u-siem 0.7.0

A framework for building custom SIEMs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

#[cfg(not(feature = "slow_geoip"))]
mod fast;
#[cfg(feature = "slow_geoip")]
mod slow;

use serde::{Deserialize, Serialize};
#[cfg(feature = "slow_geoip")]
use sled::IVec;

use crate::prelude::types::LogString;

#[derive(Serialize, Deserialize, Debug, Default, Clone)]
pub struct GeoIpInfo {
    pub country: LogString,
    pub country_iso: LogString,
    pub city: LogString,
    pub latitude: f32,
    pub longitude: f32,
    pub isp: LogString, // More important than country in my opinion because Geolocalization is very imprecise.
    pub asn: u32,
}
#[cfg(feature = "slow_geoip")]
impl Into<IVec> for GeoIpInfo {
    fn into(self) -> IVec {
        IVec::from(serde_json::to_string(&self).unwrap().as_bytes())
    }
}
#[cfg(feature = "slow_geoip")]
impl From<IVec> for GeoIpInfo {
    fn from(value: IVec) -> Self {
        let s: GeoIpInfo = serde_json::from_slice(&value).unwrap();
        s
    }
}
#[cfg(not(feature = "slow_geoip"))]
pub use fast::{GeoIpDataset, GeoIpSynDataset, UpdateGeoIp};

#[cfg(feature = "slow_geoip")]
pub use slow::{
    SlowGeoIpDataset as GeoIpDataset, SlowGeoIpSynDataset as GeoIpSynDataset,
    UpdateSlowGeoIp as UpdateGeoIp,
};