Class: Oober::CefLogger

Inherits:
Hashie::Dash
  • Object
show all
Defined in:
lib/oober/cef_logger.rb

Instance Method Summary collapse

Instance Method Details

#cef ⇒ Object 



26
27
28
 
# File 'lib/oober/cef_logger.rb', line 26

def cef
  @cef ||= CEF.logger(export_config)
end

#event_defaults ⇒ Object 



17
18
19
20
21
22
23
24
 
# File 'lib/oober/cef_logger.rb', line 17

def event_defaults
  @event_defaults ||= {
    name: self.feed_name,
    deviceProduct: self.class.name,
    deviceVersion: Oober::VERSION,
    receiptTime: Time.new
  }
end

#extract_blocks(blocks = get_blocks) ⇒ Object 



45
46
47
48
 
# File 'lib/oober/cef_logger.rb', line 45

def extract_blocks(blocks=get_blocks)
  extractor_pipeline(blocks).flat_map(&:extract)
                            .map {|extracted| extracted.merge(event_defaults)}
end

#extractor_pipeline(blocks = get_blocks) ⇒ Object 



38
39
40
41
42
43
 
# File 'lib/oober/cef_logger.rb', line 38

def extractor_pipeline(blocks=get_blocks)
  extractors = blocks.flat_map do |block|
    extractor_configs.map { |conf| extractor.new(conf.merge(data: block)) }
  end
  extractors.reject {|ext| ext.selected.empty? }
end

#get_blocks ⇒ Object 



34
35
36
 
# File 'lib/oober/cef_logger.rb', line 34

def get_blocks
  taxii.get_content_blocks(self.request_message)
end

#poll_messages ⇒ Object 



54
55
56
57
58
 
# File 'lib/oober/cef_logger.rb', line 54

def poll_messages
  transform_extracts(extract_blocks).each do |transformed_event|
    cef.emit(transformed_event)
  end
end

#request_message ⇒ Object 



60
61
62
63
64
 
# File 'lib/oober/cef_logger.rb', line 60

def request_message
  full_results = Taxii::Messages::Parameters::Poll.new(response_type: 'FULL')
  req = Taxii::Messages::PollRequest.new(collection_name: feed_name, poll_parameters: full_results)
  req.to_xml
end

#taxii ⇒ Object 



30
31
32
 
# File 'lib/oober/cef_logger.rb', line 30

def taxii
  @taxii ||= Taxii::PollClient.new(taxii_config)
end

#transform_extracts(events = extract_blocks) ⇒ Object 



50
51
52
 
# File 'lib/oober/cef_logger.rb', line 50

def transform_extracts(events=extract_blocks)
  events.map {|event| CEF::Event.new(event) }
end