNS_DEST_RECORD, dnsDestRecord);
- }
- public static String DNS_DEST_RECORD = "dest_record";
-
- /**
- * The DNS zone that is being received by the slave as part of a zone
- * transfer.
- */
- public void setDnsDestZone(String dnsDestZone) {
- addField(DNS_DEST_ZONE, dnsDestZone);
- }
- public static String DNS_DEST_ZONE = "dest_zone";
-
- /**
- * The DNS resource record class.
- */
- public void setDnsRecordClass(String dnsRecordClass) {
- addField(DNS_RECORD_CLASS, dnsRecordClass);
- }
- public static String DNS_RECORD_CLASS = "record_class";
-
- /**
- * The DNS resource record type.
- *
- * @see see
- * this Wikipedia article on DNS record types
- */
- public void setDnsRecordType(String dnsRecordType) {
- addField(DNS_RECORD_TYPE, dnsRecordType);
- }
- public static String DNS_RECORD_TYPE = "record_type";
-
- /**
- * The local DNS domain that is being queried.
- */
- public void setDnsSrcDomain(String dnsSrcDomain) {
- addField(DNS_SRC_DOMAIN, dnsSrcDomain);
- }
- public static String DNS_SRC_DOMAIN = "src_domain";
-
- /**
- * The local DNS resource record being acted upon.
- */
- public void setDnsSrcRecord(String dnsSrcRecord) {
- addField(DNS_SRC_RECORD, dnsSrcRecord);
- }
- public static String DNS_SRC_RECORD = "src_record";
-
- /**
- * The DNS zone that is being transferred by the master as part of a zone
- * transfer.
- */
- public void setDnsSrcZone(String dnsSrcZone) {
- addField(DNS_SRC_ZONE, dnsSrcZone);
- }
- public static String DNS_SRC_ZONE = "src_zone";
-
- // ----------------------------------
- // Email tracking
- // ----------------------------------
-
- /**
- * The person to whom an email is sent.
- */
- public void setEmailRecipient(String emailRecipient) {
- addField(EMAIL_RECIPIENT, emailRecipient);
- }
- public static String EMAIL_RECIPIENT = "recipient";
-
- /**
- * The person responsible for sending an email.
- */
- public void setEmailSender(String emailSender) {
- addField(EMAIL_SENDER, emailSender);
- }
- public static String EMAIL_SENDER = "sender";
-
- /**
- * The email subject line.
- */
- public void setEmailSubject(String emailSubject) {
- addField(EMAIL_SUBJECT, emailSubject);
- }
- public static String EMAIL_SUBJECT = "subject";
-
- // ----------------------------------
- // File management
- // ----------------------------------
-
- /**
- * The time the file (the object of the event) was accessed.
- */
- public void setFileAccessTime(long fileAccessTime) {
- addField(FILE_ACCESS_TIME, fileAccessTime);
- }
- public static String FILE_ACCESS_TIME = "file_access_time";
-
- /**
- * The time the file (the object of the event) was created.
- */
- public void setFileCreateTime(long fileCreateTime) {
- addField(FILE_CREATE_TIME, fileCreateTime);
- }
- public static String FILE_CREATE_TIME = "file_create_time";
-
- /**
- * A cryptographic identifier assigned to the file object affected by the
- * event.
- */
- public void setFileHash(String fileHash) {
- addField(FILE_HASH, fileHash);
- }
- public static String FILE_HASH = "file_hash";
-
- /**
- * The time the file (the object of the event) was altered.
- */
- public void setFileModifyTime(long fileModifyTime) {
- addField(FILE_MODIFY_TIME, fileModifyTime);
- }
- public static String FILE_MODIFY_TIME = "file_modify_time";
-
- /**
- * The name of the file that is the object of the event (without location
- * information related to local file or directory structure).
- */
- public void setFileName(String fileName) {
- addField(FILE_NAME, fileName);
- }
- public static String FILE_NAME = "file_name";
-
- /**
- * The location of the file that is the object of the event, in terms of
- * local file and directory structure.
- */
- public void setFilePath(String filePath) {
- addField(FILE_PATH, filePath);
- }
- public static String FILE_PATH = "file_path";
-
- /**
- * Access controls associated with the file affected by the event.
- */
- public void setFilePermission(String filePermission) {
- addField(FILE_PERMISSION, filePermission);
- }
- public static String FILE_PERMISSION = "file_permission";
-
- /**
- * The size of the file that is the object of the event. Indicate whether
- * Bytes, KB, MB, GB.
- */
- public void setFileSize(long fileSize) {
- addField(FILE_SIZE, fileSize);
- }
- public static String FILE_SIZE = "file_size";
-
- // ----------------------------------
- // Intrusion detection
- // ----------------------------------
-
- /**
- * The category of the triggered signature.
- */
- public void setIntrusionDetectionCategory(String intrusionDetectionCategory) {
- addField(INTRUSION_DETECTION_CATEGORY, intrusionDetectionCategory);
- }
- public static String INTRUSION_DETECTION_CATEGORY = "category";
-
- /**
- * The destination of the attack detected by the intrusion detection system
- * (IDS). If your field is named dest_host, dest_ip, dest_ipv6, or
- * dest_nt_host you can alias it as dest to make it CIM-compliant.
- */
- public void setIntrusionDetectionDest(String intrusionDetectionDest) {
- addField(INTRUSION_DETECTION_DEST, intrusionDetectionDest);
- }
- public static String INTRUSION_DETECTION_DEST = "dest";
-
- /**
- * The device that detected the intrusion event.
- */
- public void setIntrusionDetectionDvc(String intrusionDetectionDvc) {
- addField(INTRUSION_DETECTION_DVC, intrusionDetectionDvc);
- }
- public static String INTRUSION_DETECTION_DVC = "dvc";
-
- /**
- * The type of IDS that generated the event.
- */
- public void setIntrusionDetectionIdsType(String intrusionDetectionIdsType) {
- addField(INTRUSION_DETECTION_IDS_TYPE, intrusionDetectionIdsType);
- }
- public static String INTRUSION_DETECTION_IDS_TYPE = "ids_type";
-
- /**
- * The product name of the vendor technology generating network protection
- * data, such as IDP, Providentia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public void setIntrusionDetectionProduct(String intrusionDetectionProduct) {
- addField(INTRUSION_DETECTION_PRODUCT, intrusionDetectionProduct);
- }
- public static String INTRUSION_DETECTION_PRODUCT = "product";
-
- /**
- * The severity of the network protection event (such as critical, high,
- * medium, low, or informational).
- *
- * Note: This field is a string. Please use a severity_id field for severity
- * ID fields that are integer data types.
- */
- public void setIntrusionDetectionSeverity(String intrusionDetectionSeverity) {
- addField(INTRUSION_DETECTION_SEVERITY, intrusionDetectionSeverity);
- }
- public static String INTRUSION_DETECTION_SEVERITY = "severity";
-
- /**
- * The name of the intrusion detected on the client (the src), such as
- * PlugAndPlay_BO and JavaScript_Obfuscation_Fre.
- */
- public void setIntrusionDetectionSignature(
- String intrusionDetectionSignature) {
- addField(INTRUSION_DETECTION_SIGNATURE, intrusionDetectionSignature);
- }
- public static String INTRUSION_DETECTION_SIGNATURE = "signature";
-
- /**
- * The source involved in the attack detected by the IDS. If your field is
- * named src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src
- * to make it CIM-compliant.
- */
- public void setIntrusionDetectionSrc(String intrusionDetectionSrc) {
- addField(INTRUSION_DETECTION_SRC, intrusionDetectionSrc);
- }
- public static String INTRUSION_DETECTION_SRC = "src";
-
- /**
- * The user involved with the intrusion detection event.
- */
- public void setIntrusionDetectionUser(String intrusionDetectionUser) {
- addField(INTRUSION_DETECTION_USER, intrusionDetectionUser);
- }
- public static String INTRUSION_DETECTION_USER = "user";
-
- /**
- * The vendor technology used to generate network protection data, such as
- * IDP, Providentia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public void setIntrusionDetectionVendor(String intrusionDetectionVendor) {
- addField(INTRUSION_DETECTION_VENDOR, intrusionDetectionVendor);
- }
- public static String INTRUSION_DETECTION_VENDOR = "vendor";
-
-
- // ----------------------------------
- // Malware - Endpoint protection
- // ----------------------------------
-
- /**
- * The outcome of the infection
- */
- public void setMalwareEndpointProtectionAction(
- String malwareEndpointProtectionAction) {
- addField(MALWARE_ENDPOINT_PROTECTION_ACTION,
- malwareEndpointProtectionAction);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_ACTION = "action";
-
- /**
- * The NT domain of the destination (the dest_bestmatch).
- */
- public void setMalwareEndpointProtectionDestNtDomain(
- String malwareEndpointProtectionDestNtDomain) {
- addField(MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN,
- malwareEndpointProtectionDestNtDomain);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN = "dest_nt_domain";
-
- /**
- * The cryptographic hash of the file associated with the malware event
- * (such as the malicious or infected file).
- */
- public void setMalwareEndpointProtectionFileHash(
- String malwareEndpointProtectionFileHash) {
- addField(MALWARE_ENDPOINT_PROTECTION_FILE_HASH,
- malwareEndpointProtectionFileHash);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_FILE_HASH = "file_hash";
-
- /**
- * The name of the file involved in the malware event (such as the infected
- * or malicious file).
- */
- public void setMalwareEndpointProtectionFileName(
- String malwareEndpointProtectionFileName) {
- addField(MALWARE_ENDPOINT_PROTECTION_FILE_NAME,
- malwareEndpointProtectionFileName);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_FILE_NAME = "file_name";
-
- /**
- * The path of the file involved in the malware event (such as the infected
- * or malicious file).
- */
- public void setMalwareEndpointProtectionFilePath(
- String malwareEndpointProtectionFilePath) {
- addField(MALWARE_ENDPOINT_PROTECTION_FILE_PATH,
- malwareEndpointProtectionFilePath);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_FILE_PATH = "file_path";
-
- /**
- * The product name of the vendor technology (the vendor field) that is
- * generating malware data (such as Antivirus or EPO).
- */
- public void setMalwareEndpointProtectionProduct(
- String malwareEndpointProtectionProduct) {
- addField(MALWARE_ENDPOINT_PROTECTION_PRODUCT,
- malwareEndpointProtectionProduct);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT = "product";
-
- /**
- * The product version number of the vendor technology installed on the
- * client (such as 10.4.3 or 11.0.2).
- */
- public void setMalwareEndpointProtectionProductVersion(
- String malwareEndpointProtectionProductVersion) {
- addField(MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION,
- malwareEndpointProtectionProductVersion);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION = "product_version";
-
- /**
- * The name of the malware infection detected on the client (the src), such
- * as Trojan.Vundo,Spyware.Gaobot,W32.Nimbda).
- *
- * Note: This field is a string. Please use a signature_id field for
- * signature ID fields that are integer data types.
- */
- public void setMalwareEndpointProtectionSignature(
- String malwareEndpointProtectionSignature) {
- addField(MALWARE_ENDPOINT_PROTECTION_SIGNATURE,
- malwareEndpointProtectionSignature);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE = "signature";
-
- /**
- * The current signature definition set running on the client, such as
- * 11hsvx)
- */
- public void setMalwareEndpointProtectionSignatureVersion(
- String malwareEndpointProtectionSignatureVersion) {
- addField(MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION,
- malwareEndpointProtectionSignatureVersion);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION = "signature_version";
-
- /**
- * The target affected or infected by the malware. If your field is named
- * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
- * to make it CIM-compliant.
- */
- public void setMalwareEndpointProtectionDest(
- String malwareEndpointProtectionDest) {
- addField(MALWARE_ENDPOINT_PROTECTION_DEST, malwareEndpointProtectionDest);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_DEST = "dest";
-
- /**
- * The NT domain of the source (the src).
- */
- public void setMalwareEndpointProtectionSrcNtDomain(
- String malwareEndpointProtectionSrcNtDomain) {
- addField(MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN,
- malwareEndpointProtectionSrcNtDomain);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN = "src_nt_domain";
-
- /**
- * The name of the user involved in the malware event.
- */
- public void setMalwareEndpointProtectionUser(
- String malwareEndpointProtectionUser) {
- addField(MALWARE_ENDPOINT_PROTECTION_USER, malwareEndpointProtectionUser);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_USER = "user";
-
- /**
- * The name of the vendor technology generating malware data, such as
- * Symantec or McAfee.
- */
- public void setMalwareEndpointProtectionVendor(
- String malwareEndpointProtectionVendor) {
- addField(MALWARE_ENDPOINT_PROTECTION_VENDOR,
- malwareEndpointProtectionVendor);
- }
- public static String MALWARE_ENDPOINT_PROTECTION_VENDOR = "vendor";
-
- // ----------------------------------
- // Malware - Network protection
- // ----------------------------------
-
- /**
- * The product name of the vendor technology generating network protection
- * data, such as IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public void setMalwareNetworkProtectionProduct(
- String malwareNetworkProtectionProduct) {
- addField(MALWARE_NETWORK_PROTECTION_PRODUCT,
- malwareNetworkProtectionProduct);
- }
- public static String MALWARE_NETWORK_PROTECTION_PRODUCT = "product";
-
- /**
- * The severity of the network protection event (such as critical, high,
- * medium, low, or informational).
- *
- * Note: This field is a string. Please use a severity_id field for severity
- * ID fields that are integer data types.
- */
- public void setMalwareNetworkProtectionSeverity(
- String malwareNetworkProtectionSeverity) {
- addField(MALWARE_NETWORK_PROTECTION_SEVERITY,
- malwareNetworkProtectionSeverity);
- }
- public static String MALWARE_NETWORK_PROTECTION_SEVERITY = "severity";
-
- /**
- * The vendor technology used to generate network protection data, such as
- * IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public void setMalwareNetworkProtectionVendor(
- String malwareNetworkProtectionVendor) {
- addField(MALWARE_NETWORK_PROTECTION_VENDOR,
- malwareNetworkProtectionVendor);
- }
- public static String MALWARE_NETWORK_PROTECTION_VENDOR = "vendor";
-
-
- // ----------------------------------
- // Network traffic - ESS
- // ----------------------------------
-
- /**
- * The action of the network traffic.
- */
- public void setNetworkTrafficEssAction(String networkTrafficEssAction) {
- addField(NETWORK_TRAFFIC_ESS_ACTION, networkTrafficEssAction);
- }
- public static String NETWORK_TRAFFIC_ESS_ACTION = "action";
-
- /**
- * The destination port of the network traffic.
- */
- public void setNetworkTrafficEssDestPort(int networkTrafficEssDestPort) {
- addField(NETWORK_TRAFFIC_ESS_DEST_PORT, networkTrafficEssDestPort);
- }
- public static String NETWORK_TRAFFIC_ESS_DEST_PORT = "dest_port";
-
- /**
- * The product name of the vendor technology generating NetworkProtection
- * data, such as IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public void setNetworkTrafficEssProduct(String networkTrafficEssProduct) {
- addField(NETWORK_TRAFFIC_ESS_PRODUCT, networkTrafficEssProduct);
- }
- public static String NETWORK_TRAFFIC_ESS_PRODUCT = "product";
-
- /**
- * The source port of the network traffic.
- */
- public void setNetworkTrafficEssSrcPort(int networkTrafficEssSrcPort) {
- addField(NETWORK_TRAFFIC_ESS_SRC_PORT, networkTrafficEssSrcPort);
- }
- public static String NETWORK_TRAFFIC_ESS_SRC_PORT = "src_port";
-
- /**
- * The vendor technology used to generate NetworkProtection data, such as
- * IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public void setNetworkTrafficEssVendor(String networkTrafficEssVendor) {
- addField(NETWORK_TRAFFIC_ESS_VENDOR, networkTrafficEssVendor);
- }
- public static String NETWORK_TRAFFIC_ESS_VENDOR = "vendor";
-
- // ----------------------------------
- // Network traffic - Generic
- // ----------------------------------
-
- /**
- * The ISO layer 7 (application layer) protocol, such as HTTP, HTTPS, SSH,
- * and IMAP.
- */
- public void setNetworkTrafficGenericAppLayer(
- String networkTrafficGenericAppLayer) {
- addField(NETWORK_TRAFFIC_GENERIC_APP_LAYER,
- networkTrafficGenericAppLayer);
- }
- public static String NETWORK_TRAFFIC_GENERIC_APP_LAYER = "app_layer";
- /**
- * How many bytes this device/interface received.
- */
- public void setNetworkTrafficGenericBytesIn(
- long networkTrafficGenericBytesIn) {
- addField(NETWORK_TRAFFIC_GENERIC_BYTES_IN, networkTrafficGenericBytesIn);
- }
- public static String NETWORK_TRAFFIC_GENERIC_BYTES_IN = "bytes_in";
-
-
- /**
- * How many bytes this device/interface transmitted.
- */
- public void setNetworkTrafficGenericBytesOut(
- long networkTrafficGenericBytesOut) {
- addField(NETWORK_TRAFFIC_GENERIC_BYTES_OUT,
- networkTrafficGenericBytesOut);
- }
- public static String NETWORK_TRAFFIC_GENERIC_BYTES_OUT = "bytes_out";
-
- /**
- * 802.11 channel number used by a wireless network.
- */
- public void setNetworkTrafficGenericChannel(
- String networkTrafficGenericChannel) {
- addField(NETWORK_TRAFFIC_GENERIC_CHANNEL, networkTrafficGenericChannel);
- }
- public static String NETWORK_TRAFFIC_GENERIC_CHANNEL = "channel";
-
- /**
- * The Common Vulnerabilities and Exposures (CVE) reference value.
- */
- public void setNetworkTrafficGenericCve(String networkTrafficGenericCve) {
- addField(NETWORK_TRAFFIC_GENERIC_CVE, networkTrafficGenericCve);
- }
- public static String NETWORK_TRAFFIC_GENERIC_CVE = "cve";
-
- /**
- * The destination application being targeted.
- */
- public void setNetworkTrafficGenericDestApp(
- String networkTrafficGenericDestApp) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_APP, networkTrafficGenericDestApp);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_APP = "dest_app";
-
- /**
- * The destination command and control service channel.
- */
- public void setNetworkTrafficGenericDestCncChannel(
- String networkTrafficGenericDestCncChannel) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL,
- networkTrafficGenericDestCncChannel);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL = "dest_cnc_channel";
-
- /**
- * The destination command and control service name.
- */
- public void setNetworkTrafficGenericDestCncName(
- String networkTrafficGenericDestCncName) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME,
- networkTrafficGenericDestCncName);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME = "dest_cnc_name";
-
- /**
- * The destination command and control service port.
- */
- public void setNetworkTrafficGenericDestCncPort(
- String networkTrafficGenericDestCncPort) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT,
- networkTrafficGenericDestCncPort);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT = "dest_cnc_port";
-
- /**
- * The country associated with a packet's recipient.
- */
- public void setNetworkTrafficGenericDestCountry(
- String networkTrafficGenericDestCountry) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY,
- networkTrafficGenericDestCountry);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY = "dest_country";
-
- /**
- * The fully qualified host name of a packet's recipient. For HTTP sessions,
- * this is the host header.
- */
- public void setNetworkTrafficGenericDestHost(
- String networkTrafficGenericDestHost) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_HOST,
- networkTrafficGenericDestHost);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_HOST = "dest_host";
-
- /**
- * The interface that is listening remotely or receiving packets locally.
- */
- public void setNetworkTrafficGenericDestInt(
- String networkTrafficGenericDestInt) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_INT, networkTrafficGenericDestInt);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_INT = "dest_int";
-
- /**
- * The IPv4 address of a packet's recipient.
- */
- public void setNetworkTrafficGenericDestIp(
- String networkTrafficGenericDestIp) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_IP, networkTrafficGenericDestIp);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_IP = "dest_ip";
-
- /**
- * The IPv6 address of a packet's recipient.
- */
- public void setNetworkTrafficGenericDestIpv6(
- String networkTrafficGenericDestIpv6) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_IPV6,
- networkTrafficGenericDestIpv6);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_IPV6 = "dest_ipv6";
-
- /**
- * The (physical) latitude of a packet's destination.
- */
- public void setNetworkTrafficGenericDestLat(int networkTrafficGenericDestLat) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_LAT, networkTrafficGenericDestLat);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_LAT = "dest_lat";
-
- /**
- * The (physical) longitude of a packet's destination.
- */
- public void setNetworkTrafficGenericDestLong(
- int networkTrafficGenericDestLong) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_LONG,
- networkTrafficGenericDestLong);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_LONG = "dest_long";
-
- /**
- * The destination TCP/IP layer 2 Media Access Control (MAC) address of a
- * packet's destination.
- */
- public void setNetworkTrafficGenericDestMac(
- String networkTrafficGenericDestMac) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_MAC, networkTrafficGenericDestMac);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_MAC = "dest_mac";
-
- /**
- * The Windows NT domain containing a packet's destination.
- */
- public void setNetworkTrafficGenericDestNtDomain(
- String networkTrafficGenericDestNtDomain) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN,
- networkTrafficGenericDestNtDomain);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN = "dest_nt_domain";
-
- /**
- * The Windows NT host name of a packet's destination.
- */
- public void setNetworkTrafficGenericDestNtHost(
- String networkTrafficGenericDestNtHost) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST,
- networkTrafficGenericDestNtHost);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST = "dest_nt_host";
-
- /**
- * TCP/IP port to which a packet is being sent.
- */
- public void setNetworkTrafficGenericDestPort(
- int networkTrafficGenericDestPort) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_PORT,
- networkTrafficGenericDestPort);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_PORT = "dest_port";
-
- /**
- * The NATed IPv4 address to which a packet has been sent.
- */
- public void setNetworkTrafficGenericDestTranslatedIp(
- String networkTrafficGenericDestTranslatedIp) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP,
- networkTrafficGenericDestTranslatedIp);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP = "dest_translated_ip";
-
- /**
- * The NATed port to which a packet has been sent.
- */
- public void setNetworkTrafficGenericDestTranslatedPort(
- int networkTrafficGenericDestTranslatedPort) {
- addField(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT,
- networkTrafficGenericDestTranslatedPort);
- }
- public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT = "dest_translated_port";
-
- /**
- * The numbered Internet Protocol version.
- */
- public void setNetworkTrafficGenericIpVersion(
- int networkTrafficGenericIpVersion) {
- addField(NETWORK_TRAFFIC_GENERIC_IP_VERSION,
- networkTrafficGenericIpVersion);
- }
- public static String NETWORK_TRAFFIC_GENERIC_IP_VERSION = "ip_version";
-
- /**
- * The network interface through which a packet was transmitted.
- */
- public void setNetworkTrafficGenericOutboundInterface(
- String networkTrafficGenericOutboundInterface) {
- addField(NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE,
- networkTrafficGenericOutboundInterface);
- }
- public static String NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE = "outbound_interface";
-
- /**
- * How many packets this device/interface received.
- */
- public void setNetworkTrafficGenericPacketsIn(
- long networkTrafficGenericPacketsIn) {
- addField(NETWORK_TRAFFIC_GENERIC_PACKETS_IN,
- networkTrafficGenericPacketsIn);
- }
- public static String NETWORK_TRAFFIC_GENERIC_PACKETS_IN = "packets_in";
-
- /**
- * How many packets this device/interface transmitted.
- */
- public void setNetworkTrafficGenericPacketsOut(
- long networkTrafficGenericPacketsOut) {
- addField(NETWORK_TRAFFIC_GENERIC_PACKETS_OUT,
- networkTrafficGenericPacketsOut);
- }
- public static String NETWORK_TRAFFIC_GENERIC_PACKETS_OUT = "packets_out";
-
- /**
- * The OSI layer 3 (Network Layer) protocol, such as IPv4/IPv6, ICMP, IPsec,
- * IGMP or RIP.
- */
- public void setNetworkTrafficGenericProto(String networkTrafficGenericProto) {
- addField(NETWORK_TRAFFIC_GENERIC_PROTO, networkTrafficGenericProto);
- }
- public static String NETWORK_TRAFFIC_GENERIC_PROTO = "proto";
-
- /**
- * The session identifier. Multiple transactions build a session.
- */
- public void setNetworkTrafficGenericSessionId(
- String networkTrafficGenericSessionId) {
- addField(NETWORK_TRAFFIC_GENERIC_SESSION_ID,
- networkTrafficGenericSessionId);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SESSION_ID = "session_id";
-
- /**
- * The 802.11 service set identifier (ssid) assigned to a wireless session.
- */
- public void setNetworkTrafficGenericSsid(String networkTrafficGenericSsid) {
- addField(NETWORK_TRAFFIC_GENERIC_SSID, networkTrafficGenericSsid);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SSID = "ssid";
-
- /**
- * The country from which the packet was sent.
- */
- public void setNetworkTrafficGenericSrcCountry(
- String networkTrafficGenericSrcCountry) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY,
- networkTrafficGenericSrcCountry);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY = "src_country";
-
- /**
- * The fully qualified host name of the system that transmitted the packet.
- * For Web logs, this is the HTTP client.
- */
- public void setNetworkTrafficGenericSrcHost(
- String networkTrafficGenericSrcHost) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_HOST, networkTrafficGenericSrcHost);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_HOST = "src_host";
-
- /**
- * The interface that is listening locally or sending packets remotely.
- */
- public void setNetworkTrafficGenericSrcInt(
- String networkTrafficGenericSrcInt) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_INT, networkTrafficGenericSrcInt);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_INT = "src_int";
-
- /**
- * The IPv4 address of the packet's source. For Web logs, this is the http
- * client.
- */
- public void setNetworkTrafficGenericSrcIp(String networkTrafficGenericSrcIp) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_IP, networkTrafficGenericSrcIp);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_IP = "src_ip";
-
- /**
- * The IPv6 address of the packet's source.
- */
- public void setNetworkTrafficGenericSrcIpv6(
- String networkTrafficGenericSrcIpv6) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_IPV6, networkTrafficGenericSrcIpv6);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_IPV6 = "src_ipv6";
-
- /**
- * The (physical) latitude of the packet's source.
- */
- public void setNetworkTrafficGenericSrcLat(int networkTrafficGenericSrcLat) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_LAT, networkTrafficGenericSrcLat);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_LAT = "src_lat";
-
- /**
- * The (physical) longitude of the packet's source.
- */
- public void setNetworkTrafficGenericSrcLong(int networkTrafficGenericSrcLong) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_LONG, networkTrafficGenericSrcLong);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_LONG = "src_long";
-
- /**
- * The Media Access Control (MAC) address from which a packet was
- * transmitted.
- */
- public void setNetworkTrafficGenericSrcMac(
- String networkTrafficGenericSrcMac) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_MAC, networkTrafficGenericSrcMac);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_MAC = "src_mac";
-
- /**
- * The Windows NT domain containing the machines that generated the event.
- */
- public void setNetworkTrafficGenericSrcNtDomain(
- String networkTrafficGenericSrcNtDomain) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN,
- networkTrafficGenericSrcNtDomain);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN = "src_nt_domain";
-
- /**
- * The Windows NT hostname of the system that generated the event.
- */
- public void setNetworkTrafficGenericSrcNtHost(
- String networkTrafficGenericSrcNtHost) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST,
- networkTrafficGenericSrcNtHost);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST = "src_nt_host";
-
- /**
- * The network port from which a packet originated.
- */
- public void setNetworkTrafficGenericSrcPort(int networkTrafficGenericSrcPort) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_PORT, networkTrafficGenericSrcPort);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_PORT = "src_port";
-
- /**
- * The NATed IPv4 address from which a packet has been sent.
- */
- public void setNetworkTrafficGenericSrcTranslatedIp(
- String networkTrafficGenericSrcTranslatedIp) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP,
- networkTrafficGenericSrcTranslatedIp);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP = "src_translated_ip";
-
- /**
- * The NATed network port from which a packet has been sent.
- */
- public void setNetworkTrafficGenericSrcTranslatedPort(
- int networkTrafficGenericSrcTranslatedPort) {
- addField(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT,
- networkTrafficGenericSrcTranslatedPort);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT = "src_translated_port";
-
- /**
- * The application, process, or OS subsystem that generated the event.
- */
- public void setNetworkTrafficGenericSyslogId(
- String networkTrafficGenericSyslogId) {
- addField(NETWORK_TRAFFIC_GENERIC_SYSLOG_ID,
- networkTrafficGenericSyslogId);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_ID = "syslog_id";
-
- /**
- * The criticality of an event, as recorded by UNIX syslog.
- */
- public void setNetworkTrafficGenericSyslogPriority(
- String networkTrafficGenericSyslogPriority) {
- addField(NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY,
- networkTrafficGenericSyslogPriority);
- }
- public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY = "syslog_priority";
-
- /**
- * The TCP flag(s) specified in the event.
- */
- public void setNetworkTrafficGenericTcpFlag(
- String networkTrafficGenericTcpFlag) {
- addField(NETWORK_TRAFFIC_GENERIC_TCP_FLAG, networkTrafficGenericTcpFlag);
- }
- public static String NETWORK_TRAFFIC_GENERIC_TCP_FLAG = "tcp_flag";
-
- /**
- * The hex bit that specifies TCP 'type of service'
- *
- * @see Type of
- * Service
- */
- public void setNetworkTrafficGenericTos(String networkTrafficGenericTos) {
- addField(NETWORK_TRAFFIC_GENERIC_TOS, networkTrafficGenericTos);
- }
- public static String NETWORK_TRAFFIC_GENERIC_TOS = "tos";
-
- /**
- * The transport protocol.
- */
- public void setNetworkTrafficGenericTransport(
- String networkTrafficGenericTransport) {
- addField(NETWORK_TRAFFIC_GENERIC_TRANSPORT,
- networkTrafficGenericTransport);
- }
- public static String NETWORK_TRAFFIC_GENERIC_TRANSPORT = "transport";
-
- /**
- * The "time to live" of a packet or datagram.
- */
- public void setNetworkTrafficGenericTtl(int networkTrafficGenericTtl) {
- addField(NETWORK_TRAFFIC_GENERIC_TTL, networkTrafficGenericTtl);
- }
- public static String NETWORK_TRAFFIC_GENERIC_TTL = "ttl";
-
- /**
- * The numeric identifier assigned to the virtual local area network (VLAN)
- * specified in the record.
- */
- public void setNetworkTrafficGenericVlanId(long networkTrafficGenericVlanId) {
- addField(NETWORK_TRAFFIC_GENERIC_VLAN_ID, networkTrafficGenericVlanId);
- }
- public static String NETWORK_TRAFFIC_GENERIC_VLAN_ID = "vlan_id";
-
- /**
- * The name assigned to the virtual local area network (VLAN) specified in
- * the record.
- */
- public void setNetworkTrafficGenericVlanName(
- String networkTrafficGenericVlanName) {
- addField(NETWORK_TRAFFIC_GENERIC_VLAN_NAME,
- networkTrafficGenericVlanName);
- }
- public static String NETWORK_TRAFFIC_GENERIC_VLAN_NAME = "vlan_name";
-
-
- // ----------------------------------
- // Packet filtering
- // ----------------------------------
-
- /**
- * The action the filtering device (the dvc_bestmatch field) performed on
- * the communication.
- */
- public void setPacketFilteringAction(String packetFilteringAction) {
- addField(PACKET_FILTERING_ACTION, packetFilteringAction);
- }
- public static String PACKET_FILTERING_ACTION = "action";
-
- /**
- * The IP port of the packet's destination, such as 22.
- */
- public void setPacketFilteringDestPort(int packetFilteringDestPort) {
- addField(PACKET_FILTERING_DEST_PORT, packetFilteringDestPort);
- }
- public static String PACKET_FILTERING_DEST_PORT = "dest_port";
-
- /**
- * The direction the packet is traveling.
- */
- public void setPacketFilteringDirection(String packetFilteringDirection) {
- addField(PACKET_FILTERING_DIRECTION, packetFilteringDirection);
- }
- public static String PACKET_FILTERING_DIRECTION = "direction";
-
- /**
- * The name of the packet filtering device. If your field is named dvc_host,
- * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
- */
- public void setPacketFilteringDvc(String packetFilteringDvc) {
- addField(PACKET_FILTERING_DVC, packetFilteringDvc);
- }
- public static String PACKET_FILTERING_DVC = "dvc";
-
- /**
- * The rule which took action on the packet, such as 143.
- */
- public void setPacketFilteringRule(String packetFilteringRule) {
- addField(PACKET_FILTERING_RULE, packetFilteringRule);
- }
- public static String PACKET_FILTERING_RULE = "rule";
-
- /**
- * The IP port of the packet's source, such as 34541.
- */
- public void setPacketFilteringSvcPort(int packetFilteringSvcPort) {
- addField(PACKET_FILTERING_SVC_PORT, packetFilteringSvcPort);
- }
- public static String PACKET_FILTERING_SVC_PORT = "svc_port";
-
-
- // ----------------------------------
- // Proxy
- // ----------------------------------
-
- /**
- * The action taken by the proxy.
- */
- public void setProxyAction(String proxyAction) {
- addField(PROXY_ACTION, proxyAction);
- }
- public static String PROXY_ACTION = "action";
-
- /**
- * The destination of the network traffic (the remote host).
- */
- public void setProxyDest(String proxyDest) {
- addField(PROXY_DEST, proxyDest);
- }
- public static String PROXY_DEST = "dest";
-
- /**
- * The content-type of the requested HTTP resource.
- */
- public void setProxyHttpContentType(String proxyHttpContentType) {
- addField(PROXY_HTTP_CONTENT_TYPE, proxyHttpContentType);
- }
- public static String PROXY_HTTP_CONTENT_TYPE = "http_content_type";
-
- /**
- * The HTTP method used to request the resource.
- */
- public void setProxyHttpMethod(String proxyHttpMethod) {
- addField(PROXY_HTTP_METHOD, proxyHttpMethod);
- }
- public static String PROXY_HTTP_METHOD = "http_method";
-
- /**
- * The HTTP referrer used to request the HTTP resource.
- */
- public void setProxyHttpRefer(String proxyHttpRefer) {
- addField(PROXY_HTTP_REFER, proxyHttpRefer);
- }
- public static String PROXY_HTTP_REFER = "http_refer";
-
- /**
- * The HTTP response code.
- */
- public void setProxyHttpResponse(int proxyHttpResponse) {
- addField(PROXY_HTTP_RESPONSE, proxyHttpResponse);
- }
- public static String PROXY_HTTP_RESPONSE = "http_response";
-
- /**
- * The user agent used to request the HTTP resource.
- */
- public void setProxyHttpUserAgent(String proxyHttpUserAgent) {
- addField(PROXY_HTTP_USER_AGENT, proxyHttpUserAgent);
- }
- public static String PROXY_HTTP_USER_AGENT = "http_user_agent";
-
- /**
- * The product name of the vendor technology generating Network Protection
- * data, such as IDP, Providentia, and ASA.
- */
- public void setProxyProduct(String proxyProduct) {
- addField(PROXY_PRODUCT, proxyProduct);
- }
- public static String PROXY_PRODUCT = "product";
-
- /**
- * The source of the network traffic (the client requesting the connection).
- */
- public void setProxySrc(String proxySrc) {
- addField(PROXY_SRC, proxySrc);
- }
- public static String PROXY_SRC = "src";
-
- /**
- * The HTTP response code indicating the status of the proxy request.
- */
- public void setProxyStatus(int proxyStatus) {
- addField(PROXY_STATUS, proxyStatus);
- }
- public static String PROXY_STATUS = "status";
-
- /**
- * The user that requested the HTTP resource.
- */
- public void setProxyUser(String proxyUser) {
- addField(PROXY_USER, proxyUser);
- }
- public static String PROXY_USER = "user";
-
- /**
- * The URL of the requested HTTP resource.
- */
- public void setProxyUrl(String proxyUrl) {
- addField(PROXY_URL, proxyUrl);
- }
- public static String PROXY_URL = "url";
-
- /**
- * The vendor technology generating Network Protection data, such as IDP,
- * Providentia, and ASA.
- */
- public void setProxyVendor(String proxyVendor) {
- addField(PROXY_VENDOR, proxyVendor);
- }
- public static String PROXY_VENDOR = "vendor";
-
-
- // ----------------------------------
- // System center
- // ----------------------------------
-
- /**
- * The running application or service on the system (the src field), such as
- * explorer.exe or sshd.
- */
- public void setSystemCenterApp(String systemCenterApp) {
- addField(SYSTEM_CENTER_APP, systemCenterApp);
- }
- public static String SYSTEM_CENTER_APP = "app";
-
- /**
- * The amount of disk space available per drive or mount (the mount field)
- * on the system (the src field).
- */
- public void setSystemCenterFreembytes(long systemCenterFreembytes) {
- addField(SYSTEM_CENTER_FREEMBYTES, systemCenterFreembytes);
- }
- public static String SYSTEM_CENTER_FREEMBYTES = "FreeMBytes";
-
- /**
- * The version of operating system installed on the host (the src field),
- * such as 6.0.1.4 or 2.6.27.30-170.2.82.fc10.x86_64.
- */
- public void setSystemCenterKernelRelease(String systemCenterKernelRelease) {
- addField(SYSTEM_CENTER_KERNEL_RELEASE, systemCenterKernelRelease);
- }
- public static String SYSTEM_CENTER_KERNEL_RELEASE = "kernel_release";
-
- /**
- * Human-readable version of the SystemUptime value.
- */
- public void setSystemCenterLabel(String systemCenterLabel) {
- addField(SYSTEM_CENTER_LABEL, systemCenterLabel);
- }
- public static String SYSTEM_CENTER_LABEL = "label";
-
- /**
- * The drive or mount reporting available disk space (the FreeMBytes field)
- * on the system (the src field).
- */
- public void setSystemCenterMount(String systemCenterMount) {
- addField(SYSTEM_CENTER_MOUNT, systemCenterMount);
- }
- public static String SYSTEM_CENTER_MOUNT = "mount";
-
- /**
- * The name of the operating system installed on the host (the src), such as
- * Microsoft Windows Server 2003 or GNU/Linux).
- */
- public void setSystemCenterOs(String systemCenterOs) {
- addField(SYSTEM_CENTER_OS, systemCenterOs);
- }
- public static String SYSTEM_CENTER_OS = "os";
-
- /**
- * The percentage of processor utilization.
- */
- public void setSystemCenterPercentprocessortime(
- int systemCenterPercentprocessortime) {
- addField(SYSTEM_CENTER_PERCENTPROCESSORTIME,
- systemCenterPercentprocessortime);
- }
- public static String SYSTEM_CENTER_PERCENTPROCESSORTIME = "PercentProcessorTime";
-
- /**
- * The setlocaldefs setting from the SE Linux configuration.
- */
- public void setSystemCenterSetlocaldefs(int systemCenterSetlocaldefs) {
- addField(SYSTEM_CENTER_SETLOCALDEFS, systemCenterSetlocaldefs);
- }
- public static String SYSTEM_CENTER_SETLOCALDEFS = "setlocaldefs";
-
- /**
- * Values from the SE Linux configuration file.
- */
- public void setSystemCenterSelinux(String systemCenterSelinux) {
- addField(SYSTEM_CENTER_SELINUX, systemCenterSelinux);
- }
- public static String SYSTEM_CENTER_SELINUX = "selinux";
-
- /**
- * The SE Linux type (such as targeted).
- */
- public void setSystemCenterSelinuxtype(String systemCenterSelinuxtype) {
- addField(SYSTEM_CENTER_SELINUXTYPE, systemCenterSelinuxtype);
- }
- public static String SYSTEM_CENTER_SELINUXTYPE = "selinuxtype";
-
- /**
- * The shell provided to the User Account (the user field) upon logging into
- * the system (the src field).
- */
- public void setSystemCenterShell(String systemCenterShell) {
- addField(SYSTEM_CENTER_SHELL, systemCenterShell);
- }
- public static String SYSTEM_CENTER_SHELL = "shell";
-
- /**
- * The TCP/UDP source port on the system (the src field).
- */
- public void setSystemCenterSrcPort(int systemCenterSrcPort) {
- addField(SYSTEM_CENTER_SRC_PORT, systemCenterSrcPort);
- }
- public static String SYSTEM_CENTER_SRC_PORT = "src_port";
-
- /**
- * The sshd protocol version.
- */
- public void setSystemCenterSshdProtocol(String systemCenterSshdProtocol) {
- addField(SYSTEM_CENTER_SSHD_PROTOCOL, systemCenterSshdProtocol);
- }
- public static String SYSTEM_CENTER_SSHD_PROTOCOL = "sshd_protocol";
-
- /**
- * The start mode of the given service.
- */
- public void setSystemCenterStartmode(String systemCenterStartmode) {
- addField(SYSTEM_CENTER_STARTMODE, systemCenterStartmode);
- }
- public static String SYSTEM_CENTER_STARTMODE = "Startmode";
-
- /**
- * The number of seconds since the system (the src) has been "up."
- */
- public void setSystemCenterSystemuptime(long systemCenterSystemuptime) {
- addField(SYSTEM_CENTER_SYSTEMUPTIME, systemCenterSystemuptime);
- }
- public static String SYSTEM_CENTER_SYSTEMUPTIME = "SystemUptime";
-
- /**
- * The total amount of available memory on the system (the src).
- */
- public void setSystemCenterTotalmbytes(long systemCenterTotalmbytes) {
- addField(SYSTEM_CENTER_TOTALMBYTES, systemCenterTotalmbytes);
- }
- public static String SYSTEM_CENTER_TOTALMBYTES = "TotalMBytes";
-
- /**
- * The amount of used memory on the system (the src).
- */
- public void setSystemCenterUsedmbytes(long systemCenterUsedmbytes) {
- addField(SYSTEM_CENTER_USEDMBYTES, systemCenterUsedmbytes);
- }
- public static String SYSTEM_CENTER_USEDMBYTES = "UsedMBytes";
-
- /**
- * The User Account present on the system (the src).
- */
- public void setSystemCenterUser(String systemCenterUser) {
- addField(SYSTEM_CENTER_USER, systemCenterUser);
- }
- public static String SYSTEM_CENTER_USER = "user";
-
- /**
- * The number of updates the system (the src) is missing.
- */
- public void setSystemCenterUpdates(long systemCenterUpdates) {
- addField(SYSTEM_CENTER_UPDATES, systemCenterUpdates);
- }
- public static String SYSTEM_CENTER_UPDATES = "updates";
-
-
- // ----------------------------------
- // Traffic
- // ----------------------------------
-
- /**
- * The destination of the network traffic. If your field is named dest_host,
- * dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest to make it
- * CIM-compliant.
- */
- public void setTrafficDest(String trafficDest) {
- addField(TRAFFIC_DEST, trafficDest);
- }
- public static String TRAFFIC_DEST = "dest";
-
- /**
- * The name of the packet filtering device. If your field is named dvc_host,
- * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
- */
- public void setTrafficDvc(String trafficDvc) {
- addField(TRAFFIC_DVC, trafficDvc);
- }
- public static String TRAFFIC_DVC = "dvc";
-
- /**
- * The source of the network traffic. If your field is named src_host,
- * src_ip, src_ipv6, or src_nt_host you can alias it as src to make it
- * CIM-compliant.
- */
- public void setTrafficSrc(String trafficSrc) {
- addField(TRAFFIC_SRC, trafficSrc);
- }
- public static String TRAFFIC_SRC = "src";
-
-
- // ----------------------------------
- // Update
- // ----------------------------------
-
- /**
- * The name of the installed update.
- */
- public void setUpdatePackage(String updatePackage) {
- addField(UPDATE_PACKAGE, updatePackage);
- }
- public static String UPDATE_PACKAGE = "package";
-
-
- // ----------------------------------
- // User information updates
- // ----------------------------------
-
- /**
- * A user that has been affected by a change. For example, user fflanda
- * changed the name of user rhallen, so affected_user=rhallen.
- */
- public void setUserInfoUpdatesAffectedUser(
- String userInfoUpdatesAffectedUser) {
- addField(USER_INFO_UPDATES_AFFECTED_USER, userInfoUpdatesAffectedUser);
- }
- public static String USER_INFO_UPDATES_AFFECTED_USER = "affected_user";
-
- /**
- * The user group affected by a change.
- */
- public void setUserInfoUpdatesAffectedUserGroup(
- String userInfoUpdatesAffectedUserGroup) {
- addField(USER_INFO_UPDATES_AFFECTED_USER_GROUP,
- userInfoUpdatesAffectedUserGroup);
- }
- public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP = "affected_user_group";
-
- /**
- * The identifier of the user group affected by a change.
- */
- public void setUserInfoUpdatesAffectedUserGroupId(
- int userInfoUpdatesAffectedUserGroupId) {
- addField(USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID,
- userInfoUpdatesAffectedUserGroupId);
- }
- public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID = "affected_user_group_id";
-
- /**
- * The identifier of the user affected by a change.
- */
- public void setUserInfoUpdatesAffectedUserId(
- int userInfoUpdatesAffectedUserId) {
- addField(USER_INFO_UPDATES_AFFECTED_USER_ID,
- userInfoUpdatesAffectedUserId);
- }
- public static String USER_INFO_UPDATES_AFFECTED_USER_ID = "affected_user_id";
-
- /**
- * The security context associated with the user affected by a change.
- */
- public void setUserInfoUpdatesAffectedUserPrivilege(
- String userInfoUpdatesAffectedUserPrivilege) {
- addField(USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE,
- userInfoUpdatesAffectedUserPrivilege);
- }
- public static String USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE = "affected_user_privilege";
-
- /**
- * The name of the user affected by the recorded event.
- */
- public void setUserInfoUpdatesUser(String userInfoUpdatesUser) {
- addField(USER_INFO_UPDATES_USER, userInfoUpdatesUser);
- }
- public static String USER_INFO_UPDATES_USER = "user";
-
- /**
- * A user group that is the object of an event, expressed in human-readable
- * terms.
- */
- public void setUserInfoUpdatesUserGroup(String userInfoUpdatesUserGroup) {
- addField(USER_INFO_UPDATES_USER_GROUP, userInfoUpdatesUserGroup);
- }
- public static String USER_INFO_UPDATES_USER_GROUP = "user_group";
-
- /**
- * The numeric identifier assigned to the user group event object.
- */
- public void setUserInfoUpdatesUserGroupId(int userInfoUpdatesUserGroupId) {
- addField(USER_INFO_UPDATES_USER_GROUP_ID, userInfoUpdatesUserGroupId);
- }
- public static String USER_INFO_UPDATES_USER_GROUP_ID = "user_group_id";
-
- /**
- * The system-assigned identifier for the user affected by an event.
- */
- public void setUserInfoUpdatesUserId(int userInfoUpdatesUserId) {
- addField(USER_INFO_UPDATES_USER_ID, userInfoUpdatesUserId);
- }
- public static String USER_INFO_UPDATES_USER_ID = "user_id";
-
- /**
- * The security context associated with the object of an event (the affected
- * user).
- */
- public void setUserInfoUpdatesUserPrivilege(
- String userInfoUpdatesUserPrivilege) {
- addField(USER_INFO_UPDATES_USER_PRIVILEGE, userInfoUpdatesUserPrivilege);
- }
- public static String USER_INFO_UPDATES_USER_PRIVILEGE = "user_privilege";
-
- /**
- * The name of the user that is the subject of an event--the user executing
- * the action, in other words.
- */
- public void setUserInfoUpdatesUserSubject(String userInfoUpdatesUserSubject) {
- addField(USER_INFO_UPDATES_USER_SUBJECT, userInfoUpdatesUserSubject);
- }
- public static String USER_INFO_UPDATES_USER_SUBJECT = "user_subject";
-
- /**
- * The ID number of the user that is the subject of an event.
- */
- public void setUserInfoUpdatesUserSubjectId(int userInfoUpdatesUserSubjectId) {
- addField(USER_INFO_UPDATES_USER_SUBJECT_ID, userInfoUpdatesUserSubjectId);
- }
- public static String USER_INFO_UPDATES_USER_SUBJECT_ID = "user_subject_id";
-
- /**
- * The security context associated with the subject of an event (the user
- * causing a change).
- */
- public void setUserInfoUpdatesUserSubjectPrivilege(
- String userInfoUpdatesUserSubjectPrivilege) {
- addField(USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE,
- userInfoUpdatesUserSubjectPrivilege);
- }
- public static String USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE = "user_subject_privilege";
-
-
- // ----------------------------------
- // Vulnerability
- // ----------------------------------
-
- /**
- * The category of the discovered vulnerability.
- */
- public void setVulnerabilityCategory(String vulnerabilityCategory) {
- addField(VULNERABILITY_CATEGORY, vulnerabilityCategory);
- }
- public static String VULNERABILITY_CATEGORY = "category";
-
- /**
- * The host with the discovered vulnerability. If your field is named
- * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
- * to make it CIM-compliant.
- */
- public void setVulnerabilityDest(String vulnerabilityDest) {
- addField(VULNERABILITY_DEST, vulnerabilityDest);
- }
- public static String VULNERABILITY_DEST = "dest";
-
- /**
- * The operating system of the host containing the vulnerability detected on
- * the client (the src field), such as SuSE Security Update, or cups
- * security update.
- */
- public void setVulnerabilityOs(String vulnerabilityOs) {
- addField(VULNERABILITY_OS, vulnerabilityOs);
- }
- public static String VULNERABILITY_OS = "os";
-
- /**
- * The severity of the discovered vulnerability.
- */
- public void setVulnerabilitySeverity(String vulnerabilitySeverity) {
- addField(VULNERABILITY_SEVERITY, vulnerabilitySeverity);
- }
- public static String VULNERABILITY_SEVERITY = "severity";
-
- /**
- * The name of the vulnerability detected on the client (the src field),
- * such as SuSE Security Update, or cups security update.
- */
- public void setVulnerabilitySignature(String vulnerabilitySignature) {
- addField(VULNERABILITY_SIGNATURE, vulnerabilitySignature);
- }
- public static String VULNERABILITY_SIGNATURE = "signature";
-
-
- // ----------------------------------
- // Windows administration
- // ----------------------------------
-
- /**
- * The object name (associated only with Windows).
- */
- public void setWindowsAdminObjectName(String windowsAdminObjectName) {
- addField(WINDOWS_ADMIN_OBJECT_NAME, windowsAdminObjectName);
- }
- public static String WINDOWS_ADMIN_OBJECT_NAME = "object_name";
-
- /**
- * The object type (associated only with Windows).
- */
- public void setWindowsAdminObjectType(String windowsAdminObjectType) {
- addField(WINDOWS_ADMIN_OBJECT_TYPE, windowsAdminObjectType);
- }
- public static String WINDOWS_ADMIN_OBJECT_TYPE = "object_type";
-
- /**
- * The object handle (associated only with Windows).
- */
- public void setWindowsAdminObjectHandle(String windowsAdminObjectHandle) {
- addField(WINDOWS_ADMIN_OBJECT_HANDLE, windowsAdminObjectHandle);
- }
- public static String WINDOWS_ADMIN_OBJECT_HANDLE = "object_handle";
-}
+package com.splunk.logging;
+
+/*
+ * Copyright 2013-2014 Splunk, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"): you may
+ * not use this file except in compliance with the License. You may obtain
+ * a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+
+import java.util.LinkedHashMap;
+import java.util.regex.Pattern;
+
+/**
+ * SplunkCimLogEvent
encapsulates the best practice logging semantics recommended by Splunk.
+ *
+ * It produces events of key, value pairs, properly formatted and quoted for logging with any of Java's standard
+ * logging libraries (logback, log4j, java.util.logging, etc.) and indexing by Splunk. The class has convenience
+ * methods to set the fields defined in the standard Splunk Common Information Model.
+ *
+ * SplunkCimLogEvent
adds no timestamp to its fields, leaving you free to configure whatever timestamp
+ * format you prefer in your logging configuration.
+ *
+ *
+ * Logger logger = LoggerFactory.getLogger("splunk.logger");
+ * SplunkCimLogEvent event = new SplunkCimLogEvent("Failed Login", "sshd:failure");
+ * event.setAuthApp("jane");
+ * event.setAuthUser("jane");
+ * event.addField("somefieldname", "foobar");
+ * logger.info(event.toString());
+ *
+ *
+ * @see Splunk
+ * CIM
+ * @see Splunk
+ * Logging Best Practices
+ */
+public class SplunkCimLogEvent {
+ /**
+ * Delimiters to use in formatting the event.
+ */
+ private static final String KVDELIM = "=";
+ private static final String PAIRDELIM = " ";
+ private static final char QUOTE = '"';
+
+ private LinkedHashMap entries;
+
+ /**
+ * @param eventName event name
+ * @param eventID event ID
+ */
+ public SplunkCimLogEvent(String eventName, String eventID) {
+ entries = new LinkedHashMap();
+
+ addField(PREFIX_NAME, eventName);
+ addField(PREFIX_EVENT_ID, eventID);
+ }
+
+ /**
+ * Add a key value pair. The value may be any Java object which returns a sensible
+ * result from its toString
method.
+ *
+ * For logging exceptions, consider using addThrowableWithStacktrace
instead.
+ *
+ * @param key key
+ * @param value value
+ */
+ public void addField(String key, Object value) {
+ entries.put(key, value);
+ }
+
+ /**
+ * Logs an exception with its stacktrace nicely formatted for indexing and searching by Splunk.
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ */
+ public void addThrowableWithStacktrace(Throwable throwable) {
+
+ addThrowableWithStacktrace(throwable, Integer.MAX_VALUE);
+ }
+
+ /**
+ * Logs an exception with the first stacktraceDepth
elements of its stacktrace nicely
+ * formatted for indexing and searching by Splunk,
+ *
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ * @param stacktraceDepth
+ * maximum number of stacktrace elements to log
+ */
+
+ public void addThrowableWithStacktrace(Throwable throwable, int stacktraceDepth) {
+ addField(THROWABLE_CLASS, throwable.getClass().getCanonicalName());
+ addField(THROWABLE_MESSAGE, throwable.getMessage());
+
+ StackTraceElement[] elements = throwable.getStackTrace();
+ StringBuilder sb = new StringBuilder();
+ for (int depth = 0; depth < elements.length && depth < stacktraceDepth; depth++) {
+ if (depth > 0)
+ sb.append(",");
+ sb.append(elements[depth].toString());
+ }
+
+ if (stacktraceDepth > 0) {
+ addField(THROWABLE_STACKTRACE_ELEMENTS, sb.toString());
+ }
+ }
+
+ private static final Pattern DOUBLE_QUOTE = Pattern.compile("\"");
+ @Override
+ public String toString() {
+ StringBuilder output = new StringBuilder();
+
+ boolean first = true;
+ for (String key : entries.keySet()) {
+ if (!first) {
+ output.append(PAIRDELIM);
+ } else {
+ first = false;
+ }
+ String value = String.valueOf(entries.get(key));
+
+ // Escape any " that appear in the key or value.
+ key = DOUBLE_QUOTE.matcher(key).replaceAll("\\\\\"");
+ value = DOUBLE_QUOTE.matcher(value).replaceAll("\\\\\"");
+
+ output.append(QUOTE).append(key).append(KVDELIM).append(value).append(QUOTE);
+ }
+
+ return output.toString();
+ }
+
+
+ /**
+ * Event prefix fields
+ */
+ private static final String PREFIX_NAME = "name";
+ private static final String PREFIX_EVENT_ID = "event_id";
+
+ /**
+ * Java Throwable type fields
+ */
+ private static final String THROWABLE_CLASS = "throwable_class";
+ private static final String THROWABLE_MESSAGE = "throwable_message";
+ private static final String THROWABLE_STACKTRACE_ELEMENTS = "stacktrace_elements";
+
+ /**
+ * Splunk Common Information Model(CIM) Fields
+ */
+
+ // ------------------
+ // Account management
+ // ------------------
+
+ /**
+ * The domain containing the user that is affected by the account management event.
+ */
+ public void setAcManagementDestNtDomain(String acManagementDestNtDomain) {
+ addField(AC_MANAGEMENT_DEST_NT_DOMAIN, acManagementDestNtDomain);
+ }
+ public static String AC_MANAGEMENT_DEST_NT_DOMAIN = "dest_nt_domain";
+
+ /**
+ * Description of the account management change performed.
+ */
+ public void setAcManagementSignature(String acManagementSignature) {
+ addField(AC_MANAGEMENT_SIGNATURE, acManagementSignature);
+ }
+ public static String AC_MANAGEMENT_SIGNATURE = "signature";
+
+ /**
+ * The NT source of the destination. In the case of an account management
+ * event, this is the domain that contains the user that generated the
+ * event.
+ */
+ public void setAcManagementSrcNtDomain(String acManagementSrcNtDomain) {
+ addField(AC_MANAGEMENT_SRC_NT_DOMAIN, acManagementSrcNtDomain);
+ }
+ public static String AC_MANAGEMENT_SRC_NT_DOMAIN = "src_nt_domain";
+
+ // ----------------------------------
+ // Authentication - Access protection
+ // ----------------------------------
+
+ /**
+ * The action performed on the resource. success, failure
+ */
+ public void setAuthAction(String authAction) {
+ addField(AUTH_ACTION, authAction);
+ }
+ public static String AUTH_ACTION = "action";
+ /**
+ * The application involved in the event (such as ssh, spunk, win:local).
+ */
+ public void setAuthApp(String authApp) {
+ addField(AUTH_APP, authApp);
+ }
+ public static String AUTH_APP = "app";
+
+ /**
+ * The target involved in the authentication. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public void setAuthDest(String authDest) {
+ addField(AUTH_DEST, authDest);
+ }
+ public static String AUTH_DEST = "dest";
+
+ /**
+ * The source involved in the authentication. In the case of endpoint
+ * protection authentication the src is the client. If your field is named
+ * src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src to
+ * make it CIM-compliant.. It is required for all events dealing with
+ * endpoint protection (Authentication, change analysis, malware, system
+ * center, and update). Note: Do not confuse this with the event source or
+ * sourcetype fields.
+ */
+ public void setAuthSrc(String authSrc) {
+ addField(AUTH_SRC, authSrc);
+ }
+ public static String AUTH_SRC = "src";
+
+ /**
+ * In privilege escalation events, src_user represents the user who
+ * initiated the privilege escalation.
+ */
+ public void setAuthSrcUser(String authSrcUser) {
+ addField(AUTH_SRC_USER, authSrcUser);
+ }
+ public static String AUTH_SRC_USER = "src_user";
+
+ /**
+ * The name of the user involved in the event, or who initiated the event.
+ * For authentication privilege escalation events this should represent the
+ * user targeted by the escalation.
+ */
+ public void setAuthUser(String authUser) {
+ addField(AUTH_USER, authUser);
+ }
+ public static String AUTH_USER = "user";
+
+ // ----------------------------------
+ // Change analysis - Endpoint protection
+ // ----------------------------------
+
+ /**
+ * The action performed on the resource.
+ */
+ public void setChangeEndpointProtectionAction(
+ String changeEndpointProtectionAction) {
+ addField(CHANGE_ENDPOINT_PROTECTION_ACTION,
+ changeEndpointProtectionAction);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_ACTION = "action";
+
+ /**
+ * The type of change discovered in the change analysis event.
+ */
+ public void setChangeEndpointProtectionChangeType(
+ String changeEndpointProtectionChangeType) {
+ addField(CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE,
+ changeEndpointProtectionChangeType);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE = "change_type";
+
+ /**
+ * The host that was affected by the change. If your field is named
+ * dest_host,dest_ip,dest_ipv6, or dest_nt_host you can alias it as dest to
+ * make it CIM-compliant.
+ */
+ public void setChangeEndpointProtectionDest(
+ String changeEndpointProtectionDest) {
+ addField(CHANGE_ENDPOINT_PROTECTION_DEST, changeEndpointProtectionDest);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_DEST = "dest";
+
+ /**
+ * The hash signature of the modified resource.
+ */
+ public void setChangeEndpointProtectionHash(
+ String changeEndpointProtectionHash) {
+ addField(CHANGE_ENDPOINT_PROTECTION_HASH, changeEndpointProtectionHash);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_HASH = "hash";
+
+ /**
+ * The group ID of the modified resource.
+ */
+ public void setChangeEndpointProtectionGid(long changeEndpointProtectionGid) {
+ addField(CHANGE_ENDPOINT_PROTECTION_GID, changeEndpointProtectionGid);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_GID = "gid";
+
+ /**
+ * Indicates whether or not the modified resource is a directory.
+ */
+ public void setChangeEndpointProtectionIsdr(
+ boolean changeEndpointProtectionIsdr) {
+ addField(CHANGE_ENDPOINT_PROTECTION_ISDR, changeEndpointProtectionIsdr);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_ISDR = "isdr";
+
+ /**
+ * The permissions mode of the modified resource.
+ */
+ public void setChangeEndpointProtectionMode(
+ long changeEndpointProtectionMode) {
+ addField(CHANGE_ENDPOINT_PROTECTION_MODE, changeEndpointProtectionMode);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_MODE = "mode";
+
+ /**
+ * The modification time of the modified resource.
+ */
+ public void setChangeEndpointProtectionModtime(
+ String changeEndpointProtectionModtime) {
+ addField(CHANGE_ENDPOINT_PROTECTION_MODTIME,
+ changeEndpointProtectionModtime);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_MODTIME = "modtime";
+
+ /**
+ * The file path of the modified resource.
+ */
+ public void setChangeEndpointProtectionPath(
+ String changeEndpointProtectionPath) {
+ addField(CHANGE_ENDPOINT_PROTECTION_PATH, changeEndpointProtectionPath);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_PATH = "path";
+
+ /**
+ * The size of the modified resource.
+ */
+ public void setChangeEndpointProtectionSize(
+ long changeEndpointProtectionSize) {
+ addField(CHANGE_ENDPOINT_PROTECTION_SIZE, changeEndpointProtectionSize);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_SIZE = "size";
+
+ /**
+ * The user ID of the modified resource.
+ */
+ public void setChangeEndpointProtectionUid(long changeEndpointProtectionUid) {
+ addField(CHANGE_ENDPOINT_PROTECTION_UID, changeEndpointProtectionUid);
+ }
+ public static String CHANGE_ENDPOINT_PROTECTION_UID = "uid";
+
+ // ----------------------------------
+ // Change analysis - Network protection
+ // ----------------------------------
+
+ /**
+ * The type of change observed.
+ */
+ public void setChangeNetworkProtectionAction(
+ String changeNetworkProtectionAction) {
+ addField(CHANGE_NETWORK_PROTECTION_ACTION, changeNetworkProtectionAction);
+ }
+ public static String CHANGE_NETWORK_PROTECTION_ACTION = "action";
+
+ /**
+ * The command that initiated the change.
+ */
+ public void setChangeNetworkProtectionCommand(
+ String changeNetworkProtectionCommand) {
+ addField(CHANGE_NETWORK_PROTECTION_COMMAND,
+ changeNetworkProtectionCommand);
+ }
+ public static String CHANGE_NETWORK_PROTECTION_COMMAND = "command";
+
+ /**
+ * The device that is directly affected by the change.
+ */
+ public void setChangeNetworkProtectionDvc(String changeNetworkProtectionDvc) {
+ addField(CHANGE_NETWORK_PROTECTION_DVC, changeNetworkProtectionDvc);
+ }
+ public static String CHANGE_NETWORK_PROTECTION_DVC = "dvc";
+
+ /**
+ * The user that initiated the change.
+ */
+ public void setChangeNetworkProtectionUser(
+ String changeNetworkProtectionUser) {
+ addField(CHANGE_NETWORK_PROTECTION_USER, changeNetworkProtectionUser);
+ }
+ public static String CHANGE_NETWORK_PROTECTION_USER = "user";
+
+ // ----------------------------------
+ // Common event fields
+ // ----------------------------------
+
+ /**
+ * A device-specific classification provided as part of the event.
+ */
+ public void setCommonCategory(String commonCategory) {
+ addField(COMMON_CATEGORY, commonCategory);
+ }
+ public static String COMMON_CATEGORY = "category";
+
+ /**
+ * A device-specific classification provided as part of the event.
+ */
+ public void setCommonCount(String commonCount) {
+ addField(COMMON_COUNT, commonCount);
+ }
+ public static String COMMON_COUNT = "count";
+
+ /**
+ * The free-form description of a particular event.
+ */
+ public void setCommonDesc(String commonDesc) {
+ addField(COMMON_DESC, commonDesc);
+ }
+ public static String COMMON_DESC = "desc";
+
+ /**
+ * The name of a given DHCP pool on a DHCP server.
+ */
+ public void setCommonDhcpPool(String commonDhcpPool) {
+ addField(COMMON_DHCP_POOL, commonDhcpPool);
+ }
+ public static String COMMON_DHCP_POOL = "dhcp_pool";
+
+ /**
+ * The amount of time the event lasted.
+ */
+ public void setCommonDuration(long commonDuration) {
+ addField(COMMON_DURATION, commonDuration);
+ }
+ public static String COMMON_DURATION = "duration";
+
+ /**
+ * The fully qualified domain name of the device transmitting or recording
+ * the log record.
+ */
+ public void setCommonDvcHost(String commonDvcHost) {
+ addField(COMMON_DVC_HOST, commonDvcHost);
+ }
+ public static String COMMON_DVC_HOST = "dvc_host";
+
+ /**
+ * The IPv4 address of the device reporting the event.
+ */
+ public void setCommonDvcIp(String commonDvcIp) {
+ addField(COMMON_DVC_IP, commonDvcIp);
+ }
+ public static String COMMON_DVC_IP = "dvc_ip";
+
+ /**
+ * The IPv6 address of the device reporting the event.
+ */
+ public void setCommonDvcIp6(String commonDvcIp6) {
+ addField(COMMON_DVC_IP6, commonDvcIp6);
+ }
+ public static String COMMON_DVC_IP6 = "dvc_ip6";
+
+ /**
+ * The free-form description of the device's physical location.
+ */
+ public void setCommonDvcLocation(String commonDvcLocation) {
+ addField(COMMON_DVC_LOCATION, commonDvcLocation);
+ }
+ public static String COMMON_DVC_LOCATION = "dvc_location";
+
+ /**
+ * The MAC (layer 2) address of the device reporting the event.
+ */
+ public void setCommonDvcMac(String commonDvcMac) {
+ addField(COMMON_DVC_MAC, commonDvcMac);
+ }
+ public static String COMMON_DVC_MAC = "dvc_mac";
+
+ /**
+ * The Windows NT domain of the device recording or transmitting the event.
+ */
+ public void setCommonDvcNtDomain(String commonDvcNtDomain) {
+ addField(COMMON_DVC_NT_DOMAIN, commonDvcNtDomain);
+ }
+ public static String COMMON_DVC_NT_DOMAIN = "dvc_nt_domain";
+
+ /**
+ * The Windows NT host name of the device recording or transmitting the
+ * event.
+ */
+ public void setCommonDvcNtHost(String commonDvcNtHost) {
+ addField(COMMON_DVC_NT_HOST, commonDvcNtHost);
+ }
+ public static String COMMON_DVC_NT_HOST = "dvc_nt_host";
+
+ /**
+ * Time at which the device recorded the event.
+ */
+ public void setCommonDvcTime(long commonDvcTime) {
+ addField(COMMON_DVC_TIME, commonDvcTime);
+ }
+ public static String COMMON_DVC_TIME = "dvc_time";
+
+ /**
+ * The event's specified end time.
+ */
+ public void setCommonEndTime(long commonEndTime) {
+ addField(COMMON_END_TIME, commonEndTime);
+ }
+ public static String COMMON_END_TIME = "end_time";
+
+ /**
+ * A unique identifier that identifies the event. This is unique to the
+ * reporting device.
+ */
+ public void setCommonEventId(long commonEventId) {
+ addField(COMMON_EVENT_ID, commonEventId);
+ }
+ public static String COMMON_EVENT_ID = "event_id";
+
+ /**
+ * The length of the datagram, event, message, or packet.
+ */
+ public void setCommonLength(long commonLength) {
+ addField(COMMON_LENGTH, commonLength);
+ }
+ public static String COMMON_LENGTH = "length";
+
+ /**
+ * The log-level that was set on the device and recorded in the event.
+ */
+ public void setCommonLogLevel(String commonLogLevel) {
+ addField(COMMON_LOG_LEVEL, commonLogLevel);
+ }
+ public static String COMMON_LOG_LEVEL = "log_level";
+
+ /**
+ * The name of the event as reported by the device. The name should not
+ * contain information that's already being parsed into other fields from
+ * the event, such as IP addresses.
+ */
+ public void setCommonName(String commonName) {
+ addField(COMMON_NAME, commonName);
+ }
+ public static String COMMON_NAME = "name";
+
+ /**
+ * An integer assigned by the device operating system to the process
+ * creating the record.
+ */
+ public void setCommonPid(long commonPid) {
+ addField(COMMON_PID, commonPid);
+ }
+ public static String COMMON_PID = "pid";
+
+ /**
+ * An environment-specific assessment of the event's importance, based on
+ * elements such as event severity, business function of the affected
+ * system, or other locally defined variables.
+ */
+ public void setCommonPriority(long commonPriority) {
+ addField(COMMON_PRIORITY, commonPriority);
+ }
+ public static String COMMON_PRIORITY = "priority";
+
+ /**
+ * The product that generated the event.
+ */
+ public void setCommonProduct(String commonProduct) {
+ addField(COMMON_PRODUCT, commonProduct);
+ }
+ public static String COMMON_PRODUCT = "product";
+
+ /**
+ * The version of the product that generated the event.
+ */
+ public void setCommonProductVersion(long commonProductVersion) {
+ addField(COMMON_PRODUCT_VERSION, commonProductVersion);
+ }
+ public static String COMMON_PRODUCT_VERSION = "product_version";
+
+ /**
+ * The result root cause, such as connection refused, timeout, crash, and so
+ * on.
+ */
+ public void setCommonReason(String commonReason) {
+ addField(COMMON_REASON, commonReason);
+ }
+ public static String COMMON_REASON = "reason";
+
+ /**
+ * The action result. Often is a binary choice: succeeded and failed,
+ * allowed and denied, and so on.
+ */
+ public void setCommonResult(String commonResult) {
+ addField(COMMON_RESULT, commonResult);
+ }
+ public static String COMMON_RESULT = "result";
+
+ /**
+ * The severity (or priority) of an event as reported by the originating
+ * device.
+ */
+ public void setCommonSeverity(String commonSeverity) {
+ addField(COMMON_SEVERITY, commonSeverity);
+ }
+ public static String COMMON_SEVERITY = "severity";
+
+ /**
+ * The event's specified start time.
+ */
+ public void setCommonStartTime(long commonStartTime) {
+ addField(COMMON_START_TIME, commonStartTime);
+ }
+ public static String COMMON_START_TIME = "start_time";
+
+ /**
+ * The transaction identifier.
+ */
+ public void setCommonTransactionId(String commonTransactionId) {
+ addField(COMMON_TRANSACTION_ID, commonTransactionId);
+ }
+ public static String COMMON_TRANSACTION_ID = "transaction_id";
+
+ /**
+ * A uniform record locator (a web address, in other words) included in a
+ * record.
+ */
+ public void setCommonUrl(String commonUrl) {
+ addField(COMMON_URL, commonUrl);
+ }
+ public static String COMMON_URL = "url";
+
+ /**
+ * The vendor who made the product that generated the event.
+ */
+ public void setCommonVendor(String commonVendor) {
+ addField(COMMON_VENDOR, commonVendor);
+ }
+ public static String COMMON_VENDOR = "vendor";
+
+ // ----------------------------------
+ // DNS protocol
+ // ----------------------------------
+
+ /**
+ * The DNS domain that has been queried.
+ */
+ public void setDnsDestDomain(String dnsDestDomain) {
+ addField(DNS_DEST_DOMAIN, dnsDestDomain);
+ }
+ public static String DNS_DEST_DOMAIN = "dest_domain";
+
+ /**
+ * The remote DNS resource record being acted upon.
+ */
+ public void setDnsDestRecord(String dnsDestRecord) {
+ addField(DNS_DEST_RECORD, dnsDestRecord);
+ }
+ public static String DNS_DEST_RECORD = "dest_record";
+
+ /**
+ * The DNS zone that is being received by the slave as part of a zone
+ * transfer.
+ */
+ public void setDnsDestZone(String dnsDestZone) {
+ addField(DNS_DEST_ZONE, dnsDestZone);
+ }
+ public static String DNS_DEST_ZONE = "dest_zone";
+
+ /**
+ * The DNS resource record class.
+ */
+ public void setDnsRecordClass(String dnsRecordClass) {
+ addField(DNS_RECORD_CLASS, dnsRecordClass);
+ }
+ public static String DNS_RECORD_CLASS = "record_class";
+
+ /**
+ * The DNS resource record type.
+ *
+ * @see see
+ * this Wikipedia article on DNS record types
+ */
+ public void setDnsRecordType(String dnsRecordType) {
+ addField(DNS_RECORD_TYPE, dnsRecordType);
+ }
+ public static String DNS_RECORD_TYPE = "record_type";
+
+ /**
+ * The local DNS domain that is being queried.
+ */
+ public void setDnsSrcDomain(String dnsSrcDomain) {
+ addField(DNS_SRC_DOMAIN, dnsSrcDomain);
+ }
+ public static String DNS_SRC_DOMAIN = "src_domain";
+
+ /**
+ * The local DNS resource record being acted upon.
+ */
+ public void setDnsSrcRecord(String dnsSrcRecord) {
+ addField(DNS_SRC_RECORD, dnsSrcRecord);
+ }
+ public static String DNS_SRC_RECORD = "src_record";
+
+ /**
+ * The DNS zone that is being transferred by the master as part of a zone
+ * transfer.
+ */
+ public void setDnsSrcZone(String dnsSrcZone) {
+ addField(DNS_SRC_ZONE, dnsSrcZone);
+ }
+ public static String DNS_SRC_ZONE = "src_zone";
+
+ // ----------------------------------
+ // Email tracking
+ // ----------------------------------
+
+ /**
+ * The person to whom an email is sent.
+ */
+ public void setEmailRecipient(String emailRecipient) {
+ addField(EMAIL_RECIPIENT, emailRecipient);
+ }
+ public static String EMAIL_RECIPIENT = "recipient";
+
+ /**
+ * The person responsible for sending an email.
+ */
+ public void setEmailSender(String emailSender) {
+ addField(EMAIL_SENDER, emailSender);
+ }
+ public static String EMAIL_SENDER = "sender";
+
+ /**
+ * The email subject line.
+ */
+ public void setEmailSubject(String emailSubject) {
+ addField(EMAIL_SUBJECT, emailSubject);
+ }
+ public static String EMAIL_SUBJECT = "subject";
+
+ // ----------------------------------
+ // File management
+ // ----------------------------------
+
+ /**
+ * The time the file (the object of the event) was accessed.
+ */
+ public void setFileAccessTime(long fileAccessTime) {
+ addField(FILE_ACCESS_TIME, fileAccessTime);
+ }
+ public static String FILE_ACCESS_TIME = "file_access_time";
+
+ /**
+ * The time the file (the object of the event) was created.
+ */
+ public void setFileCreateTime(long fileCreateTime) {
+ addField(FILE_CREATE_TIME, fileCreateTime);
+ }
+ public static String FILE_CREATE_TIME = "file_create_time";
+
+ /**
+ * A cryptographic identifier assigned to the file object affected by the
+ * event.
+ */
+ public void setFileHash(String fileHash) {
+ addField(FILE_HASH, fileHash);
+ }
+ public static String FILE_HASH = "file_hash";
+
+ /**
+ * The time the file (the object of the event) was altered.
+ */
+ public void setFileModifyTime(long fileModifyTime) {
+ addField(FILE_MODIFY_TIME, fileModifyTime);
+ }
+ public static String FILE_MODIFY_TIME = "file_modify_time";
+
+ /**
+ * The name of the file that is the object of the event (without location
+ * information related to local file or directory structure).
+ */
+ public void setFileName(String fileName) {
+ addField(FILE_NAME, fileName);
+ }
+ public static String FILE_NAME = "file_name";
+
+ /**
+ * The location of the file that is the object of the event, in terms of
+ * local file and directory structure.
+ */
+ public void setFilePath(String filePath) {
+ addField(FILE_PATH, filePath);
+ }
+ public static String FILE_PATH = "file_path";
+
+ /**
+ * Access controls associated with the file affected by the event.
+ */
+ public void setFilePermission(String filePermission) {
+ addField(FILE_PERMISSION, filePermission);
+ }
+ public static String FILE_PERMISSION = "file_permission";
+
+ /**
+ * The size of the file that is the object of the event. Indicate whether
+ * Bytes, KB, MB, GB.
+ */
+ public void setFileSize(long fileSize) {
+ addField(FILE_SIZE, fileSize);
+ }
+ public static String FILE_SIZE = "file_size";
+
+ // ----------------------------------
+ // Intrusion detection
+ // ----------------------------------
+
+ /**
+ * The category of the triggered signature.
+ */
+ public void setIntrusionDetectionCategory(String intrusionDetectionCategory) {
+ addField(INTRUSION_DETECTION_CATEGORY, intrusionDetectionCategory);
+ }
+ public static String INTRUSION_DETECTION_CATEGORY = "category";
+
+ /**
+ * The destination of the attack detected by the intrusion detection system
+ * (IDS). If your field is named dest_host, dest_ip, dest_ipv6, or
+ * dest_nt_host you can alias it as dest to make it CIM-compliant.
+ */
+ public void setIntrusionDetectionDest(String intrusionDetectionDest) {
+ addField(INTRUSION_DETECTION_DEST, intrusionDetectionDest);
+ }
+ public static String INTRUSION_DETECTION_DEST = "dest";
+
+ /**
+ * The device that detected the intrusion event.
+ */
+ public void setIntrusionDetectionDvc(String intrusionDetectionDvc) {
+ addField(INTRUSION_DETECTION_DVC, intrusionDetectionDvc);
+ }
+ public static String INTRUSION_DETECTION_DVC = "dvc";
+
+ /**
+ * The type of IDS that generated the event.
+ */
+ public void setIntrusionDetectionIdsType(String intrusionDetectionIdsType) {
+ addField(INTRUSION_DETECTION_IDS_TYPE, intrusionDetectionIdsType);
+ }
+ public static String INTRUSION_DETECTION_IDS_TYPE = "ids_type";
+
+ /**
+ * The product name of the vendor technology generating network protection
+ * data, such as IDP, Providentia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public void setIntrusionDetectionProduct(String intrusionDetectionProduct) {
+ addField(INTRUSION_DETECTION_PRODUCT, intrusionDetectionProduct);
+ }
+ public static String INTRUSION_DETECTION_PRODUCT = "product";
+
+ /**
+ * The severity of the network protection event (such as critical, high,
+ * medium, low, or informational).
+ *
+ * Note: This field is a string. Please use a severity_id field for severity
+ * ID fields that are integer data types.
+ */
+ public void setIntrusionDetectionSeverity(String intrusionDetectionSeverity) {
+ addField(INTRUSION_DETECTION_SEVERITY, intrusionDetectionSeverity);
+ }
+ public static String INTRUSION_DETECTION_SEVERITY = "severity";
+
+ /**
+ * The name of the intrusion detected on the client (the src), such as
+ * PlugAndPlay_BO and JavaScript_Obfuscation_Fre.
+ */
+ public void setIntrusionDetectionSignature(
+ String intrusionDetectionSignature) {
+ addField(INTRUSION_DETECTION_SIGNATURE, intrusionDetectionSignature);
+ }
+ public static String INTRUSION_DETECTION_SIGNATURE = "signature";
+
+ /**
+ * The source involved in the attack detected by the IDS. If your field is
+ * named src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src
+ * to make it CIM-compliant.
+ */
+ public void setIntrusionDetectionSrc(String intrusionDetectionSrc) {
+ addField(INTRUSION_DETECTION_SRC, intrusionDetectionSrc);
+ }
+ public static String INTRUSION_DETECTION_SRC = "src";
+
+ /**
+ * The user involved with the intrusion detection event.
+ */
+ public void setIntrusionDetectionUser(String intrusionDetectionUser) {
+ addField(INTRUSION_DETECTION_USER, intrusionDetectionUser);
+ }
+ public static String INTRUSION_DETECTION_USER = "user";
+
+ /**
+ * The vendor technology used to generate network protection data, such as
+ * IDP, Providentia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public void setIntrusionDetectionVendor(String intrusionDetectionVendor) {
+ addField(INTRUSION_DETECTION_VENDOR, intrusionDetectionVendor);
+ }
+ public static String INTRUSION_DETECTION_VENDOR = "vendor";
+
+
+ // ----------------------------------
+ // Malware - Endpoint protection
+ // ----------------------------------
+
+ /**
+ * The outcome of the infection
+ */
+ public void setMalwareEndpointProtectionAction(
+ String malwareEndpointProtectionAction) {
+ addField(MALWARE_ENDPOINT_PROTECTION_ACTION,
+ malwareEndpointProtectionAction);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_ACTION = "action";
+
+ /**
+ * The NT domain of the destination (the dest_bestmatch).
+ */
+ public void setMalwareEndpointProtectionDestNtDomain(
+ String malwareEndpointProtectionDestNtDomain) {
+ addField(MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN,
+ malwareEndpointProtectionDestNtDomain);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN = "dest_nt_domain";
+
+ /**
+ * The cryptographic hash of the file associated with the malware event
+ * (such as the malicious or infected file).
+ */
+ public void setMalwareEndpointProtectionFileHash(
+ String malwareEndpointProtectionFileHash) {
+ addField(MALWARE_ENDPOINT_PROTECTION_FILE_HASH,
+ malwareEndpointProtectionFileHash);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_HASH = "file_hash";
+
+ /**
+ * The name of the file involved in the malware event (such as the infected
+ * or malicious file).
+ */
+ public void setMalwareEndpointProtectionFileName(
+ String malwareEndpointProtectionFileName) {
+ addField(MALWARE_ENDPOINT_PROTECTION_FILE_NAME,
+ malwareEndpointProtectionFileName);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_NAME = "file_name";
+
+ /**
+ * The path of the file involved in the malware event (such as the infected
+ * or malicious file).
+ */
+ public void setMalwareEndpointProtectionFilePath(
+ String malwareEndpointProtectionFilePath) {
+ addField(MALWARE_ENDPOINT_PROTECTION_FILE_PATH,
+ malwareEndpointProtectionFilePath);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_PATH = "file_path";
+
+ /**
+ * The product name of the vendor technology (the vendor field) that is
+ * generating malware data (such as Antivirus or EPO).
+ */
+ public void setMalwareEndpointProtectionProduct(
+ String malwareEndpointProtectionProduct) {
+ addField(MALWARE_ENDPOINT_PROTECTION_PRODUCT,
+ malwareEndpointProtectionProduct);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT = "product";
+
+ /**
+ * The product version number of the vendor technology installed on the
+ * client (such as 10.4.3 or 11.0.2).
+ */
+ public void setMalwareEndpointProtectionProductVersion(
+ String malwareEndpointProtectionProductVersion) {
+ addField(MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION,
+ malwareEndpointProtectionProductVersion);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION = "product_version";
+
+ /**
+ * The name of the malware infection detected on the client (the src), such
+ * as Trojan.Vundo,Spyware.Gaobot,W32.Nimbda).
+ *
+ * Note: This field is a string. Please use a signature_id field for
+ * signature ID fields that are integer data types.
+ */
+ public void setMalwareEndpointProtectionSignature(
+ String malwareEndpointProtectionSignature) {
+ addField(MALWARE_ENDPOINT_PROTECTION_SIGNATURE,
+ malwareEndpointProtectionSignature);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE = "signature";
+
+ /**
+ * The current signature definition set running on the client, such as
+ * 11hsvx)
+ */
+ public void setMalwareEndpointProtectionSignatureVersion(
+ String malwareEndpointProtectionSignatureVersion) {
+ addField(MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION,
+ malwareEndpointProtectionSignatureVersion);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION = "signature_version";
+
+ /**
+ * The target affected or infected by the malware. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public void setMalwareEndpointProtectionDest(
+ String malwareEndpointProtectionDest) {
+ addField(MALWARE_ENDPOINT_PROTECTION_DEST, malwareEndpointProtectionDest);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_DEST = "dest";
+
+ /**
+ * The NT domain of the source (the src).
+ */
+ public void setMalwareEndpointProtectionSrcNtDomain(
+ String malwareEndpointProtectionSrcNtDomain) {
+ addField(MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN,
+ malwareEndpointProtectionSrcNtDomain);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN = "src_nt_domain";
+
+ /**
+ * The name of the user involved in the malware event.
+ */
+ public void setMalwareEndpointProtectionUser(
+ String malwareEndpointProtectionUser) {
+ addField(MALWARE_ENDPOINT_PROTECTION_USER, malwareEndpointProtectionUser);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_USER = "user";
+
+ /**
+ * The name of the vendor technology generating malware data, such as
+ * Symantec or McAfee.
+ */
+ public void setMalwareEndpointProtectionVendor(
+ String malwareEndpointProtectionVendor) {
+ addField(MALWARE_ENDPOINT_PROTECTION_VENDOR,
+ malwareEndpointProtectionVendor);
+ }
+ public static String MALWARE_ENDPOINT_PROTECTION_VENDOR = "vendor";
+
+ // ----------------------------------
+ // Malware - Network protection
+ // ----------------------------------
+
+ /**
+ * The product name of the vendor technology generating network protection
+ * data, such as IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public void setMalwareNetworkProtectionProduct(
+ String malwareNetworkProtectionProduct) {
+ addField(MALWARE_NETWORK_PROTECTION_PRODUCT,
+ malwareNetworkProtectionProduct);
+ }
+ public static String MALWARE_NETWORK_PROTECTION_PRODUCT = "product";
+
+ /**
+ * The severity of the network protection event (such as critical, high,
+ * medium, low, or informational).
+ *
+ * Note: This field is a string. Please use a severity_id field for severity
+ * ID fields that are integer data types.
+ */
+ public void setMalwareNetworkProtectionSeverity(
+ String malwareNetworkProtectionSeverity) {
+ addField(MALWARE_NETWORK_PROTECTION_SEVERITY,
+ malwareNetworkProtectionSeverity);
+ }
+ public static String MALWARE_NETWORK_PROTECTION_SEVERITY = "severity";
+
+ /**
+ * The vendor technology used to generate network protection data, such as
+ * IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public void setMalwareNetworkProtectionVendor(
+ String malwareNetworkProtectionVendor) {
+ addField(MALWARE_NETWORK_PROTECTION_VENDOR,
+ malwareNetworkProtectionVendor);
+ }
+ public static String MALWARE_NETWORK_PROTECTION_VENDOR = "vendor";
+
+
+ // ----------------------------------
+ // Network traffic - ESS
+ // ----------------------------------
+
+ /**
+ * The action of the network traffic.
+ */
+ public void setNetworkTrafficEssAction(String networkTrafficEssAction) {
+ addField(NETWORK_TRAFFIC_ESS_ACTION, networkTrafficEssAction);
+ }
+ public static String NETWORK_TRAFFIC_ESS_ACTION = "action";
+
+ /**
+ * The destination port of the network traffic.
+ */
+ public void setNetworkTrafficEssDestPort(int networkTrafficEssDestPort) {
+ addField(NETWORK_TRAFFIC_ESS_DEST_PORT, networkTrafficEssDestPort);
+ }
+ public static String NETWORK_TRAFFIC_ESS_DEST_PORT = "dest_port";
+
+ /**
+ * The product name of the vendor technology generating NetworkProtection
+ * data, such as IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public void setNetworkTrafficEssProduct(String networkTrafficEssProduct) {
+ addField(NETWORK_TRAFFIC_ESS_PRODUCT, networkTrafficEssProduct);
+ }
+ public static String NETWORK_TRAFFIC_ESS_PRODUCT = "product";
+
+ /**
+ * The source port of the network traffic.
+ */
+ public void setNetworkTrafficEssSrcPort(int networkTrafficEssSrcPort) {
+ addField(NETWORK_TRAFFIC_ESS_SRC_PORT, networkTrafficEssSrcPort);
+ }
+ public static String NETWORK_TRAFFIC_ESS_SRC_PORT = "src_port";
+
+ /**
+ * The vendor technology used to generate NetworkProtection data, such as
+ * IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public void setNetworkTrafficEssVendor(String networkTrafficEssVendor) {
+ addField(NETWORK_TRAFFIC_ESS_VENDOR, networkTrafficEssVendor);
+ }
+ public static String NETWORK_TRAFFIC_ESS_VENDOR = "vendor";
+
+ // ----------------------------------
+ // Network traffic - Generic
+ // ----------------------------------
+
+ /**
+ * The ISO layer 7 (application layer) protocol, such as HTTP, HTTPS, SSH,
+ * and IMAP.
+ */
+ public void setNetworkTrafficGenericAppLayer(
+ String networkTrafficGenericAppLayer) {
+ addField(NETWORK_TRAFFIC_GENERIC_APP_LAYER,
+ networkTrafficGenericAppLayer);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_APP_LAYER = "app_layer";
+ /**
+ * How many bytes this device/interface received.
+ */
+ public void setNetworkTrafficGenericBytesIn(
+ long networkTrafficGenericBytesIn) {
+ addField(NETWORK_TRAFFIC_GENERIC_BYTES_IN, networkTrafficGenericBytesIn);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_BYTES_IN = "bytes_in";
+
+
+ /**
+ * How many bytes this device/interface transmitted.
+ */
+ public void setNetworkTrafficGenericBytesOut(
+ long networkTrafficGenericBytesOut) {
+ addField(NETWORK_TRAFFIC_GENERIC_BYTES_OUT,
+ networkTrafficGenericBytesOut);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_BYTES_OUT = "bytes_out";
+
+ /**
+ * 802.11 channel number used by a wireless network.
+ */
+ public void setNetworkTrafficGenericChannel(
+ String networkTrafficGenericChannel) {
+ addField(NETWORK_TRAFFIC_GENERIC_CHANNEL, networkTrafficGenericChannel);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_CHANNEL = "channel";
+
+ /**
+ * The Common Vulnerabilities and Exposures (CVE) reference value.
+ */
+ public void setNetworkTrafficGenericCve(String networkTrafficGenericCve) {
+ addField(NETWORK_TRAFFIC_GENERIC_CVE, networkTrafficGenericCve);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_CVE = "cve";
+
+ /**
+ * The destination application being targeted.
+ */
+ public void setNetworkTrafficGenericDestApp(
+ String networkTrafficGenericDestApp) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_APP, networkTrafficGenericDestApp);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_APP = "dest_app";
+
+ /**
+ * The destination command and control service channel.
+ */
+ public void setNetworkTrafficGenericDestCncChannel(
+ String networkTrafficGenericDestCncChannel) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL,
+ networkTrafficGenericDestCncChannel);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL = "dest_cnc_channel";
+
+ /**
+ * The destination command and control service name.
+ */
+ public void setNetworkTrafficGenericDestCncName(
+ String networkTrafficGenericDestCncName) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME,
+ networkTrafficGenericDestCncName);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME = "dest_cnc_name";
+
+ /**
+ * The destination command and control service port.
+ */
+ public void setNetworkTrafficGenericDestCncPort(
+ String networkTrafficGenericDestCncPort) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT,
+ networkTrafficGenericDestCncPort);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT = "dest_cnc_port";
+
+ /**
+ * The country associated with a packet's recipient.
+ */
+ public void setNetworkTrafficGenericDestCountry(
+ String networkTrafficGenericDestCountry) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY,
+ networkTrafficGenericDestCountry);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY = "dest_country";
+
+ /**
+ * The fully qualified host name of a packet's recipient. For HTTP sessions,
+ * this is the host header.
+ */
+ public void setNetworkTrafficGenericDestHost(
+ String networkTrafficGenericDestHost) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_HOST,
+ networkTrafficGenericDestHost);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_HOST = "dest_host";
+
+ /**
+ * The interface that is listening remotely or receiving packets locally.
+ */
+ public void setNetworkTrafficGenericDestInt(
+ String networkTrafficGenericDestInt) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_INT, networkTrafficGenericDestInt);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_INT = "dest_int";
+
+ /**
+ * The IPv4 address of a packet's recipient.
+ */
+ public void setNetworkTrafficGenericDestIp(
+ String networkTrafficGenericDestIp) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_IP, networkTrafficGenericDestIp);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_IP = "dest_ip";
+
+ /**
+ * The IPv6 address of a packet's recipient.
+ */
+ public void setNetworkTrafficGenericDestIpv6(
+ String networkTrafficGenericDestIpv6) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_IPV6,
+ networkTrafficGenericDestIpv6);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_IPV6 = "dest_ipv6";
+
+ /**
+ * The (physical) latitude of a packet's destination.
+ */
+ public void setNetworkTrafficGenericDestLat(int networkTrafficGenericDestLat) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_LAT, networkTrafficGenericDestLat);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_LAT = "dest_lat";
+
+ /**
+ * The (physical) longitude of a packet's destination.
+ */
+ public void setNetworkTrafficGenericDestLong(
+ int networkTrafficGenericDestLong) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_LONG,
+ networkTrafficGenericDestLong);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_LONG = "dest_long";
+
+ /**
+ * The destination TCP/IP layer 2 Media Access Control (MAC) address of a
+ * packet's destination.
+ */
+ public void setNetworkTrafficGenericDestMac(
+ String networkTrafficGenericDestMac) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_MAC, networkTrafficGenericDestMac);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_MAC = "dest_mac";
+
+ /**
+ * The Windows NT domain containing a packet's destination.
+ */
+ public void setNetworkTrafficGenericDestNtDomain(
+ String networkTrafficGenericDestNtDomain) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN,
+ networkTrafficGenericDestNtDomain);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN = "dest_nt_domain";
+
+ /**
+ * The Windows NT host name of a packet's destination.
+ */
+ public void setNetworkTrafficGenericDestNtHost(
+ String networkTrafficGenericDestNtHost) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST,
+ networkTrafficGenericDestNtHost);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST = "dest_nt_host";
+
+ /**
+ * TCP/IP port to which a packet is being sent.
+ */
+ public void setNetworkTrafficGenericDestPort(
+ int networkTrafficGenericDestPort) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_PORT,
+ networkTrafficGenericDestPort);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_PORT = "dest_port";
+
+ /**
+ * The NATed IPv4 address to which a packet has been sent.
+ */
+ public void setNetworkTrafficGenericDestTranslatedIp(
+ String networkTrafficGenericDestTranslatedIp) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP,
+ networkTrafficGenericDestTranslatedIp);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP = "dest_translated_ip";
+
+ /**
+ * The NATed port to which a packet has been sent.
+ */
+ public void setNetworkTrafficGenericDestTranslatedPort(
+ int networkTrafficGenericDestTranslatedPort) {
+ addField(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT,
+ networkTrafficGenericDestTranslatedPort);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT = "dest_translated_port";
+
+ /**
+ * The numbered Internet Protocol version.
+ */
+ public void setNetworkTrafficGenericIpVersion(
+ int networkTrafficGenericIpVersion) {
+ addField(NETWORK_TRAFFIC_GENERIC_IP_VERSION,
+ networkTrafficGenericIpVersion);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_IP_VERSION = "ip_version";
+
+ /**
+ * The network interface through which a packet was transmitted.
+ */
+ public void setNetworkTrafficGenericOutboundInterface(
+ String networkTrafficGenericOutboundInterface) {
+ addField(NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE,
+ networkTrafficGenericOutboundInterface);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE = "outbound_interface";
+
+ /**
+ * How many packets this device/interface received.
+ */
+ public void setNetworkTrafficGenericPacketsIn(
+ long networkTrafficGenericPacketsIn) {
+ addField(NETWORK_TRAFFIC_GENERIC_PACKETS_IN,
+ networkTrafficGenericPacketsIn);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_PACKETS_IN = "packets_in";
+
+ /**
+ * How many packets this device/interface transmitted.
+ */
+ public void setNetworkTrafficGenericPacketsOut(
+ long networkTrafficGenericPacketsOut) {
+ addField(NETWORK_TRAFFIC_GENERIC_PACKETS_OUT,
+ networkTrafficGenericPacketsOut);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_PACKETS_OUT = "packets_out";
+
+ /**
+ * The OSI layer 3 (Network Layer) protocol, such as IPv4/IPv6, ICMP, IPsec,
+ * IGMP or RIP.
+ */
+ public void setNetworkTrafficGenericProto(String networkTrafficGenericProto) {
+ addField(NETWORK_TRAFFIC_GENERIC_PROTO, networkTrafficGenericProto);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_PROTO = "proto";
+
+ /**
+ * The session identifier. Multiple transactions build a session.
+ */
+ public void setNetworkTrafficGenericSessionId(
+ String networkTrafficGenericSessionId) {
+ addField(NETWORK_TRAFFIC_GENERIC_SESSION_ID,
+ networkTrafficGenericSessionId);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SESSION_ID = "session_id";
+
+ /**
+ * The 802.11 service set identifier (ssid) assigned to a wireless session.
+ */
+ public void setNetworkTrafficGenericSsid(String networkTrafficGenericSsid) {
+ addField(NETWORK_TRAFFIC_GENERIC_SSID, networkTrafficGenericSsid);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SSID = "ssid";
+
+ /**
+ * The country from which the packet was sent.
+ */
+ public void setNetworkTrafficGenericSrcCountry(
+ String networkTrafficGenericSrcCountry) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY,
+ networkTrafficGenericSrcCountry);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY = "src_country";
+
+ /**
+ * The fully qualified host name of the system that transmitted the packet.
+ * For Web logs, this is the HTTP client.
+ */
+ public void setNetworkTrafficGenericSrcHost(
+ String networkTrafficGenericSrcHost) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_HOST, networkTrafficGenericSrcHost);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_HOST = "src_host";
+
+ /**
+ * The interface that is listening locally or sending packets remotely.
+ */
+ public void setNetworkTrafficGenericSrcInt(
+ String networkTrafficGenericSrcInt) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_INT, networkTrafficGenericSrcInt);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_INT = "src_int";
+
+ /**
+ * The IPv4 address of the packet's source. For Web logs, this is the http
+ * client.
+ */
+ public void setNetworkTrafficGenericSrcIp(String networkTrafficGenericSrcIp) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_IP, networkTrafficGenericSrcIp);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_IP = "src_ip";
+
+ /**
+ * The IPv6 address of the packet's source.
+ */
+ public void setNetworkTrafficGenericSrcIpv6(
+ String networkTrafficGenericSrcIpv6) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_IPV6, networkTrafficGenericSrcIpv6);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_IPV6 = "src_ipv6";
+
+ /**
+ * The (physical) latitude of the packet's source.
+ */
+ public void setNetworkTrafficGenericSrcLat(int networkTrafficGenericSrcLat) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_LAT, networkTrafficGenericSrcLat);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_LAT = "src_lat";
+
+ /**
+ * The (physical) longitude of the packet's source.
+ */
+ public void setNetworkTrafficGenericSrcLong(int networkTrafficGenericSrcLong) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_LONG, networkTrafficGenericSrcLong);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_LONG = "src_long";
+
+ /**
+ * The Media Access Control (MAC) address from which a packet was
+ * transmitted.
+ */
+ public void setNetworkTrafficGenericSrcMac(
+ String networkTrafficGenericSrcMac) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_MAC, networkTrafficGenericSrcMac);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_MAC = "src_mac";
+
+ /**
+ * The Windows NT domain containing the machines that generated the event.
+ */
+ public void setNetworkTrafficGenericSrcNtDomain(
+ String networkTrafficGenericSrcNtDomain) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN,
+ networkTrafficGenericSrcNtDomain);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN = "src_nt_domain";
+
+ /**
+ * The Windows NT hostname of the system that generated the event.
+ */
+ public void setNetworkTrafficGenericSrcNtHost(
+ String networkTrafficGenericSrcNtHost) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST,
+ networkTrafficGenericSrcNtHost);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST = "src_nt_host";
+
+ /**
+ * The network port from which a packet originated.
+ */
+ public void setNetworkTrafficGenericSrcPort(int networkTrafficGenericSrcPort) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_PORT, networkTrafficGenericSrcPort);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_PORT = "src_port";
+
+ /**
+ * The NATed IPv4 address from which a packet has been sent.
+ */
+ public void setNetworkTrafficGenericSrcTranslatedIp(
+ String networkTrafficGenericSrcTranslatedIp) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP,
+ networkTrafficGenericSrcTranslatedIp);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP = "src_translated_ip";
+
+ /**
+ * The NATed network port from which a packet has been sent.
+ */
+ public void setNetworkTrafficGenericSrcTranslatedPort(
+ int networkTrafficGenericSrcTranslatedPort) {
+ addField(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT,
+ networkTrafficGenericSrcTranslatedPort);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT = "src_translated_port";
+
+ /**
+ * The application, process, or OS subsystem that generated the event.
+ */
+ public void setNetworkTrafficGenericSyslogId(
+ String networkTrafficGenericSyslogId) {
+ addField(NETWORK_TRAFFIC_GENERIC_SYSLOG_ID,
+ networkTrafficGenericSyslogId);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_ID = "syslog_id";
+
+ /**
+ * The criticality of an event, as recorded by UNIX syslog.
+ */
+ public void setNetworkTrafficGenericSyslogPriority(
+ String networkTrafficGenericSyslogPriority) {
+ addField(NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY,
+ networkTrafficGenericSyslogPriority);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY = "syslog_priority";
+
+ /**
+ * The TCP flag(s) specified in the event.
+ */
+ public void setNetworkTrafficGenericTcpFlag(
+ String networkTrafficGenericTcpFlag) {
+ addField(NETWORK_TRAFFIC_GENERIC_TCP_FLAG, networkTrafficGenericTcpFlag);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_TCP_FLAG = "tcp_flag";
+
+ /**
+ * The hex bit that specifies TCP 'type of service'
+ *
+ * @see Type of
+ * Service
+ */
+ public void setNetworkTrafficGenericTos(String networkTrafficGenericTos) {
+ addField(NETWORK_TRAFFIC_GENERIC_TOS, networkTrafficGenericTos);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_TOS = "tos";
+
+ /**
+ * The transport protocol.
+ */
+ public void setNetworkTrafficGenericTransport(
+ String networkTrafficGenericTransport) {
+ addField(NETWORK_TRAFFIC_GENERIC_TRANSPORT,
+ networkTrafficGenericTransport);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_TRANSPORT = "transport";
+
+ /**
+ * The "time to live" of a packet or datagram.
+ */
+ public void setNetworkTrafficGenericTtl(int networkTrafficGenericTtl) {
+ addField(NETWORK_TRAFFIC_GENERIC_TTL, networkTrafficGenericTtl);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_TTL = "ttl";
+
+ /**
+ * The numeric identifier assigned to the virtual local area network (VLAN)
+ * specified in the record.
+ */
+ public void setNetworkTrafficGenericVlanId(long networkTrafficGenericVlanId) {
+ addField(NETWORK_TRAFFIC_GENERIC_VLAN_ID, networkTrafficGenericVlanId);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_VLAN_ID = "vlan_id";
+
+ /**
+ * The name assigned to the virtual local area network (VLAN) specified in
+ * the record.
+ */
+ public void setNetworkTrafficGenericVlanName(
+ String networkTrafficGenericVlanName) {
+ addField(NETWORK_TRAFFIC_GENERIC_VLAN_NAME,
+ networkTrafficGenericVlanName);
+ }
+ public static String NETWORK_TRAFFIC_GENERIC_VLAN_NAME = "vlan_name";
+
+
+ // ----------------------------------
+ // Packet filtering
+ // ----------------------------------
+
+ /**
+ * The action the filtering device (the dvc_bestmatch field) performed on
+ * the communication.
+ */
+ public void setPacketFilteringAction(String packetFilteringAction) {
+ addField(PACKET_FILTERING_ACTION, packetFilteringAction);
+ }
+ public static String PACKET_FILTERING_ACTION = "action";
+
+ /**
+ * The IP port of the packet's destination, such as 22.
+ */
+ public void setPacketFilteringDestPort(int packetFilteringDestPort) {
+ addField(PACKET_FILTERING_DEST_PORT, packetFilteringDestPort);
+ }
+ public static String PACKET_FILTERING_DEST_PORT = "dest_port";
+
+ /**
+ * The direction the packet is traveling.
+ */
+ public void setPacketFilteringDirection(String packetFilteringDirection) {
+ addField(PACKET_FILTERING_DIRECTION, packetFilteringDirection);
+ }
+ public static String PACKET_FILTERING_DIRECTION = "direction";
+
+ /**
+ * The name of the packet filtering device. If your field is named dvc_host,
+ * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
+ */
+ public void setPacketFilteringDvc(String packetFilteringDvc) {
+ addField(PACKET_FILTERING_DVC, packetFilteringDvc);
+ }
+ public static String PACKET_FILTERING_DVC = "dvc";
+
+ /**
+ * The rule which took action on the packet, such as 143.
+ */
+ public void setPacketFilteringRule(String packetFilteringRule) {
+ addField(PACKET_FILTERING_RULE, packetFilteringRule);
+ }
+ public static String PACKET_FILTERING_RULE = "rule";
+
+ /**
+ * The IP port of the packet's source, such as 34541.
+ */
+ public void setPacketFilteringSvcPort(int packetFilteringSvcPort) {
+ addField(PACKET_FILTERING_SVC_PORT, packetFilteringSvcPort);
+ }
+ public static String PACKET_FILTERING_SVC_PORT = "svc_port";
+
+
+ // ----------------------------------
+ // Proxy
+ // ----------------------------------
+
+ /**
+ * The action taken by the proxy.
+ */
+ public void setProxyAction(String proxyAction) {
+ addField(PROXY_ACTION, proxyAction);
+ }
+ public static String PROXY_ACTION = "action";
+
+ /**
+ * The destination of the network traffic (the remote host).
+ */
+ public void setProxyDest(String proxyDest) {
+ addField(PROXY_DEST, proxyDest);
+ }
+ public static String PROXY_DEST = "dest";
+
+ /**
+ * The content-type of the requested HTTP resource.
+ */
+ public void setProxyHttpContentType(String proxyHttpContentType) {
+ addField(PROXY_HTTP_CONTENT_TYPE, proxyHttpContentType);
+ }
+ public static String PROXY_HTTP_CONTENT_TYPE = "http_content_type";
+
+ /**
+ * The HTTP method used to request the resource.
+ */
+ public void setProxyHttpMethod(String proxyHttpMethod) {
+ addField(PROXY_HTTP_METHOD, proxyHttpMethod);
+ }
+ public static String PROXY_HTTP_METHOD = "http_method";
+
+ /**
+ * The HTTP referrer used to request the HTTP resource.
+ */
+ public void setProxyHttpRefer(String proxyHttpRefer) {
+ addField(PROXY_HTTP_REFER, proxyHttpRefer);
+ }
+ public static String PROXY_HTTP_REFER = "http_refer";
+
+ /**
+ * The HTTP response code.
+ */
+ public void setProxyHttpResponse(int proxyHttpResponse) {
+ addField(PROXY_HTTP_RESPONSE, proxyHttpResponse);
+ }
+ public static String PROXY_HTTP_RESPONSE = "http_response";
+
+ /**
+ * The user agent used to request the HTTP resource.
+ */
+ public void setProxyHttpUserAgent(String proxyHttpUserAgent) {
+ addField(PROXY_HTTP_USER_AGENT, proxyHttpUserAgent);
+ }
+ public static String PROXY_HTTP_USER_AGENT = "http_user_agent";
+
+ /**
+ * The product name of the vendor technology generating Network Protection
+ * data, such as IDP, Providentia, and ASA.
+ */
+ public void setProxyProduct(String proxyProduct) {
+ addField(PROXY_PRODUCT, proxyProduct);
+ }
+ public static String PROXY_PRODUCT = "product";
+
+ /**
+ * The source of the network traffic (the client requesting the connection).
+ */
+ public void setProxySrc(String proxySrc) {
+ addField(PROXY_SRC, proxySrc);
+ }
+ public static String PROXY_SRC = "src";
+
+ /**
+ * The HTTP response code indicating the status of the proxy request.
+ */
+ public void setProxyStatus(int proxyStatus) {
+ addField(PROXY_STATUS, proxyStatus);
+ }
+ public static String PROXY_STATUS = "status";
+
+ /**
+ * The user that requested the HTTP resource.
+ */
+ public void setProxyUser(String proxyUser) {
+ addField(PROXY_USER, proxyUser);
+ }
+ public static String PROXY_USER = "user";
+
+ /**
+ * The URL of the requested HTTP resource.
+ */
+ public void setProxyUrl(String proxyUrl) {
+ addField(PROXY_URL, proxyUrl);
+ }
+ public static String PROXY_URL = "url";
+
+ /**
+ * The vendor technology generating Network Protection data, such as IDP,
+ * Providentia, and ASA.
+ */
+ public void setProxyVendor(String proxyVendor) {
+ addField(PROXY_VENDOR, proxyVendor);
+ }
+ public static String PROXY_VENDOR = "vendor";
+
+
+ // ----------------------------------
+ // System center
+ // ----------------------------------
+
+ /**
+ * The running application or service on the system (the src field), such as
+ * explorer.exe or sshd.
+ */
+ public void setSystemCenterApp(String systemCenterApp) {
+ addField(SYSTEM_CENTER_APP, systemCenterApp);
+ }
+ public static String SYSTEM_CENTER_APP = "app";
+
+ /**
+ * The amount of disk space available per drive or mount (the mount field)
+ * on the system (the src field).
+ */
+ public void setSystemCenterFreembytes(long systemCenterFreembytes) {
+ addField(SYSTEM_CENTER_FREEMBYTES, systemCenterFreembytes);
+ }
+ public static String SYSTEM_CENTER_FREEMBYTES = "FreeMBytes";
+
+ /**
+ * The version of operating system installed on the host (the src field),
+ * such as 6.0.1.4 or 2.6.27.30-170.2.82.fc10.x86_64.
+ */
+ public void setSystemCenterKernelRelease(String systemCenterKernelRelease) {
+ addField(SYSTEM_CENTER_KERNEL_RELEASE, systemCenterKernelRelease);
+ }
+ public static String SYSTEM_CENTER_KERNEL_RELEASE = "kernel_release";
+
+ /**
+ * Human-readable version of the SystemUptime value.
+ */
+ public void setSystemCenterLabel(String systemCenterLabel) {
+ addField(SYSTEM_CENTER_LABEL, systemCenterLabel);
+ }
+ public static String SYSTEM_CENTER_LABEL = "label";
+
+ /**
+ * The drive or mount reporting available disk space (the FreeMBytes field)
+ * on the system (the src field).
+ */
+ public void setSystemCenterMount(String systemCenterMount) {
+ addField(SYSTEM_CENTER_MOUNT, systemCenterMount);
+ }
+ public static String SYSTEM_CENTER_MOUNT = "mount";
+
+ /**
+ * The name of the operating system installed on the host (the src), such as
+ * Microsoft Windows Server 2003 or GNU/Linux).
+ */
+ public void setSystemCenterOs(String systemCenterOs) {
+ addField(SYSTEM_CENTER_OS, systemCenterOs);
+ }
+ public static String SYSTEM_CENTER_OS = "os";
+
+ /**
+ * The percentage of processor utilization.
+ */
+ public void setSystemCenterPercentprocessortime(
+ int systemCenterPercentprocessortime) {
+ addField(SYSTEM_CENTER_PERCENTPROCESSORTIME,
+ systemCenterPercentprocessortime);
+ }
+ public static String SYSTEM_CENTER_PERCENTPROCESSORTIME = "PercentProcessorTime";
+
+ /**
+ * The setlocaldefs setting from the SE Linux configuration.
+ */
+ public void setSystemCenterSetlocaldefs(int systemCenterSetlocaldefs) {
+ addField(SYSTEM_CENTER_SETLOCALDEFS, systemCenterSetlocaldefs);
+ }
+ public static String SYSTEM_CENTER_SETLOCALDEFS = "setlocaldefs";
+
+ /**
+ * Values from the SE Linux configuration file.
+ */
+ public void setSystemCenterSelinux(String systemCenterSelinux) {
+ addField(SYSTEM_CENTER_SELINUX, systemCenterSelinux);
+ }
+ public static String SYSTEM_CENTER_SELINUX = "selinux";
+
+ /**
+ * The SE Linux type (such as targeted).
+ */
+ public void setSystemCenterSelinuxtype(String systemCenterSelinuxtype) {
+ addField(SYSTEM_CENTER_SELINUXTYPE, systemCenterSelinuxtype);
+ }
+ public static String SYSTEM_CENTER_SELINUXTYPE = "selinuxtype";
+
+ /**
+ * The shell provided to the User Account (the user field) upon logging into
+ * the system (the src field).
+ */
+ public void setSystemCenterShell(String systemCenterShell) {
+ addField(SYSTEM_CENTER_SHELL, systemCenterShell);
+ }
+ public static String SYSTEM_CENTER_SHELL = "shell";
+
+ /**
+ * The TCP/UDP source port on the system (the src field).
+ */
+ public void setSystemCenterSrcPort(int systemCenterSrcPort) {
+ addField(SYSTEM_CENTER_SRC_PORT, systemCenterSrcPort);
+ }
+ public static String SYSTEM_CENTER_SRC_PORT = "src_port";
+
+ /**
+ * The sshd protocol version.
+ */
+ public void setSystemCenterSshdProtocol(String systemCenterSshdProtocol) {
+ addField(SYSTEM_CENTER_SSHD_PROTOCOL, systemCenterSshdProtocol);
+ }
+ public static String SYSTEM_CENTER_SSHD_PROTOCOL = "sshd_protocol";
+
+ /**
+ * The start mode of the given service.
+ */
+ public void setSystemCenterStartmode(String systemCenterStartmode) {
+ addField(SYSTEM_CENTER_STARTMODE, systemCenterStartmode);
+ }
+ public static String SYSTEM_CENTER_STARTMODE = "Startmode";
+
+ /**
+ * The number of seconds since the system (the src) has been "up."
+ */
+ public void setSystemCenterSystemuptime(long systemCenterSystemuptime) {
+ addField(SYSTEM_CENTER_SYSTEMUPTIME, systemCenterSystemuptime);
+ }
+ public static String SYSTEM_CENTER_SYSTEMUPTIME = "SystemUptime";
+
+ /**
+ * The total amount of available memory on the system (the src).
+ */
+ public void setSystemCenterTotalmbytes(long systemCenterTotalmbytes) {
+ addField(SYSTEM_CENTER_TOTALMBYTES, systemCenterTotalmbytes);
+ }
+ public static String SYSTEM_CENTER_TOTALMBYTES = "TotalMBytes";
+
+ /**
+ * The amount of used memory on the system (the src).
+ */
+ public void setSystemCenterUsedmbytes(long systemCenterUsedmbytes) {
+ addField(SYSTEM_CENTER_USEDMBYTES, systemCenterUsedmbytes);
+ }
+ public static String SYSTEM_CENTER_USEDMBYTES = "UsedMBytes";
+
+ /**
+ * The User Account present on the system (the src).
+ */
+ public void setSystemCenterUser(String systemCenterUser) {
+ addField(SYSTEM_CENTER_USER, systemCenterUser);
+ }
+ public static String SYSTEM_CENTER_USER = "user";
+
+ /**
+ * The number of updates the system (the src) is missing.
+ */
+ public void setSystemCenterUpdates(long systemCenterUpdates) {
+ addField(SYSTEM_CENTER_UPDATES, systemCenterUpdates);
+ }
+ public static String SYSTEM_CENTER_UPDATES = "updates";
+
+
+ // ----------------------------------
+ // Traffic
+ // ----------------------------------
+
+ /**
+ * The destination of the network traffic. If your field is named dest_host,
+ * dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest to make it
+ * CIM-compliant.
+ */
+ public void setTrafficDest(String trafficDest) {
+ addField(TRAFFIC_DEST, trafficDest);
+ }
+ public static String TRAFFIC_DEST = "dest";
+
+ /**
+ * The name of the packet filtering device. If your field is named dvc_host,
+ * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
+ */
+ public void setTrafficDvc(String trafficDvc) {
+ addField(TRAFFIC_DVC, trafficDvc);
+ }
+ public static String TRAFFIC_DVC = "dvc";
+
+ /**
+ * The source of the network traffic. If your field is named src_host,
+ * src_ip, src_ipv6, or src_nt_host you can alias it as src to make it
+ * CIM-compliant.
+ */
+ public void setTrafficSrc(String trafficSrc) {
+ addField(TRAFFIC_SRC, trafficSrc);
+ }
+ public static String TRAFFIC_SRC = "src";
+
+
+ // ----------------------------------
+ // Update
+ // ----------------------------------
+
+ /**
+ * The name of the installed update.
+ */
+ public void setUpdatePackage(String updatePackage) {
+ addField(UPDATE_PACKAGE, updatePackage);
+ }
+ public static String UPDATE_PACKAGE = "package";
+
+
+ // ----------------------------------
+ // User information updates
+ // ----------------------------------
+
+ /**
+ * A user that has been affected by a change. For example, user fflanda
+ * changed the name of user rhallen, so affected_user=rhallen.
+ */
+ public void setUserInfoUpdatesAffectedUser(
+ String userInfoUpdatesAffectedUser) {
+ addField(USER_INFO_UPDATES_AFFECTED_USER, userInfoUpdatesAffectedUser);
+ }
+ public static String USER_INFO_UPDATES_AFFECTED_USER = "affected_user";
+
+ /**
+ * The user group affected by a change.
+ */
+ public void setUserInfoUpdatesAffectedUserGroup(
+ String userInfoUpdatesAffectedUserGroup) {
+ addField(USER_INFO_UPDATES_AFFECTED_USER_GROUP,
+ userInfoUpdatesAffectedUserGroup);
+ }
+ public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP = "affected_user_group";
+
+ /**
+ * The identifier of the user group affected by a change.
+ */
+ public void setUserInfoUpdatesAffectedUserGroupId(
+ int userInfoUpdatesAffectedUserGroupId) {
+ addField(USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID,
+ userInfoUpdatesAffectedUserGroupId);
+ }
+ public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID = "affected_user_group_id";
+
+ /**
+ * The identifier of the user affected by a change.
+ */
+ public void setUserInfoUpdatesAffectedUserId(
+ int userInfoUpdatesAffectedUserId) {
+ addField(USER_INFO_UPDATES_AFFECTED_USER_ID,
+ userInfoUpdatesAffectedUserId);
+ }
+ public static String USER_INFO_UPDATES_AFFECTED_USER_ID = "affected_user_id";
+
+ /**
+ * The security context associated with the user affected by a change.
+ */
+ public void setUserInfoUpdatesAffectedUserPrivilege(
+ String userInfoUpdatesAffectedUserPrivilege) {
+ addField(USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE,
+ userInfoUpdatesAffectedUserPrivilege);
+ }
+ public static String USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE = "affected_user_privilege";
+
+ /**
+ * The name of the user affected by the recorded event.
+ */
+ public void setUserInfoUpdatesUser(String userInfoUpdatesUser) {
+ addField(USER_INFO_UPDATES_USER, userInfoUpdatesUser);
+ }
+ public static String USER_INFO_UPDATES_USER = "user";
+
+ /**
+ * A user group that is the object of an event, expressed in human-readable
+ * terms.
+ */
+ public void setUserInfoUpdatesUserGroup(String userInfoUpdatesUserGroup) {
+ addField(USER_INFO_UPDATES_USER_GROUP, userInfoUpdatesUserGroup);
+ }
+ public static String USER_INFO_UPDATES_USER_GROUP = "user_group";
+
+ /**
+ * The numeric identifier assigned to the user group event object.
+ */
+ public void setUserInfoUpdatesUserGroupId(int userInfoUpdatesUserGroupId) {
+ addField(USER_INFO_UPDATES_USER_GROUP_ID, userInfoUpdatesUserGroupId);
+ }
+ public static String USER_INFO_UPDATES_USER_GROUP_ID = "user_group_id";
+
+ /**
+ * The system-assigned identifier for the user affected by an event.
+ */
+ public void setUserInfoUpdatesUserId(int userInfoUpdatesUserId) {
+ addField(USER_INFO_UPDATES_USER_ID, userInfoUpdatesUserId);
+ }
+ public static String USER_INFO_UPDATES_USER_ID = "user_id";
+
+ /**
+ * The security context associated with the object of an event (the affected
+ * user).
+ */
+ public void setUserInfoUpdatesUserPrivilege(
+ String userInfoUpdatesUserPrivilege) {
+ addField(USER_INFO_UPDATES_USER_PRIVILEGE, userInfoUpdatesUserPrivilege);
+ }
+ public static String USER_INFO_UPDATES_USER_PRIVILEGE = "user_privilege";
+
+ /**
+ * The name of the user that is the subject of an event--the user executing
+ * the action, in other words.
+ */
+ public void setUserInfoUpdatesUserSubject(String userInfoUpdatesUserSubject) {
+ addField(USER_INFO_UPDATES_USER_SUBJECT, userInfoUpdatesUserSubject);
+ }
+ public static String USER_INFO_UPDATES_USER_SUBJECT = "user_subject";
+
+ /**
+ * The ID number of the user that is the subject of an event.
+ */
+ public void setUserInfoUpdatesUserSubjectId(int userInfoUpdatesUserSubjectId) {
+ addField(USER_INFO_UPDATES_USER_SUBJECT_ID, userInfoUpdatesUserSubjectId);
+ }
+ public static String USER_INFO_UPDATES_USER_SUBJECT_ID = "user_subject_id";
+
+ /**
+ * The security context associated with the subject of an event (the user
+ * causing a change).
+ */
+ public void setUserInfoUpdatesUserSubjectPrivilege(
+ String userInfoUpdatesUserSubjectPrivilege) {
+ addField(USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE,
+ userInfoUpdatesUserSubjectPrivilege);
+ }
+ public static String USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE = "user_subject_privilege";
+
+
+ // ----------------------------------
+ // Vulnerability
+ // ----------------------------------
+
+ /**
+ * The category of the discovered vulnerability.
+ */
+ public void setVulnerabilityCategory(String vulnerabilityCategory) {
+ addField(VULNERABILITY_CATEGORY, vulnerabilityCategory);
+ }
+ public static String VULNERABILITY_CATEGORY = "category";
+
+ /**
+ * The host with the discovered vulnerability. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public void setVulnerabilityDest(String vulnerabilityDest) {
+ addField(VULNERABILITY_DEST, vulnerabilityDest);
+ }
+ public static String VULNERABILITY_DEST = "dest";
+
+ /**
+ * The operating system of the host containing the vulnerability detected on
+ * the client (the src field), such as SuSE Security Update, or cups
+ * security update.
+ */
+ public void setVulnerabilityOs(String vulnerabilityOs) {
+ addField(VULNERABILITY_OS, vulnerabilityOs);
+ }
+ public static String VULNERABILITY_OS = "os";
+
+ /**
+ * The severity of the discovered vulnerability.
+ */
+ public void setVulnerabilitySeverity(String vulnerabilitySeverity) {
+ addField(VULNERABILITY_SEVERITY, vulnerabilitySeverity);
+ }
+ public static String VULNERABILITY_SEVERITY = "severity";
+
+ /**
+ * The name of the vulnerability detected on the client (the src field),
+ * such as SuSE Security Update, or cups security update.
+ */
+ public void setVulnerabilitySignature(String vulnerabilitySignature) {
+ addField(VULNERABILITY_SIGNATURE, vulnerabilitySignature);
+ }
+ public static String VULNERABILITY_SIGNATURE = "signature";
+
+
+ // ----------------------------------
+ // Windows administration
+ // ----------------------------------
+
+ /**
+ * The object name (associated only with Windows).
+ */
+ public void setWindowsAdminObjectName(String windowsAdminObjectName) {
+ addField(WINDOWS_ADMIN_OBJECT_NAME, windowsAdminObjectName);
+ }
+ public static String WINDOWS_ADMIN_OBJECT_NAME = "object_name";
+
+ /**
+ * The object type (associated only with Windows).
+ */
+ public void setWindowsAdminObjectType(String windowsAdminObjectType) {
+ addField(WINDOWS_ADMIN_OBJECT_TYPE, windowsAdminObjectType);
+ }
+ public static String WINDOWS_ADMIN_OBJECT_TYPE = "object_type";
+
+ /**
+ * The object handle (associated only with Windows).
+ */
+ public void setWindowsAdminObjectHandle(String windowsAdminObjectHandle) {
+ addField(WINDOWS_ADMIN_OBJECT_HANDLE, windowsAdminObjectHandle);
+ }
+ public static String WINDOWS_ADMIN_OBJECT_HANDLE = "object_handle";
+}
diff --git a/src/main/java/com/splunk/logging/hec/MetadataTags.java b/src/main/java/com/splunk/logging/hec/MetadataTags.java
new file mode 100644
index 00000000..797dd83f
--- /dev/null
+++ b/src/main/java/com/splunk/logging/hec/MetadataTags.java
@@ -0,0 +1,24 @@
+/*
+ Copyright © 2019 Splunk Inc.
+ SPLUNK CONFIDENTIAL – Use or disclosure of this material in whole or in part
+ without a valid written license from Splunk Inc. is PROHIBITED.
+ */
+package com.splunk.logging.hec;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+public class MetadataTags {
+ public static final String TIME = "time";
+ public static final String HOST = "host";
+ public static final String INDEX = "index";
+ public static final String SOURCE = "source";
+ public static final String SOURCETYPE = "sourcetype";
+ public static final String MESSAGEFORMAT = "messageFormat";
+ public static final Set HEC_TAGS =
+ new HashSet<>(Arrays.asList(TIME, HOST, INDEX, SOURCE, SOURCETYPE));
+ public static final Set INTERNAL_TAGS=
+ new HashSet<>(Collections.singletonList(MESSAGEFORMAT));
+}
diff --git a/src/main/java/com/splunk/logging/serialization/EventInfoTypeAdapter.java b/src/main/java/com/splunk/logging/serialization/EventInfoTypeAdapter.java
new file mode 100644
index 00000000..6aedb536
--- /dev/null
+++ b/src/main/java/com/splunk/logging/serialization/EventInfoTypeAdapter.java
@@ -0,0 +1,67 @@
+/*
+ Copyright © 2019 Splunk Inc.
+ SPLUNK CONFIDENTIAL – Use or disclosure of this material in whole or in part
+ without a valid written license from Splunk Inc. is PROHIBITED.
+ */
+package com.splunk.logging.serialization;
+
+import com.google.gson.*;
+import com.splunk.logging.EventBodySerializer;
+import com.splunk.logging.HttpEventCollectorEventInfo;
+
+import java.lang.reflect.Type;
+import java.util.HashMap;
+import java.util.Locale;
+import java.util.Map;
+
+public class EventInfoTypeAdapter implements JsonSerializer {
+
+ @Override
+ public JsonElement serialize(HttpEventCollectorEventInfo src, Type typeOfSrc, JsonSerializationContext context) {
+ Map event = new HashMap<>();
+ // TODO: JsonParser constructor is deprecated in favor of static methods in gson 1.8.6,
+ // but Spring Boot does some Gradle magic that downgrades (as of 11/2019) to 1.8.5. This
+ // should move to static methods once 1.8.6 has widespread adoption.
+ JsonParser parser = new JsonParser();
+ if (src.getTime() > 0) {
+ event.put("time", String.format(Locale.US, "%.3f", src.getTime()));
+ }
+ if (src.getSeverity() != null) {
+ event.put("severity", src.getSeverity());
+ }
+
+ // Always put a message, even if it's empty.
+ try {
+ // TODO: Move to JsonParser.parseString (see note above)
+ event.put("message", parser.parse(src.getMessage()));
+ } catch (JsonSyntaxException e) {
+ event.put("message", src.getMessage());
+ }
+
+ if (src.getLoggerName() != null && !src.getLoggerName().isEmpty()) {
+ event.put("logger", src.getLoggerName());
+ }
+
+ if (src.getThreadName() != null && !src.getThreadName().isEmpty()) {
+ event.put("thread", src.getThreadName());
+ }
+
+ if (src.getExceptionMessage() != null && ! src.getExceptionMessage().isEmpty()) {
+ event.put("exception", src.getExceptionMessage());
+ }
+
+ Map props = src.getProperties();
+ if (props != null && props.size() > 0) {
+ event.put("properties", props);
+ }
+
+ if (src.getMarker() != null) {
+ String markerString = src.getMarker().toString();
+ if (!markerString.isEmpty()) {
+ event.put("marker", src.getMarker().toString());
+ }
+ }
+
+ return context.serialize(event);
+ }
+}
diff --git a/src/main/java/com/splunk/logging/serialization/HecJsonSerializer.java b/src/main/java/com/splunk/logging/serialization/HecJsonSerializer.java
new file mode 100644
index 00000000..003c452c
--- /dev/null
+++ b/src/main/java/com/splunk/logging/serialization/HecJsonSerializer.java
@@ -0,0 +1,60 @@
+/*
+ Copyright © 2019 Splunk Inc.
+ SPLUNK CONFIDENTIAL – Use or disclosure of this material in whole or in part
+ without a valid written license from Splunk Inc. is PROHIBITED.
+ */
+package com.splunk.logging.serialization;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.splunk.logging.EventBodySerializer;
+import com.splunk.logging.HttpEventCollectorEventInfo;
+
+import java.util.*;
+
+public class HecJsonSerializer {
+ private static final Set KEYWORDS = new HashSet<>(Arrays.asList(
+ "host", "source", "sourcetype", "index", "time"));
+ private Map template = new LinkedHashMap<>();
+ private EventInfoTypeAdapter typeAdapter = new EventInfoTypeAdapter();
+ private Gson gson = new GsonBuilder()
+ .registerTypeAdapter(HttpEventCollectorEventInfo.class, typeAdapter)
+ .disableHtmlEscaping()
+ .create();
+ private EventBodySerializer eventBodySerializer;
+
+ public HecJsonSerializer(Map metadata) {
+ for (Map.Entry entry : metadata.entrySet()) {
+ setValue(entry.getKey(), entry.getValue());
+ }
+ }
+
+ @SuppressWarnings("unchecked")
+ private void setValue(String key, String value) {
+ if (KEYWORDS.contains(key)) {
+ template.put(key, value);
+ } else {
+ if (!template.containsKey("fields")) {
+ template.put("fields", new HashMap());
+ }
+ Object fields = template.get("fields");
+ if (fields instanceof Map) {
+ ((Map) fields).put(key, value);
+ }
+ }
+ }
+
+ public String serialize(HttpEventCollectorEventInfo info) {
+ Map event = new HashMap<>(template);
+ if (this.eventBodySerializer != null) {
+ event.put("event", eventBodySerializer.serializeEventBody(info, info.getMessage()));
+ } else {
+ event.put("event", info);
+ }
+ return gson.toJson(event);
+ }
+
+ public void setEventBodySerializer(EventBodySerializer eventBodySerializer) {
+ this.eventBodySerializer = eventBodySerializer;
+ }
+}
diff --git a/src/test/java/HttpEventCollector_JavaLoggingTest.java b/src/test/java/HttpEventCollector_JavaLoggingTest.java
index 1ba3b967..b99375f5 100644
--- a/src/test/java/HttpEventCollector_JavaLoggingTest.java
+++ b/src/test/java/HttpEventCollector_JavaLoggingTest.java
@@ -16,12 +16,12 @@
import java.util.*;
-import com.splunk.logging.EventBodySerializer;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonPrimitive;
import com.splunk.logging.HttpEventCollectorErrorHandler;
import com.splunk.logging.HttpEventCollectorEventInfo;
-import com.splunk.logging.HttpEventCollectorSender;
-import org.json.simple.JSONObject;
+import org.apache.commons.lang3.StringUtils;
import org.junit.Assert;
import org.junit.Test;
@@ -343,7 +343,7 @@ public void error(final List data, final Exception
Assert.assertEquals(1, errors.size());
System.out.println(logEx.toString());
- if (!(logEx.toString().contains("Connection refused") || logEx.toString().contains("Connection closed")))
+ if (!StringUtils.containsAny(logEx.toString(), "Failed to connect to", "Remote host terminated the handshake", "Connection reset"))
Assert.fail(String.format("Unexpected error message '%s'", logEx.toString()));
}
@@ -492,21 +492,21 @@ private void canSendJsonEventUsingUtilLoggerWithSourceType(final String sourceTy
final long timeMillsec = new Date().getTime();
- final JSONObject jsonObject = new JSONObject();
- jsonObject.put("transactionId", "11");
- jsonObject.put("userId", "21");
- jsonObject.put("eventTimestamp", timeMillsec);
+ final JsonObject jsonObject = new JsonObject();
+ jsonObject.add("transactionId", new JsonPrimitive("11"));
+ jsonObject.add("userId", new JsonPrimitive("21"));
+ jsonObject.add("eventTimestamp", new JsonPrimitive(timeMillsec));
final Logger logger = Logger.getLogger(loggerName);
// Test with a json event message
- jsonObject.put("severity", "info");
+ jsonObject.add("severity", new JsonPrimitive("info"));
final String infoJson = jsonObject.toString();
logger.info(infoJson);
msgs.add(infoJson);
// Test with a text event message
- jsonObject.put("severity", "info");
+ jsonObject.add("severity", new JsonPrimitive("info"));
final String infoText = String.format("{EventTimestamp:%s, EventMsg:'this is a text info for java util logger}", timeMillsec);
logger.info(infoText);
msgs.add(infoText);
diff --git a/src/test/java/HttpEventCollector_Log4j2Test.java b/src/test/java/HttpEventCollector_Log4j2Test.java
index 6bcaacfd..b049f812 100644
--- a/src/test/java/HttpEventCollector_Log4j2Test.java
+++ b/src/test/java/HttpEventCollector_Log4j2Test.java
@@ -17,11 +17,13 @@
import java.io.*;
import java.util.*;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonPrimitive;
import com.splunk.logging.HttpEventCollectorErrorHandler;
import com.splunk.logging.HttpEventCollectorEventInfo;
+import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.core.LoggerContext;
-import org.json.simple.JSONObject;
import org.junit.Assert;
import org.junit.Test;
import org.apache.logging.log4j.Logger;
@@ -29,7 +31,7 @@
public final class HttpEventCollector_Log4j2Test {
private String httpEventCollectorName = "Log4j2Test";
List> errors = new ArrayList>();
- List logEx = new ArrayList();
+ List logEx = new ArrayList<>();
/**
* sending a message via httplogging using log4j2 to splunk
@@ -328,7 +330,7 @@ public void error(final List data, final Exception
Assert.assertTrue(errors.size() >= 1);
System.out.println(logEx.toString());
- if (!(logEx.toString().contains("Connection refused") || logEx.toString().contains("Connection closed")))
+ if (!StringUtils.containsAny(logEx.toString(), "Failed to connect to", "Remote host terminated the handshake", "Connection reset"))
Assert.fail(String.format("Unexpected error message '%s'", logEx.toString()));
}
@@ -402,13 +404,13 @@ private void canSendJsonEventUsingUtilLoggerWithSourceType(final String sourceTy
final long timeMillsec = new Date().getTime();
- final JSONObject jsonObject = new JSONObject();
- jsonObject.put("transactionId", "11");
- jsonObject.put("userId", "21");
- jsonObject.put("eventTimestap", timeMillsec);
+ final JsonObject jsonObject = new JsonObject();
+ jsonObject.add("transactionId", new JsonPrimitive("11"));
+ jsonObject.add("userId", new JsonPrimitive("21"));
+ jsonObject.add("eventTimestamp", new JsonPrimitive(timeMillsec));
// Test with a json event message
- jsonObject.put("severity", "info");
+ jsonObject.add("severity", new JsonPrimitive("info"));
final String infoJson = jsonObject.toString();
logger.info(infoJson);
msgs.add(infoJson);
diff --git a/src/test/java/HttpEventCollector_LogbackTest.java b/src/test/java/HttpEventCollector_LogbackTest.java
index 4f7b0367..3fa2c20e 100644
--- a/src/test/java/HttpEventCollector_LogbackTest.java
+++ b/src/test/java/HttpEventCollector_LogbackTest.java
@@ -16,10 +16,12 @@
import java.util.*;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonPrimitive;
import com.splunk.logging.HttpEventCollectorErrorHandler;
import com.splunk.logging.HttpEventCollectorEventInfo;
-import org.json.simple.JSONObject;
+import org.apache.commons.lang3.StringUtils;
import org.junit.Assert;
import org.junit.Test;
import org.slf4j.Logger;
@@ -320,7 +322,7 @@ public void error(final List data, final Exception
Assert.assertEquals(1, errors.size());
System.out.println(logEx.toString());
- if (!(logEx.toString().contains("Connection refused") || logEx.toString().contains("Connection closed")))
+ if (!StringUtils.containsAny(logEx.toString(), "Failed to connect to", "Remote host terminated the handshake", "Connection reset"))
Assert.fail(String.format("Unexpected error message '%s'", logEx.toString()));
}
@@ -389,30 +391,30 @@ private void canSendJsonEventUsingLogbackWithSourceType(final String sourceType)
TestUtil.resetLogbackConfiguration("logback_template.xml", "logback.xml", userInputs);
- final List msgs = new ArrayList();
+ final List msgs = new ArrayList<>();
final long timeMillsec = new Date().getTime();
- final JSONObject jsonObject = new JSONObject();
- jsonObject.put("transactionId", "11");
- jsonObject.put("userId", "21");
- jsonObject.put("eventTimestamp", timeMillsec);
+ final JsonObject jsonObject = new JsonObject();
+ jsonObject.add("transactionId", new JsonPrimitive("11"));
+ jsonObject.add("userId", new JsonPrimitive("21"));
+ jsonObject.add("eventTimestamp", new JsonPrimitive(timeMillsec));
final Logger logger = LoggerFactory.getLogger(loggerName);
// Test with a json event message
- jsonObject.put("severity", "info");
+ jsonObject.add("severity", new JsonPrimitive("info"));
final String infoJson = jsonObject.toString();
logger.info(infoJson);
msgs.add(infoJson);
- jsonObject.put("severity", "error");
+ jsonObject.add("severity", new JsonPrimitive("error"));
final String errorJson = jsonObject.toString();
logger.error(errorJson);
msgs.add(errorJson);
// Test with a text event message
- jsonObject.put("severity", "debug");
+ jsonObject.add("severity", new JsonPrimitive("debug"));
final String debugText = String.format("{EventTimestamp:%s, EventMsg:'this is a test debug for Logback Test}", timeMillsec);
logger.debug(debugText);
msgs.add(debugText);
diff --git a/src/test/java/HttpEventCollector_Test.java b/src/test/java/HttpEventCollector_Test.java
index 410f7e00..35a32920 100644
--- a/src/test/java/HttpEventCollector_Test.java
+++ b/src/test/java/HttpEventCollector_Test.java
@@ -100,17 +100,16 @@ public void BatchLogToSplunkViaDifferentLoggers() throws Exception {
LogToSplunk(true);
}
- public static volatile boolean exceptionWasRaised = false;
+ public boolean exceptionWasRaised = false;
+ private String message = null;
+ private List data = null;
@Test
public void TryToLogToSplunkWithDisabledHttpEventCollector() throws Exception {
- HttpEventCollectorErrorHandler.onError(new HttpEventCollectorErrorHandler.ErrorCallback() {
- public void error(final List data, final Exception ex) {
- String exceptionInfo = ex.getMessage() + " " + ex.getStackTrace();
- HttpEventCollectorErrorHandler.ServerErrorException serverErrorException =
- new HttpEventCollectorErrorHandler.ServerErrorException(exceptionInfo);
- System.out.printf("Callback has been called on error\n");
- exceptionWasRaised = true;
- }
+ HttpEventCollectorErrorHandler.onError((data, ex) -> {
+ System.out.print("Callback has been called on error\n");
+ message = ex.getMessage();
+ this.data = data;
+ exceptionWasRaised = true;
});
int expectedCounter = 200;
exceptionWasRaised = false;
@@ -118,7 +117,7 @@ public void error(final List data, final Exception
System.out.printf("\tSetting up http event collector with %s ... ", batching ? "batching" : "no batching");
TestUtil.enableHttpEventCollector();
String token=TestUtil.createHttpEventCollectorToken(httpEventCollectorName);
- System.out.printf("set\n");
+ System.out.print("set\n");
//modify the config file with the generated token
String loggerName = "splunkLogger_disabled";
@@ -143,6 +142,9 @@ public void error(final List data, final Exception
Thread.sleep(15000);
}
Assert.assertTrue(exceptionWasRaised);
+ Assert.assertNotNull(message);
+ Assert.assertNotNull(data);
+ Assert.assertTrue(data.size() > 0);
System.out.printf("PASSED with %d events sent.\n\n", expectedCounter);
}
@@ -150,7 +152,7 @@ private boolean insertDataWithLoggerAndVerify(String token, String loggerType, i
System.out.printf("\tInserting data with logger '%s'... ", loggerType);
long startTime = System.currentTimeMillis() / 1000;
Thread.sleep(2000);
- HashMap userInputs = new HashMap();
+ HashMap userInputs = new HashMap<>();
userInputs.put("user_httpEventCollector_token", token);
if (batching) {
userInputs.put("user_batch_interval", "200");
diff --git a/src/test/java/TestEventBodySerializer.java b/src/test/java/TestEventBodySerializer.java
index 73bb7625..fdf3022a 100644
--- a/src/test/java/TestEventBodySerializer.java
+++ b/src/test/java/TestEventBodySerializer.java
@@ -15,17 +15,7 @@
*/
import com.splunk.logging.EventBodySerializer;
-import com.splunk.logging.HttpEventCollectorErrorHandler;
import com.splunk.logging.HttpEventCollectorEventInfo;
-import org.json.simple.JSONObject;
-import org.junit.Assert;
-import org.junit.Test;
-
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.List;
-import java.util.logging.Logger;
// Implement the interface of EventBodySerializer for testing
public class TestEventBodySerializer implements EventBodySerializer {
diff --git a/src/test/java/TestUtil.java b/src/test/java/TestUtil.java
index 631695d0..cc783848 100644
--- a/src/test/java/TestUtil.java
+++ b/src/test/java/TestUtil.java
@@ -17,15 +17,15 @@
import ch.qos.logback.classic.LoggerContext;
import ch.qos.logback.classic.joran.JoranConfigurator;
import ch.qos.logback.core.joran.spi.JoranException;
+import com.google.gson.*;
import com.splunk.*;
-import org.json.simple.JSONObject;
-import org.json.simple.JSONValue;
import org.junit.Assert;
import org.slf4j.*;
import java.io.*;
import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.util.*;
import java.util.Map.Entry;
@@ -135,7 +135,7 @@ public static String createHttpEventCollectorToken(String httpEventCollectorName
enableHttpEventCollector();
//create an httpEventCollector
- Map args = new HashMap();
+ Map args = new HashMap<>();
args.put("name", httpEventCollectorName);
args.put("description", "test http event collector");
@@ -146,9 +146,9 @@ public static String createHttpEventCollectorToken(String httpEventCollectorName
assert msg.getStatus() == 201;
//get httpEventCollector token
- args = new HashMap();
+ args = new HashMap<>();
ResponseMessage response = service.get(httpEventCollectorTokenEndpointPath + "/" + httpEventCollectorName, args);
- BufferedReader reader = new BufferedReader(new InputStreamReader(response.getContent(), "UTF-8"));
+ BufferedReader reader = new BufferedReader(new InputStreamReader(response.getContent(), StandardCharsets.UTF_8));
String token = "";
while (true) {
String line = reader.readLine();
@@ -385,10 +385,15 @@ public static void verifyEventsSentToSplunk(List msgs) throws IOExceptio
int eventCount = 0;
InputStream resultsStream = null;
ResultsReaderXml resultsReader = null;
- final Object parsedObject = JSONValue.parse(msg);
+ Object parsedObject;
+ try {
+ parsedObject = JsonParser.parseString(msg);
+ } catch (JsonSyntaxException e) {
+ parsedObject = msg;
+ }
while (System.currentTimeMillis() - startTime < 30 * 1000)/*wait for up to 30s*/ {
- if (parsedObject instanceof JSONObject) {
- resultsStream = searchJsonMessageEvent((JSONObject) parsedObject);
+ if (parsedObject instanceof JsonObject) {
+ resultsStream = searchJsonMessageEvent((JsonObject) parsedObject);
} else {
resultsStream = service.oneshotSearch("search " + msg);
}
@@ -422,20 +427,21 @@ public static void verifyEventsSentToSplunk(List msgs) throws IOExceptio
* @return the input stream linked with the search result
*/
@SuppressWarnings("rawtypes")
- private static InputStream searchJsonMessageEvent(final JSONObject jsonObject) {
- String searchQuery = "";
+ private static InputStream searchJsonMessageEvent(final JsonObject jsonObject) {
+ StringBuilder searchQuery = new StringBuilder();
boolean firstSearchTerm = true;
for (final Object entryObject : jsonObject.entrySet()) {
final Entry jsonEntry = (Entry) entryObject;
if (firstSearchTerm) {
- searchQuery += String.format("search \"message.%s\"=%s", jsonEntry.getKey(), jsonEntry.getValue());
+ searchQuery.append(String.format("search \"message.%s\"=%s", jsonEntry.getKey(), jsonEntry.getValue()));
firstSearchTerm = false;
} else {
- searchQuery += String.format(" | search \"message.%s\"=%s", jsonEntry.getKey(), jsonEntry.getValue());
+ searchQuery.append(String.format(" | search \"message.%s\"=%s", jsonEntry.getKey(), jsonEntry.getValue()));
}
}
+ System.err.println(searchQuery.toString());
- return service.oneshotSearch(searchQuery);
+ return service.oneshotSearch(searchQuery.toString());
}
public static void verifyEventsSentInOrder(String prefix, int totalEventsCount, String index) throws IOException {
diff --git a/src/test/java/Util.java b/src/test/java/Util.java
index 82827fd1..603897d3 100644
--- a/src/test/java/Util.java
+++ b/src/test/java/Util.java
@@ -34,11 +34,11 @@ public static class StringContainer {
/**
* Asynchronously read a line from a TCP port or time out.
*
- * This method immediately returns a StringContainer object with its value set to null.
- * It then listens on TCP port port. If a line arrives on that port within timeoutInMs
+ * This method immediately returns a StringContainer object with its value set to null
.
+ * It then listens on TCP port port
. If a line arrives on that port within timeoutInMs
* milliseconds, its sets that line (minus the terminating newline) as the value of the returned
* StringContainer and calls notifyAll on the StringContainer. If no line as arrived after the timeout
- * expires, it calls notifyAll but leaves the value null.
+ * expires, it calls notifyAll but leaves the value null
.
*
* A user of the method should call it something like this:
*
diff --git a/src/test/resources/log4j2.xml b/src/test/resources/log4j2.xml
index ec3d55eb..27edabbb 100644
--- a/src/test/resources/log4j2.xml
+++ b/src/test/resources/log4j2.xml
@@ -33,7 +33,7 @@ under the License.