forked from opensearch-project/security-analytics
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implemented ListIOCs API. (opensearch-project#1064)
* Removed unused imports. Removed redundant helper function. Signed-off-by: AWSHurneyt <[email protected]> * Added note about system index refactoring. Signed-off-by: AWSHurneyt <[email protected]> * Implemented draft of IocService. Signed-off-by: AWSHurneyt <[email protected]> * Made changes based on PR feedback. Signed-off-by: AWSHurneyt <[email protected]> * Fixed test helper function. Signed-off-by: AWSHurneyt <[email protected]> * Removed unused imports. Signed-off-by: AWSHurneyt <[email protected]> * Adjusted mappings based on PR feedback. Signed-off-by: AWSHurneyt <[email protected]> * Continuation of fetch IOC service implementation. Signed-off-by: AWSHurneyt <[email protected]> * Implemented ListtIOCs API. Signed-off-by: AWSHurneyt <[email protected]> * Removed "enabled" field from ListIOCs API as that will not be configured at the IOC level. Signed-off-by: AWSHurneyt <[email protected]> * Renamed response keys. Signed-off-by: AWSHurneyt <[email protected]> * Removed "enabled" field mapping as that will not be configured at the IOC level. Signed-off-by: AWSHurneyt <[email protected]> * Added feedId as a filter for LiistIOCs API. Added handling for IndexNotFoundException when calling ListIOCs API. Signed-off-by: AWSHurneyt <[email protected]> * Implemented ListtIOCs API. Signed-off-by: AWSHurneyt <[email protected]> * Removed "enabled" field from ListIOCs API as that will not be configured at the IOC level. Signed-off-by: AWSHurneyt <[email protected]> * Renamed response keys. Signed-off-by: AWSHurneyt <[email protected]> * Removed unused test suite. Signed-off-by: AWSHurneyt <[email protected]> * Added feedId as a filter for LiistIOCs API. Added handling for IndexNotFoundException when calling ListIOCs API. Signed-off-by: AWSHurneyt <[email protected]> * Added feedId as a filter for ListIOCs API. Signed-off-by: AWSHurneyt <[email protected]> * Fixed merge conflict. Signed-off-by: AWSHurneyt <[email protected]> * Removed unused test suite. Signed-off-by: AWSHurneyt <[email protected]> * Fixed test case. Signed-off-by: AWSHurneyt <[email protected]> * Fixed test index mappings. Signed-off-by: AWSHurneyt <[email protected]> --------- Signed-off-by: AWSHurneyt <[email protected]>
- Loading branch information
1 parent
4908e29
commit d2f405b
Showing
11 changed files
with
652 additions
and
224 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 17 additions & 0 deletions
17
src/main/java/org/opensearch/securityanalytics/action/ListIOCsAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.securityanalytics.action; | ||
|
|
||
| import org.opensearch.action.ActionType; | ||
|
|
||
| public class ListIOCsAction extends ActionType<ListIOCsActionResponse> { | ||
| public static final ListIOCsAction INSTANCE = new ListIOCsAction(); | ||
| public static final String NAME = "cluster:admin/opensearch/securityanalytics/iocs/list"; | ||
|
|
||
| public ListIOCsAction() { | ||
| super(NAME, ListIOCsActionResponse::new); | ||
| } | ||
| } |
121 changes: 121 additions & 0 deletions
121
src/main/java/org/opensearch/securityanalytics/action/ListIOCsActionRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.securityanalytics.action; | ||
|
|
||
| import org.opensearch.action.ActionRequest; | ||
| import org.opensearch.action.ActionRequestValidationException; | ||
| import org.opensearch.action.ValidateActions; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
| import org.opensearch.securityanalytics.commons.model.IOCType; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Locale; | ||
|
|
||
| public class ListIOCsActionRequest extends ActionRequest { | ||
| public static String START_INDEX_FIELD = "start"; | ||
| public static String SIZE_FIELD = "size"; | ||
| public static String SORT_ORDER_FIELD = "sort_order"; | ||
| public static String SORT_STRING_FIELD = "sort_string"; | ||
| public static String SEARCH_FIELD = "search"; | ||
| public static String TYPE_FIELD = "type"; | ||
| public static String ALL_TYPES_FILTER = "ALL"; | ||
|
|
||
| private int startIndex; | ||
| private int size; | ||
| private SortOrder sortOrder; | ||
| private String sortString; | ||
|
|
||
| private String search; | ||
| private String type; | ||
| private String feedId; | ||
|
|
||
| public ListIOCsActionRequest(int startIndex, int size, String sortOrder, String sortString, String search, String type, String feedId) { | ||
| super(); | ||
| this.startIndex = startIndex; | ||
| this.size = size; | ||
| this.sortOrder = SortOrder.valueOf(sortOrder.toLowerCase(Locale.ROOT)); | ||
| this.sortString = sortString; | ||
| this.search = search; | ||
| this.type = type.toLowerCase(Locale.ROOT); | ||
| this.feedId = feedId; | ||
| } | ||
|
|
||
| public ListIOCsActionRequest(StreamInput sin) throws IOException { | ||
| this( | ||
| sin.readInt(), // startIndex | ||
| sin.readInt(), // size | ||
| sin.readString(), // sortOrder | ||
| sin.readString(), // sortString | ||
| sin.readOptionalString(), // search | ||
| sin.readOptionalString(), // type | ||
| sin.readOptionalString() //feedId | ||
| ); | ||
| } | ||
|
|
||
| public void writeTo(StreamOutput out) throws IOException { | ||
| out.writeInt(startIndex); | ||
| out.writeInt(size); | ||
| out.writeEnum(sortOrder); | ||
| out.writeString(sortString); | ||
| out.writeOptionalString(search); | ||
| out.writeOptionalString(type); | ||
| out.writeOptionalString(feedId); | ||
| } | ||
|
|
||
| @Override | ||
| public ActionRequestValidationException validate() { | ||
| ActionRequestValidationException validationException = null; | ||
| if (startIndex < 0) { | ||
| validationException = ValidateActions | ||
| .addValidationError(String.format("[%s] param cannot be a negative number.", START_INDEX_FIELD), validationException); | ||
| } else if (size < 0 || size > 10000) { | ||
| validationException = ValidateActions | ||
| .addValidationError(String.format("[%s] param must be between 0 and 10,000.", SIZE_FIELD), validationException); | ||
| } else if (!ALL_TYPES_FILTER.equalsIgnoreCase(type)) { | ||
| try { | ||
| IOCType.valueOf(type); | ||
| } catch (Exception e) { | ||
| validationException = ValidateActions | ||
| .addValidationError(String.format("Unrecognized [%s] param.", TYPE_FIELD), validationException); | ||
| } | ||
| } | ||
| return validationException; | ||
| } | ||
|
|
||
| public int getStartIndex() { | ||
| return startIndex; | ||
| } | ||
|
|
||
| public int getSize() { | ||
| return size; | ||
| } | ||
|
|
||
| public SortOrder getSortOrder() { | ||
| return sortOrder; | ||
| } | ||
|
|
||
| public String getSortString() { | ||
| return sortString; | ||
| } | ||
|
|
||
| public String getSearch() { | ||
| return search; | ||
| } | ||
|
|
||
| public String getType() { | ||
| return type; | ||
| } | ||
|
|
||
| public String getFeedId() { | ||
| return feedId; | ||
| } | ||
|
|
||
| public enum SortOrder { | ||
| asc, | ||
| dsc | ||
| } | ||
| } |
51 changes: 51 additions & 0 deletions
51
src/main/java/org/opensearch/securityanalytics/action/ListIOCsActionResponse.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.securityanalytics.action; | ||
|
|
||
| import org.opensearch.core.action.ActionResponse; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
| import org.opensearch.core.xcontent.ToXContentObject; | ||
| import org.opensearch.core.xcontent.XContentBuilder; | ||
| import org.opensearch.securityanalytics.model.STIX2IOCDto; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
|
|
||
| public class ListIOCsActionResponse extends ActionResponse implements ToXContentObject { | ||
| public static String TOTAL_HITS_FIELD = "total"; | ||
| public static String HITS_FIELD = "iocs"; | ||
|
|
||
| public static ListIOCsActionResponse EMPTY_RESPONSE = new ListIOCsActionResponse(0, Collections.emptyList()); | ||
|
|
||
| private long totalHits; | ||
| private List<STIX2IOCDto> hits; | ||
|
|
||
| public ListIOCsActionResponse(long totalHits, List<STIX2IOCDto> hits) { | ||
| super(); | ||
| this.totalHits = totalHits; | ||
| this.hits = hits; | ||
| } | ||
|
|
||
| public ListIOCsActionResponse(StreamInput sin) throws IOException { | ||
| this(sin.readInt(), sin.readList(STIX2IOCDto::new)); | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| out.writeLong(totalHits); | ||
| out.writeList(hits); | ||
| } | ||
|
|
||
| @Override | ||
| public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException { | ||
| return builder.startObject() | ||
| .field(TOTAL_HITS_FIELD, totalHits) | ||
| .field(HITS_FIELD, hits) | ||
| .endObject(); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
63 changes: 63 additions & 0 deletions
63
src/main/java/org/opensearch/securityanalytics/resthandler/RestListIOCsAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.securityanalytics.resthandler; | ||
|
|
||
| import org.apache.logging.log4j.LogManager; | ||
| import org.apache.logging.log4j.Logger; | ||
| import org.opensearch.client.node.NodeClient; | ||
| import org.opensearch.core.rest.RestStatus; | ||
| import org.opensearch.core.xcontent.ToXContent; | ||
| import org.opensearch.rest.BaseRestHandler; | ||
| import org.opensearch.rest.BytesRestResponse; | ||
| import org.opensearch.rest.RestRequest; | ||
| import org.opensearch.rest.RestResponse; | ||
| import org.opensearch.rest.action.RestResponseListener; | ||
| import org.opensearch.securityanalytics.SecurityAnalyticsPlugin; | ||
| import org.opensearch.securityanalytics.action.ListIOCsAction; | ||
| import org.opensearch.securityanalytics.action.ListIOCsActionRequest; | ||
| import org.opensearch.securityanalytics.action.ListIOCsActionResponse; | ||
| import org.opensearch.securityanalytics.commons.model.STIX2; | ||
| import org.opensearch.securityanalytics.model.STIX2IOC; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.List; | ||
| import java.util.Locale; | ||
|
|
||
| public class RestListIOCsAction extends BaseRestHandler { | ||
| private static final Logger log = LogManager.getLogger(RestListIOCsAction.class); | ||
|
|
||
| public String getName() { | ||
| return "list_iocs_action"; | ||
| } | ||
|
|
||
| public List<Route> routes() { | ||
| return List.of( | ||
| new Route(RestRequest.Method.GET, SecurityAnalyticsPlugin.LIST_IOCS_URI) | ||
| ); | ||
| } | ||
|
|
||
| @Override | ||
| protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient client) throws IOException { | ||
| log.debug(String.format(Locale.ROOT, "%s %s", request.method(), SecurityAnalyticsPlugin.LIST_IOCS_URI)); | ||
|
|
||
| int startIndex = request.paramAsInt(ListIOCsActionRequest.START_INDEX_FIELD, 0); | ||
| int size = request.paramAsInt(ListIOCsActionRequest.SIZE_FIELD, 10); | ||
| String sortOrder = request.param(ListIOCsActionRequest.SORT_ORDER_FIELD, ListIOCsActionRequest.SortOrder.asc.toString()); | ||
| String sortString = request.param(ListIOCsActionRequest.SORT_STRING_FIELD, STIX2.NAME_FIELD); | ||
| String search = request.param(ListIOCsActionRequest.SEARCH_FIELD, ""); | ||
| String type = request.param(ListIOCsActionRequest.TYPE_FIELD, ListIOCsActionRequest.ALL_TYPES_FILTER); | ||
| String feedId = request.param(STIX2IOC.FEED_ID_FIELD, ""); | ||
|
|
||
| ListIOCsActionRequest listRequest = new ListIOCsActionRequest(startIndex, size, sortOrder, sortString, search, type, feedId); | ||
|
|
||
| return channel -> client.execute(ListIOCsAction.INSTANCE, listRequest, new RestResponseListener<>(channel) { | ||
| @Override | ||
| public RestResponse buildResponse(ListIOCsActionResponse response) throws Exception { | ||
| return new BytesRestResponse(RestStatus.OK, response.toXContent(channel.newBuilder(), ToXContent.EMPTY_PARAMS)); | ||
| } | ||
| }); | ||
| } | ||
| } |
Oops, something went wrong.