u-siem 0.7.0

A framework for building custom SIEMs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

use std::io::Error as IoError;

use serde::{Deserialize, Serialize};

use crate::prelude::parsing::LogParsingError;
pub type SiemResult<T> = Result<T, SiemError>;

#[derive(Serialize, Deserialize, Clone, Debug)]
#[non_exhaustive]
pub enum SiemError {
    /// Io Error
    Io(String),
    /// Seriaization/Deserialization error
    Serialization(String),
    /// Error parsing a log
    Parsing(LogParsingError),
    /// Error indexing a log
    Indexing(String),
    /// Error accessing the storage system
    Storage(StorageError),
    /// A task execution failed
    Task(String),
    /// A command executed failed
    Command(CommandExecutionError),
    /// A component sufered an error during the startup process
    Configuration(String),
    Messaging(MessagingError),
    Other(String),
    Component(ComponentError),
}

#[derive(Serialize, Deserialize, Clone, Debug)]
#[non_exhaustive]
pub enum CommandExecutionError {
    Communication(String),
    Other(String),
}

#[derive(Serialize, Deserialize, Debug, Clone)]
#[non_exhaustive]
pub enum StorageError {
    NotExists,
    ConnectionError,
    AlredyExists,
}

#[derive(Serialize, Deserialize, Debug, Clone)]
#[non_exhaustive]
pub enum MessagingError {
    Disconnected,
    TimeoutReached,
    Full,
}

#[derive(Serialize, Deserialize, Debug, Clone)]
#[non_exhaustive]
pub enum ComponentError {
    StopRequested,
}

impl From<MessagingError> for SiemError {
    fn from(e: MessagingError) -> Self {
        Self::Messaging(e)
    }
}
impl From<ComponentError> for SiemError {
    fn from(e: ComponentError) -> Self {
        Self::Component(e)
    }
}
impl From<StorageError> for SiemError {
    fn from(e: StorageError) -> Self {
        Self::Storage(e)
    }
}
impl From<CommandExecutionError> for SiemError {
    fn from(e: CommandExecutionError) -> Self {
        Self::Command(e)
    }
}

impl From<IoError> for SiemError {
    fn from(e: IoError) -> Self {
        Self::Io(e.to_string())
    }
}

impl From<serde_json::Error> for SiemError {
    fn from(e: serde_json::Error) -> Self {
        Self::Serialization(e.to_string())
    }
}

impl<T> From<crossbeam_channel::TrySendError<T>> for SiemError {
    fn from(e: crossbeam_channel::TrySendError<T>) -> Self {
        match e {
            crossbeam_channel::TrySendError::Full(_) => Self::Messaging(MessagingError::Full),
            crossbeam_channel::TrySendError::Disconnected(_) => {
                Self::Messaging(MessagingError::Disconnected)
            }
        }
    }
}
impl<T> From<crossbeam_channel::SendError<T>> for SiemError {
    fn from(_e: crossbeam_channel::SendError<T>) -> Self {
        Self::Messaging(MessagingError::Disconnected)
    }
}
impl<T> From<crossbeam_channel::SendTimeoutError<T>> for SiemError {
    fn from(e: crossbeam_channel::SendTimeoutError<T>) -> Self {
        match e {
            crossbeam_channel::SendTimeoutError::Timeout(_) => {
                Self::Messaging(MessagingError::TimeoutReached)
            }
            crossbeam_channel::SendTimeoutError::Disconnected(_) => {
                Self::Messaging(MessagingError::Disconnected)
            }
        }
    }
}