u-siem 0.7.0

A framework for building custom SIEMs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

use std::time::Duration;

use chrono::Utc;
use crossbeam_channel::Sender;

use crate::prelude::{types::LogString, Notification, NotificationLevel, SiemMessage, SiemResult};

#[derive(Clone)]
pub struct KernelMessager {
    component_id: u64,
    component_name: String,
    channel: Sender<SiemMessage>,
    level: NotificationLevel,
}

impl Default for KernelMessager {
    fn default() -> Self {
        let (channel, _) = crossbeam_channel::bounded(1);
        Self {
            component_id: Default::default(),
            component_name: Default::default(),
            channel,
            level: NotificationLevel::Info,
        }
    }
}

impl KernelMessager {
    pub fn new(id: u64, name: String, channel: Sender<SiemMessage>) -> Self {
        Self {
            component_id: id,
            component_name: name,
            channel,
            level: NotificationLevel::Info,
        }
    }
    pub fn set_level(&mut self, level: NotificationLevel) {
        self.level = level;
    }

    pub fn send<T: Into<SiemMessage>>(&self, msg: T) -> SiemResult<()> {
        let msg: SiemMessage = msg.into();
        Ok(self.channel.send(msg)?)
    }

    pub fn try_send<T: Into<SiemMessage>>(&self, msg: T) -> SiemResult<()> {
        let msg: SiemMessage = msg.into();
        Ok(self.channel.try_send(msg)?)
    }

    pub fn send_timeout<T: Into<SiemMessage>>(&self, msg: T, timeout: Duration) -> SiemResult<()> {
        let msg: SiemMessage = msg.into();
        Ok(self.channel.send_timeout(msg, timeout)?)
    }

    fn _send(&self, log: String, level: NotificationLevel) {
        if self.level < level {
            return;
        }
        let _ = self
            .channel
            .try_send(SiemMessage::Notification(Notification {
                component: self.component_id,
                timestamp: Utc::now().timestamp_millis(),
                component_name: LogString::Owned(self.component_name.clone()),
                log: LogString::Owned(log),
                level,
            }));
    }
    pub fn log(&self, log: String, level: NotificationLevel) {
        self._send(log, level);
    }
    pub fn trace(&self, log: String) {
        self._send(log, NotificationLevel::Trace);
    }
    pub fn debug(&self, log: String) {
        self._send(log, NotificationLevel::Debug);
    }
    pub fn info(&self, log: String) {
        self._send(log, NotificationLevel::Info);
    }
    pub fn warn(&self, log: String) {
        self._send(log, NotificationLevel::Warn);
    }
    pub fn error(&self, log: String) {
        self._send(log, NotificationLevel::Error);
    }
}