usiem-utils 0.1.0

A framework for building custom SIEMs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

use usiem::{
    prelude::{geo_ip::GeoIpSynDataset, LogEnrichment, SiemDatasetType, SiemField, SiemIp},
    utilities::types::LogString,
};

#[derive(Clone)]
pub struct GeoIpEnricher {}

impl LogEnrichment for GeoIpEnricher {
    fn enrich(
        &self,
        mut log: usiem::prelude::SiemLog,
        datasets: &usiem::prelude::holder::DatasetHolder,
    ) -> usiem::prelude::SiemLog {
        let geo_ip: &GeoIpSynDataset = match datasets.get(&SiemDatasetType::GeoIp) {
            Some(v) => match v.try_into() {
                Ok(v) => v,
                Err(_) => return log,
            },
            None => return log,
        };
        let mut new_fields = Vec::with_capacity(32);
        for (field_name, ip_field) in log.ip_fields() {
            let ip: &SiemIp = match ip_field.try_into() {
                Ok(v) => v,
                Err(_) => continue,
            };
            match geo_ip.get(ip) {
                Some(geoip_info) => {
                    if geoip_info.city.len() > 0 {
                        new_fields.push((
                            LogString::Owned(format!("{}.geo.city_name", &field_name[..])),
                            SiemField::Text(geoip_info.city.clone()),
                        ));
                    }
                    if geoip_info.country.len() > 0 {
                        new_fields.push((
                            LogString::Owned(format!("{}.geo.country_name", &field_name[..])),
                            SiemField::Text(geoip_info.country.clone()),
                        ));
                        new_fields.push((
                            LogString::Owned(format!("{}.geo.country_iso_code", &field_name[..])),
                            SiemField::Text(geoip_info.country_iso.clone()),
                        ));
                    }
                    if geoip_info.isp.len() > 0 {
                        new_fields.push((
                            LogString::Owned(format!("{}.as.organization.name", &field_name[..])),
                            SiemField::Text(geoip_info.isp.clone()),
                        ));
                    }
                    if geoip_info.asn > 0 {
                        new_fields.push((
                            LogString::Owned(format!("{}.as.number", &field_name[..])),
                            SiemField::U64(geoip_info.asn as u64),
                        ));
                    }
                    if geoip_info.longitude != 0.0 && geoip_info.latitude != 0.0 {
                        new_fields.push((
                            LogString::Owned(format!("{}.geo.location.lon", &field_name[..])),
                            SiemField::F64(geoip_info.longitude as f64),
                        ));
                        new_fields.push((
                            LogString::Owned(format!("{}.geo.location.lat", &field_name[..])),
                            SiemField::F64(geoip_info.latitude as f64),
                        ));
                    }
                }
                None => continue,
            };
        }
        for (field_name, field_value) in new_fields {
            log.insert(field_name, field_value);
        }
        log
    }

    fn name(&self) -> &'static str {
        "GeoIpEnricher"
    }

    fn description(&self) -> &'static str {
        "Adds geo ip information to each IP field"
    }
}