Module: Unified2
- Defined in:
- lib/unified2.rb,
lib/unified2/event.rb,
lib/unified2/packet.rb,
lib/unified2/sensor.rb,
lib/unified2/payload.rb,
lib/unified2/version.rb,
lib/unified2/construct.rb,
lib/unified2/event_ip4.rb,
lib/unified2/event_ip6.rb,
lib/unified2/signature.rb,
lib/unified2/config_file.rb,
lib/unified2/record_header.rb,
lib/unified2/classification.rb,
lib/unified2/primitive/ipv4.rb,
lib/unified2/exceptions/file_not_found.rb,
lib/unified2/exceptions/file_not_readable.rb,
lib/unified2/exceptions/unknown_load_type.rb
Defined Under Namespace
Modules: Primitive Classes: Classification, ConfigFile, Construct, Event, EventIP4, EventIP6, FileNotFound, FileNotReadable, Packet, Payload, RecordHeader, Sensor, Signature, UnknownLoadType
Constant Summary collapse
- TYPES =
[ :signatures, :generators, :classifications ]
- VERSION =
unified2 version
"0.2.1"
Class Attribute Summary collapse
-
.classifications ⇒ Object
Returns the value of attribute classifications.
-
.generators ⇒ Object
Returns the value of attribute generators.
-
.hostname ⇒ Object
Returns the value of attribute hostname.
-
.interface ⇒ Object
Returns the value of attribute interface.
-
.sensor(options = {}, &block) ⇒ Object
Returns the value of attribute sensor.
-
.signatures ⇒ Object
Returns the value of attribute signatures.
Class Method Summary collapse
- .configuration(options = {}, &block) ⇒ Object
- .load(type, path) ⇒ Object
- .read(path, &block) ⇒ Object
- .watch(path, position = :first, &block) ⇒ Object
Class Attribute Details
.classifications ⇒ Object
Returns the value of attribute classifications.
21 22 23 |
# File 'lib/unified2.rb', line 21 def classifications @classifications end |
.generators ⇒ Object
Returns the value of attribute generators.
21 22 23 |
# File 'lib/unified2.rb', line 21 def generators @generators end |
.hostname ⇒ Object
Returns the value of attribute hostname.
21 22 23 |
# File 'lib/unified2.rb', line 21 def hostname @hostname end |
.interface ⇒ Object
Returns the value of attribute interface.
21 22 23 |
# File 'lib/unified2.rb', line 21 def interface @interface end |
.sensor(options = {}, &block) ⇒ Object
Returns the value of attribute sensor.
21 22 23 |
# File 'lib/unified2.rb', line 21 def sensor @sensor end |
.signatures ⇒ Object
Returns the value of attribute signatures.
21 22 23 |
# File 'lib/unified2.rb', line 21 def signatures @signatures end |
Class Method Details
.configuration(options = {}, &block) ⇒ Object
26 27 28 29 |
# File 'lib/unified2.rb', line 26 def self.configuration(={}, &block) @sensor ||= Sensor.new self.instance_eval(&block) end |
.load(type, path) ⇒ Object
38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
# File 'lib/unified2.rb', line 38 def self.load(type, path) unless TYPES.include?(type.to_sym) raise UnknownLoadType, "Error - #{@type} is unknown." end if File.exists?(path) if File.readable?(path) instance_variable_set("@#{type}", ConfigFile.new(type, path)) else raise FileNotReadable, "Error - #{path} not readable." end else raise FileNotFound, "Error - #{path} not found." end end |
.read(path, &block) ⇒ Object
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 |
# File 'lib/unified2.rb', line 119 def self.read(path, &block) unless File.exists?(path) raise FileNotFound, "Error - #{path} not found." end if File.readable?(path) io = File.open(path) first_open = File.open(path) first_event = Unified2::Construct.read(first_open) first_open.close @event = Event.new(first_event.data.event_id) until io.eof? event = Unified2::Construct.read(io) check_event(event, block) end else raise FileNotReadable, "Error - #{path} not readable." end end |
.watch(path, position = :first, &block) ⇒ Object
54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 |
# File 'lib/unified2.rb', line 54 def self.watch(path, position=:first, &block) unless File.exists?(path) raise FileNotFound, "Error - #{path} not found." end if File.readable?(path) io = File.open(path) case position when Integer, Fixnum event_id = position.to_i.zero? ? 1 : position.to_i @event = Event.new(event_id) when Symbol, String case position.to_sym when :last until io.eof? event = Unified2::Construct.read(io) event_id = event.data.event_id if event end @event = Event.new(event_id + 1) # set event_id to false to catch # beginning loop and process event_id = false when :first first_open = File.open(path) first_event = Unified2::Construct.read(first_open) first_open.close event_id = first_event.data.event_id @event = Event.new(event_id) end end loop do begin event = Unified2::Construct.read(io) if event_id if event.data.event_id.to_i > (event_id - 1) check_event(event, block) end else check_event(event, block) end rescue EOFError sleep 5 retry end end else raise FileNotReadable, "Error - #{path} not readable." end end |