-
Notifications
You must be signed in to change notification settings - Fork 69
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'feature/threat_intel' of https://github.com/opensearch-…
…project/security-analytics into 3.0-threat-intel
- Loading branch information
Showing
31 changed files
with
1,622 additions
and
88 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
234 changes: 234 additions & 0 deletions
234
src/main/java/org/opensearch/securityanalytics/model/IoCMatch.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,234 @@ | ||
| package org.opensearch.securityanalytics.model; | ||
|
|
||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.opensearch.core.common.io.stream.StreamInput; | ||
| import org.opensearch.core.common.io.stream.StreamOutput; | ||
| import org.opensearch.core.common.io.stream.Writeable; | ||
| import org.opensearch.core.xcontent.ToXContent; | ||
| import org.opensearch.core.xcontent.XContentBuilder; | ||
| import org.opensearch.core.xcontent.XContentParser; | ||
| import org.opensearch.core.xcontent.XContentParserUtils; | ||
|
|
||
| import java.io.IOException; | ||
| import java.time.Instant; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| import static org.opensearch.core.xcontent.XContentParserUtils.ensureExpectedToken; | ||
|
|
||
| /** | ||
| * IoC Match provides mapping of the IoC Value to the list of docs that contain the ioc in a given execution of IoC_Scan_job | ||
| * It's the inverse of an IoC finding which maps a document to list of IoC's | ||
| */ | ||
| public class IoCMatch implements Writeable, ToXContent { | ||
| //TODO implement IoC_Match interface from security-analytics-commons | ||
| public static final String ID_FIELD = "id"; | ||
| public static final String RELATED_DOC_IDS_FIELD = "related_doc_ids"; | ||
| public static final String FEED_IDS_FIELD = "feed_ids"; | ||
| public static final String IOC_SCAN_JOB_ID_FIELD = "ioc_scan_job_id"; | ||
| public static final String IOC_SCAN_JOB_NAME_FIELD = "ioc_scan_job_name"; | ||
| public static final String IOC_VALUE_FIELD = "ioc_value"; | ||
| public static final String IOC_TYPE_FIELD = "ioc_type"; | ||
| public static final String TIMESTAMP_FIELD = "timestamp"; | ||
| public static final String EXECUTION_ID_FIELD = "execution_id"; | ||
|
|
||
| private final String id; | ||
| private final List<String> relatedDocIds; | ||
| private final List<String> feedIds; | ||
| private final String iocScanJobId; | ||
| private final String iocScanJobName; | ||
| private final String iocValue; | ||
| private final String iocType; | ||
| private final Instant timestamp; | ||
| private final String executionId; | ||
|
|
||
| public IoCMatch(String id, List<String> relatedDocIds, List<String> feedIds, String iocScanJobId, | ||
| String iocScanJobName, String iocValue, String iocType, Instant timestamp, String executionId) { | ||
| validateIoCMatch(id, iocScanJobId, iocScanJobName, iocValue, timestamp, executionId, relatedDocIds); | ||
| this.id = id; | ||
| this.relatedDocIds = relatedDocIds; | ||
| this.feedIds = feedIds; | ||
| this.iocScanJobId = iocScanJobId; | ||
| this.iocScanJobName = iocScanJobName; | ||
| this.iocValue = iocValue; | ||
| this.iocType = iocType; | ||
| this.timestamp = timestamp; | ||
| this.executionId = executionId; | ||
| } | ||
|
|
||
| public IoCMatch(StreamInput in) throws IOException { | ||
| id = in.readString(); | ||
| relatedDocIds = in.readStringList(); | ||
| feedIds = in.readStringList(); | ||
| iocScanJobId = in.readString(); | ||
| iocScanJobName = in.readString(); | ||
| iocValue = in.readString(); | ||
| iocType = in.readString(); | ||
| timestamp = in.readInstant(); | ||
| executionId = in.readOptionalString(); | ||
| } | ||
|
|
||
| @Override | ||
| public void writeTo(StreamOutput out) throws IOException { | ||
| out.writeString(id); | ||
| out.writeStringCollection(relatedDocIds); | ||
| out.writeStringCollection(feedIds); | ||
| out.writeString(iocScanJobId); | ||
| out.writeString(iocScanJobName); | ||
| out.writeString(iocValue); | ||
| out.writeString(iocType); | ||
| out.writeInstant(timestamp); | ||
| out.writeOptionalString(executionId); | ||
| } | ||
|
|
||
| @Override | ||
| public XContentBuilder toXContent(XContentBuilder builder, Params params) throws IOException { | ||
| builder.startObject() | ||
| .field(ID_FIELD, id) | ||
| .field(RELATED_DOC_IDS_FIELD, relatedDocIds) | ||
| .field(FEED_IDS_FIELD, feedIds) | ||
| .field(IOC_SCAN_JOB_ID_FIELD, iocScanJobId) | ||
| .field(IOC_SCAN_JOB_NAME_FIELD, iocScanJobName) | ||
| .field(IOC_VALUE_FIELD, iocValue) | ||
| .field(IOC_TYPE_FIELD, iocType) | ||
| .field(TIMESTAMP_FIELD, timestamp.toEpochMilli()) | ||
| .field(EXECUTION_ID_FIELD, executionId) | ||
| .endObject(); | ||
| return builder; | ||
| } | ||
|
|
||
| public String getId() { | ||
| return id; | ||
| } | ||
|
|
||
| public List<String> getRelatedDocIds() { | ||
| return relatedDocIds; | ||
| } | ||
|
|
||
| public List<String> getFeedIds() { | ||
| return feedIds; | ||
| } | ||
|
|
||
| public String getIocScanJobId() { | ||
| return iocScanJobId; | ||
| } | ||
|
|
||
| public String getIocScanJobName() { | ||
| return iocScanJobName; | ||
| } | ||
|
|
||
| public String getIocValue() { | ||
| return iocValue; | ||
| } | ||
|
|
||
| public String getIocType() { | ||
| return iocType; | ||
| } | ||
|
|
||
| public Instant getTimestamp() { | ||
| return timestamp; | ||
| } | ||
|
|
||
| public String getExecutionId() { | ||
| return executionId; | ||
| } | ||
|
|
||
| public static IoCMatch parse(XContentParser xcp) throws IOException { | ||
| String id = null; | ||
| List<String> relatedDocIds = new ArrayList<>(); | ||
| List<String> feedIds = new ArrayList<>(); | ||
| String iocScanJobId = null; | ||
| String iocScanName = null; | ||
| String iocValue = null; | ||
| String iocType = null; | ||
| Instant timestamp = null; | ||
| String executionId = null; | ||
|
|
||
| ensureExpectedToken(XContentParser.Token.START_OBJECT, xcp.currentToken(), xcp); | ||
| while (xcp.nextToken() != XContentParser.Token.END_OBJECT) { | ||
| String fieldName = xcp.currentName(); | ||
| xcp.nextToken(); | ||
|
|
||
| switch (fieldName) { | ||
| case ID_FIELD: | ||
| id = xcp.text(); | ||
| break; | ||
| case RELATED_DOC_IDS_FIELD: | ||
| ensureExpectedToken(XContentParser.Token.START_ARRAY, xcp.currentToken(), xcp); | ||
| while (xcp.nextToken() != XContentParser.Token.END_ARRAY) { | ||
| relatedDocIds.add(xcp.text()); | ||
| } | ||
| break; | ||
| case FEED_IDS_FIELD: | ||
| ensureExpectedToken(XContentParser.Token.START_ARRAY, xcp.currentToken(), xcp); | ||
| while (xcp.nextToken() != XContentParser.Token.END_ARRAY) { | ||
| feedIds.add(xcp.text()); | ||
| } | ||
| break; | ||
| case IOC_SCAN_JOB_ID_FIELD: | ||
| iocScanJobId = xcp.textOrNull(); | ||
| break; | ||
| case IOC_SCAN_JOB_NAME_FIELD: | ||
| iocScanName = xcp.textOrNull(); | ||
| break; | ||
| case IOC_VALUE_FIELD: | ||
| iocValue = xcp.textOrNull(); | ||
| break; | ||
| case IOC_TYPE_FIELD: | ||
| iocType = xcp.textOrNull(); | ||
| break; | ||
| case TIMESTAMP_FIELD: | ||
| try { | ||
| if (xcp.currentToken() == XContentParser.Token.VALUE_NULL) { | ||
| timestamp = null; | ||
| } else if (xcp.currentToken().isValue()) { | ||
| timestamp = Instant.ofEpochMilli(xcp.longValue()); | ||
| } else { | ||
| XContentParserUtils.throwUnknownToken(xcp.currentToken(), xcp.getTokenLocation()); | ||
| timestamp = null; | ||
| } | ||
| break; | ||
| } catch (Exception e) { | ||
| throw new IllegalArgumentException("failed to parse timestamp in IoC Match object"); | ||
| } | ||
| case EXECUTION_ID_FIELD: | ||
| executionId = xcp.textOrNull(); | ||
| break; | ||
| } | ||
| } | ||
|
|
||
| return new IoCMatch(id, relatedDocIds, feedIds, iocScanJobId, iocScanName, iocValue, iocType, timestamp, executionId); | ||
| } | ||
|
|
||
| public static IoCMatch readFrom(StreamInput in) throws IOException { | ||
| return new IoCMatch(in); | ||
| } | ||
|
|
||
|
|
||
| private static void validateIoCMatch(String id, String iocScanJobId, String iocScanName, String iocValue, Instant timestamp, String executionId, List<String> relatedDocIds) { | ||
| if (StringUtils.isBlank(id)) { | ||
| throw new IllegalArgumentException("id cannot be empty in IoC_Match Object"); | ||
| } | ||
| if (StringUtils.isBlank(iocValue)) { | ||
| throw new IllegalArgumentException("ioc_value cannot be empty in IoC_Match Object"); | ||
| } | ||
| if (StringUtils.isBlank(iocValue)) { | ||
| throw new IllegalArgumentException("ioc_value cannot be empty in IoC_Match Object"); | ||
| } | ||
| if (StringUtils.isBlank(iocScanJobId)) { | ||
| throw new IllegalArgumentException("ioc_scan_job_id cannot be empty in IoC_Match Object"); | ||
| } | ||
| if (StringUtils.isBlank(iocScanName)) { | ||
| throw new IllegalArgumentException("ioc_scan_job_name cannot be empty in IoC_Match Object"); | ||
| } | ||
| if (StringUtils.isBlank(executionId)) { | ||
| throw new IllegalArgumentException("execution_id cannot be empty in IoC_Match Object"); | ||
| } | ||
| if (timestamp == null) { | ||
| throw new IllegalArgumentException("timestamp cannot be null in IoC_Match Object"); | ||
| } | ||
| if(relatedDocIds == null || relatedDocIds.isEmpty()) { | ||
| throw new IllegalArgumentException("related_doc_ids cannot be null or empty in IoC_Match Object"); | ||
| } | ||
| } | ||
| } |
21 changes: 21 additions & 0 deletions
21
src/main/java/org/opensearch/securityanalytics/threatIntel/common/FeedType.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| package org.opensearch.securityanalytics.threatIntel.common; | ||
|
|
||
| /** | ||
| * Types of feeds threat intel can support | ||
| * Feed types include: licensed, open-sourced, custom, and internal | ||
| */ | ||
| public enum FeedType { | ||
|
|
||
| LICENSED, | ||
|
|
||
| OPEN_SOURCED, | ||
|
|
||
| CUSTOM, | ||
|
|
||
| INTERNAL | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.