Skip to content

Commit

Permalink
Code works adequately - still a WIP
Browse files Browse the repository at this point in the history
Code works well enough - generating properly formatted LEEF strings -
need to look at the documentation and make sure it is acceptable, think
about how it should be used and what functionality the "Logger" class
should have.

Probably need a better name for the class as well.
  • Loading branch information
Ryan Peck committed Nov 17, 2014
1 parent 6333c00 commit 8f6d74a
Show file tree
Hide file tree
Showing 5 changed files with 111 additions and 1 deletion.
3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -52,3 +52,6 @@ docs/_build/

# PyBuilder
target/

# ignore vim swp files
*.swp
9 changes: 9 additions & 0 deletions .travis.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
language: python
python:
- '2.7'
env:
- PYTHONPATH=.
install:
- pip install coveralls
script: coverage run test_leef.py
after_success: coveralls
4 changes: 3 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
pyLEEF
python-LEEF
======

[![Build Status](https://travis-ci.org/RyPeck/python-LEEF.svg)](https://travis-ci.org/RyPeck/python-LEEF) [![Coverage Status](https://coveralls.io/repos/RyPeck/python-LEEF/badge.png)](https://coveralls.io/r/RyPeck/python-LEEF)

Python Module for creating Log Event Extended Format events for IBM QRadar
59 changes: 59 additions & 0 deletions leef.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
#!/usr/bin/python

"""
Based off of the IBM Guide for LEEF 1.0 - http://goo.gl/8u4Kfg
Acquired November 17th, 2014 - 5a57f47d20d6e73da6fa7d6501b3b3cd
Currently can only use to construct a properly formatted LEEF Log message.
"""

from __future__ import print_function


__version__ = '0.0.1'


class Logger:
"""LEEFLOGGER"""

# LEEF Headers
version_major = None
version_minor = None
product_vendor = None
product_name = None
product_version = None

def __init__(self, product_vendor, product_name, product_version,
version_major=1, version_minor=0):
""" Define the LEEF Headers for the application logging """

self.version_major = version_major
self.version_minor = version_minor
self.product_vendor = product_vendor
self.product_name = product_name
self.product_version = product_version

def logEvent(self, event_id, keys):
"""
Log an event
"""
return self._createEventString(event_id, keys)

def _createEventString(self, event_id, keys):
header = self._createHeader(event_id)

values = sorted([(str(k) + "=" + str(v)) for k, v in keys.iteritems()])

payload = '\t'.join(values)

return (header + payload)

def _createHeader(self, event_id):
return "LEEF:{0}.{1}|{2}|{3}|{4}|{5}|". \
format(self.version_major,
self.version_minor,
self.product_vendor,
self.product_name,
self.product_version,
event_id
)
37 changes: 37 additions & 0 deletions test_leef.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
import unittest
import leef


class TestSequenceFunctions(unittest.TestCase):
def setUp(self):
self.l = leef.Logger("TestVendor", "TestName", leef.__version__)

def testLogger(self):
self.assertEqual(self.l.product_vendor, "TestVendor")
self.assertEqual(self.l.product_name, "TestName")
self.assertEqual(self.l.product_version, leef.__version__)

def testEventString(self):
keys = {"key1": "value1",
"key2": "value2",
"key3": "value3",
}

event_id = 1989

# Proper Header
header = "LEEF:1.0|TestVendor|TestName|{0}|{1}|". \
format(leef.__version__,
str(event_id))

# Expected keys value string
attributes = "key1=value1\tkey2=value2\tkey3=value3"

expected = header + attributes

test_string = self.l._createEventString("1989", keys)
self.assertEqual(test_string, expected)


if __name__ == "__main__":
unittest.main()

0 comments on commit 8f6d74a

Please sign in to comment.