u-siem 0.7.0

A framework for building custom SIEMs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

use std::thread::JoinHandle;

use crossbeam_channel::{SendError, Sender};

use crate::components::{
    command::{SiemCommandCall, SiemCommandHeader},
    common::SiemMessage,
    SiemComponent,
};
pub mod parsers;

/// Simplify the process of testing components.
/// Allows executing some actions like send SiemMessages before stopping a component
pub fn do_before_stoping_component<F>(
    component: &Box<dyn SiemComponent>,
    action: F,
) -> JoinHandle<Result<(), SendError<SiemMessage>>>
where
    F: FnOnce() + Send + 'static,
{
    let sender: Sender<SiemMessage> = component.local_channel();
    let comp_name = component.name().to_string();
    std::thread::spawn(move || {
        action();
        sender.send(SiemMessage::Command(
            SiemCommandHeader {
                comp_id: 0,
                comm_id: 0,
                user: String::from("kernel"),
            },
            SiemCommandCall::STOP_COMPONENT(comp_name),
        ))
    })
}