u-siem 0.7.0

A framework for building custom SIEMs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

use crate::prelude::types::LogString;
use crossbeam_channel::Sender;
use serde::Serialize;
use std::collections::BTreeMap;
use std::sync::Arc;
#[derive(Serialize, Debug)]
pub enum UpdateTextMap {
    Add((LogString, LogString)),
    Remove(LogString),
    Replace(TextMapDataset),
}
#[derive(Debug, Clone)]
pub struct TextMapSynDataset {
    dataset: Arc<TextMapDataset>,
    comm: Sender<UpdateTextMap>,
}
impl TextMapSynDataset {
    pub fn new(dataset: Arc<TextMapDataset>, comm: Sender<UpdateTextMap>) -> Self {
        Self { dataset, comm }
    }
    pub fn empty() -> Self {
        let (sender, _) = crossbeam_channel::bounded(1);
        Self {
            dataset: Arc::new(TextMapDataset::new()),
            comm: sender,
        }
    }
    pub fn insert<S>(&self, key: S, data: S)
    where
        S: Into<LogString>,
    {
        let _ = self
            .comm
            .try_send(UpdateTextMap::Add((key.into(), data.into())));
    }
    pub fn remove<S>(&self, key: S)
    where
        S: Into<LogString>,
    {
        // Todo: improve with local cache to send retries
        let _ = self.comm.try_send(UpdateTextMap::Remove(key.into()));
    }
    pub fn update(&self, data: TextMapDataset) {
        // Todo: improve with local cache to send retries
        let _ = self.comm.try_send(UpdateTextMap::Replace(data));
    }
    pub fn get(&self, key: &str) -> Option<&LogString> {
        // Todo improve with cached content
        self.dataset.get(key)
    }
}
#[derive(Serialize, Debug, Default)]
pub struct TextMapDataset {
    data: BTreeMap<LogString, LogString>,
}

impl TextMapDataset {
    pub fn new() -> TextMapDataset {
        Self::default()
    }
    pub fn insert<S>(&mut self, key: S, data: S)
    where
        S: Into<LogString>,
    {
        self.data.insert(key.into(), data.into());
    }
    pub fn get(&self, key: &str) -> Option<&LogString> {
        self.data.get(key)
    }
    pub fn internal_ref(&self) -> &BTreeMap<LogString, LogString> {
        &self.data
    }
}

#[cfg(test)]
mod tests {

    use super::*;
    #[test]
    fn should_find_data_in_map() {
        let mut dataset = TextMapDataset::new();
        dataset.insert(
            LogString::Borrowed("192.168.1.1"),
            LogString::Borrowed("Local IP"),
        );
        assert_eq!(
            dataset.get("192.168.1.1"),
            Some(&LogString::Borrowed("Local IP"))
        );
    }
}