usiem-basic-parser 0.1.0

uSIEM parser component that allows using multiple and different parsers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

use std::convert::TryInto;

use usiem::prelude::{
    metrics::{SiemMetric, SiemMetricDefinition},
    LogParser,
};

use usiem::prelude::counter::CounterVec;
#[cfg(feature="metrics")]
pub fn generate_parser_metrics(
    parsers: &[Box<dyn LogParser>],
) -> (Vec<SiemMetricDefinition>, ParserMetrics) {
    let mut labels = Vec::with_capacity(32);
    let empty = vec![];
    labels.push(&empty[..]);
    let mut parser_names = Vec::with_capacity(32);
    for parser in parsers {
        parser_names.push(vec![("parser", parser.name())]);
    }
    for i in 0..parsers.len() {
        labels.push(parser_names.get(i).unwrap());
    }

    let parser_unimplemented = SiemMetricDefinition::new(
        "parser_unimplemented",
        "Number of logs which the parser was not implemented for",
        SiemMetric::Counter(CounterVec::new(&labels[..])),
    )
    .unwrap();
    let parser_format_error = SiemMetricDefinition::new(
        "parser_format_error",
        "Number of logs for which the parser needs to be updated",
        SiemMetric::Counter(CounterVec::new(&labels[..])),
    )
    .unwrap();
    let parser_bug_error = SiemMetricDefinition::new(
        "parser_bug_error",
        "Number of logs for which the parser has a bug",
        SiemMetric::Counter(CounterVec::new(&labels[..])),
    )
    .unwrap();
    let parser_discarded = SiemMetricDefinition::new(
        "parser_discarded",
        "Number of logs discarded by parsers",
        SiemMetric::Counter(CounterVec::new(&labels[..])),
    )
    .unwrap();
    let metrics = ParserMetrics {
        parser_unimplemented: get_metric_counter(&parser_unimplemented),
        parser_format_error: get_metric_counter(&parser_format_error),
        parser_bug_error: get_metric_counter(&parser_bug_error),
        parser_discarded: get_metric_counter(&parser_discarded),
    };
    (
        vec![
            parser_unimplemented,
            parser_format_error,
            parser_bug_error,
            parser_discarded,
        ],
        metrics,
    )
}

#[cfg(not(feature="metrics"))]
pub fn generate_parser_metrics(
    _parsers: &[Box<dyn LogParser>],
) -> (Vec<SiemMetricDefinition>, ParserMetrics) {
    (vec![], ParserMetrics::empty())
}

fn get_metric_counter(definition: &SiemMetricDefinition) -> CounterVec {
    definition.metric().try_into().unwrap()
}

#[derive(Clone)]
pub struct ParserMetrics {
    pub parser_unimplemented: CounterVec,
    pub parser_format_error: CounterVec,
    pub parser_bug_error: CounterVec,
    pub parser_discarded: CounterVec,
}
#[cfg(not(feature="metrics"))]
impl ParserMetrics {
    pub fn empty() -> Self {
        Self {
            parser_unimplemented: CounterVec::new(&[]),
            parser_format_error: CounterVec::new(&[]),
            parser_bug_error: CounterVec::new(&[]),
            parser_discarded: CounterVec::new(&[]),
        }
    }
}