com.opensoc.parsing.parsers.BasicSourcefireParser.java Source code

Introduction

Here is the source code for com.opensoc.parsing.parsers.BasicSourcefireParser.java

Source

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.opensoc.parsing.parsers;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

import org.json.simple.JSONObject;

import com.opensoc.parser.interfaces.MessageParser;

@SuppressWarnings("serial")
public class BasicSourcefireParser extends AbstractParser implements MessageParser {

    public static final String hostkey = "host";
    String domain_name_regex = "([^\\.]+)\\.([a-z]{2}|[a-z]{3}|([a-z]{2}\\.[a-z]{2}))$";
    String sidRegex = "(.*)(\\[[0-9]+:[0-9]+:[0-9]\\])(.*)$";
    //String sidRegex = "(\\[[0-9]+:[0-9]+:[0-9]\\])(.*)$";
    Pattern sidPattern = Pattern.compile(sidRegex);
    Pattern pattern = Pattern.compile(domain_name_regex);

    @SuppressWarnings({ "unchecked", "unused" })
    public JSONObject parse(byte[] msg) {

        JSONObject payload = new JSONObject();
        String toParse = "";

        try {

            toParse = new String(msg, "UTF-8");
            _LOG.debug("Received message: " + toParse);

            String tmp = toParse.substring(toParse.lastIndexOf("{"));
            payload.put("key", tmp);

            String protocol = tmp.substring(tmp.indexOf("{") + 1, tmp.indexOf("}")).toLowerCase();
            String source = tmp.substring(tmp.indexOf("}") + 1, tmp.indexOf("->")).trim();
            String dest = tmp.substring(tmp.indexOf("->") + 2, tmp.length()).trim();

            payload.put("protocol", protocol);

            String source_ip = "";
            String dest_ip = "";

            if (source.contains(":")) {
                String parts[] = source.split(":");
                payload.put("ip_src_addr", parts[0]);
                payload.put("ip_src_port", parts[1]);
                source_ip = parts[0];
            } else {
                payload.put("ip_src_addr", source);
                source_ip = source;

            }

            if (dest.contains(":")) {
                String parts[] = dest.split(":");
                payload.put("ip_dst_addr", parts[0]);
                payload.put("ip_dst_port", parts[1]);
                dest_ip = parts[0];
            } else {
                payload.put("ip_dst_addr", dest);
                dest_ip = dest;
            }

            payload.put("timestamp", System.currentTimeMillis());

            Matcher sidMatcher = sidPattern.matcher(toParse);
            String originalString = null;
            String signatureId = "";
            if (sidMatcher.find()) {
                signatureId = sidMatcher.group(2);
                originalString = sidMatcher.group(1) + " " + sidMatcher.group(2) + " " + sidMatcher.group(3);
            } else {
                _LOG.warn("Unable to find SID in message: " + toParse);
                originalString = toParse;
            }
            payload.put("original_string", originalString);
            payload.put("signature_id", signatureId);

            return payload;
        } catch (Exception e) {
            e.printStackTrace();
            _LOG.error("Failed to parse: " + toParse);
            return null;
        }
    }

}