Skip to content

Commit

Permalink
adds new tif source config type - url download
Browse files Browse the repository at this point in the history
Signed-off-by: Surya Sashank Nistala <snistala@amazon.com>
  • Loading branch information
eirsep committed Jul 9, 2024
1 parent 3be4828 commit 4573483
Show file tree
Hide file tree
Showing 3 changed files with 69 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,4 @@ public void setIocs(List<STIX2IOCDto> iocs) {
public String getFileName() {
return fileName;
}

public void setFileName(String fileName) {
this.fileName = fileName;
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ public abstract class Source {
abstract String name();
public static final String S3_FIELD = "s3";
public static final String IOC_UPLOAD_FIELD = "ioc_upload";
public static final String URL_DOWNLOAD_FIELD = "url_download";

static Source readFrom(StreamInput sin) throws IOException {
Type type = sin.readEnum(Type.class);
Expand All @@ -28,6 +29,8 @@ static Source readFrom(StreamInput sin) throws IOException {
return new S3Source(sin);
case IOC_UPLOAD:
return new IocUploadSource(sin);
case URL_DOWNLOAD:
return new UrlDownloadSource(sin);
default:
throw new IllegalStateException("Unexpected input ["+ type + "] when reading ioc store config");
}
Expand Down Expand Up @@ -57,7 +60,9 @@ public void writeTo(StreamOutput out) throws IOException {}
enum Type {
S3(),

IOC_UPLOAD();
IOC_UPLOAD(),

URL_DOWNLOAD();

@Override
public String toString() {
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
package org.opensearch.securityanalytics.threatIntel.model;

import org.opensearch.core.common.io.stream.StreamInput;
import org.opensearch.core.common.io.stream.Writeable;
import org.opensearch.core.xcontent.ToXContent;
import org.opensearch.core.xcontent.XContentBuilder;
import org.opensearch.core.xcontent.XContentParser;

import java.io.IOException;
import java.net.URL;

/**
* This is a Threat Intel Source config where the iocs are downloaded from the URL
*/
public class UrlDownloadSource extends Source implements Writeable, ToXContent {
public static final String URL_FIELD = "url";
public static final String SOURCE_NAME = "URL_DOWNLOAD";

private final URL url;

public UrlDownloadSource(URL url) {
this.url = url;
}

public UrlDownloadSource(StreamInput sin) throws IOException {
this(new URL(sin.readString()));
}

@Override
String name() {
return SOURCE_NAME;
}

public URL getUrl() {
return url;
}

public static UrlDownloadSource parse(XContentParser xcp) throws IOException {
URL url = null;
while (xcp.nextToken() != XContentParser.Token.END_OBJECT) {
String fieldName = xcp.currentName();
xcp.nextToken();
switch (fieldName) {
case URL_FIELD:
String urlString = xcp.text();
url = new URL(urlString);
break;
default:
xcp.skipChildren();
}
}
return new UrlDownloadSource(url);
}

@Override
public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException {
return builder.startObject()
.startObject(URL_DOWNLOAD_FIELD)
.field(URL_FIELD, url)
.endObject()
.endObject();
}
}

0 comments on commit 4573483

Please sign in to comment.