-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Code works well enough - generating properly formatted LEEF strings - need to look at the documentation and make sure it is acceptable, think about how it should be used and what functionality the "Logger" class should have. Probably need a better name for the class as well.
- Loading branch information
Ryan Peck
committed
Nov 17, 2014
1 parent
6333c00
commit 8f6d74a
Showing
5 changed files
with
111 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -52,3 +52,6 @@ docs/_build/ | |
|
||
# PyBuilder | ||
target/ | ||
|
||
# ignore vim swp files | ||
*.swp |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
language: python | ||
python: | ||
- '2.7' | ||
env: | ||
- PYTHONPATH=. | ||
install: | ||
- pip install coveralls | ||
script: coverage run test_leef.py | ||
after_success: coveralls |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,6 @@ | ||
pyLEEF | ||
python-LEEF | ||
====== | ||
|
||
[![Build Status](https://travis-ci.org/RyPeck/python-LEEF.svg)](https://travis-ci.org/RyPeck/python-LEEF) [![Coverage Status](https://coveralls.io/repos/RyPeck/python-LEEF/badge.png)](https://coveralls.io/r/RyPeck/python-LEEF) | ||
|
||
Python Module for creating Log Event Extended Format events for IBM QRadar |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
#!/usr/bin/python | ||
|
||
""" | ||
Based off of the IBM Guide for LEEF 1.0 - http://goo.gl/8u4Kfg | ||
Acquired November 17th, 2014 - 5a57f47d20d6e73da6fa7d6501b3b3cd | ||
Currently can only use to construct a properly formatted LEEF Log message. | ||
""" | ||
|
||
from __future__ import print_function | ||
|
||
|
||
__version__ = '0.0.1' | ||
|
||
|
||
class Logger: | ||
"""LEEFLOGGER""" | ||
|
||
# LEEF Headers | ||
version_major = None | ||
version_minor = None | ||
product_vendor = None | ||
product_name = None | ||
product_version = None | ||
|
||
def __init__(self, product_vendor, product_name, product_version, | ||
version_major=1, version_minor=0): | ||
""" Define the LEEF Headers for the application logging """ | ||
|
||
self.version_major = version_major | ||
self.version_minor = version_minor | ||
self.product_vendor = product_vendor | ||
self.product_name = product_name | ||
self.product_version = product_version | ||
|
||
def logEvent(self, event_id, keys): | ||
""" | ||
Log an event | ||
""" | ||
return self._createEventString(event_id, keys) | ||
|
||
def _createEventString(self, event_id, keys): | ||
header = self._createHeader(event_id) | ||
|
||
values = sorted([(str(k) + "=" + str(v)) for k, v in keys.iteritems()]) | ||
|
||
payload = '\t'.join(values) | ||
|
||
return (header + payload) | ||
|
||
def _createHeader(self, event_id): | ||
return "LEEF:{0}.{1}|{2}|{3}|{4}|{5}|". \ | ||
format(self.version_major, | ||
self.version_minor, | ||
self.product_vendor, | ||
self.product_name, | ||
self.product_version, | ||
event_id | ||
) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
import unittest | ||
import leef | ||
|
||
|
||
class TestSequenceFunctions(unittest.TestCase): | ||
def setUp(self): | ||
self.l = leef.Logger("TestVendor", "TestName", leef.__version__) | ||
|
||
def testLogger(self): | ||
self.assertEqual(self.l.product_vendor, "TestVendor") | ||
self.assertEqual(self.l.product_name, "TestName") | ||
self.assertEqual(self.l.product_version, leef.__version__) | ||
|
||
def testEventString(self): | ||
keys = {"key1": "value1", | ||
"key2": "value2", | ||
"key3": "value3", | ||
} | ||
|
||
event_id = 1989 | ||
|
||
# Proper Header | ||
header = "LEEF:1.0|TestVendor|TestName|{0}|{1}|". \ | ||
format(leef.__version__, | ||
str(event_id)) | ||
|
||
# Expected keys value string | ||
attributes = "key1=value1\tkey2=value2\tkey3=value3" | ||
|
||
expected = header + attributes | ||
|
||
test_string = self.l._createEventString("1989", keys) | ||
self.assertEqual(test_string, expected) | ||
|
||
|
||
if __name__ == "__main__": | ||
unittest.main() |