forked from opensearch-project/security-analytics
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Subhobrata Dey <[email protected]>
- Loading branch information
Showing
9 changed files
with
599 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
86 changes: 86 additions & 0 deletions
86
src/main/java/org/opensearch/securityanalytics/model/threatintel/IocMatchWithDocs.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.opensearch.securityanalytics.model.threatintel; | ||
|
|
||
| import org.opensearch.commons.alerting.model.FindingDocument; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
| import org.opensearch.core.common.io.stream.Writeable; | ||
| import org.opensearch.core.xcontent.ToXContent; | ||
| import org.opensearch.core.xcontent.XContentBuilder; | ||
| import org.opensearch.core.xcontent.XContentParser; | ||
| import org.opensearch.core.xcontent.XContentParserUtils; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| public class IocMatchWithDocs implements Writeable, ToXContent { | ||
|
|
||
| private static final String IOC_MATCH_FIELD = "ioc_finding"; | ||
|
|
||
| private static final String DOCUMENTS_FIELD = "document_list"; | ||
|
|
||
| private IocMatch iocMatch; | ||
|
|
||
| private List<FindingDocument> documents; | ||
|
|
||
| public IocMatchWithDocs(IocMatch iocMatch, List<FindingDocument> documents) { | ||
| super(); | ||
| this.iocMatch = iocMatch; | ||
| this.documents = documents; | ||
| } | ||
|
|
||
| public IocMatchWithDocs(StreamInput sin) throws IOException { | ||
| this( | ||
| IocMatch.readFrom(sin), | ||
| sin.readList(FindingDocument::readFrom) | ||
| ); | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| iocMatch.writeTo(out); | ||
| out.writeCollection(documents); | ||
| } | ||
|
|
||
| @Override | ||
| public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException { | ||
| builder.startObject() | ||
| .field(IOC_MATCH_FIELD, iocMatch) | ||
| .field(DOCUMENTS_FIELD, documents); | ||
| return builder.endObject(); | ||
| } | ||
|
|
||
| public static IocMatchWithDocs parse(XContentParser xcp) throws IOException { | ||
| IocMatch iocMatch = null; | ||
| List<FindingDocument> documents = new ArrayList<>(); | ||
|
|
||
| XContentParserUtils.ensureExpectedToken(XContentParser.Token.START_OBJECT, xcp.currentToken(), xcp); | ||
| while (xcp.nextToken() != XContentParser.Token.END_OBJECT) { | ||
| String fieldName = xcp.currentName(); | ||
| xcp.nextToken(); | ||
|
|
||
| switch (fieldName) { | ||
| case IOC_MATCH_FIELD: | ||
| iocMatch = IocMatch.parse(xcp); | ||
| break; | ||
| case DOCUMENTS_FIELD: | ||
| XContentParserUtils.ensureExpectedToken(XContentParser.Token.START_ARRAY, xcp.currentToken(), xcp); | ||
| while (xcp.nextToken() != XContentParser.Token.END_ARRAY) { | ||
| documents.add(FindingDocument.parse(xcp)); | ||
| } | ||
| break; | ||
| default: | ||
| xcp.skipChildren(); | ||
| } | ||
| } | ||
| return new IocMatchWithDocs(iocMatch, documents); | ||
| } | ||
|
|
||
| public static IocMatchWithDocs readFrom(StreamInput sin) throws IOException { | ||
| return new IocMatchWithDocs(sin); | ||
| } | ||
| } |
17 changes: 17 additions & 0 deletions
17
src/main/java/org/opensearch/securityanalytics/threatIntel/action/GetIocFindingsAction.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.opensearch.securityanalytics.threatIntel.action; | ||
|
|
||
| import org.opensearch.action.ActionType; | ||
|
|
||
| public class GetIocFindingsAction extends ActionType<GetIocFindingsResponse> { | ||
|
|
||
| public static final GetIocFindingsAction INSTANCE = new GetIocFindingsAction(); | ||
| public static final String NAME = "cluster:admin/opensearch/securityanalytics/ioc/findings/get"; | ||
|
|
||
| public GetIocFindingsAction() { | ||
| super(NAME, GetIocFindingsResponse::new); | ||
| } | ||
| } |
101 changes: 101 additions & 0 deletions
101
src/main/java/org/opensearch/securityanalytics/threatIntel/action/GetIocFindingsRequest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.opensearch.securityanalytics.threatIntel.action; | ||
|
|
||
| import org.opensearch.action.ActionRequest; | ||
| import org.opensearch.action.ActionRequestValidationException; | ||
| import org.opensearch.action.ValidateActions; | ||
| import org.opensearch.commons.alerting.model.Table; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
|
|
||
| import java.io.IOException; | ||
| import java.time.Instant; | ||
| import java.util.List; | ||
| import java.util.Locale; | ||
|
|
||
| public class GetIocFindingsRequest extends ActionRequest { | ||
|
|
||
| private List<String> findingIds; | ||
|
|
||
| private Instant startTime; | ||
|
|
||
| private Instant endTime; | ||
|
|
||
| private String threatIntelMonitorId; | ||
|
|
||
| private Table table; | ||
|
|
||
| public static final String THREAT_INTEL_MONITOR_ID = "monitor_id"; | ||
|
|
||
| public GetIocFindingsRequest(String threatIntelMonitorId) { | ||
| super(); | ||
| this.threatIntelMonitorId = threatIntelMonitorId; | ||
| } | ||
|
|
||
| public GetIocFindingsRequest(StreamInput sin) throws IOException { | ||
| this( | ||
| sin.readOptionalStringList(), | ||
| sin.readOptionalInstant(), | ||
| sin.readOptionalInstant(), | ||
| sin.readOptionalString(), | ||
| Table.readFrom(sin) | ||
| ); | ||
| } | ||
|
|
||
| public GetIocFindingsRequest(List<String> findingIds, | ||
| Instant startTime, | ||
| Instant endTime, | ||
| String threatIntelMonitorId, | ||
| Table table) { | ||
| this.findingIds = findingIds; | ||
| this.startTime = startTime; | ||
| this.endTime = endTime; | ||
| this.threatIntelMonitorId = threatIntelMonitorId; | ||
| this.table = table; | ||
| } | ||
|
|
||
| @Override | ||
| public ActionRequestValidationException validate() { | ||
| ActionRequestValidationException validationException = null; | ||
| if (threatIntelMonitorId != null && threatIntelMonitorId.isEmpty()) { | ||
| validationException = ValidateActions.addValidationError(String.format(Locale.getDefault(), | ||
| "threat intel monitor id is missing"), validationException); | ||
| } else if (startTime != null && endTime != null && startTime.isAfter(endTime)) { | ||
| validationException = ValidateActions.addValidationError(String.format(Locale.getDefault(), | ||
| "startTime should be less than endTime"), validationException); | ||
| } | ||
| return validationException; | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| out.writeOptionalStringCollection(findingIds); | ||
| out.writeOptionalInstant(startTime); | ||
| out.writeOptionalInstant(endTime); | ||
| out.writeOptionalString(threatIntelMonitorId); | ||
| table.writeTo(out); | ||
| } | ||
|
|
||
| public List<String> getFindingIds() { | ||
| return findingIds; | ||
| } | ||
|
|
||
| public Instant getStartTime() { | ||
| return startTime; | ||
| } | ||
|
|
||
| public Instant getEndTime() { | ||
| return endTime; | ||
| } | ||
|
|
||
| public String getThreatIntelMonitorId() { | ||
| return threatIntelMonitorId; | ||
| } | ||
|
|
||
| public Table getTable() { | ||
| return table; | ||
| } | ||
| } |
63 changes: 63 additions & 0 deletions
63
...main/java/org/opensearch/securityanalytics/threatIntel/action/GetIocFindingsResponse.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package org.opensearch.securityanalytics.threatIntel.action; | ||
|
|
||
| import org.opensearch.core.action.ActionResponse; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
| import org.opensearch.core.xcontent.ToXContentObject; | ||
| import org.opensearch.core.xcontent.XContentBuilder; | ||
| import org.opensearch.securityanalytics.model.threatintel.IocMatch; | ||
| import org.opensearch.securityanalytics.model.threatintel.IocMatchWithDocs; | ||
|
|
||
| import java.io.IOException; | ||
| import java.util.Collections; | ||
| import java.util.List; | ||
|
|
||
| public class GetIocFindingsResponse extends ActionResponse implements ToXContentObject { | ||
|
|
||
| private static final String TOTAL_IOC_FINDINGS_FIELD = "total_findings"; | ||
|
|
||
| private static final String IOC_FINDINGS_FIELD = "ioc_findings"; | ||
|
|
||
| private Integer totalFindings; | ||
|
|
||
| private List<IocMatchWithDocs> iocFindings; | ||
|
|
||
| public GetIocFindingsResponse(Integer totalFindings, List<IocMatchWithDocs> iocFindings) { | ||
| super(); | ||
| this.totalFindings = totalFindings; | ||
| this.iocFindings = iocFindings; | ||
| } | ||
|
|
||
| public GetIocFindingsResponse(StreamInput sin) throws IOException { | ||
| this( | ||
| sin.readInt(), | ||
| Collections.unmodifiableList(sin.readList(IocMatchWithDocs::new)) | ||
| ); | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| out.writeInt(totalFindings); | ||
| out.writeCollection(iocFindings); | ||
| } | ||
|
|
||
| @Override | ||
| public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException { | ||
| builder.startObject() | ||
| .field(TOTAL_IOC_FINDINGS_FIELD, totalFindings) | ||
| .field(IOC_FINDINGS_FIELD, iocFindings); | ||
| return builder.endObject(); | ||
| } | ||
|
|
||
| public Integer getTotalFindings() { | ||
| return totalFindings; | ||
| } | ||
|
|
||
| public List<IocMatchWithDocs> getIocFindings() { | ||
| return iocFindings; | ||
| } | ||
| } |
Oops, something went wrong.