Class: AiRootShield::Integrations::SiemConnector

Inherits:
Object
  • Object
show all
Defined in:
lib/ai_root_shield/integrations/siem_connector.rb

Overview

SIEM and SOC integration connector for third-party security platforms

Constant Summary collapse

SUPPORTED_PLATFORMS =

Supported SIEM platforms

{
  splunk: 'Splunk Enterprise/Cloud',
  elastic: 'Elastic Stack (ELK)',
  qradar: 'IBM QRadar',
  sentinel: 'Microsoft Sentinel',
  sumo_logic: 'Sumo Logic',
  datadog: 'Datadog Security',
  chronicle: 'Google Chronicle',
  arcsight: 'Micro Focus ArcSight'
}.freeze
SEVERITY_LEVELS =

Event severity levels

{
  info: 1,
  low: 2,
  medium: 3,
  high: 4,
  critical: 5
}.freeze

Instance Method Summary collapse

Constructor Details

#initialize(platform, config = {}) ⇒ SiemConnector

Returns a new instance of SiemConnector.



33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/ai_root_shield/integrations/siem_connector.rb', line 33

def initialize(platform, config = {})
  @platform = platform.to_sym
  @config = config
  @api_endpoint = config[:api_endpoint]
  @api_key = config[:api_key]
  @index = config[:index] || 'ai_root_shield'
  @source_type = config[:source_type] || 'mobile_security'
  @timeout = config[:timeout] || 30
  
  validate_configuration
end

Instance Method Details

#create_security_alert(analysis_results, alert_config = {}) ⇒ Object

Create security alert based on risk threshold



89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/ai_root_shield/integrations/siem_connector.rb', line 89

def create_security_alert(analysis_results, alert_config = {})
  risk_score = analysis_results[:risk_score] || 0
  threshold = alert_config[:threshold] || 70
  
  return unless risk_score >= threshold
  
  alert_data = {
    alert_id: generate_alert_id,
    timestamp: Time.now.utc.iso8601,
    severity: determine_alert_severity(risk_score),
    title: generate_alert_title(analysis_results),
    description: generate_alert_description(analysis_results),
    risk_score: risk_score,
    risk_factors: analysis_results[:risk_factors] || [],
    platform: analysis_results[:platform] || 'unknown',
    device_info: extract_device_info(analysis_results),
    remediation_steps: generate_remediation_steps(analysis_results),
    tags: generate_alert_tags(analysis_results)
  }
  
  send_alert(alert_data)
end

#generate_dashboard_url(dashboard_type = 'overview') ⇒ Object

Generate security dashboard URL



127
128
129
130
131
132
133
134
135
136
137
138
 
# File 'lib/ai_root_shield/integrations/siem_connector.rb', line 127

def generate_dashboard_url(dashboard_type = 'overview')
  case @platform
  when :splunk
    "#{@api_endpoint}/app/search/ai_root_shield_#{dashboard_type}"
  when :elastic
    "#{@api_endpoint}/app/kibana#/dashboard/ai-root-shield-#{dashboard_type}"
  when :datadog
    "#{@api_endpoint}/dashboard/ai-root-shield-#{dashboard_type}"
  else
    @api_endpoint
  end
end

#query_security_events(query_params = {}) ⇒ Object

Query SIEM for historical security events



113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/ai_root_shield/integrations/siem_connector.rb', line 113

def query_security_events(query_params = {})
  case @platform
  when :splunk
    query_splunk(query_params)
  when :elastic
    query_elastic(query_params)
  when :qradar
    query_qradar(query_params)
  else
    raise "Query not supported for platform: #{@platform}"
  end
end

#send_batch_events(analysis_results_array, metadata = {}) ⇒ Object

Send batch of security events



72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
# File 'lib/ai_root_shield/integrations/siem_connector.rb', line 72

def send_batch_events(analysis_results_array, metadata = {})
  batch_data = analysis_results_array.map do |results|
    format_security_event(results, metadata)
  end
  
  case @platform
  when :splunk
    send_batch_to_splunk(batch_data)
  when :elastic
    send_batch_to_elastic(batch_data)
  else
    # For platforms without native batch support, send individually
    batch_data.each { |event| send_security_event(event, metadata) }
  end
end

#send_security_event(analysis_results, metadata = {}) ⇒ Object

Send security events to SIEM platform



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/ai_root_shield/integrations/siem_connector.rb', line 46

def send_security_event(analysis_results, metadata = {})
  event_data = format_security_event(analysis_results, metadata)
  
  case @platform
  when :splunk
    send_to_splunk(event_data)
  when :elastic
    send_to_elastic(event_data)
  when :qradar
    send_to_qradar(event_data)
  when :sentinel
    send_to_sentinel(event_data)
  when :sumo_logic
    send_to_sumo_logic(event_data)
  when :datadog
    send_to_datadog(event_data)
  when :chronicle
    send_to_chronicle(event_data)
  when :arcsight
    send_to_arcsight(event_data)
  else
    raise "Unsupported SIEM platform: #{@platform}"
  end
end