diff --git a/README.md b/README.md
index 3e34235..3bc1923 100644
--- a/README.md
+++ b/README.md
@@ -5,8 +5,8 @@ The SI adapter includes Outbound Channel Adapter and Inbound Channel Adapter.
Inbound channel adapter :
-----------------------------------------------------------------------------
-Inbound channel adapter is used to get data out of Splunk and put into
-Spring Integration's channel. There are 5 ways to get data out of Splunk:
+The Inbound channel adapter is used to read data from Splunk and output a message containing the data to a Spring Integration channel. There are 5 ways to get data from Splunk:
+
* Blocking
* Non blocking
* Saved search
@@ -15,99 +15,134 @@ Spring Integration's channel. There are 5 ways to get data out of Splunk:
### Blocking search:
-~~~~~xml
+
+```xml
-~~~~~
+```
+
### Non blocking search:
-~~~~~xml
+
+```xml
-~~~~~
+```
+
### Saved search:
-~~~~~xml
+
+```xml
-~~~~~
+```
+
### Realtime search:
-~~~~~xml
+
+```xml
-~~~~~
+```
### Export:
-~~~~~xml
+
+```xml
-~~~~~
+```
Outbound channel adapter:
----------------------------------------------------------------------------------------------
-Outbound channel adapter is used to put data into Splunk from
-channels in Spring Integration. There are 3 kinds of method to put data
-* REST(submit)
-* stream
-* tcp
+
+The Outbound channel adapter is used to write data to Splunk from a Spring Integration message channel. There are 3 types of data writers provided:
+
+* submit - Use's Splunk's REST API. Appropriate for small or infrequent data loads. Posts data to a named index or the default if not specified.
+* index - Streams data to a named index or the default if not specified.
+* tcp - Streams data to a tcp port associated with a defined tcp input.
+
+The outbound channel adapter requires a child *-writer element which defines related attributes:
### Submit:
-~~~~~xml
+
+```xml
+ splunk-server-ref="splunkServer"
+ sourceType="spring-integration"
+ source="example2">
+
+```
-~~~~~
+### Index:
-### Stream:
-~~~~~xml
+```xml
+ id="splunkOutboundChannelAdapter"
+ channel="outputToSplunk"
+ splunk-server-ref="splunkServer"
+ >
+
+```
-~~~~~
+### TCP
-### tcp
-~~~~~xml
+```xml
+ id="splunkOutboundChannelAdapter"
+ channel="outputToSplunk"
+ splunk-server-ref="splunkServer"
+ >
+
+```
+
+*NOTE: The input must exist and be enabled on the server*
-~~~~~
+### Configuring The Splunk Server connection
+
+```xml
+
+```
+
+Additional server properties include (see [splunk](http://docs.splunk.com/Documentation/Splunk/latest) documentation for details):
+
+* app
+* scheme
+* scope
+* owner
+
+The default host is *localhost* and the default port is *8089*. The *timeout* attribute indicates how long to wait for a connection in miliseconds.
Development
-----------------
-### To build:
+### Build:
./gradlew build
-### To generate Eclipse metadata (.classpath and .project files), do the following:
+### Import the project to Eclipse:
+
+To generate Eclipse metadata (e.g., .classpath and .project files), do the following:
./gradlew eclipse
-
diff --git a/build.gradle b/build.gradle
index 8123c9d..7313d5f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -21,20 +21,8 @@ repositories {
maven { url 'http://repo.springsource.org/plugins-release' } // for bundlor
}
-sourceCompatibility=1.5
-targetCompatibility=1.5
-
-ext {
- cglibVersion = '2.2'
- junitVersion = '4.8.2'
- log4jVersion = '1.2.12'
- mockitoVersion = '1.9.0'
- springVersion = '3.1.2.RELEASE'
- springIntegrationVersion = '2.1.2.RELEASE'
- commonsLangVersion = '2.6'
- commonsPoolVersion = '1.6'
- splunkVersion = '0.8.0'
-}
+sourceCompatibility=1.6
+targetCompatibility=1.6
// See http://www.gradle.org/docs/current/userguide/dependency_management.html#sub:configurations
// and http://www.gradle.org/docs/current/dsl/org.gradle.api.artifacts.ConfigurationContainer.html
diff --git a/gradle.properties b/gradle.properties
index 5364470..89135de 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1 +1,10 @@
version=0.5.0.BUILD-SNAPSHOT
+cglibVersion=2.2
+junitVersion=4.8.2
+log4jVersion=1.2.12
+mockitoVersion=1.9.0
+springVersion=3.1.2.RELEASE
+springIntegrationVersion=2.1.2.RELEASE
+commonsLangVersion=2.6
+commonsPoolVersion=1.6
+splunkVersion =1.0.0
diff --git a/src/main/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParser.java b/src/main/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParser.java
index c25d161..8649d6a 100644
--- a/src/main/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParser.java
+++ b/src/main/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParser.java
@@ -52,22 +52,14 @@ public class SplunkInboundChannelAdapterParser extends AbstractPollingInboundCha
splunkDataReaderBuilder.addPropertyValue("count", count);
}
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "fieldList");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "field-list");
IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "search");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "savedSearch");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "saved-search");
IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "owner");
IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "app");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "initEarliestTime");
-
- String earliestTime = element.getAttribute("earliestTime");
- if (StringUtils.hasText(earliestTime)) {
- splunkDataReaderBuilder.addPropertyValue("earliestTime", earliestTime);
- }
-
- String latestTime = element.getAttribute("latestTime");
- if (StringUtils.hasText(latestTime)) {
- splunkDataReaderBuilder.addPropertyValue("latestTime", latestTime);
- }
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "init-earliest-time");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "earliest-time");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataReaderBuilder, element, "latest-time");
BeanDefinitionBuilder connectionFactoryBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkConnectionFactory.class);
diff --git a/src/main/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParser.java b/src/main/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParser.java
index 634e052..929e653 100644
--- a/src/main/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParser.java
+++ b/src/main/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParser.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2012 the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -24,15 +24,20 @@ import org.springframework.integration.config.xml.AbstractOutboundChannelAdapter
import org.springframework.integration.config.xml.IntegrationNamespaceUtils;
import org.springframework.integration.splunk.outbound.SplunkOutboundChannelAdapter;
import org.springframework.integration.splunk.support.ConnectionFactoryFactoryBean;
-import org.springframework.integration.splunk.support.SplunkDataWriter;
+import org.springframework.integration.splunk.support.SplunkArgsFactoryBean;
import org.springframework.integration.splunk.support.SplunkConnectionFactory;
+import org.springframework.integration.splunk.support.SplunkIndexWriter;
+import org.springframework.integration.splunk.support.SplunkSubmitWriter;
+import org.springframework.integration.splunk.support.SplunkTcpWriter;
import org.springframework.util.StringUtils;
+import org.springframework.util.xml.DomUtils;
import org.w3c.dom.Element;
/**
* The parser for the Splunk Outbound Channel Adapter.
*
* @author Jarred Li
+ * @author David Turanski
* @since 1.0
*
*/
@@ -53,18 +58,16 @@ public class SplunkOutboundChannelAdapterParser extends AbstractOutboundChannelA
BeanDefinitionBuilder splunkOutboundChannelAdapterBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkOutboundChannelAdapter.class);
BeanDefinitionBuilder splunkExecutorBuilder = SplunkParserUtils.getSplunkExecutorBuilder(element, parserContext);
-
- BeanDefinitionBuilder splunkDataWriterBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkDataWriter.class);
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "sourceType");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "source");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "index");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "ingest");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "tcpPort");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "host");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(splunkDataWriterBuilder, element, "hostRegex");
- BeanDefinitionBuilder connectionFactoryBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkConnectionFactory.class);
-
- String splunkServerBeanName = element.getAttribute("splunk-server-ref");
+ BeanDefinitionBuilder argsBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkArgsFactoryBean.class);
+
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(argsBuilder, element, "source-type");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(argsBuilder, element, "source");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(argsBuilder, element, "host");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(argsBuilder, element, "host-regex");
+
+ BeanDefinitionBuilder connectionFactoryBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkConnectionFactory.class);
+
+ String splunkServerBeanName = element.getAttribute("splunk-server-ref");
if (StringUtils.hasText(splunkServerBeanName)) {
connectionFactoryBuilder.addConstructorArgReference(splunkServerBeanName);
}
@@ -72,14 +75,17 @@ public class SplunkOutboundChannelAdapterParser extends AbstractOutboundChannelA
BeanDefinitionBuilder connectionFactoryFactoryBeanBuilder = BeanDefinitionBuilder.genericBeanDefinition(ConnectionFactoryFactoryBean.class);
connectionFactoryFactoryBeanBuilder.addConstructorArgValue(connectionFactoryBuilder.getBeanDefinition());
connectionFactoryFactoryBeanBuilder.addConstructorArgValue(element.getAttribute("pool-server-connection"));
- splunkDataWriterBuilder.addConstructorArgValue(connectionFactoryFactoryBeanBuilder.getBeanDefinition());
-
+
+ BeanDefinitionBuilder dataWriterBuilder = parseDataWriter(element, parserContext);
+ dataWriterBuilder.addConstructorArgValue(connectionFactoryFactoryBeanBuilder.getBeanDefinition());
+ dataWriterBuilder.addConstructorArgValue(argsBuilder.getBeanDefinition());
+
String channelAdapterId = this.resolveId(element, splunkOutboundChannelAdapterBuilder.getRawBeanDefinition(),
parserContext);
String splunkExecutorBeanName = channelAdapterId + ".splunkExecutor";
String splunkDataWriterBeanName = splunkExecutorBeanName + ".writer";
- parserContext.registerBeanComponent(new BeanComponentDefinition(splunkDataWriterBuilder.getBeanDefinition(),
+ parserContext.registerBeanComponent(new BeanComponentDefinition(dataWriterBuilder.getBeanDefinition(),
splunkDataWriterBeanName));
splunkExecutorBuilder.addPropertyReference("writer", splunkDataWriterBeanName);
@@ -93,5 +99,31 @@ public class SplunkOutboundChannelAdapterParser extends AbstractOutboundChannelA
return splunkOutboundChannelAdapterBuilder.getBeanDefinition();
}
+
+ private BeanDefinitionBuilder parseDataWriter(Element element, ParserContext parserContext) {
+ BeanDefinitionBuilder dataWriterBuilder = null;
+ Element dataWriter = null;
+ if (DomUtils.getChildElementByTagName(element, "index-writer") != null) {
+ dataWriter = DomUtils.getChildElementByTagName(element, "index-writer");
+ dataWriterBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkIndexWriter.class);
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(dataWriterBuilder, dataWriter, "index");
+
+ }
+ if (DomUtils.getChildElementByTagName(element, "submit-writer") != null) {
+ dataWriter = DomUtils.getChildElementByTagName(element, "submit-writer");
+ dataWriterBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkSubmitWriter.class);
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(dataWriterBuilder, dataWriter, "index");
+ }
+ if (DomUtils.getChildElementByTagName(element, "tcp-writer") != null) {
+ dataWriter = DomUtils.getChildElementByTagName(element, "tcp-writer");
+ dataWriterBuilder = BeanDefinitionBuilder.genericBeanDefinition(SplunkTcpWriter.class);
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(dataWriterBuilder, dataWriter, "port");
+
+ }
+
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(dataWriterBuilder, element, "auto-startup");
+
+ return dataWriterBuilder;
+ }
}
diff --git a/src/main/java/org/springframework/integration/splunk/config/xml/SplunkServerParser.java b/src/main/java/org/springframework/integration/splunk/config/xml/SplunkServerParser.java
index cca86e0..3151d1d 100644
--- a/src/main/java/org/springframework/integration/splunk/config/xml/SplunkServerParser.java
+++ b/src/main/java/org/springframework/integration/splunk/config/xml/SplunkServerParser.java
@@ -20,7 +20,7 @@ import org.springframework.beans.factory.xml.AbstractSimpleBeanDefinitionParser;
import org.springframework.beans.factory.xml.BeanDefinitionParserDelegate;
import org.springframework.beans.factory.xml.ParserContext;
import org.springframework.integration.config.xml.IntegrationNamespaceUtils;
-import org.springframework.integration.splunk.entity.SplunkServer;
+import org.springframework.integration.splunk.support.SplunkServer;
import org.w3c.dom.Element;
/**
@@ -29,7 +29,7 @@ import org.w3c.dom.Element;
* The XML element is like this:
*
* {@code
- *
* }
*
@@ -54,8 +54,9 @@ public class SplunkServerParser extends AbstractSimpleBeanDefinitionParser {
IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "scheme");
IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "app");
IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "owner");
- IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "userName");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "username");
IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "password");
+ IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "timeout");
}
diff --git a/src/main/java/org/springframework/integration/splunk/core/DataReader.java b/src/main/java/org/springframework/integration/splunk/core/DataReader.java
index aef7b68..6caf942 100644
--- a/src/main/java/org/springframework/integration/splunk/core/DataReader.java
+++ b/src/main/java/org/springframework/integration/splunk/core/DataReader.java
@@ -17,7 +17,7 @@ package org.springframework.integration.splunk.core;
import java.util.List;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
/**
* Data reader to read Splunk data from the service.
@@ -27,6 +27,6 @@ import org.springframework.integration.splunk.entity.SplunkData;
*/
public interface DataReader {
- List search() throws Exception;
+ List search() throws Exception;
}
diff --git a/src/main/java/org/springframework/integration/splunk/core/DataWriter.java b/src/main/java/org/springframework/integration/splunk/core/DataWriter.java
index 69154b5..607aa14 100644
--- a/src/main/java/org/springframework/integration/splunk/core/DataWriter.java
+++ b/src/main/java/org/springframework/integration/splunk/core/DataWriter.java
@@ -15,7 +15,7 @@
*/
package org.springframework.integration.splunk.core;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
/**
* Data writer to write Splunk data into Splunk
@@ -26,6 +26,6 @@ import org.springframework.integration.splunk.entity.SplunkData;
*/
public interface DataWriter {
- void write(SplunkData data) throws Exception;
+ void write(SplunkEvent data) throws Exception;
}
diff --git a/src/main/java/org/springframework/integration/splunk/entity/SplunkData.java b/src/main/java/org/springframework/integration/splunk/entity/SplunkData.java
deleted file mode 100644
index 782f806..0000000
--- a/src/main/java/org/springframework/integration/splunk/entity/SplunkData.java
+++ /dev/null
@@ -1,2274 +0,0 @@
-/*
- * Copyright 2011-2012 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.integration.splunk.entity;
-
-import java.io.Serializable;
-import java.util.Date;
-import java.util.Map;
-
-import org.apache.commons.lang.time.FastDateFormat;
-
-/**
- * Splunk data entity
- *
- * @author Jarred Li
- * @author Damien Dallimore damien@dtdsoftware.com
- * @since 1.0
- *
- */
-public class SplunkData implements Serializable {
-
- private static final long serialVersionUID = -7369254824093658523L;
-
-
- private Map eventData;
-
- /**
- * Contents of the event message
- */
- private StringBuffer eventMessage;
-
- /**
- * Whether or not to put quotes around values
- */
- private boolean quoteValues = true;
-
- /**
- * Whether or not to add a date to the event string
- */
- private boolean useInternalDate = true;
-
- /**
- * default key value delimiter
- */
- private static final String KVDELIM = "=";
- /**
- * default pair delimiter
- */
- private static final String PAIRDELIM = " ";
- /**
- * default quote char
- */
- private static final char QUOTE = '"';
- /**
- * default date format is using internal generated date
- */
- private static final String DATEFORMATPATTERN = "yyyy-MM-dd HH:mm:ss:SSSZ";
- /**
- * Date Formatter instance
- */
- private static FastDateFormat DATEFORMATTER = FastDateFormat.getInstance(DATEFORMATPATTERN);
-
- /**
- * Event prefix fields
- */
- private static final String PREFIX_NAME = "name";
- private static final String PREFIX_EVENT_ID = "event_id";
-
- /**
- * Java Throwable type fields
- */
- private static final String THROWABLE_CLASS = "throwable_class";
- private static final String THROWABLE_MESSAGE = "throwable_message";
- private static final String THROWABLE_STACKTRACE_ELEMENTS = "stacktrace_elements";
-
- /**
- * Splunk Common Information Model(CIM) Fields
- */
-
- // ------------------
- // Account management
- // ------------------
-
- /**
- * The domain containing the user that is affected by the account management
- * event.
- */
- public static String AC_MANAGEMENT_DEST_NT_DOMAIN = "dest_nt_domain";
- /**
- * Description of the account management change performed.
- */
- public static String AC_MANAGEMENT_SIGNATURE = "signature";
- /**
- * The NT source of the destination. In the case of an account management
- * event, this is the domain that contains the user that generated the
- * event.
- */
- public static String AC_MANAGEMENT_SRC_NT_DOMAIN = "src_nt_domain";
-
- // ----------------------------------
- // Authentication - Access protection
- // ----------------------------------
-
- /**
- * The action performed on the resource. success, failure
- */
- public static String AUTH_ACTION = "action";
- /**
- * The application involved in the event (such as ssh, spunk, win:local).
- */
- public static String AUTH_APP = "app";
- /**
- * The target involved in the authentication. If your field is named
- * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
- * to make it CIM-compliant.
- */
- public static String AUTH_DEST = "dest";
- /**
- * The source involved in the authentication. In the case of endpoint
- * protection authentication the src is the client. If your field is named
- * src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src to
- * make it CIM-compliant.. It is required for all events dealing with
- * endpoint protection (Authentication, change analysis, malware, system
- * center, and update). Note: Do not confuse this with the event source or
- * sourcetype fields.
- */
- public static String AUTH_SRC = "src";
- /**
- * In privilege escalation events, src_user represents the user who
- * initiated the privilege escalation.
- */
- public static String AUTH_SRC_USER = "src_user";
- /**
- * The name of the user involved in the event, or who initiated the event.
- * For authentication privilege escalation events this should represent the
- * user targeted by the escalation.
- */
- public static String AUTH_USER = "user";
-
- // ----------------------------------
- // Change analysis - Endpoint protection
- // ----------------------------------
-
- /**
- * The action performed on the resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_ACTION = "action";
- /**
- * The type of change discovered in the change analysis event.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE = "change_type";
- /**
- * The host that was affected by the change. If your field is named
- * dest_host,dest_ip,dest_ipv6, or dest_nt_host you can alias it as dest to
- * make it CIM-compliant.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_DEST = "dest";
- /**
- * The hash signature of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_HASH = "hash";
- /**
- * The group ID of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_GID = "gid";
- /**
- * Indicates whether or not the modified resource is a directory.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_ISDR = "isdr";
- /**
- * The permissions mode of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_MODE = "mode";
- /**
- * The modification time of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_MODTIME = "modtime";
- /**
- * The file path of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_PATH = "path";
- /**
- * The size of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_SIZE = "size";
- /**
- * The user ID of the modified resource.
- */
- public static String CHANGE_ENDPOINT_PROTECTION_UID = "uid";
-
- // ----------------------------------
- // Change analysis - Network protection
- // ----------------------------------
-
- /**
- * The type of change observed.
- */
- public static String CHANGE_NETWORK_PROTECTION_ACTION = "action";
- /**
- * The command that initiated the change.
- */
- public static String CHANGE_NETWORK_PROTECTION_COMMAND = "command";
- /**
- * The device that is directly affected by the change.
- */
- public static String CHANGE_NETWORK_PROTECTION_DVC = "dvc";
- /**
- * The user that initiated the change.
- */
- public static String CHANGE_NETWORK_PROTECTION_USER = "user";
-
- // ----------------------------------
- // Common event fields
- // ----------------------------------
-
- /**
- * A device-specific classification provided as part of the event.
- */
- public static String COMMON_CATEGORY = "category";
- /**
- * A device-specific classification provided as part of the event.
- */
- public static String COMMON_COUNT = "count";
- /**
- * The free-form description of a particular event.
- */
- public static String COMMON_DESC = "desc";
- /**
- * The name of a given DHCP pool on a DHCP server.
- */
- public static String COMMON_DHCP_POOL = "dhcp_pool";
- /**
- * The amount of time the event lasted.
- */
- public static String COMMON_DURATION = "duration";
- /**
- * The fully qualified domain name of the device transmitting or recording
- * the log record.
- */
- public static String COMMON_DVC_HOST = "dvc_host";
- /**
- * The IPv4 address of the device reporting the event.
- */
- public static String COMMON_DVC_IP = "dvc_ip";
- /**
- * The IPv6 address of the device reporting the event.
- */
- public static String COMMON_DVC_IP6 = "dvc_ip6";
- /**
- * The free-form description of the device's physical location.
- */
- public static String COMMON_DVC_LOCATION = "dvc_location";
- /**
- * The MAC (layer 2) address of the device reporting the event.
- */
- public static String COMMON_DVC_MAC = "dvc_mac";
- /**
- * The Windows NT domain of the device recording or transmitting the event.
- */
- public static String COMMON_DVC_NT_DOMAIN = "dvc_nt_domain";
- /**
- * The Windows NT host name of the device recording or transmitting the
- * event.
- */
- public static String COMMON_DVC_NT_HOST = "dvc_nt_host";
- /**
- * Time at which the device recorded the event.
- */
- public static String COMMON_DVC_TIME = "dvc_time";
- /**
- * The event's specified end time.
- */
- public static String COMMON_END_TIME = "end_time";
- /**
- * A unique identifier that identifies the event. This is unique to the
- * reporting device.
- */
- public static String COMMON_EVENT_ID = "event_id";
- /**
- * The length of the datagram, event, message, or packet.
- */
- public static String COMMON_LENGTH = "length";
- /**
- * The log-level that was set on the device and recorded in the event.
- */
- public static String COMMON_LOG_LEVEL = "log_level";
- /**
- * The name of the event as reported by the device. The name should not
- * contain information that's already being parsed into other fields from
- * the event, such as IP addresses.
- */
- public static String COMMON_NAME = "name";
- /**
- * An integer assigned by the device operating system to the process
- * creating the record.
- */
- public static String COMMON_PID = "pid";
- /**
- * An environment-specific assessment of the event's importance, based on
- * elements such as event severity, business function of the affected
- * system, or other locally defined variables.
- */
- public static String COMMON_PRIORITY = "priority";
- /**
- * The product that generated the event.
- */
- public static String COMMON_PRODUCT = "product";
- /**
- * The version of the product that generated the event.
- */
- public static String COMMON_PRODUCT_VERSION = "product_version";
- /**
- * The result root cause, such as connection refused, timeout, crash, and so
- * on.
- */
- public static String COMMON_REASON = "reason";
- /**
- * The action result. Often is a binary choice: succeeded and failed,
- * allowed and denied, and so on.
- */
- public static String COMMON_RESULT = "result";
- /**
- * The severity (or priority) of an event as reported by the originating
- * device.
- */
- public static String COMMON_SEVERITY = "severity";
- /**
- * The event's specified start time.
- */
- public static String COMMON_START_TIME = "start_time";
- /**
- * The transaction identifier.
- */
- public static String COMMON_TRANSACTION_ID = "transaction_id";
- /**
- * A uniform record locator (a web address, in other words) included in a
- * record.
- */
- public static String COMMON_URL = "url";
- /**
- * The vendor who made the product that generated the event.
- */
- public static String COMMON_VENDOR = "vendor";
-
- // ----------------------------------
- // DNS protocol
- // ----------------------------------
-
- /**
- * The DNS domain that has been queried.
- */
- public static String DNS_DEST_DOMAIN = "dest_domain";
- /**
- * The remote DNS resource record being acted upon.
- */
- public static String DNS_DEST_RECORD = "dest_record";
- /**
- * The DNS zone that is being received by the slave as part of a zone
- * transfer.
- */
- public static String DNS_DEST_ZONE = "dest_zone";
- /**
- * The DNS resource record class.
- */
- public static String DNS_RECORD_CLASS = "record_class";
- /**
- * The DNS resource record type.
- *
- * @see see
- * this Wikipedia article on DNS record types
- */
- public static String DNS_RECORD_TYPE = "record_type";
- /**
- * The local DNS domain that is being queried.
- */
- public static String DNS_SRC_DOMAIN = "src_domain";
- /**
- * The local DNS resource record being acted upon.
- */
- public static String DNS_SRC_RECORD = "src_record";
- /**
- * The DNS zone that is being transferred by the master as part of a zone
- * transfer.
- */
- public static String DNS_SRC_ZONE = "src_zone";
-
- // ----------------------------------
- // Email tracking
- // ----------------------------------
-
- /**
- * The person to whom an email is sent.
- */
- public static String EMAIL_RECIPIENT = "recipient";
- /**
- * The person responsible for sending an email.
- */
- public static String EMAIL_SENDER = "sender";
- /**
- * The email subject line.
- */
- public static String EMAIL_SUBJECT = "subject";
-
- // ----------------------------------
- // File management
- // ----------------------------------
-
- /**
- * The time the file (the object of the event) was accessed.
- */
- public static String FILE_ACCESS_TIME = "file_access_time";
- /**
- * The time the file (the object of the event) was created.
- */
- public static String FILE_CREATE_TIME = "file_create_time";
- /**
- * A cryptographic identifier assigned to the file object affected by the
- * event.
- */
- public static String FILE_HASH = "file_hash";
- /**
- * The time the file (the object of the event) was altered.
- */
- public static String FILE_MODIFY_TIME = "file_modify_time";
- /**
- * The name of the file that is the object of the event (without location
- * information related to local file or directory structure).
- */
- public static String FILE_NAME = "file_name";
- /**
- * The location of the file that is the object of the event, in terms of
- * local file and directory structure.
- */
- public static String FILE_PATH = "file_path";
- /**
- * Access controls associated with the file affected by the event.
- */
- public static String FILE_PERMISSION = "file_permission";
- /**
- * The size of the file that is the object of the event. Indicate whether
- * Bytes, KB, MB, GB.
- */
- public static String FILE_SIZE = "file_size";
-
- // ----------------------------------
- // Intrusion detection
- // ----------------------------------
-
- /**
- * The category of the triggered signature.
- */
- public static String INTRUSION_DETECTION_CATEGORY = "category";
- /**
- * The destination of the attack detected by the intrusion detection system
- * (IDS). If your field is named dest_host, dest_ip, dest_ipv6, or
- * dest_nt_host you can alias it as dest to make it CIM-compliant.
- */
- public static String INTRUSION_DETECTION_DEST = "dest";
- /**
- * The device that detected the intrusion event.
- */
- public static String INTRUSION_DETECTION_DVC = "dvc";
- /**
- * The type of IDS that generated the event.
- */
- public static String INTRUSION_DETECTION_IDS_TYPE = "ids_type";
- /**
- * The product name of the vendor technology generating network protection
- * data, such as IDP, Providentia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public static String INTRUSION_DETECTION_PRODUCT = "product";
- /**
- * The severity of the network protection event (such as critical, high,
- * medium, low, or informational).
- *
- * Note: This field is a string. Please use a severity_id field for severity
- * ID fields that are integer data types.
- */
- public static String INTRUSION_DETECTION_SEVERITY = "severity";
- /**
- * The name of the intrusion detected on the client (the src), such as
- * PlugAndPlay_BO and JavaScript_Obfuscation_Fre.
- */
- public static String INTRUSION_DETECTION_SIGNATURE = "signature";
- /**
- * The source involved in the attack detected by the IDS. If your field is
- * named src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src
- * to make it CIM-compliant.
- */
- public static String INTRUSION_DETECTION_SRC = "src";
- /**
- * The user involved with the intrusion detection event.
- */
- public static String INTRUSION_DETECTION_USER = "user";
- /**
- * The vendor technology used to generate network protection data, such as
- * IDP, Providentia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public static String INTRUSION_DETECTION_VENDOR = "vendor";
-
- // ----------------------------------
- // Malware - Endpoint protection
- // ----------------------------------
-
- /**
- * The outcome of the infection
- */
- public static String MALWARE_ENDPOINT_PROTECTION_ACTION = "action";
- /**
- * The NT domain of the destination (the dest_bestmatch).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN = "dest_nt_domain";
- /**
- * The cryptographic hash of the file associated with the malware event
- * (such as the malicious or infected file).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_FILE_HASH = "file_hash";
- /**
- * The name of the file involved in the malware event (such as the infected
- * or malicious file).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_FILE_NAME = "file_name";
- /**
- * The path of the file involved in the malware event (such as the infected
- * or malicious file).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_FILE_PATH = "file_path";
- /**
- * The product name of the vendor technology (the vendor field) that is
- * generating malware data (such as Antivirus or EPO).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT = "product";
- /**
- * The product version number of the vendor technology installed on the
- * client (such as 10.4.3 or 11.0.2).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION = "product_version";
- /**
- * The name of the malware infection detected on the client (the src), such
- * as Trojan.Vundo,Spyware.Gaobot,W32.Nimbda).
- *
- * Note: This field is a string. Please use a signature_id field for
- * signature ID fields that are integer data types.
- */
- public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE = "signature";
- /**
- * The current signature definition set running on the client, such as
- * 11hsvx)
- */
- public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION = "signature_version";
- /**
- * The target affected or infected by the malware. If your field is named
- * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
- * to make it CIM-compliant.
- */
- public static String MALWARE_ENDPOINT_PROTECTION_DEST = "dest";
- /**
- * The NT domain of the source (the src).
- */
- public static String MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN = "src_nt_domain";
- /**
- * The name of the user involved in the malware event.
- */
- public static String MALWARE_ENDPOINT_PROTECTION_USER = "user";
- /**
- * The name of the vendor technology generating malware data, such as
- * Symantec or McAfee.
- */
- public static String MALWARE_ENDPOINT_PROTECTION_VENDOR = "vendor";
-
- // ----------------------------------
- // Malware - Network protection
- // ----------------------------------
-
- /**
- * The product name of the vendor technology generating network protection
- * data, such as IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public static String MALWARE_NETWORK_PROTECTION_PRODUCT = "product";
- /**
- * The severity of the network protection event (such as critical, high,
- * medium, low, or informational).
- *
- * Note: This field is a string. Please use a severity_id field for severity
- * ID fields that are integer data types.
- */
- public static String MALWARE_NETWORK_PROTECTION_SEVERITY = "severity";
- /**
- * The vendor technology used to generate network protection data, such as
- * IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public static String MALWARE_NETWORK_PROTECTION_VENDOR = "vendor";
-
- // ----------------------------------
- // Network traffic - ESS
- // ----------------------------------
-
- /**
- * The action of the network traffic.
- */
- public static String NETWORK_TRAFFIC_ESS_ACTION = "action";
- /**
- * The destination port of the network traffic.
- */
- public static String NETWORK_TRAFFIC_ESS_DEST_PORT = "dest_port";
- /**
- * The product name of the vendor technology generating NetworkProtection
- * data, such as IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public static String NETWORK_TRAFFIC_ESS_PRODUCT = "product";
- /**
- * The source port of the network traffic.
- */
- public static String NETWORK_TRAFFIC_ESS_SRC_PORT = "src_port";
- /**
- * The vendor technology used to generate NetworkProtection data, such as
- * IDP, Proventia, and ASA.
- *
- * Note: Required for all events dealing with network protection (Change
- * analysis, proxy, malware, intrusion detection, packet filtering, and
- * vulnerability).
- */
- public static String NETWORK_TRAFFIC_ESS_VENDOR = "vendor";
-
- // ----------------------------------
- // Network traffic - Generic
- // ----------------------------------
-
- /**
- * The ISO layer 7 (application layer) protocol, such as HTTP, HTTPS, SSH,
- * and IMAP.
- */
- public static String NETWORK_TRAFFIC_GENERIC_APP_LAYER = "app_layer";
- /**
- * How many bytes this device/interface received.
- */
- public static String NETWORK_TRAFFIC_GENERIC_BYTES_IN = "bytes_in";
- /**
- * How many bytes this device/interface transmitted.
- */
- public static String NETWORK_TRAFFIC_GENERIC_BYTES_OUT = "bytes_out";
- /**
- * 802.11 channel number used by a wireless network.
- */
- public static String NETWORK_TRAFFIC_GENERIC_CHANNEL = "channel";
- /**
- * The Common Vulnerabilities and Exposures (CVE) reference value.
- */
- public static String NETWORK_TRAFFIC_GENERIC_CVE = "cve";
- /**
- * The destination application being targeted.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_APP = "dest_app";
- /**
- * The destination command and control service channel.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL = "dest_cnc_channel";
- /**
- * The destination command and control service name.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME = "dest_cnc_name";
- /**
- * The destination command and control service port.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT = "dest_cnc_port";
- /**
- * The country associated with a packet's recipient.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY = "dest_country";
- /**
- * The fully qualified host name of a packet's recipient. For HTTP sessions,
- * this is the host header.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_HOST = "dest_host";
- /**
- * The interface that is listening remotely or receiving packets locally.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_INT = "dest_int";
- /**
- * The IPv4 address of a packet's recipient.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_IP = "dest_ip";
- /**
- * The IPv6 address of a packet's recipient.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_IPV6 = "dest_ipv6";
- /**
- * The (physical) latitude of a packet's destination.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_LAT = "dest_lat";
- /**
- * The (physical) longitude of a packet's destination.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_LONG = "dest_long";
- /**
- * The destination TCP/IP layer 2 Media Access Control (MAC) address of a
- * packet's destination.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_MAC = "dest_mac";
- /**
- * The Windows NT domain containing a packet's destination.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN = "dest_nt_domain";
- /**
- * The Windows NT host name of a packet's destination.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST = "dest_nt_host";
- /**
- * TCP/IP port to which a packet is being sent.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_PORT = "dest_port";
- /**
- * The NATed IPv4 address to which a packet has been sent.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP = "dest_translated_ip";
- /**
- * The NATed port to which a packet has been sent.
- */
- public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT = "dest_translated_port";
- /**
- * The numbered Internet Protocol version.
- */
- public static String NETWORK_TRAFFIC_GENERIC_IP_VERSION = "ip_version";
- /**
- * The network interface through which a packet was transmitted.
- */
- public static String NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE = "outbound_interface";
- /**
- * How many packets this device/interface received.
- */
- public static String NETWORK_TRAFFIC_GENERIC_PACKETS_IN = "packets_in";
- /**
- * How many packets this device/interface transmitted.
- */
- public static String NETWORK_TRAFFIC_GENERIC_PACKETS_OUT = "packets_out";
- /**
- * The OSI layer 3 (Network Layer) protocol, such as IPv4/IPv6, ICMP, IPsec,
- * IGMP or RIP.
- */
- public static String NETWORK_TRAFFIC_GENERIC_PROTO = "proto";
- /**
- * The session identifier. Multiple transactions build a session.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SESSION_ID = "session_id";
- /**
- * The 802.11 service set identifier (ssid) assigned to a wireless session.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SSID = "ssid";
- /**
- * The country from which the packet was sent.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY = "src_country";
- /**
- * The fully qualified host name of the system that transmitted the packet.
- * For Web logs, this is the HTTP client.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_HOST = "src_host";
- /**
- * The interface that is listening locally or sending packets remotely.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_INT = "src_int";
- /**
- * The IPv4 address of the packet's source. For Web logs, this is the http
- * client.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_IP = "src_ip";
- /**
- * The IPv6 address of the packet's source.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_IPV6 = "src_ipv6";
- /**
- * The (physical) latitude of the packet's source.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_LAT = "src_lat";
- /**
- * The (physical) longitude of the packet's source.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_LONG = "src_long";
- /**
- * The Media Access Control (MAC) address from which a packet was
- * transmitted.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_MAC = "src_mac";
- /**
- * The Windows NT domain containing the machines that generated the event.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN = "src_nt_domain";
- /**
- * The Windows NT hostname of the system that generated the event.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST = "src_nt_host";
- /**
- * The network port from which a packet originated.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_PORT = "src_port";
- /**
- * The NATed IPv4 address from which a packet has been sent.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP = "src_translated_ip";
- /**
- * The NATed network port from which a packet has been sent.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT = "src_translated_port";
- /**
- * The application, process, or OS subsystem that generated the event.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_ID = "syslog_id";
- /**
- * The criticality of an event, as recorded by UNIX syslog.
- */
- public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY = "syslog_priority";
- /**
- * The TCP flag(s) specified in the event.
- */
- public static String NETWORK_TRAFFIC_GENERIC_TCP_FLAG = "tcp_flag";
- /**
- * The hex bit that specifies TCP 'type of service'
- *
- * @see Type of
- * Service
- */
- public static String NETWORK_TRAFFIC_GENERIC_TOS = "tos";
- /**
- * The transport protocol.
- */
- public static String NETWORK_TRAFFIC_GENERIC_TRANSPORT = "transport";
- /**
- * The "time to live" of a packet or datagram.
- */
- public static String NETWORK_TRAFFIC_GENERIC_TTL = "ttl";
- /**
- * The numeric identifier assigned to the virtual local area network (VLAN)
- * specified in the record.
- */
- public static String NETWORK_TRAFFIC_GENERIC_VLAN_ID = "vlan_id";
- /**
- * The name assigned to the virtual local area network (VLAN) specified in
- * the record.
- */
- public static String NETWORK_TRAFFIC_GENERIC_VLAN_NAME = "vlan_name";
-
- // ----------------------------------
- // Packet filtering
- // ----------------------------------
-
- /**
- * The action the filtering device (the dvc_bestmatch field) performed on
- * the communication.
- */
- public static String PACKET_FILTERING_ACTION = "action";
- /**
- * The IP port of the packet's destination, such as 22.
- */
- public static String PACKET_FILTERING_DEST_PORT = "dest_port";
- /**
- * The direction the packet is traveling.
- */
- public static String PACKET_FILTERING_DIRECTION = "direction";
- /**
- * The name of the packet filtering device. If your field is named dvc_host,
- * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
- */
- public static String PACKET_FILTERING_DVC = "dvc";
- /**
- * The rule which took action on the packet, such as 143.
- */
- public static String PACKET_FILTERING_RULE = "rule";
- /**
- * The IP port of the packet's source, such as 34541.
- */
- public static String PACKET_FILTERING_SVC_PORT = "svc_port";
-
- // ----------------------------------
- // Proxy
- // ----------------------------------
-
- /**
- * The action taken by the proxy.
- */
- public static String PROXY_ACTION = "action";
- /**
- * The destination of the network traffic (the remote host).
- */
- public static String PROXY_DEST = "dest";
- /**
- * The content-type of the requested HTTP resource.
- */
- public static String PROXY_HTTP_CONTENT_TYPE = "http_content_type";
- /**
- * The HTTP method used to request the resource.
- */
- public static String PROXY_HTTP_METHOD = "http_method";
- /**
- * The HTTP referrer used to request the HTTP resource.
- */
- public static String PROXY_HTTP_REFER = "http_refer";
- /**
- * The HTTP response code.
- */
- public static String PROXY_HTTP_RESPONSE = "http_response";
- /**
- * The user agent used to request the HTTP resource.
- */
- public static String PROXY_HTTP_USER_AGENT = "http_user_agent";
- /**
- * The product name of the vendor technology generating Network Protection
- * data, such as IDP, Providentia, and ASA.
- */
- public static String PROXY_PRODUCT = "product";
- /**
- * The source of the network traffic (the client requesting the connection).
- */
- public static String PROXY_SRC = "src";
- /**
- * The HTTP response code indicating the status of the proxy request.
- */
- public static String PROXY_STATUS = "status";
- /**
- * The user that requested the HTTP resource.
- */
- public static String PROXY_USER = "user";
- /**
- * The URL of the requested HTTP resource.
- */
- public static String PROXY_URL = "url";
- /**
- * The vendor technology generating Network Protection data, such as IDP,
- * Providentia, and ASA.
- */
- public static String PROXY_VENDOR = "vendor";
-
- // ----------------------------------
- // System center
- // ----------------------------------
-
- /**
- * The running application or service on the system (the src field), such as
- * explorer.exe or sshd.
- */
- public static String SYSTEM_CENTER_APP = "app";
- /**
- * The amount of disk space available per drive or mount (the mount field)
- * on the system (the src field).
- */
- public static String SYSTEM_CENTER_FREEMBYTES = "FreeMBytes";
- /**
- * The version of operating system installed on the host (the src field),
- * such as 6.0.1.4 or 2.6.27.30-170.2.82.fc10.x86_64.
- */
- public static String SYSTEM_CENTER_KERNEL_RELEASE = "kernel_release";
- /**
- * Human-readable version of the SystemUptime value.
- */
- public static String SYSTEM_CENTER_LABEL = "label";
- /**
- * The drive or mount reporting available disk space (the FreeMBytes field)
- * on the system (the src field).
- */
- public static String SYSTEM_CENTER_MOUNT = "mount";
- /**
- * The name of the operating system installed on the host (the src), such as
- * Microsoft Windows Server 2003 or GNU/Linux).
- */
- public static String SYSTEM_CENTER_OS = "os";
- /**
- * The percentage of processor utilization.
- */
- public static String SYSTEM_CENTER_PERCENTPROCESSORTIME = "PercentProcessorTime";
- /**
- * The setlocaldefs setting from the SE Linux configuration.
- */
- public static String SYSTEM_CENTER_SETLOCALDEFS = "setlocaldefs";
- /**
- * Values from the SE Linux configuration file.
- */
- public static String SYSTEM_CENTER_SELINUX = "selinux";
- /**
- * The SE Linux type (such as targeted).
- */
- public static String SYSTEM_CENTER_SELINUXTYPE = "selinuxtype";
- /**
- * The shell provided to the User Account (the user field) upon logging into
- * the system (the src field).
- */
- public static String SYSTEM_CENTER_SHELL = "shell";
- /**
- * The TCP/UDP source port on the system (the src field).
- */
- public static String SYSTEM_CENTER_SRC_PORT = "src_port";
- /**
- * The sshd protocol version.
- */
- public static String SYSTEM_CENTER_SSHD_PROTOCOL = "sshd_protocol";
- /**
- * The start mode of the given service.
- */
- public static String SYSTEM_CENTER_STARTMODE = "Startmode";
- /**
- * The number of seconds since the system (the src) has been "up."
- */
- public static String SYSTEM_CENTER_SYSTEMUPTIME = "SystemUptime";
- /**
- * The total amount of available memory on the system (the src).
- */
- public static String SYSTEM_CENTER_TOTALMBYTES = "TotalMBytes";
- /**
- * The amount of used memory on the system (the src).
- */
- public static String SYSTEM_CENTER_USEDMBYTES = "UsedMBytes";
- /**
- * The User Account present on the system (the src).
- */
- public static String SYSTEM_CENTER_USER = "user";
- /**
- * The number of updates the system (the src) is missing.
- */
- public static String SYSTEM_CENTER_UPDATES = "updates";
-
- // ----------------------------------
- // Traffic
- // ----------------------------------
-
- /**
- * The destination of the network traffic. If your field is named dest_host,
- * dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest to make it
- * CIM-compliant.
- */
- public static String TRAFFIC_DEST = "dest";
- /**
- * The name of the packet filtering device. If your field is named dvc_host,
- * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
- */
- public static String TRAFFIC_DVC = "dvc";
- /**
- * The source of the network traffic. If your field is named src_host,
- * src_ip, src_ipv6, or src_nt_host you can alias it as src to make it
- * CIM-compliant.
- */
- public static String TRAFFIC_SRC = "src";
-
- // ----------------------------------
- // Update
- // ----------------------------------
-
- /**
- * The name of the installed update.
- */
- public static String UPDATE_PACKAGE = "package";
-
- // ----------------------------------
- // User information updates
- // ----------------------------------
-
- /**
- * A user that has been affected by a change. For example, user fflanda
- * changed the name of user rhallen, so affected_user=rhallen.
- */
- public static String USER_INFO_UPDATES_AFFECTED_USER = "affected_user";
- /**
- * The user group affected by a change.
- */
- public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP = "affected_user_group";
- /**
- * The identifier of the user group affected by a change.
- */
- public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID = "affected_user_group_id";
- /**
- * The identifier of the user affected by a change.
- */
- public static String USER_INFO_UPDATES_AFFECTED_USER_ID = "affected_user_id";
- /**
- * The security context associated with the user affected by a change.
- */
- public static String USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE = "affected_user_privilege";
- /**
- * The name of the user affected by the recorded event.
- */
- public static String USER_INFO_UPDATES_USER = "user";
- /**
- * A user group that is the object of an event, expressed in human-readable
- * terms.
- */
- public static String USER_INFO_UPDATES_USER_GROUP = "user_group";
- /**
- * The numeric identifier assigned to the user group event object.
- */
- public static String USER_INFO_UPDATES_USER_GROUP_ID = "user_group_id";
- /**
- * The system-assigned identifier for the user affected by an event.
- */
- public static String USER_INFO_UPDATES_USER_ID = "user_id";
- /**
- * The security context associated with the object of an event (the affected
- * user).
- */
- public static String USER_INFO_UPDATES_USER_PRIVILEGE = "user_privilege";
- /**
- * The name of the user that is the subject of an event--the user executing
- * the action, in other words.
- */
- public static String USER_INFO_UPDATES_USER_SUBJECT = "user_subject";
- /**
- * The ID number of the user that is the subject of an event.
- */
- public static String USER_INFO_UPDATES_USER_SUBJECT_ID = "user_subject_id";
- /**
- * The security context associated with the subject of an event (the user
- * causing a change).
- */
- public static String USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE = "user_subject_privilege";
-
- // ----------------------------------
- // Vulnerability
- // ----------------------------------
-
- /**
- * The category of the discovered vulnerability.
- */
- public static String VULNERABILITY_CATEGORY = "category";
- /**
- * The host with the discovered vulnerability. If your field is named
- * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
- * to make it CIM-compliant.
- */
- public static String VULNERABILITY_DEST = "dest";
- /**
- * The operating system of the host containing the vulnerability detected on
- * the client (the src field), such as SuSE Security Update, or cups
- * security update.
- */
- public static String VULNERABILITY_OS = "os";
- /**
- * The severity of the discovered vulnerability.
- */
- public static String VULNERABILITY_SEVERITY = "severity";
- /**
- * The name of the vulnerability detected on the client (the src field),
- * such as SuSE Security Update, or cups security update.
- */
- public static String VULNERABILITY_SIGNATURE = "signature";
-
- // ----------------------------------
- // Windows administration
- // ----------------------------------
-
- /**
- * The object name (associated only with Windows).
- */
- public static String WINDOWS_ADMIN_OBJECT_NAME = "object_name";
- /**
- * The object type (associated only with Windows).
- */
- public static String WINDOWS_ADMIN_OBJECT_TYPE = "object_type";
- /**
- * The object handle (associated only with Windows).
- */
- public static String WINDOWS_ADMIN_OBJECT_HANDLE = "object_handle";
-
-
- public SplunkData(Map data) {
- this.eventMessage = new StringBuffer();
- this.eventData = data;
- for (String key : data.keySet()) {
- this.addPair(key, data.get(key));
- }
- }
-
- /**
- * Constructor.
- *
- * @param eventName
- * the event name
- * @param eventID
- * the event id
- * @param useInternalDate
- * Whether or not to add a date to the event string
- * @param quoteValues
- * Whether or not to put quotes around values
- */
- public SplunkData(String eventName, String eventID, boolean useInternalDate, boolean quoteValues) {
-
- this.eventMessage = new StringBuffer();
- this.quoteValues = quoteValues;
- this.useInternalDate = useInternalDate;
-
- addPair(PREFIX_NAME, eventName);
- addPair(PREFIX_EVENT_ID, eventID);
- }
-
- /**
- * Constructor.Will add internally generated date and put quotes around
- * values.
- *
- * @param eventName
- * the event name
- * @param eventID
- * the event ID
- */
- public SplunkData(String eventName, String eventID) {
-
- this(eventName, eventID, true, true);
- }
-
- /**
- * Default constructor
- */
- public SplunkData() {
- this.eventMessage = new StringBuffer();
- }
-
- /**
- * Simple shallow cloning method
- */
- public SplunkData clone() {
- SplunkData clone = new SplunkData();
- clone.quoteValues = this.quoteValues;
- clone.useInternalDate = this.useInternalDate;
- clone.eventMessage.append(this.eventMessage);
-
- return clone;
- }
-
-
- public Map getEventData() {
- return eventData;
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, char value) {
- addPair(key, String.valueOf(value));
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, boolean value) {
- addPair(key, String.valueOf(value));
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, double value) {
- addPair(key, String.valueOf(value));
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, long value) {
- addPair(key, String.valueOf(value));
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, int value) {
- addPair(key, String.valueOf(value));
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, Object value) {
- addPair(key, value.toString());
- }
-
- /**
- * Utility method for formatting Throwable,Error,Exception objects in a more
- * linear and Splunk friendly manner than printStackTrace
- *
- * @param throwable
- * the Throwable object to add to the event
- */
- public void addThrowable(Throwable throwable) {
-
- addThrowableObject(throwable, -1);
- }
-
- /**
- * Utility method for formatting Throwable,Error,Exception objects in a more
- * linear and Splunk friendly manner than printStackTrace
- *
- * @param throwable
- * the Throwable object to add to the event
- * @param stackTraceDepth
- * maximum number of stacktrace elements to log
- */
- public void addThrowable(Throwable throwable, int stackTraceDepth) {
-
- addThrowableObject(throwable, stackTraceDepth);
- }
-
- /**
- * Internal private method for formatting Throwable,Error,Exception objects
- * in a more linear and Splunk friendly manner than printStackTrace
- *
- * @param throwable
- * the Throwable object to add to the event
- * @param stackTraceDepth
- * maximum number of stacktrace elements to log, -1 for all
- */
-
- private void addThrowableObject(Throwable throwable, int stackTraceDepth) {
-
- addPair(THROWABLE_CLASS, throwable.getClass().getCanonicalName());
- addPair(THROWABLE_MESSAGE, throwable.getMessage());
- StackTraceElement[] elements = throwable.getStackTrace();
- StringBuffer sb = new StringBuffer();
- int depth = 0;
- for (StackTraceElement element : elements) {
- depth++;
- if (stackTraceDepth == -1 || stackTraceDepth >= depth)
- sb.append(element.toString()).append(",");
- else
- break;
-
- }
- addPair(THROWABLE_STACKTRACE_ELEMENTS, sb.toString());
- }
-
- /**
- * Add a key value pair
- *
- * @param key
- * @param value
- */
- public void addPair(String key, String value) {
-
- if (quoteValues)
- this.eventMessage.append(key).append(KVDELIM).append(QUOTE).append(value).append(QUOTE).append(PAIRDELIM);
- else
- this.eventMessage.append(key).append(KVDELIM).append(value).append(PAIRDELIM);
-
- }
-
- @Override
- /**
- * return the completed event message
- */
- public String toString() {
-
- String event = "";
-
- if (useInternalDate) {
- StringBuffer clonedMessage = new StringBuffer();
- clonedMessage.append(DATEFORMATTER.format(new Date())).append(PAIRDELIM).append(this.eventMessage);
- event = clonedMessage.toString();
- }
- else
- event = eventMessage.toString();
- // trim off trailing pair delim char(s)
- return event.substring(0, event.length() - PAIRDELIM.length());
- }
-
- public void setAcManagementDestNtDomain(String acManagementDestNtDomain) {
- addPair(AC_MANAGEMENT_DEST_NT_DOMAIN, acManagementDestNtDomain);
- }
-
- public void setAcManagementSignature(String acManagementSignature) {
- addPair(AC_MANAGEMENT_SIGNATURE, acManagementSignature);
- }
-
- public void setAcManagementSrcNtDomain(String acManagementSrcNtDomain) {
- addPair(AC_MANAGEMENT_SRC_NT_DOMAIN, acManagementSrcNtDomain);
- }
-
- public void setAuthAction(String authAction) {
- addPair(AUTH_ACTION, authAction);
- }
-
- public void setAuthApp(String authApp) {
- addPair(AUTH_APP, authApp);
- }
-
- public void setAuthDest(String authDest) {
- addPair(AUTH_DEST, authDest);
- }
-
- public void setAuthSrc(String authSrc) {
- addPair(AUTH_SRC, authSrc);
- }
-
- public void setAuthSrcUser(String authSrcUser) {
- addPair(AUTH_SRC_USER, authSrcUser);
- }
-
- public void setAuthUser(String authUser) {
- addPair(AUTH_USER, authUser);
- }
-
- public void setChangeEndpointProtectionAction(String changeEndpointProtectionAction) {
- addPair(CHANGE_ENDPOINT_PROTECTION_ACTION, changeEndpointProtectionAction);
- }
-
- public void setChangeEndpointProtectionChangeType(String changeEndpointProtectionChangeType) {
- addPair(CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE, changeEndpointProtectionChangeType);
- }
-
- public void setChangeEndpointProtectionDest(String changeEndpointProtectionDest) {
- addPair(CHANGE_ENDPOINT_PROTECTION_DEST, changeEndpointProtectionDest);
- }
-
- public void setChangeEndpointProtectionHash(String changeEndpointProtectionHash) {
- addPair(CHANGE_ENDPOINT_PROTECTION_HASH, changeEndpointProtectionHash);
- }
-
- public void setChangeEndpointProtectionGid(long changeEndpointProtectionGid) {
- addPair(CHANGE_ENDPOINT_PROTECTION_GID, changeEndpointProtectionGid);
- }
-
- public void setChangeEndpointProtectionIsdr(boolean changeEndpointProtectionIsdr) {
- addPair(CHANGE_ENDPOINT_PROTECTION_ISDR, changeEndpointProtectionIsdr);
- }
-
- public void setChangeEndpointProtectionMode(long changeEndpointProtectionMode) {
- addPair(CHANGE_ENDPOINT_PROTECTION_MODE, changeEndpointProtectionMode);
- }
-
- public void setChangeEndpointProtectionModtime(String changeEndpointProtectionModtime) {
- addPair(CHANGE_ENDPOINT_PROTECTION_MODTIME, changeEndpointProtectionModtime);
- }
-
- public void setChangeEndpointProtectionPath(String changeEndpointProtectionPath) {
- addPair(CHANGE_ENDPOINT_PROTECTION_PATH, changeEndpointProtectionPath);
- }
-
- public void setChangeEndpointProtectionSize(long changeEndpointProtectionSize) {
- addPair(CHANGE_ENDPOINT_PROTECTION_SIZE, changeEndpointProtectionSize);
- }
-
- public void setChangeEndpointProtectionUid(long changeEndpointProtectionUid) {
- addPair(CHANGE_ENDPOINT_PROTECTION_UID, changeEndpointProtectionUid);
- }
-
- public void setChangeNetworkProtectionAction(String changeNetworkProtectionAction) {
- addPair(CHANGE_NETWORK_PROTECTION_ACTION, changeNetworkProtectionAction);
- }
-
- public void setChangeNetworkProtectionCommand(String changeNetworkProtectionCommand) {
- addPair(CHANGE_NETWORK_PROTECTION_COMMAND, changeNetworkProtectionCommand);
- }
-
- public void setChangeNetworkProtectionDvc(String changeNetworkProtectionDvc) {
- addPair(CHANGE_NETWORK_PROTECTION_DVC, changeNetworkProtectionDvc);
- }
-
- public void setChangeNetworkProtectionUser(String changeNetworkProtectionUser) {
- addPair(CHANGE_NETWORK_PROTECTION_USER, changeNetworkProtectionUser);
- }
-
- public void setCommonCategory(String commonCategory) {
- addPair(COMMON_CATEGORY, commonCategory);
- }
-
- public void setCommonCount(String commonCount) {
- addPair(COMMON_COUNT, commonCount);
- }
-
- public void setCommonDesc(String commonDesc) {
- addPair(COMMON_DESC, commonDesc);
- }
-
- public void setCommonDhcpPool(String commonDhcpPool) {
- addPair(COMMON_DHCP_POOL, commonDhcpPool);
- }
-
- public void setCommonDuration(long commonDuration) {
- addPair(COMMON_DURATION, commonDuration);
- }
-
- public void setCommonDvcHost(String commonDvcHost) {
- addPair(COMMON_DVC_HOST, commonDvcHost);
- }
-
- public void setCommonDvcIp(String commonDvcIp) {
- addPair(COMMON_DVC_IP, commonDvcIp);
- }
-
- public void setCommonDvcIp6(String commonDvcIp6) {
- addPair(COMMON_DVC_IP6, commonDvcIp6);
- }
-
- public void setCommonDvcLocation(String commonDvcLocation) {
- addPair(COMMON_DVC_LOCATION, commonDvcLocation);
- }
-
- public void setCommonDvcMac(String commonDvcMac) {
- addPair(COMMON_DVC_MAC, commonDvcMac);
- }
-
- public void setCommonDvcNtDomain(String commonDvcNtDomain) {
- addPair(COMMON_DVC_NT_DOMAIN, commonDvcNtDomain);
- }
-
- public void setCommonDvcNtHost(String commonDvcNtHost) {
- addPair(COMMON_DVC_NT_HOST, commonDvcNtHost);
- }
-
- public void setCommonDvcTime(long commonDvcTime) {
- addPair(COMMON_DVC_TIME, commonDvcTime);
- }
-
- public void setCommonEndTime(long commonEndTime) {
- addPair(COMMON_END_TIME, commonEndTime);
- }
-
- public void setCommonEventId(long commonEventId) {
- addPair(COMMON_EVENT_ID, commonEventId);
- }
-
- public void setCommonLength(long commonLength) {
- addPair(COMMON_LENGTH, commonLength);
- }
-
- public void setCommonLogLevel(String commonLogLevel) {
- addPair(COMMON_LOG_LEVEL, commonLogLevel);
- }
-
- public void setCommonName(String commonName) {
- addPair(COMMON_NAME, commonName);
- }
-
- public void setCommonPid(long commonPid) {
- addPair(COMMON_PID, commonPid);
- }
-
- public void setCommonPriority(long commonPriority) {
- addPair(COMMON_PRIORITY, commonPriority);
- }
-
- public void setCommonProduct(String commonProduct) {
- addPair(COMMON_PRODUCT, commonProduct);
- }
-
- public void setCommonProductVersion(long commonProductVersion) {
- addPair(COMMON_PRODUCT_VERSION, commonProductVersion);
- }
-
- public void setCommonReason(String commonReason) {
- addPair(COMMON_REASON, commonReason);
- }
-
- public void setCommonResult(String commonResult) {
- addPair(COMMON_RESULT, commonResult);
- }
-
- public void setCommonSeverity(String commonSeverity) {
- addPair(COMMON_SEVERITY, commonSeverity);
- }
-
- public void setCommonStartTime(long commonStartTime) {
- addPair(COMMON_START_TIME, commonStartTime);
- }
-
- public void setCommonTransactionId(String commonTransactionId) {
- addPair(COMMON_TRANSACTION_ID, commonTransactionId);
- }
-
- public void setCommonUrl(String commonUrl) {
- addPair(COMMON_URL, commonUrl);
- }
-
- public void setCommonVendor(String commonVendor) {
- addPair(COMMON_VENDOR, commonVendor);
- }
-
- public void setDnsDestDomain(String dnsDestDomain) {
- addPair(DNS_DEST_DOMAIN, dnsDestDomain);
- }
-
- public void setDnsDestRecord(String dnsDestRecord) {
- addPair(DNS_DEST_RECORD, dnsDestRecord);
- }
-
- public void setDnsDestZone(String dnsDestZone) {
- addPair(DNS_DEST_ZONE, dnsDestZone);
- }
-
- public void setDnsRecordClass(String dnsRecordClass) {
- addPair(DNS_RECORD_CLASS, dnsRecordClass);
- }
-
- public void setDnsRecordType(String dnsRecordType) {
- addPair(DNS_RECORD_TYPE, dnsRecordType);
- }
-
- public void setDnsSrcDomain(String dnsSrcDomain) {
- addPair(DNS_SRC_DOMAIN, dnsSrcDomain);
- }
-
- public void setDnsSrcRecord(String dnsSrcRecord) {
- addPair(DNS_SRC_RECORD, dnsSrcRecord);
- }
-
- public void setDnsSrcZone(String dnsSrcZone) {
- addPair(DNS_SRC_ZONE, dnsSrcZone);
- }
-
- public void setEmailRecipient(String emailRecipient) {
- addPair(EMAIL_RECIPIENT, emailRecipient);
- }
-
- public void setEmailSender(String emailSender) {
- addPair(EMAIL_SENDER, emailSender);
- }
-
- public void setEmailSubject(String emailSubject) {
- addPair(EMAIL_SUBJECT, emailSubject);
- }
-
- public void setFileAccessTime(long fileAccessTime) {
- addPair(FILE_ACCESS_TIME, fileAccessTime);
- }
-
- public void setFileCreateTime(long fileCreateTime) {
- addPair(FILE_CREATE_TIME, fileCreateTime);
- }
-
- public void setFileHash(String fileHash) {
- addPair(FILE_HASH, fileHash);
- }
-
- public void setFileModifyTime(long fileModifyTime) {
- addPair(FILE_MODIFY_TIME, fileModifyTime);
- }
-
- public void setFileName(String fileName) {
- addPair(FILE_NAME, fileName);
- }
-
- public void setFilePath(String filePath) {
- addPair(FILE_PATH, filePath);
- }
-
- public void setFilePermission(String filePermission) {
- addPair(FILE_PERMISSION, filePermission);
- }
-
- public void setFileSize(long fileSize) {
- addPair(FILE_SIZE, fileSize);
- }
-
- public void setIntrusionDetectionCategory(String intrusionDetectionCategory) {
- addPair(INTRUSION_DETECTION_CATEGORY, intrusionDetectionCategory);
- }
-
- public void setIntrusionDetectionDest(String intrusionDetectionDest) {
- addPair(INTRUSION_DETECTION_DEST, intrusionDetectionDest);
- }
-
- public void setIntrusionDetectionDvc(String intrusionDetectionDvc) {
- addPair(INTRUSION_DETECTION_DVC, intrusionDetectionDvc);
- }
-
- public void setIntrusionDetectionIdsType(String intrusionDetectionIdsType) {
- addPair(INTRUSION_DETECTION_IDS_TYPE, intrusionDetectionIdsType);
- }
-
- public void setIntrusionDetectionProduct(String intrusionDetectionProduct) {
- addPair(INTRUSION_DETECTION_PRODUCT, intrusionDetectionProduct);
- }
-
- public void setIntrusionDetectionSeverity(String intrusionDetectionSeverity) {
- addPair(INTRUSION_DETECTION_SEVERITY, intrusionDetectionSeverity);
- }
-
- public void setIntrusionDetectionSignature(String intrusionDetectionSignature) {
- addPair(INTRUSION_DETECTION_SIGNATURE, intrusionDetectionSignature);
- }
-
- public void setIntrusionDetectionSrc(String intrusionDetectionSrc) {
- addPair(INTRUSION_DETECTION_SRC, intrusionDetectionSrc);
- }
-
- public void setIntrusionDetectionUser(String intrusionDetectionUser) {
- addPair(INTRUSION_DETECTION_USER, intrusionDetectionUser);
- }
-
- public void setIntrusionDetectionVendor(String intrusionDetectionVendor) {
- addPair(INTRUSION_DETECTION_VENDOR, intrusionDetectionVendor);
- }
-
- public void setMalwareEndpointProtectionAction(String malwareEndpointProtectionAction) {
- addPair(MALWARE_ENDPOINT_PROTECTION_ACTION, malwareEndpointProtectionAction);
- }
-
- public void setMalwareEndpointProtectionDestNtDomain(String malwareEndpointProtectionDestNtDomain) {
- addPair(MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN, malwareEndpointProtectionDestNtDomain);
- }
-
- public void setMalwareEndpointProtectionFileHash(String malwareEndpointProtectionFileHash) {
- addPair(MALWARE_ENDPOINT_PROTECTION_FILE_HASH, malwareEndpointProtectionFileHash);
- }
-
- public void setMalwareEndpointProtectionFileName(String malwareEndpointProtectionFileName) {
- addPair(MALWARE_ENDPOINT_PROTECTION_FILE_NAME, malwareEndpointProtectionFileName);
- }
-
- public void setMalwareEndpointProtectionFilePath(String malwareEndpointProtectionFilePath) {
- addPair(MALWARE_ENDPOINT_PROTECTION_FILE_PATH, malwareEndpointProtectionFilePath);
- }
-
- public void setMalwareEndpointProtectionProduct(String malwareEndpointProtectionProduct) {
- addPair(MALWARE_ENDPOINT_PROTECTION_PRODUCT, malwareEndpointProtectionProduct);
- }
-
- public void setMalwareEndpointProtectionProductVersion(String malwareEndpointProtectionProductVersion) {
- addPair(MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION, malwareEndpointProtectionProductVersion);
- }
-
- public void setMalwareEndpointProtectionSignature(String malwareEndpointProtectionSignature) {
- addPair(MALWARE_ENDPOINT_PROTECTION_SIGNATURE, malwareEndpointProtectionSignature);
- }
-
- public void setMalwareEndpointProtectionSignatureVersion(String malwareEndpointProtectionSignatureVersion) {
- addPair(MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION, malwareEndpointProtectionSignatureVersion);
- }
-
- public void setMalwareEndpointProtectionDest(String malwareEndpointProtectionDest) {
- addPair(MALWARE_ENDPOINT_PROTECTION_DEST, malwareEndpointProtectionDest);
- }
-
- public void setMalwareEndpointProtectionSrcNtDomain(String malwareEndpointProtectionSrcNtDomain) {
- addPair(MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN, malwareEndpointProtectionSrcNtDomain);
- }
-
- public void setMalwareEndpointProtectionUser(String malwareEndpointProtectionUser) {
- addPair(MALWARE_ENDPOINT_PROTECTION_USER, malwareEndpointProtectionUser);
- }
-
- public void setMalwareEndpointProtectionVendor(String malwareEndpointProtectionVendor) {
- addPair(MALWARE_ENDPOINT_PROTECTION_VENDOR, malwareEndpointProtectionVendor);
- }
-
- public void setMalwareNetworkProtectionProduct(String malwareNetworkProtectionProduct) {
- addPair(MALWARE_NETWORK_PROTECTION_PRODUCT, malwareNetworkProtectionProduct);
- }
-
- public void setMalwareNetworkProtectionSeverity(String malwareNetworkProtectionSeverity) {
- addPair(MALWARE_NETWORK_PROTECTION_SEVERITY, malwareNetworkProtectionSeverity);
- }
-
- public void setMalwareNetworkProtectionVendor(String malwareNetworkProtectionVendor) {
- addPair(MALWARE_NETWORK_PROTECTION_VENDOR, malwareNetworkProtectionVendor);
- }
-
- public void setNetworkTrafficEssAction(String networkTrafficEssAction) {
- addPair(NETWORK_TRAFFIC_ESS_ACTION, networkTrafficEssAction);
- }
-
- public void setNetworkTrafficEssDestPort(int networkTrafficEssDestPort) {
- addPair(NETWORK_TRAFFIC_ESS_DEST_PORT, networkTrafficEssDestPort);
- }
-
- public void setNetworkTrafficEssProduct(String networkTrafficEssProduct) {
- addPair(NETWORK_TRAFFIC_ESS_PRODUCT, networkTrafficEssProduct);
- }
-
- public void setNetworkTrafficEssSrcPort(int networkTrafficEssSrcPort) {
- addPair(NETWORK_TRAFFIC_ESS_SRC_PORT, networkTrafficEssSrcPort);
- }
-
- public void setNetworkTrafficEssVendor(String networkTrafficEssVendor) {
- addPair(NETWORK_TRAFFIC_ESS_VENDOR, networkTrafficEssVendor);
- }
-
- public void setNetworkTrafficGenericAppLayer(String networkTrafficGenericAppLayer) {
- addPair(NETWORK_TRAFFIC_GENERIC_APP_LAYER, networkTrafficGenericAppLayer);
- }
-
- public void setNetworkTrafficGenericBytesIn(long networkTrafficGenericBytesIn) {
- addPair(NETWORK_TRAFFIC_GENERIC_BYTES_IN, networkTrafficGenericBytesIn);
- }
-
- public void setNetworkTrafficGenericBytesOut(long networkTrafficGenericBytesOut) {
- addPair(NETWORK_TRAFFIC_GENERIC_BYTES_OUT, networkTrafficGenericBytesOut);
- }
-
- public void setNetworkTrafficGenericChannel(String networkTrafficGenericChannel) {
- addPair(NETWORK_TRAFFIC_GENERIC_CHANNEL, networkTrafficGenericChannel);
- }
-
- public void setNetworkTrafficGenericCve(String networkTrafficGenericCve) {
- addPair(NETWORK_TRAFFIC_GENERIC_CVE, networkTrafficGenericCve);
- }
-
- public void setNetworkTrafficGenericDestApp(String networkTrafficGenericDestApp) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_APP, networkTrafficGenericDestApp);
- }
-
- public void setNetworkTrafficGenericDestCncChannel(String networkTrafficGenericDestCncChannel) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL, networkTrafficGenericDestCncChannel);
- }
-
- public void setNetworkTrafficGenericDestCncName(String networkTrafficGenericDestCncName) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME, networkTrafficGenericDestCncName);
- }
-
- public void setNetworkTrafficGenericDestCncPort(String networkTrafficGenericDestCncPort) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT, networkTrafficGenericDestCncPort);
- }
-
- public void setNetworkTrafficGenericDestCountry(String networkTrafficGenericDestCountry) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY, networkTrafficGenericDestCountry);
- }
-
- public void setNetworkTrafficGenericDestHost(String networkTrafficGenericDestHost) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_HOST, networkTrafficGenericDestHost);
- }
-
- public void setNetworkTrafficGenericDestInt(String networkTrafficGenericDestInt) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_INT, networkTrafficGenericDestInt);
- }
-
- public void setNetworkTrafficGenericDestIp(String networkTrafficGenericDestIp) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_IP, networkTrafficGenericDestIp);
- }
-
- public void setNetworkTrafficGenericDestIpv6(String networkTrafficGenericDestIpv6) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_IPV6, networkTrafficGenericDestIpv6);
- }
-
- public void setNetworkTrafficGenericDestLat(int networkTrafficGenericDestLat) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_LAT, networkTrafficGenericDestLat);
- }
-
- public void setNetworkTrafficGenericDestLong(int networkTrafficGenericDestLong) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_LONG, networkTrafficGenericDestLong);
- }
-
- public void setNetworkTrafficGenericDestMac(String networkTrafficGenericDestMac) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_MAC, networkTrafficGenericDestMac);
- }
-
- public void setNetworkTrafficGenericDestNtDomain(String networkTrafficGenericDestNtDomain) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN, networkTrafficGenericDestNtDomain);
- }
-
- public void setNetworkTrafficGenericDestNtHost(String networkTrafficGenericDestNtHost) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST, networkTrafficGenericDestNtHost);
- }
-
- public void setNetworkTrafficGenericDestPort(int networkTrafficGenericDestPort) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_PORT, networkTrafficGenericDestPort);
- }
-
- public void setNetworkTrafficGenericDestTranslatedIp(String networkTrafficGenericDestTranslatedIp) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP, networkTrafficGenericDestTranslatedIp);
- }
-
- public void setNetworkTrafficGenericDestTranslatedPort(int networkTrafficGenericDestTranslatedPort) {
- addPair(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT, networkTrafficGenericDestTranslatedPort);
- }
-
- public void setNetworkTrafficGenericIpVersion(int networkTrafficGenericIpVersion) {
- addPair(NETWORK_TRAFFIC_GENERIC_IP_VERSION, networkTrafficGenericIpVersion);
- }
-
- public void setNetworkTrafficGenericOutboundInterface(String networkTrafficGenericOutboundInterface) {
- addPair(NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE, networkTrafficGenericOutboundInterface);
- }
-
- public void setNetworkTrafficGenericPacketsIn(long networkTrafficGenericPacketsIn) {
- addPair(NETWORK_TRAFFIC_GENERIC_PACKETS_IN, networkTrafficGenericPacketsIn);
- }
-
- public void setNetworkTrafficGenericPacketsOut(long networkTrafficGenericPacketsOut) {
- addPair(NETWORK_TRAFFIC_GENERIC_PACKETS_OUT, networkTrafficGenericPacketsOut);
- }
-
- public void setNetworkTrafficGenericProto(String networkTrafficGenericProto) {
- addPair(NETWORK_TRAFFIC_GENERIC_PROTO, networkTrafficGenericProto);
- }
-
- public void setNetworkTrafficGenericSessionId(String networkTrafficGenericSessionId) {
- addPair(NETWORK_TRAFFIC_GENERIC_SESSION_ID, networkTrafficGenericSessionId);
- }
-
- public void setNetworkTrafficGenericSsid(String networkTrafficGenericSsid) {
- addPair(NETWORK_TRAFFIC_GENERIC_SSID, networkTrafficGenericSsid);
- }
-
- public void setNetworkTrafficGenericSrcCountry(String networkTrafficGenericSrcCountry) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY, networkTrafficGenericSrcCountry);
- }
-
- public void setNetworkTrafficGenericSrcHost(String networkTrafficGenericSrcHost) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_HOST, networkTrafficGenericSrcHost);
- }
-
- public void setNetworkTrafficGenericSrcInt(String networkTrafficGenericSrcInt) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_INT, networkTrafficGenericSrcInt);
- }
-
- public void setNetworkTrafficGenericSrcIp(String networkTrafficGenericSrcIp) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_IP, networkTrafficGenericSrcIp);
- }
-
- public void setNetworkTrafficGenericSrcIpv6(String networkTrafficGenericSrcIpv6) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_IPV6, networkTrafficGenericSrcIpv6);
- }
-
- public void setNetworkTrafficGenericSrcLat(int networkTrafficGenericSrcLat) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_LAT, networkTrafficGenericSrcLat);
- }
-
- public void setNetworkTrafficGenericSrcLong(int networkTrafficGenericSrcLong) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_LONG, networkTrafficGenericSrcLong);
- }
-
- public void setNetworkTrafficGenericSrcMac(String networkTrafficGenericSrcMac) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_MAC, networkTrafficGenericSrcMac);
- }
-
- public void setNetworkTrafficGenericSrcNtDomain(String networkTrafficGenericSrcNtDomain) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN, networkTrafficGenericSrcNtDomain);
- }
-
- public void setNetworkTrafficGenericSrcNtHost(String networkTrafficGenericSrcNtHost) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST, networkTrafficGenericSrcNtHost);
- }
-
- public void setNetworkTrafficGenericSrcPort(int networkTrafficGenericSrcPort) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_PORT, networkTrafficGenericSrcPort);
- }
-
- public void setNetworkTrafficGenericSrcTranslatedIp(String networkTrafficGenericSrcTranslatedIp) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP, networkTrafficGenericSrcTranslatedIp);
- }
-
- public void setNetworkTrafficGenericSrcTranslatedPort(int networkTrafficGenericSrcTranslatedPort) {
- addPair(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT, networkTrafficGenericSrcTranslatedPort);
- }
-
- public void setNetworkTrafficGenericSyslogId(String networkTrafficGenericSyslogId) {
- addPair(NETWORK_TRAFFIC_GENERIC_SYSLOG_ID, networkTrafficGenericSyslogId);
- }
-
- public void setNetworkTrafficGenericSyslogPriority(String networkTrafficGenericSyslogPriority) {
- addPair(NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY, networkTrafficGenericSyslogPriority);
- }
-
- public void setNetworkTrafficGenericTcpFlag(String networkTrafficGenericTcpFlag) {
- addPair(NETWORK_TRAFFIC_GENERIC_TCP_FLAG, networkTrafficGenericTcpFlag);
- }
-
- public void setNetworkTrafficGenericTos(String networkTrafficGenericTos) {
- addPair(NETWORK_TRAFFIC_GENERIC_TOS, networkTrafficGenericTos);
- }
-
- public void setNetworkTrafficGenericTransport(String networkTrafficGenericTransport) {
- addPair(NETWORK_TRAFFIC_GENERIC_TRANSPORT, networkTrafficGenericTransport);
- }
-
- public void setNetworkTrafficGenericTtl(int networkTrafficGenericTtl) {
- addPair(NETWORK_TRAFFIC_GENERIC_TTL, networkTrafficGenericTtl);
- }
-
- public void setNetworkTrafficGenericVlanId(long networkTrafficGenericVlanId) {
- addPair(NETWORK_TRAFFIC_GENERIC_VLAN_ID, networkTrafficGenericVlanId);
- }
-
- public void setNetworkTrafficGenericVlanName(String networkTrafficGenericVlanName) {
- addPair(NETWORK_TRAFFIC_GENERIC_VLAN_NAME, networkTrafficGenericVlanName);
- }
-
- public void setPacketFilteringAction(String packetFilteringAction) {
- addPair(PACKET_FILTERING_ACTION, packetFilteringAction);
- }
-
- public void setPacketFilteringDestPort(int packetFilteringDestPort) {
- addPair(PACKET_FILTERING_DEST_PORT, packetFilteringDestPort);
- }
-
- public void setPacketFilteringDirection(String packetFilteringDirection) {
- addPair(PACKET_FILTERING_DIRECTION, packetFilteringDirection);
- }
-
- public void setPacketFilteringDvc(String packetFilteringDvc) {
- addPair(PACKET_FILTERING_DVC, packetFilteringDvc);
- }
-
- public void setPacketFilteringRule(String packetFilteringRule) {
- addPair(PACKET_FILTERING_RULE, packetFilteringRule);
- }
-
- public void setPacketFilteringSvcPort(int packetFilteringSvcPort) {
- addPair(PACKET_FILTERING_SVC_PORT, packetFilteringSvcPort);
- }
-
- public void setProxyAction(String proxyAction) {
- addPair(PROXY_ACTION, proxyAction);
- }
-
- public void setProxyDest(String proxyDest) {
- addPair(PROXY_DEST, proxyDest);
- }
-
- public void setProxyHttpContentType(String proxyHttpContentType) {
- addPair(PROXY_HTTP_CONTENT_TYPE, proxyHttpContentType);
- }
-
- public void setProxyHttpMethod(String proxyHttpMethod) {
- addPair(PROXY_HTTP_METHOD, proxyHttpMethod);
- }
-
- public void setProxyHttpRefer(String proxyHttpRefer) {
- addPair(PROXY_HTTP_REFER, proxyHttpRefer);
- }
-
- public void setProxyHttpResponse(int proxyHttpResponse) {
- addPair(PROXY_HTTP_RESPONSE, proxyHttpResponse);
- }
-
- public void setProxyHttpUserAgent(String proxyHttpUserAgent) {
- addPair(PROXY_HTTP_USER_AGENT, proxyHttpUserAgent);
- }
-
- public void setProxyProduct(String proxyProduct) {
- addPair(PROXY_PRODUCT, proxyProduct);
- }
-
- public void setProxySrc(String proxySrc) {
- addPair(PROXY_SRC, proxySrc);
- }
-
- public void setProxyStatus(int proxyStatus) {
- addPair(PROXY_STATUS, proxyStatus);
- }
-
- public void setProxyUser(String proxyUser) {
- addPair(PROXY_USER, proxyUser);
- }
-
- public void setProxyUrl(String proxyUrl) {
- addPair(PROXY_URL, proxyUrl);
- }
-
- public void setProxyVendor(String proxyVendor) {
- addPair(PROXY_VENDOR, proxyVendor);
- }
-
- public void setSystemCenterApp(String systemCenterApp) {
- addPair(SYSTEM_CENTER_APP, systemCenterApp);
- }
-
- public void setSystemCenterFreembytes(long systemCenterFreembytes) {
- addPair(SYSTEM_CENTER_FREEMBYTES, systemCenterFreembytes);
- }
-
- public void setSystemCenterKernelRelease(String systemCenterKernelRelease) {
- addPair(SYSTEM_CENTER_KERNEL_RELEASE, systemCenterKernelRelease);
- }
-
- public void setSystemCenterLabel(String systemCenterLabel) {
- addPair(SYSTEM_CENTER_LABEL, systemCenterLabel);
- }
-
- public void setSystemCenterMount(String systemCenterMount) {
- addPair(SYSTEM_CENTER_MOUNT, systemCenterMount);
- }
-
- public void setSystemCenterOs(String systemCenterOs) {
- addPair(SYSTEM_CENTER_OS, systemCenterOs);
- }
-
- public void setSystemCenterPercentprocessortime(int systemCenterPercentprocessortime) {
- addPair(SYSTEM_CENTER_PERCENTPROCESSORTIME, systemCenterPercentprocessortime);
- }
-
- public void setSystemCenterSetlocaldefs(int systemCenterSetlocaldefs) {
- addPair(SYSTEM_CENTER_SETLOCALDEFS, systemCenterSetlocaldefs);
- }
-
- public void setSystemCenterSelinux(String systemCenterSelinux) {
- addPair(SYSTEM_CENTER_SELINUX, systemCenterSelinux);
- }
-
- public void setSystemCenterSelinuxtype(String systemCenterSelinuxtype) {
- addPair(SYSTEM_CENTER_SELINUXTYPE, systemCenterSelinuxtype);
- }
-
- public void setSystemCenterShell(String systemCenterShell) {
- addPair(SYSTEM_CENTER_SHELL, systemCenterShell);
- }
-
- public void setSystemCenterSrcPort(int systemCenterSrcPort) {
- addPair(SYSTEM_CENTER_SRC_PORT, systemCenterSrcPort);
- }
-
- public void setSystemCenterSshdProtocol(String systemCenterSshdProtocol) {
- addPair(SYSTEM_CENTER_SSHD_PROTOCOL, systemCenterSshdProtocol);
- }
-
- public void setSystemCenterStartmode(String systemCenterStartmode) {
- addPair(SYSTEM_CENTER_STARTMODE, systemCenterStartmode);
- }
-
- public void setSystemCenterSystemuptime(long systemCenterSystemuptime) {
- addPair(SYSTEM_CENTER_SYSTEMUPTIME, systemCenterSystemuptime);
- }
-
- public void setSystemCenterTotalmbytes(long systemCenterTotalmbytes) {
- addPair(SYSTEM_CENTER_TOTALMBYTES, systemCenterTotalmbytes);
- }
-
- public void setSystemCenterUsedmbytes(long systemCenterUsedmbytes) {
- addPair(SYSTEM_CENTER_USEDMBYTES, systemCenterUsedmbytes);
- }
-
- public void setSystemCenterUser(String systemCenterUser) {
- addPair(SYSTEM_CENTER_USER, systemCenterUser);
- }
-
- public void setSystemCenterUpdates(long systemCenterUpdates) {
- addPair(SYSTEM_CENTER_UPDATES, systemCenterUpdates);
- }
-
- public void setTrafficDest(String trafficDest) {
- addPair(TRAFFIC_DEST, trafficDest);
- }
-
- public void setTrafficDvc(String trafficDvc) {
- addPair(TRAFFIC_DVC, trafficDvc);
- }
-
- public void setTrafficSrc(String trafficSrc) {
- addPair(TRAFFIC_SRC, trafficSrc);
- }
-
- public void setUpdatePackage(String updatePackage) {
- addPair(UPDATE_PACKAGE, updatePackage);
- }
-
- public void setUserInfoUpdatesAffectedUser(String userInfoUpdatesAffectedUser) {
- addPair(USER_INFO_UPDATES_AFFECTED_USER, userInfoUpdatesAffectedUser);
- }
-
- public void setUserInfoUpdatesAffectedUserGroup(String userInfoUpdatesAffectedUserGroup) {
- addPair(USER_INFO_UPDATES_AFFECTED_USER_GROUP, userInfoUpdatesAffectedUserGroup);
- }
-
- public void setUserInfoUpdatesAffectedUserGroupId(int userInfoUpdatesAffectedUserGroupId) {
- addPair(USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID, userInfoUpdatesAffectedUserGroupId);
- }
-
- public void setUserInfoUpdatesAffectedUserId(int userInfoUpdatesAffectedUserId) {
- addPair(USER_INFO_UPDATES_AFFECTED_USER_ID, userInfoUpdatesAffectedUserId);
- }
-
- public void setUserInfoUpdatesAffectedUserPrivilege(String userInfoUpdatesAffectedUserPrivilege) {
- addPair(USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE, userInfoUpdatesAffectedUserPrivilege);
- }
-
- public void setUserInfoUpdatesUser(String userInfoUpdatesUser) {
- addPair(USER_INFO_UPDATES_USER, userInfoUpdatesUser);
- }
-
- public void setUserInfoUpdatesUserGroup(String userInfoUpdatesUserGroup) {
- addPair(USER_INFO_UPDATES_USER_GROUP, userInfoUpdatesUserGroup);
- }
-
- public void setUserInfoUpdatesUserGroupId(int userInfoUpdatesUserGroupId) {
- addPair(USER_INFO_UPDATES_USER_GROUP_ID, userInfoUpdatesUserGroupId);
- }
-
- public void setUserInfoUpdatesUserId(int userInfoUpdatesUserId) {
- addPair(USER_INFO_UPDATES_USER_ID, userInfoUpdatesUserId);
- }
-
- public void setUserInfoUpdatesUserPrivilege(String userInfoUpdatesUserPrivilege) {
- addPair(USER_INFO_UPDATES_USER_PRIVILEGE, userInfoUpdatesUserPrivilege);
- }
-
- public void setUserInfoUpdatesUserSubject(String userInfoUpdatesUserSubject) {
- addPair(USER_INFO_UPDATES_USER_SUBJECT, userInfoUpdatesUserSubject);
- }
-
- public void setUserInfoUpdatesUserSubjectId(int userInfoUpdatesUserSubjectId) {
- addPair(USER_INFO_UPDATES_USER_SUBJECT_ID, userInfoUpdatesUserSubjectId);
- }
-
- public void setUserInfoUpdatesUserSubjectPrivilege(String userInfoUpdatesUserSubjectPrivilege) {
- addPair(USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE, userInfoUpdatesUserSubjectPrivilege);
- }
-
- public void setVulnerabilityCategory(String vulnerabilityCategory) {
- addPair(VULNERABILITY_CATEGORY, vulnerabilityCategory);
- }
-
- public void setVulnerabilityDest(String vulnerabilityDest) {
- addPair(VULNERABILITY_DEST, vulnerabilityDest);
- }
-
- public void setVulnerabilityOs(String vulnerabilityOs) {
- addPair(VULNERABILITY_OS, vulnerabilityOs);
- }
-
- public void setVulnerabilitySeverity(String vulnerabilitySeverity) {
- addPair(VULNERABILITY_SEVERITY, vulnerabilitySeverity);
- }
-
- public void setVulnerabilitySignature(String vulnerabilitySignature) {
- addPair(VULNERABILITY_SIGNATURE, vulnerabilitySignature);
- }
-
- public void setWindowsAdminObjectName(String windowsAdminObjectName) {
- addPair(WINDOWS_ADMIN_OBJECT_NAME, windowsAdminObjectName);
- }
-
- public void setWindowsAdminObjectType(String windowsAdminObjectType) {
- addPair(WINDOWS_ADMIN_OBJECT_TYPE, windowsAdminObjectType);
- }
-
- public void setWindowsAdminObjectHandle(String windowsAdminObjectHandle) {
- addPair(WINDOWS_ADMIN_OBJECT_HANDLE, windowsAdminObjectHandle);
- }
-
-
-}
diff --git a/src/main/java/org/springframework/integration/splunk/event/AcManagementEvent.java b/src/main/java/org/springframework/integration/splunk/event/AcManagementEvent.java
new file mode 100644
index 0000000..4a88cd4
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/AcManagementEvent.java
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+
+/**
+ * Splunk data entity
+ *
+ * @author Jarred Li
+ * @author Damien Dallimore damien@dtdsoftware.com
+ * @author David Turanski
+ * @since 1.0
+ *
+ */
+@SuppressWarnings("serial")
+public class AcManagementEvent extends SplunkEvent {
+
+
+ /**
+ * Splunk Common Information Model(CIM) Fields
+ */
+
+ // ------------------
+ // Account management
+ // ------------------
+
+ /**
+ * The domain containing the user that is affected by the account management
+ * event.
+ */
+ public static String AC_MANAGEMENT_DEST_NT_DOMAIN = "dest_nt_domain";
+ /**
+ * Description of the account management change performed.
+ */
+ public static String AC_MANAGEMENT_SIGNATURE = "signature";
+ /**
+ * The NT source of the destination. In the case of an account management
+ * event, this is the domain that contains the user that generated the
+ * event.
+ */
+ public static String AC_MANAGEMENT_SRC_NT_DOMAIN = "src_nt_domain";
+
+ public void setAcManagementDestNtDomain(String acManagementDestNtDomain) {
+ addPair(AC_MANAGEMENT_DEST_NT_DOMAIN, acManagementDestNtDomain);
+ }
+
+ public void setAcManagementSignature(String acManagementSignature) {
+ addPair(AC_MANAGEMENT_SIGNATURE, acManagementSignature);
+ }
+
+ public void setAcManagementSrcNtDomain(String acManagementSrcNtDomain) {
+ addPair(AC_MANAGEMENT_SRC_NT_DOMAIN, acManagementSrcNtDomain);
+ }
+}
\ No newline at end of file
diff --git a/src/main/java/org/springframework/integration/splunk/event/AuthEvent.java b/src/main/java/org/springframework/integration/splunk/event/AuthEvent.java
new file mode 100644
index 0000000..790452f
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/AuthEvent.java
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class AuthEvent extends SplunkEvent {
+ // ----------------------------------
+ // Authentication - Access protection
+ // ----------------------------------
+
+ /**
+ * The action performed on the resource. success, failure
+ */
+ public static String AUTH_ACTION = "action";
+ /**
+ * The application involved in the event (such as ssh, spunk, win:local).
+ */
+ public static String AUTH_APP = "app";
+ /**
+ * The target involved in the authentication. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public static String AUTH_DEST = "dest";
+ /**
+ * The source involved in the authentication. In the case of endpoint
+ * protection authentication the src is the client. If your field is named
+ * src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src to
+ * make it CIM-compliant.. It is required for all events dealing with
+ * endpoint protection (Authentication, change analysis, malware, system
+ * center, and update). Note: Do not confuse this with the event source or
+ * sourcetype fields.
+ */
+ public static String AUTH_SRC = "src";
+ /**
+ * In privilege escalation events, src_user represents the user who
+ * initiated the privilege escalation.
+ */
+ public static String AUTH_SRC_USER = "src_user";
+ /**
+ * The name of the user involved in the event, or who initiated the event.
+ * For authentication privilege escalation events this should represent the
+ * user targeted by the escalation.
+ */
+ public static String AUTH_USER = "user";
+
+ public void setAuthApp(String authApp) {
+ addPair(AUTH_APP, authApp);
+ }
+
+ public void setAuthDest(String authDest) {
+ addPair(AUTH_DEST, authDest);
+ }
+
+ public void setAuthSrc(String authSrc) {
+ addPair(AUTH_SRC, authSrc);
+ }
+
+ public void setAuthSrcUser(String authSrcUser) {
+ addPair(AUTH_SRC_USER, authSrcUser);
+ }
+
+ public void setAuthUser(String authUser) {
+ addPair(AUTH_USER, authUser);
+ }
+
+ public void setAuthAction(String authAction) {
+ addPair(AUTH_ACTION, authAction);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/DnsEvent.java b/src/main/java/org/springframework/integration/splunk/event/DnsEvent.java
new file mode 100644
index 0000000..b066360
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/DnsEvent.java
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class DnsEvent extends SplunkEvent {
+ // ----------------------------------
+ // DNS protocol
+ // ----------------------------------
+
+ /**
+ * The DNS domain that has been queried.
+ */
+ public static String DNS_DEST_DOMAIN = "dest_domain";
+ /**
+ * The remote DNS resource record being acted upon.
+ */
+ public static String DNS_DEST_RECORD = "dest_record";
+ /**
+ * The DNS zone that is being received by the slave as part of a zone
+ * transfer.
+ */
+ public static String DNS_DEST_ZONE = "dest_zone";
+ /**
+ * The DNS resource record class.
+ */
+ public static String DNS_RECORD_CLASS = "record_class";
+ /**
+ * The DNS resource record type.
+ *
+ * @see see
+ * this Wikipedia article on DNS record types
+ */
+ public static String DNS_RECORD_TYPE = "record_type";
+ /**
+ * The local DNS domain that is being queried.
+ */
+ public static String DNS_SRC_DOMAIN = "src_domain";
+ /**
+ * The local DNS resource record being acted upon.
+ */
+ public static String DNS_SRC_RECORD = "src_record";
+ /**
+ * The DNS zone that is being transferred by the master as part of a zone
+ * transfer.
+ */
+ public static String DNS_SRC_ZONE = "src_zone";
+ public void setDnsDestDomain(String dnsDestDomain) {
+ addPair(DNS_DEST_DOMAIN, dnsDestDomain);
+ }
+
+ public void setDnsDestRecord(String dnsDestRecord) {
+ addPair(DNS_DEST_RECORD, dnsDestRecord);
+ }
+
+ public void setDnsDestZone(String dnsDestZone) {
+ addPair(DNS_DEST_ZONE, dnsDestZone);
+ }
+
+ public void setDnsRecordClass(String dnsRecordClass) {
+ addPair(DNS_RECORD_CLASS, dnsRecordClass);
+ }
+
+ public void setDnsRecordType(String dnsRecordType) {
+ addPair(DNS_RECORD_TYPE, dnsRecordType);
+ }
+
+ public void setDnsSrcDomain(String dnsSrcDomain) {
+ addPair(DNS_SRC_DOMAIN, dnsSrcDomain);
+ }
+
+ public void setDnsSrcRecord(String dnsSrcRecord) {
+ addPair(DNS_SRC_RECORD, dnsSrcRecord);
+ }
+
+ public void setDnsSrcZone(String dnsSrcZone) {
+ addPair(DNS_SRC_ZONE, dnsSrcZone);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/EmailEvent.java b/src/main/java/org/springframework/integration/splunk/event/EmailEvent.java
new file mode 100644
index 0000000..17127cb
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/EmailEvent.java
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class EmailEvent extends SplunkEvent {
+ // ----------------------------------
+ // Email tracking
+ // ----------------------------------
+
+ /**
+ * The person to whom an email is sent.
+ */
+ public static String EMAIL_RECIPIENT = "recipient";
+ /**
+ * The person responsible for sending an email.
+ */
+ public static String EMAIL_SENDER = "sender";
+ /**
+ * The email subject line.
+ */
+ public static String EMAIL_SUBJECT = "subject";
+
+ public void setEmailRecipient(String emailRecipient) {
+ addPair(EMAIL_RECIPIENT, emailRecipient);
+ }
+
+ public void setEmailSender(String emailSender) {
+ addPair(EMAIL_SENDER, emailSender);
+ }
+
+ public void setEmailSubject(String emailSubject) {
+ addPair(EMAIL_SUBJECT, emailSubject);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/EndpointProtectionEvent.java b/src/main/java/org/springframework/integration/splunk/event/EndpointProtectionEvent.java
new file mode 100644
index 0000000..2049d31
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/EndpointProtectionEvent.java
@@ -0,0 +1,117 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class EndpointProtectionEvent extends SplunkEvent {
+
+ // ----------------------------------
+ // Change analysis - Endpoint protection
+ // ----------------------------------
+
+ /**
+ * The action performed on the resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_ACTION = "action";
+ /**
+ * The type of change discovered in the change analysis event.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE = "change_type";
+ /**
+ * The host that was affected by the change. If your field is named
+ * dest_host,dest_ip,dest_ipv6, or dest_nt_host you can alias it as dest to
+ * make it CIM-compliant.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_DEST = "dest";
+ /**
+ * The hash signature of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_HASH = "hash";
+ /**
+ * The group ID of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_GID = "gid";
+ /**
+ * Indicates whether or not the modified resource is a directory.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_ISDR = "isdr";
+ /**
+ * The permissions mode of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_MODE = "mode";
+ /**
+ * The modification time of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_MODTIME = "modtime";
+ /**
+ * The file path of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_PATH = "path";
+ /**
+ * The size of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_SIZE = "size";
+ /**
+ * The user ID of the modified resource.
+ */
+ public static String CHANGE_ENDPOINT_PROTECTION_UID = "uid";
+ public void setChangeEndpointProtectionAction(String changeEndpointProtectionAction) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_ACTION, changeEndpointProtectionAction);
+ }
+
+ public void setChangeEndpointProtectionChangeType(String changeEndpointProtectionChangeType) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_CHANGE_TYPE, changeEndpointProtectionChangeType);
+ }
+
+ public void setChangeEndpointProtectionDest(String changeEndpointProtectionDest) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_DEST, changeEndpointProtectionDest);
+ }
+
+ public void setChangeEndpointProtectionHash(String changeEndpointProtectionHash) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_HASH, changeEndpointProtectionHash);
+ }
+
+ public void setChangeEndpointProtectionGid(long changeEndpointProtectionGid) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_GID, changeEndpointProtectionGid);
+ }
+
+ public void setChangeEndpointProtectionIsdr(boolean changeEndpointProtectionIsdr) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_ISDR, changeEndpointProtectionIsdr);
+ }
+
+ public void setChangeEndpointProtectionMode(long changeEndpointProtectionMode) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_MODE, changeEndpointProtectionMode);
+ }
+
+ public void setChangeEndpointProtectionModtime(String changeEndpointProtectionModtime) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_MODTIME, changeEndpointProtectionModtime);
+ }
+
+ public void setChangeEndpointProtectionPath(String changeEndpointProtectionPath) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_PATH, changeEndpointProtectionPath);
+ }
+
+ public void setChangeEndpointProtectionSize(long changeEndpointProtectionSize) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_SIZE, changeEndpointProtectionSize);
+ }
+
+ public void setChangeEndpointProtectionUid(long changeEndpointProtectionUid) {
+ addPair(CHANGE_ENDPOINT_PROTECTION_UID, changeEndpointProtectionUid);
+ }
+
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/FileEvent.java b/src/main/java/org/springframework/integration/splunk/event/FileEvent.java
new file mode 100644
index 0000000..6d93864
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/FileEvent.java
@@ -0,0 +1,93 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class FileEvent extends SplunkEvent {
+ // ----------------------------------
+ // File management
+ // ----------------------------------
+
+ /**
+ * The time the file (the object of the event) was accessed.
+ */
+ public static String FILE_ACCESS_TIME = "file_access_time";
+ /**
+ * The time the file (the object of the event) was created.
+ */
+ public static String FILE_CREATE_TIME = "file_create_time";
+ /**
+ * A cryptographic identifier assigned to the file object affected by the
+ * event.
+ */
+ public static String FILE_HASH = "file_hash";
+ /**
+ * The time the file (the object of the event) was altered.
+ */
+ public static String FILE_MODIFY_TIME = "file_modify_time";
+ /**
+ * The name of the file that is the object of the event (without location
+ * information related to local file or directory structure).
+ */
+ public static String FILE_NAME = "file_name";
+ /**
+ * The location of the file that is the object of the event, in terms of
+ * local file and directory structure.
+ */
+ public static String FILE_PATH = "file_path";
+ /**
+ * Access controls associated with the file affected by the event.
+ */
+ public static String FILE_PERMISSION = "file_permission";
+ /**
+ * The size of the file that is the object of the event. Indicate whether
+ * Bytes, KB, MB, GB.
+ */
+ public static String FILE_SIZE = "file_size";
+
+ public void setFileAccessTime(long fileAccessTime) {
+ addPair(FILE_ACCESS_TIME, fileAccessTime);
+ }
+
+ public void setFileCreateTime(long fileCreateTime) {
+ addPair(FILE_CREATE_TIME, fileCreateTime);
+ }
+
+ public void setFileHash(String fileHash) {
+ addPair(FILE_HASH, fileHash);
+ }
+
+ public void setFileModifyTime(long fileModifyTime) {
+ addPair(FILE_MODIFY_TIME, fileModifyTime);
+ }
+
+ public void setFileName(String fileName) {
+ addPair(FILE_NAME, fileName);
+ }
+
+ public void setFilePath(String filePath) {
+ addPair(FILE_PATH, filePath);
+ }
+
+ public void setFilePermission(String filePermission) {
+ addPair(FILE_PERMISSION, filePermission);
+ }
+
+ public void setFileSize(long fileSize) {
+ addPair(FILE_SIZE, fileSize);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/IntrusionDetectionEvent.java b/src/main/java/org/springframework/integration/splunk/event/IntrusionDetectionEvent.java
new file mode 100644
index 0000000..167d274
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/IntrusionDetectionEvent.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class IntrusionDetectionEvent extends SplunkEvent {
+
+
+ // ----------------------------------
+ // Intrusion detection
+ // ----------------------------------
+
+ /**
+ * The category of the triggered signature.
+ */
+ public static String INTRUSION_DETECTION_CATEGORY = "category";
+ /**
+ * The destination of the attack detected by the intrusion detection system
+ * (IDS). If your field is named dest_host, dest_ip, dest_ipv6, or
+ * dest_nt_host you can alias it as dest to make it CIM-compliant.
+ */
+ public static String INTRUSION_DETECTION_DEST = "dest";
+ /**
+ * The device that detected the intrusion event.
+ */
+ public static String INTRUSION_DETECTION_DVC = "dvc";
+ /**
+ * The type of IDS that generated the event.
+ */
+ public static String INTRUSION_DETECTION_IDS_TYPE = "ids_type";
+ /**
+ * The product name of the vendor technology generating network protection
+ * data, such as IDP, Providentia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String INTRUSION_DETECTION_PRODUCT = "product";
+ /**
+ * The severity of the network protection event (such as critical, high,
+ * medium, low, or informational).
+ *
+ * Note: This field is a string. Please use a severity_id field for severity
+ * ID fields that are integer data types.
+ */
+ public static String INTRUSION_DETECTION_SEVERITY = "severity";
+ /**
+ * The name of the intrusion detected on the client (the src), such as
+ * PlugAndPlay_BO and JavaScript_Obfuscation_Fre.
+ */
+ public static String INTRUSION_DETECTION_SIGNATURE = "signature";
+ /**
+ * The source involved in the attack detected by the IDS. If your field is
+ * named src_host, src_ip, src_ipv6, or src_nt_host you can alias it as src
+ * to make it CIM-compliant.
+ */
+ public static String INTRUSION_DETECTION_SRC = "src";
+ /**
+ * The user involved with the intrusion detection event.
+ */
+ public static String INTRUSION_DETECTION_USER = "user";
+ /**
+ * The vendor technology used to generate network protection data, such as
+ * IDP, Providentia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String INTRUSION_DETECTION_VENDOR = "vendor";
+ public void setIntrusionDetectionCategory(String intrusionDetectionCategory) {
+ addPair(INTRUSION_DETECTION_CATEGORY, intrusionDetectionCategory);
+ }
+
+ public void setIntrusionDetectionDest(String intrusionDetectionDest) {
+ addPair(INTRUSION_DETECTION_DEST, intrusionDetectionDest);
+ }
+
+ public void setIntrusionDetectionDvc(String intrusionDetectionDvc) {
+ addPair(INTRUSION_DETECTION_DVC, intrusionDetectionDvc);
+ }
+
+ public void setIntrusionDetectionIdsType(String intrusionDetectionIdsType) {
+ addPair(INTRUSION_DETECTION_IDS_TYPE, intrusionDetectionIdsType);
+ }
+
+ public void setIntrusionDetectionProduct(String intrusionDetectionProduct) {
+ addPair(INTRUSION_DETECTION_PRODUCT, intrusionDetectionProduct);
+ }
+
+ public void setIntrusionDetectionSeverity(String intrusionDetectionSeverity) {
+ addPair(INTRUSION_DETECTION_SEVERITY, intrusionDetectionSeverity);
+ }
+
+ public void setIntrusionDetectionSignature(String intrusionDetectionSignature) {
+ addPair(INTRUSION_DETECTION_SIGNATURE, intrusionDetectionSignature);
+ }
+
+ public void setIntrusionDetectionSrc(String intrusionDetectionSrc) {
+ addPair(INTRUSION_DETECTION_SRC, intrusionDetectionSrc);
+ }
+
+ public void setIntrusionDetectionUser(String intrusionDetectionUser) {
+ addPair(INTRUSION_DETECTION_USER, intrusionDetectionUser);
+ }
+
+ public void setIntrusionDetectionVendor(String intrusionDetectionVendor) {
+ addPair(INTRUSION_DETECTION_VENDOR, intrusionDetectionVendor);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/MalwareEndpointProtectionEvent.java b/src/main/java/org/springframework/integration/splunk/event/MalwareEndpointProtectionEvent.java
new file mode 100644
index 0000000..789c18c
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/MalwareEndpointProtectionEvent.java
@@ -0,0 +1,143 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class MalwareEndpointProtectionEvent extends SplunkEvent {
+ // ----------------------------------
+ // Malware - Endpoint protection
+ // ----------------------------------
+
+ /**
+ * The outcome of the infection
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_ACTION = "action";
+ /**
+ * The NT domain of the destination (the dest_bestmatch).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN = "dest_nt_domain";
+ /**
+ * The cryptographic hash of the file associated with the malware event
+ * (such as the malicious or infected file).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_HASH = "file_hash";
+ /**
+ * The name of the file involved in the malware event (such as the infected
+ * or malicious file).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_NAME = "file_name";
+ /**
+ * The path of the file involved in the malware event (such as the infected
+ * or malicious file).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_FILE_PATH = "file_path";
+ /**
+ * The product name of the vendor technology (the vendor field) that is
+ * generating malware data (such as Antivirus or EPO).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT = "product";
+ /**
+ * The product version number of the vendor technology installed on the
+ * client (such as 10.4.3 or 11.0.2).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION = "product_version";
+ /**
+ * The name of the malware infection detected on the client (the src), such
+ * as Trojan.Vundo,Spyware.Gaobot,W32.Nimbda).
+ *
+ * Note: This field is a string. Please use a signature_id field for
+ * signature ID fields that are integer data types.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE = "signature";
+ /**
+ * The current signature definition set running on the client, such as
+ * 11hsvx)
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION = "signature_version";
+ /**
+ * The target affected or infected by the malware. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_DEST = "dest";
+ /**
+ * The NT domain of the source (the src).
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN = "src_nt_domain";
+ /**
+ * The name of the user involved in the malware event.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_USER = "user";
+ /**
+ * The name of the vendor technology generating malware data, such as
+ * Symantec or McAfee.
+ */
+ public static String MALWARE_ENDPOINT_PROTECTION_VENDOR = "vendor";
+
+ public void setMalwareEndpointProtectionAction(String malwareEndpointProtectionAction) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_ACTION, malwareEndpointProtectionAction);
+ }
+
+ public void setMalwareEndpointProtectionDestNtDomain(String malwareEndpointProtectionDestNtDomain) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_DEST_NT_DOMAIN, malwareEndpointProtectionDestNtDomain);
+ }
+
+ public void setMalwareEndpointProtectionFileHash(String malwareEndpointProtectionFileHash) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_FILE_HASH, malwareEndpointProtectionFileHash);
+ }
+
+ public void setMalwareEndpointProtectionFileName(String malwareEndpointProtectionFileName) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_FILE_NAME, malwareEndpointProtectionFileName);
+ }
+
+ public void setMalwareEndpointProtectionFilePath(String malwareEndpointProtectionFilePath) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_FILE_PATH, malwareEndpointProtectionFilePath);
+ }
+
+ public void setMalwareEndpointProtectionProduct(String malwareEndpointProtectionProduct) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_PRODUCT, malwareEndpointProtectionProduct);
+ }
+
+ public void setMalwareEndpointProtectionProductVersion(String malwareEndpointProtectionProductVersion) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_PRODUCT_VERSION, malwareEndpointProtectionProductVersion);
+ }
+
+ public void setMalwareEndpointProtectionSignature(String malwareEndpointProtectionSignature) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_SIGNATURE, malwareEndpointProtectionSignature);
+ }
+
+ public void setMalwareEndpointProtectionSignatureVersion(String malwareEndpointProtectionSignatureVersion) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_SIGNATURE_VERSION, malwareEndpointProtectionSignatureVersion);
+ }
+
+ public void setMalwareEndpointProtectionDest(String malwareEndpointProtectionDest) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_DEST, malwareEndpointProtectionDest);
+ }
+
+ public void setMalwareEndpointProtectionSrcNtDomain(String malwareEndpointProtectionSrcNtDomain) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_SRC_NT_DOMAIN, malwareEndpointProtectionSrcNtDomain);
+ }
+
+ public void setMalwareEndpointProtectionUser(String malwareEndpointProtectionUser) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_USER, malwareEndpointProtectionUser);
+ }
+
+ public void setMalwareEndpointProtectionVendor(String malwareEndpointProtectionVendor) {
+ addPair(MALWARE_ENDPOINT_PROTECTION_VENDOR, malwareEndpointProtectionVendor);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/MalwareNetworkProtectionEvent.java b/src/main/java/org/springframework/integration/splunk/event/MalwareNetworkProtectionEvent.java
new file mode 100644
index 0000000..8dd4302
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/MalwareNetworkProtectionEvent.java
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class MalwareNetworkProtectionEvent extends SplunkEvent {
+
+ // ----------------------------------
+ // Malware - Network protection
+ // ----------------------------------
+
+ /**
+ * The product name of the vendor technology generating network protection
+ * data, such as IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String MALWARE_NETWORK_PROTECTION_PRODUCT = "product";
+ /**
+ * The severity of the network protection event (such as critical, high,
+ * medium, low, or informational).
+ *
+ * Note: This field is a string. Please use a severity_id field for severity
+ * ID fields that are integer data types.
+ */
+ public static String MALWARE_NETWORK_PROTECTION_SEVERITY = "severity";
+ /**
+ * The vendor technology used to generate network protection data, such as
+ * IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String MALWARE_NETWORK_PROTECTION_VENDOR = "vendor";
+
+ public void setMalwareNetworkProtectionProduct(String malwareNetworkProtectionProduct) {
+ addPair(MALWARE_NETWORK_PROTECTION_PRODUCT, malwareNetworkProtectionProduct);
+ }
+
+ public void setMalwareNetworkProtectionSeverity(String malwareNetworkProtectionSeverity) {
+ addPair(MALWARE_NETWORK_PROTECTION_SEVERITY, malwareNetworkProtectionSeverity);
+ }
+
+ public void setMalwareNetworkProtectionVendor(String malwareNetworkProtectionVendor) {
+ addPair(MALWARE_NETWORK_PROTECTION_VENDOR, malwareNetworkProtectionVendor);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/NetworkProtectionEvent.java b/src/main/java/org/springframework/integration/splunk/event/NetworkProtectionEvent.java
new file mode 100644
index 0000000..88556ec
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/NetworkProtectionEvent.java
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class NetworkProtectionEvent extends SplunkEvent {
+ // ----------------------------------
+ // Change analysis - Network protection
+ // ----------------------------------
+
+ /**
+ * The type of change observed.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_ACTION = "action";
+ /**
+ * The command that initiated the change.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_COMMAND = "command";
+ /**
+ * The device that is directly affected by the change.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_DVC = "dvc";
+ /**
+ * The user that initiated the change.
+ */
+ public static String CHANGE_NETWORK_PROTECTION_USER = "user";
+
+ public void setChangeNetworkProtectionAction(String changeNetworkProtectionAction) {
+ addPair(CHANGE_NETWORK_PROTECTION_ACTION, changeNetworkProtectionAction);
+ }
+
+ public void setChangeNetworkProtectionCommand(String changeNetworkProtectionCommand) {
+ addPair(CHANGE_NETWORK_PROTECTION_COMMAND, changeNetworkProtectionCommand);
+ }
+
+ public void setChangeNetworkProtectionDvc(String changeNetworkProtectionDvc) {
+ addPair(CHANGE_NETWORK_PROTECTION_DVC, changeNetworkProtectionDvc);
+ }
+
+ public void setChangeNetworkProtectionUser(String changeNetworkProtectionUser) {
+ addPair(CHANGE_NETWORK_PROTECTION_USER, changeNetworkProtectionUser);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/NetworkTrafficEssEvent.java b/src/main/java/org/springframework/integration/splunk/event/NetworkTrafficEssEvent.java
new file mode 100644
index 0000000..97048b6
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/NetworkTrafficEssEvent.java
@@ -0,0 +1,76 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class NetworkTrafficEssEvent extends SplunkEvent {
+ // ----------------------------------
+ // Network traffic - ESS
+ // ----------------------------------
+
+ /**
+ * The action of the network traffic.
+ */
+ public static String NETWORK_TRAFFIC_ESS_ACTION = "action";
+ /**
+ * The destination port of the network traffic.
+ */
+ public static String NETWORK_TRAFFIC_ESS_DEST_PORT = "dest_port";
+ /**
+ * The product name of the vendor technology generating NetworkProtection
+ * data, such as IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String NETWORK_TRAFFIC_ESS_PRODUCT = "product";
+ /**
+ * The source port of the network traffic.
+ */
+ public static String NETWORK_TRAFFIC_ESS_SRC_PORT = "src_port";
+ /**
+ * The vendor technology used to generate NetworkProtection data, such as
+ * IDP, Proventia, and ASA.
+ *
+ * Note: Required for all events dealing with network protection (Change
+ * analysis, proxy, malware, intrusion detection, packet filtering, and
+ * vulnerability).
+ */
+ public static String NETWORK_TRAFFIC_ESS_VENDOR = "vendor";
+
+ public void setNetworkTrafficEssAction(String networkTrafficEssAction) {
+ addPair(NETWORK_TRAFFIC_ESS_ACTION, networkTrafficEssAction);
+ }
+
+ public void setNetworkTrafficEssDestPort(int networkTrafficEssDestPort) {
+ addPair(NETWORK_TRAFFIC_ESS_DEST_PORT, networkTrafficEssDestPort);
+ }
+
+ public void setNetworkTrafficEssProduct(String networkTrafficEssProduct) {
+ addPair(NETWORK_TRAFFIC_ESS_PRODUCT, networkTrafficEssProduct);
+ }
+
+ public void setNetworkTrafficEssSrcPort(int networkTrafficEssSrcPort) {
+ addPair(NETWORK_TRAFFIC_ESS_SRC_PORT, networkTrafficEssSrcPort);
+ }
+
+ public void setNetworkTrafficEssVendor(String networkTrafficEssVendor) {
+ addPair(NETWORK_TRAFFIC_ESS_VENDOR, networkTrafficEssVendor);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/NetworkTrafficGenericEvent.java b/src/main/java/org/springframework/integration/splunk/event/NetworkTrafficGenericEvent.java
new file mode 100644
index 0000000..bc4b5ff
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/NetworkTrafficGenericEvent.java
@@ -0,0 +1,438 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class NetworkTrafficGenericEvent extends SplunkEvent {
+ // ----------------------------------
+ // Network traffic - Generic
+ // ----------------------------------
+
+ /**
+ * The ISO layer 7 (application layer) protocol, such as HTTP, HTTPS, SSH,
+ * and IMAP.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_APP_LAYER = "app_layer";
+ /**
+ * How many bytes this device/interface received.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_BYTES_IN = "bytes_in";
+ /**
+ * How many bytes this device/interface transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_BYTES_OUT = "bytes_out";
+ /**
+ * 802.11 channel number used by a wireless network.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_CHANNEL = "channel";
+ /**
+ * The Common Vulnerabilities and Exposures (CVE) reference value.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_CVE = "cve";
+ /**
+ * The destination application being targeted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_APP = "dest_app";
+ /**
+ * The destination command and control service channel.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL = "dest_cnc_channel";
+ /**
+ * The destination command and control service name.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME = "dest_cnc_name";
+ /**
+ * The destination command and control service port.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT = "dest_cnc_port";
+ /**
+ * The country associated with a packet's recipient.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY = "dest_country";
+ /**
+ * The fully qualified host name of a packet's recipient. For HTTP sessions,
+ * this is the host header.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_HOST = "dest_host";
+ /**
+ * The interface that is listening remotely or receiving packets locally.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_INT = "dest_int";
+ /**
+ * The IPv4 address of a packet's recipient.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_IP = "dest_ip";
+ /**
+ * The IPv6 address of a packet's recipient.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_IPV6 = "dest_ipv6";
+ /**
+ * The (physical) latitude of a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_LAT = "dest_lat";
+ /**
+ * The (physical) longitude of a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_LONG = "dest_long";
+ /**
+ * The destination TCP/IP layer 2 Media Access Control (MAC) address of a
+ * packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_MAC = "dest_mac";
+ /**
+ * The Windows NT domain containing a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN = "dest_nt_domain";
+ /**
+ * The Windows NT host name of a packet's destination.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST = "dest_nt_host";
+ /**
+ * TCP/IP port to which a packet is being sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_PORT = "dest_port";
+ /**
+ * The NATed IPv4 address to which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP = "dest_translated_ip";
+ /**
+ * The NATed port to which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT = "dest_translated_port";
+ /**
+ * The numbered Internet Protocol version.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_IP_VERSION = "ip_version";
+ /**
+ * The network interface through which a packet was transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE = "outbound_interface";
+ /**
+ * How many packets this device/interface received.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_PACKETS_IN = "packets_in";
+ /**
+ * How many packets this device/interface transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_PACKETS_OUT = "packets_out";
+ /**
+ * The OSI layer 3 (Network Layer) protocol, such as IPv4/IPv6, ICMP, IPsec,
+ * IGMP or RIP.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_PROTO = "proto";
+ /**
+ * The session identifier. Multiple transactions build a session.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SESSION_ID = "session_id";
+ /**
+ * The 802.11 service set identifier (ssid) assigned to a wireless session.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SSID = "ssid";
+ /**
+ * The country from which the packet was sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY = "src_country";
+ /**
+ * The fully qualified host name of the system that transmitted the packet.
+ * For Web logs, this is the HTTP client.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_HOST = "src_host";
+ /**
+ * The interface that is listening locally or sending packets remotely.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_INT = "src_int";
+ /**
+ * The IPv4 address of the packet's source. For Web logs, this is the http
+ * client.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_IP = "src_ip";
+ /**
+ * The IPv6 address of the packet's source.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_IPV6 = "src_ipv6";
+ /**
+ * The (physical) latitude of the packet's source.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_LAT = "src_lat";
+ /**
+ * The (physical) longitude of the packet's source.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_LONG = "src_long";
+ /**
+ * The Media Access Control (MAC) address from which a packet was
+ * transmitted.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_MAC = "src_mac";
+ /**
+ * The Windows NT domain containing the machines that generated the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN = "src_nt_domain";
+ /**
+ * The Windows NT hostname of the system that generated the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST = "src_nt_host";
+ /**
+ * The network port from which a packet originated.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_PORT = "src_port";
+ /**
+ * The NATed IPv4 address from which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP = "src_translated_ip";
+ /**
+ * The NATed network port from which a packet has been sent.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT = "src_translated_port";
+ /**
+ * The application, process, or OS subsystem that generated the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_ID = "syslog_id";
+ /**
+ * The criticality of an event, as recorded by UNIX syslog.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY = "syslog_priority";
+ /**
+ * The TCP flag(s) specified in the event.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TCP_FLAG = "tcp_flag";
+ /**
+ * The hex bit that specifies TCP 'type of service'
+ *
+ * @see Type of
+ * Service
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TOS = "tos";
+ /**
+ * The transport protocol.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TRANSPORT = "transport";
+ /**
+ * The "time to live" of a packet or datagram.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_TTL = "ttl";
+ /**
+ * The numeric identifier assigned to the virtual local area network (VLAN)
+ * specified in the record.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_VLAN_ID = "vlan_id";
+ /**
+ * The name assigned to the virtual local area network (VLAN) specified in
+ * the record.
+ */
+ public static String NETWORK_TRAFFIC_GENERIC_VLAN_NAME = "vlan_name";
+
+ public void setNetworkTrafficGenericAppLayer(String networkTrafficGenericAppLayer) {
+ addPair(NETWORK_TRAFFIC_GENERIC_APP_LAYER, networkTrafficGenericAppLayer);
+ }
+
+ public void setNetworkTrafficGenericBytesIn(long networkTrafficGenericBytesIn) {
+ addPair(NETWORK_TRAFFIC_GENERIC_BYTES_IN, networkTrafficGenericBytesIn);
+ }
+
+ public void setNetworkTrafficGenericBytesOut(long networkTrafficGenericBytesOut) {
+ addPair(NETWORK_TRAFFIC_GENERIC_BYTES_OUT, networkTrafficGenericBytesOut);
+ }
+
+ public void setNetworkTrafficGenericChannel(String networkTrafficGenericChannel) {
+ addPair(NETWORK_TRAFFIC_GENERIC_CHANNEL, networkTrafficGenericChannel);
+ }
+
+ public void setNetworkTrafficGenericCve(String networkTrafficGenericCve) {
+ addPair(NETWORK_TRAFFIC_GENERIC_CVE, networkTrafficGenericCve);
+ }
+
+ public void setNetworkTrafficGenericDestApp(String networkTrafficGenericDestApp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_APP, networkTrafficGenericDestApp);
+ }
+
+ public void setNetworkTrafficGenericDestCncChannel(String networkTrafficGenericDestCncChannel) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_CHANNEL, networkTrafficGenericDestCncChannel);
+ }
+
+ public void setNetworkTrafficGenericDestCncName(String networkTrafficGenericDestCncName) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_NAME, networkTrafficGenericDestCncName);
+ }
+
+ public void setNetworkTrafficGenericDestCncPort(String networkTrafficGenericDestCncPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_CNC_PORT, networkTrafficGenericDestCncPort);
+ }
+
+ public void setNetworkTrafficGenericDestCountry(String networkTrafficGenericDestCountry) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_COUNTRY, networkTrafficGenericDestCountry);
+ }
+
+ public void setNetworkTrafficGenericDestHost(String networkTrafficGenericDestHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_HOST, networkTrafficGenericDestHost);
+ }
+
+ public void setNetworkTrafficGenericDestInt(String networkTrafficGenericDestInt) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_INT, networkTrafficGenericDestInt);
+ }
+
+ public void setNetworkTrafficGenericDestIp(String networkTrafficGenericDestIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_IP, networkTrafficGenericDestIp);
+ }
+
+ public void setNetworkTrafficGenericDestIpv6(String networkTrafficGenericDestIpv6) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_IPV6, networkTrafficGenericDestIpv6);
+ }
+
+ public void setNetworkTrafficGenericDestLat(int networkTrafficGenericDestLat) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_LAT, networkTrafficGenericDestLat);
+ }
+
+ public void setNetworkTrafficGenericDestLong(int networkTrafficGenericDestLong) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_LONG, networkTrafficGenericDestLong);
+ }
+
+ public void setNetworkTrafficGenericDestMac(String networkTrafficGenericDestMac) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_MAC, networkTrafficGenericDestMac);
+ }
+
+ public void setNetworkTrafficGenericDestNtDomain(String networkTrafficGenericDestNtDomain) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_NT_DOMAIN, networkTrafficGenericDestNtDomain);
+ }
+
+ public void setNetworkTrafficGenericDestNtHost(String networkTrafficGenericDestNtHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_NT_HOST, networkTrafficGenericDestNtHost);
+ }
+
+ public void setNetworkTrafficGenericDestPort(int networkTrafficGenericDestPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_PORT, networkTrafficGenericDestPort);
+ }
+
+ public void setNetworkTrafficGenericDestTranslatedIp(String networkTrafficGenericDestTranslatedIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_IP, networkTrafficGenericDestTranslatedIp);
+ }
+
+ public void setNetworkTrafficGenericDestTranslatedPort(int networkTrafficGenericDestTranslatedPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_DEST_TRANSLATED_PORT, networkTrafficGenericDestTranslatedPort);
+ }
+
+ public void setNetworkTrafficGenericIpVersion(int networkTrafficGenericIpVersion) {
+ addPair(NETWORK_TRAFFIC_GENERIC_IP_VERSION, networkTrafficGenericIpVersion);
+ }
+
+ public void setNetworkTrafficGenericOutboundInterface(String networkTrafficGenericOutboundInterface) {
+ addPair(NETWORK_TRAFFIC_GENERIC_OUTBOUND_INTERFACE, networkTrafficGenericOutboundInterface);
+ }
+
+ public void setNetworkTrafficGenericPacketsIn(long networkTrafficGenericPacketsIn) {
+ addPair(NETWORK_TRAFFIC_GENERIC_PACKETS_IN, networkTrafficGenericPacketsIn);
+ }
+
+ public void setNetworkTrafficGenericPacketsOut(long networkTrafficGenericPacketsOut) {
+ addPair(NETWORK_TRAFFIC_GENERIC_PACKETS_OUT, networkTrafficGenericPacketsOut);
+ }
+
+ public void setNetworkTrafficGenericProto(String networkTrafficGenericProto) {
+ addPair(NETWORK_TRAFFIC_GENERIC_PROTO, networkTrafficGenericProto);
+ }
+
+ public void setNetworkTrafficGenericSessionId(String networkTrafficGenericSessionId) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SESSION_ID, networkTrafficGenericSessionId);
+ }
+
+ public void setNetworkTrafficGenericSsid(String networkTrafficGenericSsid) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SSID, networkTrafficGenericSsid);
+ }
+
+ public void setNetworkTrafficGenericSrcCountry(String networkTrafficGenericSrcCountry) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_COUNTRY, networkTrafficGenericSrcCountry);
+ }
+
+ public void setNetworkTrafficGenericSrcHost(String networkTrafficGenericSrcHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_HOST, networkTrafficGenericSrcHost);
+ }
+
+ public void setNetworkTrafficGenericSrcInt(String networkTrafficGenericSrcInt) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_INT, networkTrafficGenericSrcInt);
+ }
+
+ public void setNetworkTrafficGenericSrcIp(String networkTrafficGenericSrcIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_IP, networkTrafficGenericSrcIp);
+ }
+
+ public void setNetworkTrafficGenericSrcIpv6(String networkTrafficGenericSrcIpv6) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_IPV6, networkTrafficGenericSrcIpv6);
+ }
+
+ public void setNetworkTrafficGenericSrcLat(int networkTrafficGenericSrcLat) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_LAT, networkTrafficGenericSrcLat);
+ }
+
+ public void setNetworkTrafficGenericSrcLong(int networkTrafficGenericSrcLong) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_LONG, networkTrafficGenericSrcLong);
+ }
+
+ public void setNetworkTrafficGenericSrcMac(String networkTrafficGenericSrcMac) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_MAC, networkTrafficGenericSrcMac);
+ }
+
+ public void setNetworkTrafficGenericSrcNtDomain(String networkTrafficGenericSrcNtDomain) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_NT_DOMAIN, networkTrafficGenericSrcNtDomain);
+ }
+
+ public void setNetworkTrafficGenericSrcNtHost(String networkTrafficGenericSrcNtHost) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_NT_HOST, networkTrafficGenericSrcNtHost);
+ }
+
+ public void setNetworkTrafficGenericSrcPort(int networkTrafficGenericSrcPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_PORT, networkTrafficGenericSrcPort);
+ }
+
+ public void setNetworkTrafficGenericSrcTranslatedIp(String networkTrafficGenericSrcTranslatedIp) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_IP, networkTrafficGenericSrcTranslatedIp);
+ }
+
+ public void setNetworkTrafficGenericSrcTranslatedPort(int networkTrafficGenericSrcTranslatedPort) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SRC_TRANSLATED_PORT, networkTrafficGenericSrcTranslatedPort);
+ }
+
+ public void setNetworkTrafficGenericSyslogId(String networkTrafficGenericSyslogId) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SYSLOG_ID, networkTrafficGenericSyslogId);
+ }
+
+ public void setNetworkTrafficGenericSyslogPriority(String networkTrafficGenericSyslogPriority) {
+ addPair(NETWORK_TRAFFIC_GENERIC_SYSLOG_PRIORITY, networkTrafficGenericSyslogPriority);
+ }
+
+ public void setNetworkTrafficGenericTcpFlag(String networkTrafficGenericTcpFlag) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TCP_FLAG, networkTrafficGenericTcpFlag);
+ }
+
+ public void setNetworkTrafficGenericTos(String networkTrafficGenericTos) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TOS, networkTrafficGenericTos);
+ }
+
+ public void setNetworkTrafficGenericTransport(String networkTrafficGenericTransport) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TRANSPORT, networkTrafficGenericTransport);
+ }
+
+ public void setNetworkTrafficGenericTtl(int networkTrafficGenericTtl) {
+ addPair(NETWORK_TRAFFIC_GENERIC_TTL, networkTrafficGenericTtl);
+ }
+
+ public void setNetworkTrafficGenericVlanId(long networkTrafficGenericVlanId) {
+ addPair(NETWORK_TRAFFIC_GENERIC_VLAN_ID, networkTrafficGenericVlanId);
+ }
+
+ public void setNetworkTrafficGenericVlanName(String networkTrafficGenericVlanName) {
+ addPair(NETWORK_TRAFFIC_GENERIC_VLAN_NAME, networkTrafficGenericVlanName);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/PacketFilterEvent.java b/src/main/java/org/springframework/integration/splunk/event/PacketFilterEvent.java
new file mode 100644
index 0000000..56d2fcb
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/PacketFilterEvent.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class PacketFilterEvent extends SplunkEvent {
+
+ // ----------------------------------
+ // Packet filtering
+ // ----------------------------------
+
+ /**
+ * The action the filtering device (the dvc_bestmatch field) performed on
+ * the communication.
+ */
+ public static String PACKET_FILTERING_ACTION = "action";
+ /**
+ * The IP port of the packet's destination, such as 22.
+ */
+ public static String PACKET_FILTERING_DEST_PORT = "dest_port";
+ /**
+ * The direction the packet is traveling.
+ */
+ public static String PACKET_FILTERING_DIRECTION = "direction";
+ /**
+ * The name of the packet filtering device. If your field is named dvc_host,
+ * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
+ */
+ public static String PACKET_FILTERING_DVC = "dvc";
+ /**
+ * The rule which took action on the packet, such as 143.
+ */
+ public static String PACKET_FILTERING_RULE = "rule";
+ /**
+ * The IP port of the packet's source, such as 34541.
+ */
+ public static String PACKET_FILTERING_SVC_PORT = "svc_port";
+ public void setPacketFilteringAction(String packetFilteringAction) {
+ addPair(PACKET_FILTERING_ACTION, packetFilteringAction);
+ }
+
+ public void setPacketFilteringDestPort(int packetFilteringDestPort) {
+ addPair(PACKET_FILTERING_DEST_PORT, packetFilteringDestPort);
+ }
+
+ public void setPacketFilteringDirection(String packetFilteringDirection) {
+ addPair(PACKET_FILTERING_DIRECTION, packetFilteringDirection);
+ }
+
+ public void setPacketFilteringDvc(String packetFilteringDvc) {
+ addPair(PACKET_FILTERING_DVC, packetFilteringDvc);
+ }
+
+ public void setPacketFilteringRule(String packetFilteringRule) {
+ addPair(PACKET_FILTERING_RULE, packetFilteringRule);
+ }
+
+ public void setPacketFilteringSvcPort(int packetFilteringSvcPort) {
+ addPair(PACKET_FILTERING_SVC_PORT, packetFilteringSvcPort);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/ProxyEvent.java b/src/main/java/org/springframework/integration/splunk/event/ProxyEvent.java
new file mode 100644
index 0000000..24e06e3
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/ProxyEvent.java
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class ProxyEvent extends SplunkEvent {
+ // ----------------------------------
+ // Proxy
+ // ----------------------------------
+
+ /**
+ * The action taken by the proxy.
+ */
+ public static String PROXY_ACTION = "action";
+ /**
+ * The destination of the network traffic (the remote host).
+ */
+ public static String PROXY_DEST = "dest";
+ /**
+ * The content-type of the requested HTTP resource.
+ */
+ public static String PROXY_HTTP_CONTENT_TYPE = "http_content_type";
+ /**
+ * The HTTP method used to request the resource.
+ */
+ public static String PROXY_HTTP_METHOD = "http_method";
+ /**
+ * The HTTP referrer used to request the HTTP resource.
+ */
+ public static String PROXY_HTTP_REFER = "http_refer";
+ /**
+ * The HTTP response code.
+ */
+ public static String PROXY_HTTP_RESPONSE = "http_response";
+ /**
+ * The user agent used to request the HTTP resource.
+ */
+ public static String PROXY_HTTP_USER_AGENT = "http_user_agent";
+ /**
+ * The product name of the vendor technology generating Network Protection
+ * data, such as IDP, Providentia, and ASA.
+ */
+ public static String PROXY_PRODUCT = "product";
+ /**
+ * The source of the network traffic (the client requesting the connection).
+ */
+ public static String PROXY_SRC = "src";
+ /**
+ * The HTTP response code indicating the status of the proxy request.
+ */
+ public static String PROXY_STATUS = "status";
+ /**
+ * The user that requested the HTTP resource.
+ */
+ public static String PROXY_USER = "user";
+ /**
+ * The URL of the requested HTTP resource.
+ */
+ public static String PROXY_URL = "url";
+ /**
+ * The vendor technology generating Network Protection data, such as IDP,
+ * Providentia, and ASA.
+ */
+ public static String PROXY_VENDOR = "vendor";
+
+
+ public void setProxyAction(String proxyAction) {
+ addPair(PROXY_ACTION, proxyAction);
+ }
+
+ public void setProxyDest(String proxyDest) {
+ addPair(PROXY_DEST, proxyDest);
+ }
+
+ public void setProxyHttpContentType(String proxyHttpContentType) {
+ addPair(PROXY_HTTP_CONTENT_TYPE, proxyHttpContentType);
+ }
+
+ public void setProxyHttpMethod(String proxyHttpMethod) {
+ addPair(PROXY_HTTP_METHOD, proxyHttpMethod);
+ }
+
+ public void setProxyHttpRefer(String proxyHttpRefer) {
+ addPair(PROXY_HTTP_REFER, proxyHttpRefer);
+ }
+
+ public void setProxyHttpResponse(int proxyHttpResponse) {
+ addPair(PROXY_HTTP_RESPONSE, proxyHttpResponse);
+ }
+
+ public void setProxyHttpUserAgent(String proxyHttpUserAgent) {
+ addPair(PROXY_HTTP_USER_AGENT, proxyHttpUserAgent);
+ }
+
+ public void setProxyProduct(String proxyProduct) {
+ addPair(PROXY_PRODUCT, proxyProduct);
+ }
+
+ public void setProxySrc(String proxySrc) {
+ addPair(PROXY_SRC, proxySrc);
+ }
+
+ public void setProxyStatus(int proxyStatus) {
+ addPair(PROXY_STATUS, proxyStatus);
+ }
+
+ public void setProxyUser(String proxyUser) {
+ addPair(PROXY_USER, proxyUser);
+ }
+
+ public void setProxyUrl(String proxyUrl) {
+ addPair(PROXY_URL, proxyUrl);
+ }
+
+ public void setProxyVendor(String proxyVendor) {
+ addPair(PROXY_VENDOR, proxyVendor);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/SplunkEvent.java b/src/main/java/org/springframework/integration/splunk/event/SplunkEvent.java
new file mode 100644
index 0000000..4e772d3
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/SplunkEvent.java
@@ -0,0 +1,567 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+import java.io.Serializable;
+import java.util.Date;
+import java.util.Map;
+
+import org.apache.commons.lang.time.FastDateFormat;
+
+/**
+ * Splunk data entity
+ *
+ * @author Jarred Li
+ * @author Damien Dallimore damien@dtdsoftware.com
+ * @since 1.0
+ *
+ */
+
+@SuppressWarnings("serial")
+public class SplunkEvent implements Serializable {
+
+ private Map eventData;
+
+ /**
+ * Contents of the event message
+ */
+ private StringBuffer eventMessage;
+
+ /**
+ * Whether or not to put quotes around values
+ */
+ protected boolean quoteValues = true;
+
+ /**
+ * Whether or not to add a date to the event string
+ */
+ protected boolean useInternalDate = true;
+
+ /**
+ * default key value delimiter
+ */
+ protected static final String KVDELIM = "=";
+ /**
+ * default pair delimiter
+ */
+ protected static final String PAIRDELIM = " ";
+ /**
+ * default quote char
+ */
+ protected static final char QUOTE = '"';
+ /**
+ * default date format is using internal generated date
+ */
+ protected static final String DATEFORMATPATTERN = "yyyy-MM-dd HH:mm:ss:SSSZ";
+ /**
+ * Date Formatter instance
+ */
+ protected static FastDateFormat DATEFORMATTER = FastDateFormat.getInstance(DATEFORMATPATTERN);
+
+ /**
+ * Event prefix fields
+ */
+ protected static final String PREFIX_NAME = "name";
+ protected static final String PREFIX_EVENT_ID = "event_id";
+
+ /**
+ * Java Throwable type fields
+ */
+ protected static final String THROWABLE_CLASS = "throwable_class";
+ protected static final String THROWABLE_MESSAGE = "throwable_message";
+ protected static final String THROWABLE_STACKTRACE_ELEMENTS = "stacktrace_elements";
+
+ protected static final String LINEBREAK = "\n";
+
+ // ----------------------------------
+ // Common event fields
+ // ----------------------------------
+
+ /**
+ * A device-specific classification provided as part of the event.
+ */
+ public static String COMMON_CATEGORY = "category";
+ /**
+ * A device-specific classification provided as part of the event.
+ */
+ public static String COMMON_COUNT = "count";
+ /**
+ * The free-form description of a particular event.
+ */
+ public static String COMMON_DESC = "desc";
+ /**
+ * The name of a given DHCP pool on a DHCP server.
+ */
+ public static String COMMON_DHCP_POOL = "dhcp_pool";
+ /**
+ * The amount of time the event lasted.
+ */
+ public static String COMMON_DURATION = "duration";
+ /**
+ * The fully qualified domain name of the device transmitting or recording
+ * the log record.
+ */
+ public static String COMMON_DVC_HOST = "dvc_host";
+ /**
+ * The IPv4 address of the device reporting the event.
+ */
+ public static String COMMON_DVC_IP = "dvc_ip";
+ /**
+ * The IPv6 address of the device reporting the event.
+ */
+ public static String COMMON_DVC_IP6 = "dvc_ip6";
+ /**
+ * The free-form description of the device's physical location.
+ */
+ public static String COMMON_DVC_LOCATION = "dvc_location";
+ /**
+ * The MAC (layer 2) address of the device reporting the event.
+ */
+ public static String COMMON_DVC_MAC = "dvc_mac";
+ /**
+ * The Windows NT domain of the device recording or transmitting the event.
+ */
+ public static String COMMON_DVC_NT_DOMAIN = "dvc_nt_domain";
+ /**
+ * The Windows NT host name of the device recording or transmitting the
+ * event.
+ */
+ public static String COMMON_DVC_NT_HOST = "dvc_nt_host";
+ /**
+ * Time at which the device recorded the event.
+ */
+ public static String COMMON_DVC_TIME = "dvc_time";
+ /**
+ * The event's specified end time.
+ */
+ public static String COMMON_END_TIME = "end_time";
+ /**
+ * A unique identifier that identifies the event. This is unique to the
+ * reporting device.
+ */
+ public static String COMMON_EVENT_ID = "event_id";
+ /**
+ * The length of the datagram, event, message, or packet.
+ */
+ public static String COMMON_LENGTH = "length";
+ /**
+ * The log-level that was set on the device and recorded in the event.
+ */
+ public static String COMMON_LOG_LEVEL = "log_level";
+ /**
+ * The name of the event as reported by the device. The name should not
+ * contain information that's already being parsed into other fields from
+ * the event, such as IP addresses.
+ */
+ public static String COMMON_NAME = "name";
+ /**
+ * An integer assigned by the device operating system to the process
+ * creating the record.
+ */
+ public static String COMMON_PID = "pid";
+ /**
+ * An environment-specific assessment of the event's importance, based on
+ * elements such as event severity, business function of the affected
+ * system, or other locally defined variables.
+ */
+ public static String COMMON_PRIORITY = "priority";
+ /**
+ * The product that generated the event.
+ */
+ public static String COMMON_PRODUCT = "product";
+ /**
+ * The version of the product that generated the event.
+ */
+ public static String COMMON_PRODUCT_VERSION = "product_version";
+ /**
+ * The result root cause, such as connection refused, timeout, crash, and so
+ * on.
+ */
+ public static String COMMON_REASON = "reason";
+ /**
+ * The action result. Often is a binary choice: succeeded and failed,
+ * allowed and denied, and so on.
+ */
+ public static String COMMON_RESULT = "result";
+ /**
+ * The severity (or priority) of an event as reported by the originating
+ * device.
+ */
+ public static String COMMON_SEVERITY = "severity";
+ /**
+ * The event's specified start time.
+ */
+ public static String COMMON_START_TIME = "start_time";
+ /**
+ * The transaction identifier.
+ */
+ public static String COMMON_TRANSACTION_ID = "transaction_id";
+ /**
+ * A uniform record locator (a web address, in other words) included in a
+ * record.
+ */
+ public static String COMMON_URL = "url";
+ /**
+ * The vendor who made the product that generated the event.
+ */
+ public static String COMMON_VENDOR = "vendor";
+ // ----------------------------------
+ // Update
+ // ----------------------------------
+
+ /**
+ * The name of the installed update.
+ */
+ public static String UPDATE_PACKAGE = "package";
+
+
+ public SplunkEvent(Map data) {
+ this.eventMessage = new StringBuffer();
+ this.eventData = data;
+ for (String key : data.keySet()) {
+ this.addPair(key, data.get(key));
+ }
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param eventName
+ * the event name
+ * @param eventID
+ * the event id
+ * @param useInternalDate
+ * Whether or not to add a date to the event string
+ * @param quoteValues
+ * Whether or not to put quotes around values
+ */
+ public SplunkEvent(String eventName, String eventID, boolean useInternalDate, boolean quoteValues) {
+
+ this.eventMessage = new StringBuffer();
+ this.quoteValues = quoteValues;
+ this.useInternalDate = useInternalDate;
+
+ addPair(PREFIX_NAME, eventName);
+ addPair(PREFIX_EVENT_ID, eventID);
+ }
+
+ /**
+ * Constructor.Will add internally generated date and put quotes around
+ * values.
+ *
+ * @param eventName
+ * the event name
+ * @param eventID
+ * the event ID
+ */
+ public SplunkEvent(String eventName, String eventID) {
+
+ this(eventName, eventID, true, true);
+ }
+
+ /**
+ * Default constructor
+ */
+ public SplunkEvent() {
+ this.eventMessage = new StringBuffer();
+ }
+
+ /**
+ * Simple shallow cloning method
+ */
+ public SplunkEvent clone() {
+ SplunkEvent clone = new SplunkEvent();
+ clone.quoteValues = this.quoteValues;
+ clone.useInternalDate = this.useInternalDate;
+ clone.eventMessage.append(this.eventMessage);
+
+ return clone;
+ }
+
+
+ public Map getEventData() {
+ return eventData;
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, char value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, boolean value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, double value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, long value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, int value) {
+ addPair(key, String.valueOf(value));
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, Object value) {
+ addPair(key, value.toString());
+ }
+
+ /**
+ * Utility method for formatting Throwable,Error,Exception objects in a more
+ * linear and Splunk friendly manner than printStackTrace
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ */
+ public void addThrowable(Throwable throwable) {
+
+ addThrowableObject(throwable, -1);
+ }
+
+ /**
+ * Utility method for formatting Throwable,Error,Exception objects in a more
+ * linear and Splunk friendly manner than printStackTrace
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ * @param stackTraceDepth
+ * maximum number of stacktrace elements to log
+ */
+ public void addThrowable(Throwable throwable, int stackTraceDepth) {
+
+ addThrowableObject(throwable, stackTraceDepth);
+ }
+
+ /**
+ * Internal private method for formatting Throwable,Error,Exception objects
+ * in a more linear and Splunk friendly manner than printStackTrace
+ *
+ * @param throwable
+ * the Throwable object to add to the event
+ * @param stackTraceDepth
+ * maximum number of stacktrace elements to log, -1 for all
+ */
+
+ private void addThrowableObject(Throwable throwable, int stackTraceDepth) {
+
+ addPair(THROWABLE_CLASS, throwable.getClass().getCanonicalName());
+ addPair(THROWABLE_MESSAGE, throwable.getMessage());
+ StackTraceElement[] elements = throwable.getStackTrace();
+ StringBuffer sb = new StringBuffer();
+ int depth = 0;
+ for (StackTraceElement element : elements) {
+ depth++;
+ if (stackTraceDepth == -1 || stackTraceDepth >= depth)
+ sb.append(element.toString()).append(",");
+ else
+ break;
+
+ }
+ addPair(THROWABLE_STACKTRACE_ELEMENTS, sb.toString());
+ }
+
+ /**
+ * Add a key value pair
+ *
+ * @param key
+ * @param value
+ */
+ public void addPair(String key, String value) {
+
+ if (quoteValues)
+ this.eventMessage.append(key).append(KVDELIM).append(QUOTE).append(value).append(QUOTE).append(PAIRDELIM);
+ else
+ this.eventMessage.append(key).append(KVDELIM).append(value).append(PAIRDELIM);
+
+ }
+
+ @Override
+ /**
+ * return the completed event message
+ */
+ public String toString() {
+
+ String event = "";
+
+ if (useInternalDate) {
+ StringBuffer clonedMessage = new StringBuffer();
+ clonedMessage.append(DATEFORMATTER.format(new Date())).append(PAIRDELIM).append(this.eventMessage);
+ event = clonedMessage.toString();
+ }
+ else
+ event = eventMessage.toString();
+ // trim off trailing pair delim char(s)
+ String result = event.substring(0, event.length() - PAIRDELIM.length()) + LINEBREAK;
+ return result;
+ }
+
+ public void setCommonCategory(String commonCategory) {
+ addPair(COMMON_CATEGORY, commonCategory);
+ }
+
+ public void setCommonCount(String commonCount) {
+ addPair(COMMON_COUNT, commonCount);
+ }
+
+ public void setCommonDesc(String commonDesc) {
+ addPair(COMMON_DESC, commonDesc);
+ }
+
+ public void setCommonDhcpPool(String commonDhcpPool) {
+ addPair(COMMON_DHCP_POOL, commonDhcpPool);
+ }
+
+ public void setCommonDuration(long commonDuration) {
+ addPair(COMMON_DURATION, commonDuration);
+ }
+
+ public void setCommonDvcHost(String commonDvcHost) {
+ addPair(COMMON_DVC_HOST, commonDvcHost);
+ }
+
+ public void setCommonDvcIp(String commonDvcIp) {
+ addPair(COMMON_DVC_IP, commonDvcIp);
+ }
+
+ public void setCommonDvcIp6(String commonDvcIp6) {
+ addPair(COMMON_DVC_IP6, commonDvcIp6);
+ }
+
+ public void setCommonDvcLocation(String commonDvcLocation) {
+ addPair(COMMON_DVC_LOCATION, commonDvcLocation);
+ }
+
+ public void setCommonDvcMac(String commonDvcMac) {
+ addPair(COMMON_DVC_MAC, commonDvcMac);
+ }
+
+ public void setCommonDvcNtDomain(String commonDvcNtDomain) {
+ addPair(COMMON_DVC_NT_DOMAIN, commonDvcNtDomain);
+ }
+
+ public void setCommonDvcNtHost(String commonDvcNtHost) {
+ addPair(COMMON_DVC_NT_HOST, commonDvcNtHost);
+ }
+
+ public void setCommonDvcTime(long commonDvcTime) {
+ addPair(COMMON_DVC_TIME, commonDvcTime);
+ }
+
+ public void setCommonEndTime(long commonEndTime) {
+ addPair(COMMON_END_TIME, commonEndTime);
+ }
+
+ public void setCommonEventId(long commonEventId) {
+ addPair(COMMON_EVENT_ID, commonEventId);
+ }
+
+ public void setCommonLength(long commonLength) {
+ addPair(COMMON_LENGTH, commonLength);
+ }
+
+ public void setCommonLogLevel(String commonLogLevel) {
+ addPair(COMMON_LOG_LEVEL, commonLogLevel);
+ }
+
+ public void setCommonName(String commonName) {
+ addPair(COMMON_NAME, commonName);
+ }
+
+ public void setCommonPid(long commonPid) {
+ addPair(COMMON_PID, commonPid);
+ }
+
+ public void setCommonPriority(long commonPriority) {
+ addPair(COMMON_PRIORITY, commonPriority);
+ }
+
+ public void setCommonProduct(String commonProduct) {
+ addPair(COMMON_PRODUCT, commonProduct);
+ }
+
+ public void setCommonProductVersion(long commonProductVersion) {
+ addPair(COMMON_PRODUCT_VERSION, commonProductVersion);
+ }
+
+ public void setCommonReason(String commonReason) {
+ addPair(COMMON_REASON, commonReason);
+ }
+
+ public void setCommonResult(String commonResult) {
+ addPair(COMMON_RESULT, commonResult);
+ }
+
+ public void setCommonSeverity(String commonSeverity) {
+ addPair(COMMON_SEVERITY, commonSeverity);
+ }
+
+ public void setCommonStartTime(long commonStartTime) {
+ addPair(COMMON_START_TIME, commonStartTime);
+ }
+
+ public void setCommonTransactionId(String commonTransactionId) {
+ addPair(COMMON_TRANSACTION_ID, commonTransactionId);
+ }
+
+ public void setCommonUrl(String commonUrl) {
+ addPair(COMMON_URL, commonUrl);
+ }
+
+ public void setCommonVendor(String commonVendor) {
+ addPair(COMMON_VENDOR, commonVendor);
+ }
+
+ public void setUpdatePackage(String updatePackage) {
+ addPair(UPDATE_PACKAGE, updatePackage);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/SystemCenterEvent.java b/src/main/java/org/springframework/integration/splunk/event/SystemCenterEvent.java
new file mode 100644
index 0000000..7ead93c
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/SystemCenterEvent.java
@@ -0,0 +1,184 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class SystemCenterEvent extends SplunkEvent {
+ // ----------------------------------
+ // System center
+ // ----------------------------------
+
+ /**
+ * The running application or service on the system (the src field), such as
+ * explorer.exe or sshd.
+ */
+ public static String SYSTEM_CENTER_APP = "app";
+ /**
+ * The amount of disk space available per drive or mount (the mount field)
+ * on the system (the src field).
+ */
+ public static String SYSTEM_CENTER_FREEMBYTES = "FreeMBytes";
+ /**
+ * The version of operating system installed on the host (the src field),
+ * such as 6.0.1.4 or 2.6.27.30-170.2.82.fc10.x86_64.
+ */
+ public static String SYSTEM_CENTER_KERNEL_RELEASE = "kernel_release";
+ /**
+ * Human-readable version of the SystemUptime value.
+ */
+ public static String SYSTEM_CENTER_LABEL = "label";
+ /**
+ * The drive or mount reporting available disk space (the FreeMBytes field)
+ * on the system (the src field).
+ */
+ public static String SYSTEM_CENTER_MOUNT = "mount";
+ /**
+ * The name of the operating system installed on the host (the src), such as
+ * Microsoft Windows Server 2003 or GNU/Linux).
+ */
+ public static String SYSTEM_CENTER_OS = "os";
+ /**
+ * The percentage of processor utilization.
+ */
+ public static String SYSTEM_CENTER_PERCENTPROCESSORTIME = "PercentProcessorTime";
+ /**
+ * The setlocaldefs setting from the SE Linux configuration.
+ */
+ public static String SYSTEM_CENTER_SETLOCALDEFS = "setlocaldefs";
+ /**
+ * Values from the SE Linux configuration file.
+ */
+ public static String SYSTEM_CENTER_SELINUX = "selinux";
+ /**
+ * The SE Linux type (such as targeted).
+ */
+ public static String SYSTEM_CENTER_SELINUXTYPE = "selinuxtype";
+ /**
+ * The shell provided to the User Account (the user field) upon logging into
+ * the system (the src field).
+ */
+ public static String SYSTEM_CENTER_SHELL = "shell";
+ /**
+ * The TCP/UDP source port on the system (the src field).
+ */
+ public static String SYSTEM_CENTER_SRC_PORT = "src_port";
+ /**
+ * The sshd protocol version.
+ */
+ public static String SYSTEM_CENTER_SSHD_PROTOCOL = "sshd_protocol";
+ /**
+ * The start mode of the given service.
+ */
+ public static String SYSTEM_CENTER_STARTMODE = "Startmode";
+ /**
+ * The number of seconds since the system (the src) has been "up."
+ */
+ public static String SYSTEM_CENTER_SYSTEMUPTIME = "SystemUptime";
+ /**
+ * The total amount of available memory on the system (the src).
+ */
+ public static String SYSTEM_CENTER_TOTALMBYTES = "TotalMBytes";
+ /**
+ * The amount of used memory on the system (the src).
+ */
+ public static String SYSTEM_CENTER_USEDMBYTES = "UsedMBytes";
+ /**
+ * The User Account present on the system (the src).
+ */
+ public static String SYSTEM_CENTER_USER = "user";
+ /**
+ * The number of updates the system (the src) is missing.
+ */
+ public static String SYSTEM_CENTER_UPDATES = "updates";
+
+ public void setSystemCenterApp(String systemCenterApp) {
+ addPair(SYSTEM_CENTER_APP, systemCenterApp);
+ }
+
+ public void setSystemCenterFreembytes(long systemCenterFreembytes) {
+ addPair(SYSTEM_CENTER_FREEMBYTES, systemCenterFreembytes);
+ }
+
+ public void setSystemCenterKernelRelease(String systemCenterKernelRelease) {
+ addPair(SYSTEM_CENTER_KERNEL_RELEASE, systemCenterKernelRelease);
+ }
+
+ public void setSystemCenterLabel(String systemCenterLabel) {
+ addPair(SYSTEM_CENTER_LABEL, systemCenterLabel);
+ }
+
+ public void setSystemCenterMount(String systemCenterMount) {
+ addPair(SYSTEM_CENTER_MOUNT, systemCenterMount);
+ }
+
+ public void setSystemCenterOs(String systemCenterOs) {
+ addPair(SYSTEM_CENTER_OS, systemCenterOs);
+ }
+
+ public void setSystemCenterPercentprocessortime(int systemCenterPercentprocessortime) {
+ addPair(SYSTEM_CENTER_PERCENTPROCESSORTIME, systemCenterPercentprocessortime);
+ }
+
+ public void setSystemCenterSetlocaldefs(int systemCenterSetlocaldefs) {
+ addPair(SYSTEM_CENTER_SETLOCALDEFS, systemCenterSetlocaldefs);
+ }
+
+ public void setSystemCenterSelinux(String systemCenterSelinux) {
+ addPair(SYSTEM_CENTER_SELINUX, systemCenterSelinux);
+ }
+
+ public void setSystemCenterSelinuxtype(String systemCenterSelinuxtype) {
+ addPair(SYSTEM_CENTER_SELINUXTYPE, systemCenterSelinuxtype);
+ }
+
+ public void setSystemCenterShell(String systemCenterShell) {
+ addPair(SYSTEM_CENTER_SHELL, systemCenterShell);
+ }
+
+ public void setSystemCenterSrcPort(int systemCenterSrcPort) {
+ addPair(SYSTEM_CENTER_SRC_PORT, systemCenterSrcPort);
+ }
+
+ public void setSystemCenterSshdProtocol(String systemCenterSshdProtocol) {
+ addPair(SYSTEM_CENTER_SSHD_PROTOCOL, systemCenterSshdProtocol);
+ }
+
+ public void setSystemCenterStartmode(String systemCenterStartmode) {
+ addPair(SYSTEM_CENTER_STARTMODE, systemCenterStartmode);
+ }
+
+ public void setSystemCenterSystemuptime(long systemCenterSystemuptime) {
+ addPair(SYSTEM_CENTER_SYSTEMUPTIME, systemCenterSystemuptime);
+ }
+
+ public void setSystemCenterTotalmbytes(long systemCenterTotalmbytes) {
+ addPair(SYSTEM_CENTER_TOTALMBYTES, systemCenterTotalmbytes);
+ }
+
+ public void setSystemCenterUsedmbytes(long systemCenterUsedmbytes) {
+ addPair(SYSTEM_CENTER_USEDMBYTES, systemCenterUsedmbytes);
+ }
+
+ public void setSystemCenterUser(String systemCenterUser) {
+ addPair(SYSTEM_CENTER_USER, systemCenterUser);
+ }
+
+ public void setSystemCenterUpdates(long systemCenterUpdates) {
+ addPair(SYSTEM_CENTER_UPDATES, systemCenterUpdates);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/TrafficEvent.java b/src/main/java/org/springframework/integration/splunk/event/TrafficEvent.java
new file mode 100644
index 0000000..14c9207
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/TrafficEvent.java
@@ -0,0 +1,55 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class TrafficEvent extends SplunkEvent {
+
+ // ----------------------------------
+ // Traffic
+ // ----------------------------------
+
+ /**
+ * The destination of the network traffic. If your field is named dest_host,
+ * dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest to make it
+ * CIM-compliant.
+ */
+ public static String TRAFFIC_DEST = "dest";
+ /**
+ * The name of the packet filtering device. If your field is named dvc_host,
+ * dvc_ip, or dvc_nt_host you can alias it as dvc to make it CIM-compliant.
+ */
+ public static String TRAFFIC_DVC = "dvc";
+ /**
+ * The source of the network traffic. If your field is named src_host,
+ * src_ip, src_ipv6, or src_nt_host you can alias it as src to make it
+ * CIM-compliant.
+ */
+ public static String TRAFFIC_SRC = "src";
+
+ public void setTrafficDest(String trafficDest) {
+ addPair(TRAFFIC_DEST, trafficDest);
+ }
+
+ public void setTrafficDvc(String trafficDvc) {
+ addPair(TRAFFIC_DVC, trafficDvc);
+ }
+
+ public void setTrafficSrc(String trafficSrc) {
+ addPair(TRAFFIC_SRC, trafficSrc);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/UserInfoUpdateEvent.java b/src/main/java/org/springframework/integration/splunk/event/UserInfoUpdateEvent.java
new file mode 100644
index 0000000..45325cc
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/UserInfoUpdateEvent.java
@@ -0,0 +1,134 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class UserInfoUpdateEvent extends SplunkEvent {
+ // ----------------------------------
+ // User information updates
+ // ----------------------------------
+
+ /**
+ * A user that has been affected by a change. For example, user fflanda
+ * changed the name of user rhallen, so affected_user=rhallen.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER = "affected_user";
+ /**
+ * The user group affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP = "affected_user_group";
+ /**
+ * The identifier of the user group affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID = "affected_user_group_id";
+ /**
+ * The identifier of the user affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_ID = "affected_user_id";
+ /**
+ * The security context associated with the user affected by a change.
+ */
+ public static String USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE = "affected_user_privilege";
+ /**
+ * The name of the user affected by the recorded event.
+ */
+ public static String USER_INFO_UPDATES_USER = "user";
+ /**
+ * A user group that is the object of an event, expressed in human-readable
+ * terms.
+ */
+ public static String USER_INFO_UPDATES_USER_GROUP = "user_group";
+ /**
+ * The numeric identifier assigned to the user group event object.
+ */
+ public static String USER_INFO_UPDATES_USER_GROUP_ID = "user_group_id";
+ /**
+ * The system-assigned identifier for the user affected by an event.
+ */
+ public static String USER_INFO_UPDATES_USER_ID = "user_id";
+ /**
+ * The security context associated with the object of an event (the affected
+ * user).
+ */
+ public static String USER_INFO_UPDATES_USER_PRIVILEGE = "user_privilege";
+ /**
+ * The name of the user that is the subject of an event--the user executing
+ * the action, in other words.
+ */
+ public static String USER_INFO_UPDATES_USER_SUBJECT = "user_subject";
+ /**
+ * The ID number of the user that is the subject of an event.
+ */
+ public static String USER_INFO_UPDATES_USER_SUBJECT_ID = "user_subject_id";
+ /**
+ * The security context associated with the subject of an event (the user
+ * causing a change).
+ */
+ public static String USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE = "user_subject_privilege";
+ public void setUserInfoUpdatesAffectedUser(String userInfoUpdatesAffectedUser) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER, userInfoUpdatesAffectedUser);
+ }
+
+ public void setUserInfoUpdatesAffectedUserGroup(String userInfoUpdatesAffectedUserGroup) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_GROUP, userInfoUpdatesAffectedUserGroup);
+ }
+
+ public void setUserInfoUpdatesAffectedUserGroupId(int userInfoUpdatesAffectedUserGroupId) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_GROUP_ID, userInfoUpdatesAffectedUserGroupId);
+ }
+
+ public void setUserInfoUpdatesAffectedUserId(int userInfoUpdatesAffectedUserId) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_ID, userInfoUpdatesAffectedUserId);
+ }
+
+ public void setUserInfoUpdatesAffectedUserPrivilege(String userInfoUpdatesAffectedUserPrivilege) {
+ addPair(USER_INFO_UPDATES_AFFECTED_USER_PRIVILEGE, userInfoUpdatesAffectedUserPrivilege);
+ }
+
+ public void setUserInfoUpdatesUser(String userInfoUpdatesUser) {
+ addPair(USER_INFO_UPDATES_USER, userInfoUpdatesUser);
+ }
+
+ public void setUserInfoUpdatesUserGroup(String userInfoUpdatesUserGroup) {
+ addPair(USER_INFO_UPDATES_USER_GROUP, userInfoUpdatesUserGroup);
+ }
+
+ public void setUserInfoUpdatesUserGroupId(int userInfoUpdatesUserGroupId) {
+ addPair(USER_INFO_UPDATES_USER_GROUP_ID, userInfoUpdatesUserGroupId);
+ }
+
+ public void setUserInfoUpdatesUserId(int userInfoUpdatesUserId) {
+ addPair(USER_INFO_UPDATES_USER_ID, userInfoUpdatesUserId);
+ }
+
+ public void setUserInfoUpdatesUserPrivilege(String userInfoUpdatesUserPrivilege) {
+ addPair(USER_INFO_UPDATES_USER_PRIVILEGE, userInfoUpdatesUserPrivilege);
+ }
+
+ public void setUserInfoUpdatesUserSubject(String userInfoUpdatesUserSubject) {
+ addPair(USER_INFO_UPDATES_USER_SUBJECT, userInfoUpdatesUserSubject);
+ }
+
+ public void setUserInfoUpdatesUserSubjectId(int userInfoUpdatesUserSubjectId) {
+ addPair(USER_INFO_UPDATES_USER_SUBJECT_ID, userInfoUpdatesUserSubjectId);
+ }
+
+ public void setUserInfoUpdatesUserSubjectPrivilege(String userInfoUpdatesUserSubjectPrivilege) {
+ addPair(USER_INFO_UPDATES_USER_SUBJECT_PRIVILEGE, userInfoUpdatesUserSubjectPrivilege);
+ }
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/VulnerabilityEvent.java b/src/main/java/org/springframework/integration/splunk/event/VulnerabilityEvent.java
new file mode 100644
index 0000000..18d32fc
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/VulnerabilityEvent.java
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class VulnerabilityEvent extends SplunkEvent {
+ // ----------------------------------
+ // Vulnerability
+ // ----------------------------------
+
+ /**
+ * The category of the discovered vulnerability.
+ */
+ public static String VULNERABILITY_CATEGORY = "category";
+ /**
+ * The host with the discovered vulnerability. If your field is named
+ * dest_host, dest_ip, dest_ipv6, or dest_nt_host you can alias it as dest
+ * to make it CIM-compliant.
+ */
+ public static String VULNERABILITY_DEST = "dest";
+ /**
+ * The operating system of the host containing the vulnerability detected on
+ * the client (the src field), such as SuSE Security Update, or cups
+ * security update.
+ */
+ public static String VULNERABILITY_OS = "os";
+ /**
+ * The severity of the discovered vulnerability.
+ */
+ public static String VULNERABILITY_SEVERITY = "severity";
+ /**
+ * The name of the vulnerability detected on the client (the src field),
+ * such as SuSE Security Update, or cups security update.
+ */
+ public static String VULNERABILITY_SIGNATURE = "signature";
+
+ public void setVulnerabilityCategory(String vulnerabilityCategory) {
+ addPair(VULNERABILITY_CATEGORY, vulnerabilityCategory);
+ }
+
+ public void setVulnerabilityDest(String vulnerabilityDest) {
+ addPair(VULNERABILITY_DEST, vulnerabilityDest);
+ }
+
+ public void setVulnerabilityOs(String vulnerabilityOs) {
+ addPair(VULNERABILITY_OS, vulnerabilityOs);
+ }
+
+ public void setVulnerabilitySeverity(String vulnerabilitySeverity) {
+ addPair(VULNERABILITY_SEVERITY, vulnerabilitySeverity);
+ }
+
+ public void setVulnerabilitySignature(String vulnerabilitySignature) {
+ addPair(VULNERABILITY_SIGNATURE, vulnerabilitySignature);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/event/WindowsAdminEvent.java b/src/main/java/org/springframework/integration/splunk/event/WindowsAdminEvent.java
new file mode 100644
index 0000000..5f5ecd3
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/event/WindowsAdminEvent.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.event;
+
+/**
+ * @author David Turanski
+ *
+ */
+@SuppressWarnings("serial")
+public class WindowsAdminEvent extends SplunkEvent {
+ // ----------------------------------
+ // Windows administration
+ // ----------------------------------
+
+ /**
+ * The object name (associated only with Windows).
+ */
+ public static String WINDOWS_ADMIN_OBJECT_NAME = "object_name";
+ /**
+ * The object type (associated only with Windows).
+ */
+ public static String WINDOWS_ADMIN_OBJECT_TYPE = "object_type";
+ /**
+ * The object handle (associated only with Windows).
+ */
+ public static String WINDOWS_ADMIN_OBJECT_HANDLE = "object_handle";
+
+ public void setWindowsAdminObjectName(String windowsAdminObjectName) {
+ addPair(WINDOWS_ADMIN_OBJECT_NAME, windowsAdminObjectName);
+ }
+
+ public void setWindowsAdminObjectType(String windowsAdminObjectType) {
+ addPair(WINDOWS_ADMIN_OBJECT_TYPE, windowsAdminObjectType);
+ }
+
+ public void setWindowsAdminObjectHandle(String windowsAdminObjectHandle) {
+ addPair(WINDOWS_ADMIN_OBJECT_HANDLE, windowsAdminObjectHandle);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java b/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java
index c99ed67..09cdc29 100644
--- a/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java
+++ b/src/main/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapter.java
@@ -20,7 +20,7 @@ import java.util.List;
import org.springframework.integration.Message;
import org.springframework.integration.context.IntegrationObjectSupport;
import org.springframework.integration.core.MessageSource;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
import org.springframework.integration.splunk.support.SplunkExecutor;
import org.springframework.integration.support.MessageBuilder;
import org.springframework.util.Assert;
@@ -32,7 +32,7 @@ import org.springframework.util.Assert;
* @since 1.0
*
*/
-public class SplunkPollingChannelAdapter extends IntegrationObjectSupport implements MessageSource> {
+public class SplunkPollingChannelAdapter extends IntegrationObjectSupport implements MessageSource> {
private final SplunkExecutor splunkExecutor;
@@ -62,8 +62,8 @@ public class SplunkPollingChannelAdapter extends IntegrationObjectSupport implem
* If {@link SplunkExecutor#poll()} returns null, this method will return
* null. Otherwise, a new {@link Message} is constructed and returned.
*/
- public Message> receive() {
- List payload = splunkExecutor.poll();
+ public Message> receive() {
+ List payload = splunkExecutor.poll();
if (payload == null) {
return null;
}
diff --git a/src/main/java/org/springframework/integration/splunk/support/AbstractSplunkDataWriter.java b/src/main/java/org/springframework/integration/splunk/support/AbstractSplunkDataWriter.java
new file mode 100644
index 0000000..39158a8
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/support/AbstractSplunkDataWriter.java
@@ -0,0 +1,166 @@
+/*
+ * Copyright 2011-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.Writer;
+import java.net.Socket;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.context.SmartLifecycle;
+import org.springframework.integration.splunk.core.Connection;
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.core.DataWriter;
+import org.springframework.integration.splunk.event.SplunkEvent;
+import org.springframework.util.Assert;
+
+import com.splunk.Args;
+import com.splunk.Service;
+
+/**
+ * Base class for {@link DataWriter}s to write data into Splunk.
+ *
+ * @author Jarred Li
+ * @author David Turanski
+ * @since 1.0
+ *
+ */
+public abstract class AbstractSplunkDataWriter implements DataWriter, SmartLifecycle {
+
+ protected final Log logger = LogFactory.getLog(getClass());
+
+ protected ConnectionFactory connectionFactory;
+
+ protected Socket socket;
+
+ protected Service service;
+
+ protected Args args;
+
+ private boolean running;
+
+ private int phase;
+
+ private boolean autoStartup = true;
+
+
+
+ protected AbstractSplunkDataWriter(ConnectionFactory connectionFactory, Args args) {
+ Assert.notNull(connectionFactory,"connectionFactory cannot be null");
+ this.connectionFactory = connectionFactory;
+
+ Assert.notNull(args, "args cannot be null");
+ this.args = args;
+ }
+
+ public void write(SplunkEvent event) throws Exception {
+ if (logger.isDebugEnabled()) {
+ logger.debug("writing event to splunk:" + event);
+ }
+
+ doWrite(event, socket, service, args);
+ }
+
+ protected void doWrite(SplunkEvent event, Socket socket, Service service, Args args) throws IOException {
+ OutputStream ostream = socket.getOutputStream();
+ Writer writer = new OutputStreamWriter(ostream, "UTF8");
+ writer.write(event.toString());
+ writer.flush();
+ }
+
+ protected abstract Socket createSocket(Service service) throws IOException;
+
+
+ public Args getArgs() {
+ return args;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.context.Lifecycle#start()
+ */
+ public synchronized void start() {
+ try {
+ Connection connection = connectionFactory.getConnection();
+ this.service = connection.getTarget();
+
+ socket = createSocket(service);
+
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ }
+ this.running = true;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.context.Lifecycle#stop()
+ */
+ public synchronized void stop() {
+ if (!running) {
+ return;
+ }
+ try {
+ if (socket != null) {
+ socket.close();
+ }
+
+ connectionFactory.getConnection().close();
+ } catch (Exception e) {
+ throw new RuntimeException(e);
+ }
+
+ this.running = false;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.context.Lifecycle#isRunning()
+ */
+ public boolean isRunning() {
+ return this.running;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.context.Phased#getPhase()
+ */
+ public int getPhase() {
+ return this.phase;
+ }
+
+ public void setPhase(int phase) {
+ this.phase = phase;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.context.SmartLifecycle#isAutoStartup()
+ */
+ public boolean isAutoStartup() {
+ return this.autoStartup;
+ }
+
+ public void setAutoStartup(boolean autoStartup) {
+ this.autoStartup = autoStartup;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.context.SmartLifecycle#stop(java.lang.Runnable)
+ */
+ public synchronized void stop(Runnable callback) {
+ this.stop();
+ callback.run();
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/support/ArgsBuilder.java b/src/main/java/org/springframework/integration/splunk/support/ArgsBuilder.java
new file mode 100644
index 0000000..84d445a
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/support/ArgsBuilder.java
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import com.splunk.Args;
+
+/**
+ * Build {@link Args} instance. Supports method chaining
+ * @author David Turanski
+ *
+ */
+public class ArgsBuilder {
+
+ private String sourceType;
+ private String source;
+ private String host;
+ private String hostRegex;
+
+ public Args build() {
+ Args args = new Args();
+ if (sourceType != null) {
+ args.put("sourcetype", sourceType);
+ }
+ if (source != null) {
+ args.put("source", source);
+ }
+
+ if (host != null) {
+ args.put("host", host);
+ }
+
+ if (hostRegex != null) {
+ args.put("host_regex", hostRegex);
+ }
+ return args;
+ }
+
+ /**
+ * @param sourceType the sourceType to set
+ */
+ public ArgsBuilder setSourceType(String sourceType) {
+ this.sourceType = sourceType;
+ return this;
+ }
+
+ /**
+ * @param source the source to set
+ */
+ public ArgsBuilder setSource(String source) {
+ this.source = source;
+ return this;
+ }
+
+ /**
+ * @param host the host to set
+ */
+ public ArgsBuilder setHost(String host) {
+ this.host = host;
+ return this;
+ }
+
+ /**
+ * @param hostRegex the hostRegex to set
+ */
+ public ArgsBuilder setHostRegex(String hostRegex) {
+ this.hostRegex = hostRegex;
+ return this;
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/support/IngestType.java b/src/main/java/org/springframework/integration/splunk/support/IngestType.java
deleted file mode 100644
index a559a7b..0000000
--- a/src/main/java/org/springframework/integration/splunk/support/IngestType.java
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright 2011-2012 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.integration.splunk.support;
-
-/**
- * Method of pushing data into Splunk.
- *
- * Stream: Establish a connection, keep it open, and stream events until the connection is closed.Better for high volume input.
- * Tcp: Create raw socket and send event data into the socket
- * Submit: Send event data into Splunk with HTTP REST api
- *
- * @author Jarred Li
- * @since 1.0
- *
- */
-public enum IngestType {
- STREAM, TCP, SUBMIT;
-}
\ No newline at end of file
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkArgsFactoryBean.java b/src/main/java/org/springframework/integration/splunk/support/SplunkArgsFactoryBean.java
new file mode 100644
index 0000000..2e786d6
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkArgsFactoryBean.java
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import org.springframework.beans.factory.FactoryBean;
+
+import com.splunk.Args;
+
+/**
+ * {@link FactoryBean} that wraps {@link ArgsBuilder}
+ * @author David Turanski
+ *
+ */
+public class SplunkArgsFactoryBean implements FactoryBean {
+ private ArgsBuilder argsBuilder = new ArgsBuilder();
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.FactoryBean#getObject()
+ */
+ public Args getObject() throws Exception {
+ return argsBuilder.build();
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.FactoryBean#getObjectType()
+ */
+ public Class getObjectType() {
+ return Args.class;
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.beans.factory.FactoryBean#isSingleton()
+ */
+ public boolean isSingleton() {
+ return true;
+ }
+
+ /**
+ * @param host the host to set
+ */
+ public void setHost(String host) {
+ this.argsBuilder.setHost(host);
+ }
+
+ /**
+ * @param hostRegex the hostRegex to set
+ */
+ public void setHostRegex(String hostRegex) {
+ this.argsBuilder.setHostRegex(hostRegex);
+ }
+
+ /**
+ * @param sourceType the sourceType to set
+ */
+ public void setSourceType(String sourceType) {
+ this.argsBuilder.setSourceType(sourceType);
+ }
+
+ /**
+ * @param source the source to set
+ */
+ public void setSource(String source) {
+ this.argsBuilder.setSource(source);
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java b/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java
index 233fcc0..0cc2b03 100644
--- a/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkConnection.java
@@ -17,9 +17,13 @@ package org.springframework.integration.splunk.support;
import java.util.HashMap;
import java.util.Map;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
import org.springframework.integration.splunk.core.Connection;
-import org.springframework.integration.splunk.entity.SplunkServer;
import com.splunk.Service;
@@ -33,9 +37,10 @@ import com.splunk.Service;
public class SplunkConnection implements Connection {
private Service service;
+
public SplunkConnection(SplunkServer splunkServer) {
- Map args = new HashMap();
+ final Map args = new HashMap();
if (splunkServer.getHost() != null) {
args.put("host", splunkServer.getHost());
}
@@ -52,9 +57,28 @@ public class SplunkConnection implements Connection {
args.put("owner", splunkServer.getOwner());
}
- args.put("username", splunkServer.getUserName());
+ args.put("username", splunkServer.getUsername());
args.put("password", splunkServer.getPassword());
- service = Service.connect(args);
+
+ ExecutorService executor = Executors.newSingleThreadExecutor();
+
+ Future future = executor.submit(new Callable(){
+ public Service call() throws Exception {
+ return Service.connect(args);
+ }
+ });
+
+ try {
+ if (splunkServer.getTimeout() > 0) {
+ service = future.get(splunkServer.getTimeout(),TimeUnit.MILLISECONDS);
+ } else {
+ service = future.get();
+ }
+ } catch (Exception e) {
+ throw new RuntimeException(String.format("could not connect to Splunk Server @ %s:%d - %s",
+ splunkServer.getHost(),splunkServer.getPort(),e.getMessage()));
+ }
+
}
/* (non-Javadoc)
@@ -76,6 +100,7 @@ public class SplunkConnection implements Connection {
}
return result;
}
+
/* (non-Javadoc)
* @see org.springframework.integration.splunk.core.IService#getService()
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java b/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java
index 5eba652..7a15e2b 100644
--- a/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkConnectionFactory.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2011-2012 the original author or authors.
+ * Copyright 2011-2013 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,7 +17,6 @@ package org.springframework.integration.splunk.support;
import org.springframework.integration.splunk.core.Connection;
import org.springframework.integration.splunk.core.ConnectionFactory;
-import org.springframework.integration.splunk.entity.SplunkServer;
import com.splunk.Service;
@@ -25,13 +24,14 @@ import com.splunk.Service;
* Factory to create Splunk connection.
*
* @author Jarred Li
+ * @author David Turanski
* @since 1.0
*
*/
public class SplunkConnectionFactory implements ConnectionFactory {
private SplunkServer splunkServer;
-
+ private SplunkConnection connection;
public SplunkConnectionFactory(SplunkServer server) {
this.splunkServer = server;
}
@@ -39,8 +39,11 @@ public class SplunkConnectionFactory implements ConnectionFactory {
/* (non-Javadoc)
* @see org.springframework.integration.splunk.core.ServiceFactory#getService()
*/
- public Connection getConnection() throws Exception {
- return new SplunkConnection(splunkServer);
+ public synchronized Connection getConnection() throws Exception {
+ if (connection == null || !connection.isOpen()) {
+ connection = new SplunkConnection(splunkServer);
+ }
+ return connection;
}
}
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java b/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java
index a03fe66..dcff125 100644
--- a/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkDataReader.java
@@ -30,7 +30,7 @@ import org.springframework.beans.factory.InitializingBean;
import org.springframework.integration.splunk.core.Connection;
import org.springframework.integration.splunk.core.ConnectionFactory;
import org.springframework.integration.splunk.core.DataReader;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
@@ -176,7 +176,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
return app;
}
- public List search() throws Exception {
+ public List search() throws Exception {
logger.debug("mode:" + mode);
switch (mode) {
case SAVEDSEARCH: {
@@ -292,7 +292,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
}
- private List runQuery(Args queryArgs) throws Exception {
+ private List runQuery(Args queryArgs) throws Exception {
Connection connection = connectionFactory.getConnection();
try {
Job job = connection.getTarget().getJobs().create(search, queryArgs);
@@ -305,20 +305,20 @@ public class SplunkDataReader implements DataReader, InitializingBean {
}
}
- private List blockingSearch() throws Exception {
+ private List blockingSearch() throws Exception {
logger.debug("block search start");
Args queryArgs = new Args();
queryArgs.put("exec_mode", "blocking");
Calendar startTime = Calendar.getInstance();
populateArgs(queryArgs, startTime, false);
- List data = runQuery(queryArgs);
+ List data = runQuery(queryArgs);
lastSuccessfulReadTime = startTime;
return data;
}
- private List nonBlockingSearch() throws Exception {
+ private List nonBlockingSearch() throws Exception {
logger.debug("non block search start");
Args queryArgs = new Args();
@@ -326,7 +326,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
Calendar startTime = Calendar.getInstance();
populateArgs(queryArgs, startTime, false);
- List data = runQuery(queryArgs);
+ List data = runQuery(queryArgs);
lastSuccessfulReadTime = startTime;
return data;
}
@@ -336,7 +336,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
* @return
* @throws Exception
*/
- private List realtimeSearch() throws Exception {
+ private List realtimeSearch() throws Exception {
logger.debug("realtime search start");
Args queryArgs = new Args();
@@ -344,7 +344,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
Calendar startTime = Calendar.getInstance();
populateArgs(queryArgs, startTime, true);
- List data = runQuery(queryArgs);
+ List data = runQuery(queryArgs);
lastSuccessfulReadTime = startTime;
return data;
}
@@ -353,11 +353,11 @@ public class SplunkDataReader implements DataReader, InitializingBean {
* @throws Exception
*
*/
- private List exportSearch() throws Exception {
+ private List exportSearch() throws Exception {
logger.debug("export start");
- List result = new ArrayList();
+ List result = new ArrayList();
HashMap data;
- SplunkData splunkData;
+ SplunkEvent splunkData;
Args queryArgs = new Args();
Calendar startTime = Calendar.getInstance();
@@ -369,7 +369,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
InputStream os = connection.getTarget().export(search, queryArgs);
ResultsReaderXml resultsReader = new ResultsReaderXml(os);
while ((data = resultsReader.getNextEvent()) != null) {
- splunkData = new SplunkData(data);
+ splunkData = new SplunkEvent(data);
result.add(splunkData);
}
return result;
@@ -379,7 +379,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
}
- private List savedSearch() throws Exception {
+ private List savedSearch() throws Exception {
logger.debug("saved search start");
Args queryArgs = new Args();
@@ -414,7 +414,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
while (!job.isDone()) {
Thread.sleep(2000);
}
- List data = extractData(job);
+ List data = extractData(job);
this.lastSuccessfulReadTime = startTime;
return data;
} finally {
@@ -422,10 +422,10 @@ public class SplunkDataReader implements DataReader, InitializingBean {
}
}
- private List extractData(Job job) throws Exception {
- List result = new ArrayList();
+ private List extractData(Job job) throws Exception {
+ List result = new ArrayList();
HashMap data;
- SplunkData splunkData;
+ SplunkEvent splunkData;
ResultsReader resultsReader;
int total = job.getResultCount();
@@ -437,7 +437,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
resultsReader = new ResultsReaderXml(stream);
while ((data = resultsReader.getNextEvent()) != null) {
- splunkData = new SplunkData(data);
+ splunkData = new SplunkEvent(data);
result.add(splunkData);
}
}
@@ -452,7 +452,7 @@ public class SplunkDataReader implements DataReader, InitializingBean {
stream = job.getResults(outputArgs);
resultsReader = new ResultsReaderXml(stream);
while ((data = resultsReader.getNextEvent()) != null) {
- splunkData = new SplunkData(data);
+ splunkData = new SplunkEvent(data);
result.add(splunkData);
}
offset += count;
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkDataWriter.java b/src/main/java/org/springframework/integration/splunk/support/SplunkDataWriter.java
deleted file mode 100644
index 135644d..0000000
--- a/src/main/java/org/springframework/integration/splunk/support/SplunkDataWriter.java
+++ /dev/null
@@ -1,202 +0,0 @@
-/*
- * Copyright 2011-2012 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.integration.splunk.support;
-
-import java.io.OutputStream;
-import java.io.OutputStreamWriter;
-import java.io.Writer;
-import java.net.Socket;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.integration.splunk.core.Connection;
-import org.springframework.integration.splunk.core.DataWriter;
-import org.springframework.integration.splunk.core.ConnectionFactory;
-import org.springframework.integration.splunk.entity.SplunkData;
-import org.springframework.util.Assert;
-
-import com.splunk.Args;
-import com.splunk.Index;
-import com.splunk.Receiver;
-import com.splunk.Service;
-
-/**
- * Data writer to write data into Splunk. There are 3 ways to write data:
- * REST submit, TCP socket and HTTP stream.
- *
- * @author Jarred Li
- * @since 1.0
- *
- */
-public class SplunkDataWriter implements DataWriter, InitializingBean {
-
- private static final Log logger = LogFactory.getLog(SplunkDataWriter.class);
-
- private ConnectionFactory connectionFactory;
-
- private String sourceType;
-
- private String source;
-
- private String index;
-
- private IngestType ingest = IngestType.STREAM; //tcp, stream, submit
-
- private int tcpPort;
-
- private String host;
-
- private String hostRegex;
-
- public SplunkDataWriter(ConnectionFactory f) {
- this.connectionFactory = f;
- }
-
- public void write(SplunkData data) throws Exception {
- logger.debug("write message to splunk:" + data);
-
- Connection connection = connectionFactory.getConnection();
- Service service = connection.getTarget();
- Index indexObject = null;
- Receiver receiver = null;
- OutputStream ostream;
- Socket socket;
- Writer writer = null;
-
- Args args = new Args();
- if (sourceType != null) {
- args.put("sourcetype", sourceType);
- }
- if (source != null) {
- args.put("source", source);
- }
-
- if (host != null) {
- args.put("host", host);
- }
-
- if (hostRegex != null) {
- args.put("host_regex", hostRegex);
- }
-
- try {
- if (index != null) {
- indexObject = service.getIndexes().get(index);
- }
- else {
- receiver = service.getReceiver();
- }
-
- if ((ingest.equals(IngestType.STREAM) || ingest.equals(IngestType.TCP))) {
- if (ingest.equals(IngestType.STREAM)) {
- if (indexObject != null)
- socket = indexObject.attach(args);
- else
- socket = receiver.attach(args);
- }
- else {
- socket = service.open(tcpPort);
- }
- ostream = socket.getOutputStream();
- writer = new OutputStreamWriter(ostream, "UTF8");
- }
-
- if ((ingest.equals(IngestType.STREAM) || ingest.equals(IngestType.TCP))) {
- writer.write(data.toString());
- writer.flush();
- writer.close();
- }
- else {
- if (index != null) {
- indexObject.submit(args, data.toString());
- }
- else {
- receiver.submit(args, data.toString());
- }
- }
- } finally {
- connection.close();
- }
-
- }
-
-
- public void setSourceType(String sourceType) {
- this.sourceType = sourceType;
- }
-
- public void setSource(String source) {
- this.source = source;
- }
-
- public void setIndex(String index) {
- this.index = index;
- }
-
- public void setIngest(IngestType ingest) {
- this.ingest = ingest;
- }
-
- public void setTcpPort(int tcpPort) {
- this.tcpPort = tcpPort;
- }
-
- public void setHost(String host) {
- this.host = host;
- }
-
- public void setHostRegex(String hostRegex) {
- this.hostRegex = hostRegex;
- }
-
-
- public String getSourceType() {
- return sourceType;
- }
-
- public String getSource() {
- return source;
- }
-
- public String getIndex() {
- return index;
- }
-
- public IngestType getIngest() {
- return ingest;
- }
-
- public int getTcpPort() {
- return tcpPort;
- }
-
- public String getHost() {
- return host;
- }
-
- public String getHostRegex() {
- return hostRegex;
- }
-
- /* (non-Javadoc)
- * @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()
- */
- public void afterPropertiesSet() throws Exception {
- Assert.notNull(ingest, "You must specify ingest type");
- }
-
-}
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java b/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java
index 0dd1b5d..55f194d 100644
--- a/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkExecutor.java
@@ -25,7 +25,7 @@ import org.springframework.integration.MessageHandlingException;
import org.springframework.integration.MessagingException;
import org.springframework.integration.splunk.core.DataReader;
import org.springframework.integration.splunk.core.DataWriter;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
/**
* Bundles common core logic for the Splunk components.
@@ -57,7 +57,7 @@ public class SplunkExecutor implements InitializingBean {
*/
public Object executeOutboundOperation(final Message message) {
try {
- SplunkData payload = (SplunkData) message.getPayload();
+ SplunkEvent payload = (SplunkEvent) message.getPayload();
writer.write(payload);
} catch (Exception e) {
String errorMsg = "error in writing data into Splunk";
@@ -74,9 +74,9 @@ public class SplunkExecutor implements InitializingBean {
/**
* Execute the Splunk operation.
*/
- public List poll() {
+ public List poll() {
logger.debug("poll start:");
- List queryData = null;
+ List queryData = null;
try {
queryData = reader.search();
} catch (Exception e) {
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkIndexWriter.java b/src/main/java/org/springframework/integration/splunk/support/SplunkIndexWriter.java
new file mode 100644
index 0000000..c9ec1e8
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkIndexWriter.java
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.io.IOException;
+import java.net.Socket;
+
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.util.Assert;
+
+import com.splunk.Args;
+import com.splunk.Index;
+import com.splunk.Receiver;
+import com.splunk.Service;
+
+/**
+ *
+ * DataWriter to stream data into Splunk using an optional index. If no index specified,
+ * the main default index is used.
+ *
+ * @author Jarred Li
+ * @author David Turanski
+ * @since 1.0
+ *
+ */
+
+public class SplunkIndexWriter extends AbstractSplunkDataWriter {
+ private String indexName;
+ /**
+ *
+ * @param connectionFactory
+ * @param args
+ */
+ public SplunkIndexWriter(ConnectionFactory connectionFactory, Args args) {
+ super(connectionFactory, args);
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.support.SplunkDataWriter#createSocket(com.splunk.Service)
+ */
+ @Override
+ protected Socket createSocket(Service service) throws IOException {
+ Index indexObject = null;
+ Receiver receiver = null;
+ Socket socket = null;
+
+ if (indexName != null) {
+ indexObject = service.getIndexes().get(indexName);
+ Assert.notNull(indexObject,String.format("cannot find index [%s]",indexName));
+ socket = indexObject.attach(args);
+
+
+ } else {
+ receiver = service.getReceiver();
+ socket = receiver.attach(args);
+ }
+ if (logger.isDebugEnabled()) {
+ logger.debug(String.format("created a socket on %s", socket.getRemoteSocketAddress()));
+ }
+ return socket;
+ }
+
+
+}
diff --git a/src/main/java/org/springframework/integration/splunk/entity/SplunkServer.java b/src/main/java/org/springframework/integration/splunk/support/SplunkServer.java
similarity index 68%
rename from src/main/java/org/springframework/integration/splunk/entity/SplunkServer.java
rename to src/main/java/org/springframework/integration/splunk/support/SplunkServer.java
index b8b703b..157f983 100644
--- a/src/main/java/org/springframework/integration/splunk/entity/SplunkServer.java
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkServer.java
@@ -13,7 +13,9 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.springframework.integration.splunk.entity;
+package org.springframework.integration.splunk.support;
+
+import com.splunk.Service;
/**
* Splunk server entity
@@ -24,13 +26,14 @@ package org.springframework.integration.splunk.entity;
*/
public class SplunkServer {
- private String host;
- private int port;
- private String scheme;
+ private String host = Service.DEFAULT_HOST;
+ private int port = Service.DEFAULT_PORT;
+ private String scheme = Service.DEFAULT_SCHEME;
private String app;
private String owner;
- private String userName;
+ private String username;
private String password;
+ private int timeout;
/**
* @return the host
@@ -60,26 +63,50 @@ public class SplunkServer {
this.port = port;
}
+ /**
+ *
+ * @return
+ */
public String getScheme() {
return scheme;
}
+ /**
+ *
+ * @param scheme
+ */
public void setScheme(String scheme) {
this.scheme = scheme;
}
+ /**
+ *
+ * @return
+ */
public String getApp() {
return app;
}
+ /**
+ *
+ * @param app
+ */
public void setApp(String app) {
this.app = app;
}
+ /**
+ *
+ * @return
+ */
public String getOwner() {
return owner;
}
+ /**
+ *
+ * @param owner
+ */
public void setOwner(String owner) {
this.owner = owner;
}
@@ -87,15 +114,15 @@ public class SplunkServer {
/**
* @return the userName
*/
- public String getUserName() {
- return userName;
+ public String getUsername() {
+ return username;
}
/**
- * @param userName the userName to set
+ * @param username the username to set
*/
- public void setUserName(String userName) {
- this.userName = userName;
+ public void setUsername(String username) {
+ this.username = username;
}
/**
@@ -112,6 +139,18 @@ public class SplunkServer {
this.password = password;
}
-
-
+ /**
+ * @return the timeout in ms.
+ */
+ public int getTimeout() {
+ return timeout;
+ }
+
+ /**
+ * set the timeout in ms.
+ * @param timeout
+ */
+ public void setTimeout(int timeout) {
+ this.timeout = timeout;
+ }
}
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkSubmitWriter.java b/src/main/java/org/springframework/integration/splunk/support/SplunkSubmitWriter.java
new file mode 100644
index 0000000..bd4bc58
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkSubmitWriter.java
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.io.IOException;
+import java.net.Socket;
+
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.integration.splunk.event.SplunkEvent;
+
+import com.splunk.Args;
+import com.splunk.Index;
+import com.splunk.Receiver;
+import com.splunk.Service;
+
+/**
+ * @author David Turanski
+ *
+ */
+public class SplunkSubmitWriter extends AbstractSplunkDataWriter {
+ private String indexName;
+ /**
+ * @param connectionFactory
+ */
+ public SplunkSubmitWriter(ConnectionFactory connectionFactory, Args args) {
+ super(connectionFactory, args);
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.support.SplunkDataWriter#doWrite(org.springframework.integration.splunk.event.SplunkEvent, java.net.Socket, com.splunk.Service, com.splunk.Args)
+ */
+ @Override
+ protected void doWrite(SplunkEvent event, Socket socket, Service service, Args args) throws IOException {
+
+ Index index = getIndex();
+ if (index != null) {
+ index.submit(args, event.toString());
+ } else {
+ Receiver receiver = service.getReceiver();
+ receiver.submit(args, event.toString());
+ }
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.support.SplunkDataWriter#createSocket(com.splunk.Service)
+ */
+ @Override
+ protected Socket createSocket(Service service) throws IOException {
+ return null;
+ }
+ private Index getIndex() {
+ return (indexName == null) ? null: service.getIndexes().get(indexName);
+ }
+
+ public void setIndexName(String indexName) {
+ this.indexName = indexName;
+ }
+}
diff --git a/src/main/java/org/springframework/integration/splunk/support/SplunkTcpWriter.java b/src/main/java/org/springframework/integration/splunk/support/SplunkTcpWriter.java
new file mode 100644
index 0000000..a39dae3
--- /dev/null
+++ b/src/main/java/org/springframework/integration/splunk/support/SplunkTcpWriter.java
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ */
+package org.springframework.integration.splunk.support;
+
+import java.io.IOException;
+import java.net.Socket;
+
+import org.springframework.integration.splunk.core.ConnectionFactory;
+import org.springframework.util.Assert;
+
+import com.splunk.Args;
+import com.splunk.Input;
+import com.splunk.Service;
+
+/**
+ *
+ * A {@link SplunkStreamWriter} that creates a socket on a given port
+ * @author David Turanski
+ *
+ */
+public class SplunkTcpWriter extends AbstractSplunkDataWriter {
+ private int port;
+
+ /**
+ * @param connectionFactory
+ * @param args
+ */
+ public SplunkTcpWriter(ConnectionFactory connectionFactory, Args args) {
+ super(connectionFactory, args);
+ }
+
+ /* (non-Javadoc)
+ * @see org.springframework.integration.splunk.support.SplunkDataWriter#createSocket(com.splunk.Service)
+ */
+ @Override
+ protected Socket createSocket(Service service) throws IOException {
+
+ Input input = service.getInputs().get(String.valueOf(port));
+ Assert.notNull(input, "no input defined for port " + port);
+ Assert.isTrue(!input.isDisabled(),String.format("input on port %d is disabled",port));
+ Socket socket = service.open(port);
+ return socket;
+ }
+
+ /**
+ * @param port the port to set
+ */
+ public void setPort(int port) {
+ this.port = port;
+ }
+
+
+}
diff --git a/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd b/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
index c452f4f..0d8ba89 100644
--- a/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
+++ b/src/main/resources/org/springframework/integration/splunk/config/xml/spring-integration-splunk-1.0.xsd
@@ -9,7 +9,7 @@
+ schemaLocation="http://www.springframework.org/schema/integration/spring-integration.xsd" />
-
+
-
+
+
+
+
+
+
+
+
+
+
+
@@ -168,7 +180,7 @@ Indicates the password to login Splunk server
-
+
A comma-separated list of the fields to return
@@ -182,28 +194,28 @@ Indicates the password to login Splunk server
-
+
Time modifier for the start of the time window.
-
+
Time modifier for the end of the time window.
-
+
Time modifier for the start of the time window for the first search.
-
+
Saved search.
@@ -226,6 +238,26 @@ Indicates the password to login Splunk server
+
+
+
+
+
+ Index to write to.
+
+
+
+
+
+
+
+
+
+ The port corresponding to a tcp Input
+
+
+
+
@@ -237,6 +269,29 @@ Indicates the password to login Splunk server
+
+
+
+
+ Defines a Data Writer for streaming data to an index, or the default index if not specified.
+
+
+
+
+
+
+ Defines a Data Writer for streaming data to a tcp input port.
+
+
+
+
+
+
+ Defines a Data Writer to submit data, using the REST interface, to an index, or the default index if not specified.
+
+
+
+
@@ -272,34 +327,14 @@ Indicates the password to login Splunk server
-
+
Splunk event source type
-
-
-
- Splunk index name
-
-
-
-
-
-
- Splunk ingest method: tcp, streaming, submit. Default stream.
-
-
-
-
-
-
- Splunk ingest method: tcp, streaming, submit. Default stream.
-
-
-
+
@@ -307,7 +342,8 @@ Indicates the password to login Splunk server
-
+
+
Host regex can be provided so Splunk can dynamically extract the host value from the log event
diff --git a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java
index 9634741..77da908 100644
--- a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java
+++ b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests.java
@@ -15,6 +15,7 @@
*/
package org.springframework.integration.splunk.config.xml;
+import static org.junit.Assert.*;
import junit.framework.Assert;
import org.junit.Test;
@@ -47,23 +48,22 @@ public class SplunkInboundChannelAdapterParserSavedSearchTests {
public void testParseSourceElementParserContext() {
SourcePollingChannelAdapter adapter = appContext.getBean("splunkInboundChannelAdapter",
SourcePollingChannelAdapter.class);
- Assert.assertNotNull(adapter);
-
+ assertNotNull(adapter);
SplunkDataReader reader = appContext.getBean("splunkInboundChannelAdapter.splunkExecutor.reader",
SplunkDataReader.class);
- Assert.assertNotNull(reader);
+ assertNotNull(reader);
SearchMode mode = SearchMode.SAVEDSEARCH;
- Assert.assertEquals(mode, reader.getMode());
+ assertEquals(mode, reader.getMode());
String savedSearch = "savedSearch";
- Assert.assertEquals(savedSearch, reader.getSavedSearch());
+ assertEquals(savedSearch, reader.getSavedSearch());
String owner = "admin";
- Assert.assertEquals(owner, reader.getOwner());
+ assertEquals(owner, reader.getOwner());
String app = "search";
- Assert.assertEquals(app, reader.getApp());
+ assertEquals(app, reader.getApp());
}
}
diff --git a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java
index 7baaf2b..cbf293b 100644
--- a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java
+++ b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests.java
@@ -15,14 +15,15 @@
*/
package org.springframework.integration.splunk.config.xml;
+import static org.junit.Assert.assertTrue;
import junit.framework.Assert;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationContext;
-import org.springframework.integration.splunk.support.IngestType;
-import org.springframework.integration.splunk.support.SplunkDataWriter;
+import org.springframework.integration.splunk.support.AbstractSplunkDataWriter;
+import org.springframework.integration.splunk.support.SplunkIndexWriter;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
@@ -46,19 +47,10 @@ public class SplunkOutboundChannelAdapterParserStreamTests {
Object adapter = appContext.getBean("splunkOutboundChannelAdapter");
Assert.assertNotNull(adapter);
- SplunkDataWriter writer = appContext.getBean("splunkOutboundChannelAdapter.splunkExecutor.writer",
- SplunkDataWriter.class);
+ AbstractSplunkDataWriter writer = appContext.getBean("splunkOutboundChannelAdapter.splunkExecutor.writer",
+ AbstractSplunkDataWriter.class);
Assert.assertNotNull(writer);
-
- IngestType ingest = IngestType.STREAM;
- Assert.assertEquals(ingest, writer.getIngest());
-
- String host = "test.host";
- Assert.assertEquals(host, writer.getHost());
-
- String hostRegex = "test.host.*";
- Assert.assertEquals(hostRegex, writer.getHostRegex());
-
+ assertTrue(writer instanceof SplunkIndexWriter);
}
}
diff --git a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java
index 2442330..1cbf760 100644
--- a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java
+++ b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests.java
@@ -15,14 +15,17 @@
*/
package org.springframework.integration.splunk.config.xml;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
import junit.framework.Assert;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationContext;
-import org.springframework.integration.splunk.support.IngestType;
-import org.springframework.integration.splunk.support.SplunkDataWriter;
+import org.springframework.integration.splunk.support.AbstractSplunkDataWriter;
+import org.springframework.integration.splunk.support.SplunkSubmitWriter;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
@@ -46,19 +49,19 @@ public class SplunkOutboundChannelAdapterParserTests {
Object adapter = appContext.getBean("splunkOutboundChannelAdapter");
Assert.assertNotNull(adapter);
- SplunkDataWriter writer = appContext.getBean("splunkOutboundChannelAdapter.splunkExecutor.writer",
- SplunkDataWriter.class);
- Assert.assertNotNull(writer);
-
+ AbstractSplunkDataWriter writer = appContext.getBean("splunkOutboundChannelAdapter.splunkExecutor.writer",
+ AbstractSplunkDataWriter.class);
+ assertNotNull(writer);
+
+ assertTrue(writer instanceof SplunkSubmitWriter);
+ assertEquals(false,writer.isAutoStartup());
+ assertEquals(false,writer.isRunning());
+
String sourceType = "spring-integration";
- Assert.assertEquals(sourceType, writer.getSourceType());
+ assertEquals(sourceType, writer.getArgs().get("sourcetype"));
String source = "example5";
- Assert.assertEquals(source, writer.getSource());
-
- IngestType ingest = IngestType.SUBMIT;
- Assert.assertEquals(ingest, writer.getIngest());
-
+ assertEquals(source, writer.getArgs().get("source"));
}
diff --git a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java
index 50c26bf..98c806a 100644
--- a/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java
+++ b/src/test/java/org/springframework/integration/splunk/config/xml/SplunkServerParserTests.java
@@ -21,7 +21,7 @@ import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.ApplicationContext;
-import org.springframework.integration.splunk.entity.SplunkServer;
+import org.springframework.integration.splunk.support.SplunkServer;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
@@ -46,7 +46,7 @@ public class SplunkServerParserTests {
Assert.assertEquals("test.splunk.server", server.getHost());
Assert.assertEquals(8089, server.getPort());
- Assert.assertEquals("admin", server.getUserName());
+ Assert.assertEquals("admin", server.getUsername());
Assert.assertEquals("password", server.getPassword());
Assert.assertEquals("https", server.getScheme());
Assert.assertEquals("admin", server.getOwner());
diff --git a/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java b/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java
index b32b685..8a02e2a 100644
--- a/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java
+++ b/src/test/java/org/springframework/integration/splunk/inbound/SplunkPollingChannelAdapterTests.java
@@ -25,7 +25,7 @@ import junit.framework.Assert;
import org.junit.Before;
import org.junit.Test;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
import org.springframework.integration.splunk.support.SplunkExecutor;
/**
@@ -50,13 +50,13 @@ public class SplunkPollingChannelAdapterTests {
*/
@Test
public void testReceive() {
- List data = new ArrayList();
- SplunkData sd = new SplunkData("spring", "spring:example");
+ List data = new ArrayList();
+ SplunkEvent sd = new SplunkEvent("spring", "spring:example");
sd.setCommonDesc("description");
data.add(sd);
when(executor.poll()).thenReturn(data);
- List received = inboundAdapter.receive().getPayload();
+ List received = inboundAdapter.receive().getPayload();
Assert.assertEquals(1, received.size());
}
diff --git a/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java b/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java
index 9036d79..52e61ef 100644
--- a/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java
+++ b/src/test/java/org/springframework/integration/splunk/support/ConnectionFactoryFactoryBeanTests.java
@@ -19,7 +19,6 @@ import junit.framework.Assert;
import org.junit.Test;
import org.springframework.integration.splunk.core.ConnectionFactory;
-import org.springframework.integration.splunk.entity.SplunkServer;
import com.splunk.Service;
diff --git a/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java b/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java
index 7400b79..a5f80c2 100644
--- a/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java
+++ b/src/test/java/org/springframework/integration/splunk/support/SplunkDataReaderTests.java
@@ -32,7 +32,7 @@ import org.junit.Test;
import org.springframework.core.io.ClassPathResource;
import org.springframework.integration.splunk.core.Connection;
import org.springframework.integration.splunk.core.ConnectionFactory;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
import com.splunk.Job;
import com.splunk.JobCollection;
@@ -60,7 +60,7 @@ public class SplunkDataReaderTests {
public void testBlockingSearch() throws Exception {
reader.setMode(SearchMode.BLOCKING);
reader.setSearch("search spring:example");
- List data = reader.search();
+ List data = reader.search();
Assert.assertNotNull(data);
Assert.assertEquals(5, data.size());
}
@@ -69,7 +69,7 @@ public class SplunkDataReaderTests {
public void testNonBlockingSearch() throws Exception {
reader.setMode(SearchMode.NORMAL);
reader.setSearch("search spring:example");
- List data = reader.search();
+ List data = reader.search();
Assert.assertNotNull(data);
Assert.assertEquals(5, data.size());
}
@@ -79,7 +79,7 @@ public class SplunkDataReaderTests {
public void testRealtimeSearch() throws Exception {
reader.setMode(SearchMode.REALTIME);
reader.setSearch("search spring:example");
- List data = reader.search();
+ List data = reader.search();
Assert.assertNotNull(data);
Assert.assertEquals(5, data.size());
}
diff --git a/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java b/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java
index ab811da..fa2e322 100644
--- a/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java
+++ b/src/test/java/org/springframework/integration/splunk/support/SplunkDataWriterTests.java
@@ -22,7 +22,7 @@ import org.junit.Before;
import org.junit.Test;
import org.springframework.integration.splunk.core.Connection;
import org.springframework.integration.splunk.core.ConnectionFactory;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
import com.splunk.Args;
import com.splunk.Receiver;
@@ -35,31 +35,36 @@ import com.splunk.Service;
*/
public class SplunkDataWriterTests {
- private SplunkDataWriter writer;
+ private AbstractSplunkDataWriter writer;
private static Receiver receiver = mock(Receiver.class);
+ private Args args;
@Before
public void before() {
- writer = new SplunkDataWriter(new TestConnectioniFactory());
+ args = new Args();
+ writer = new SplunkSubmitWriter(new TestConnectionFactory(),args);
+ writer.start();
}
/**
- * Test method for {@link org.springframework.integration.splunk.support.SplunkDataWriter#write(org.springframework.integration.splunk.entity.SplunkData)}.
+ * Test method for {@link org.springframework.integration.splunk.support.AbstractSplunkDataWriter#write(org.springframework.integration.splunk.event.SplunkEvent)}.
* @throws Exception
*/
@Test
public void testWrite() throws Exception {
- writer.setIngest(IngestType.SUBMIT);
+
- SplunkData sd = new SplunkData("spring", "spring:example");
+ SplunkEvent sd = new SplunkEvent("spring", "spring:example");
sd.setCommonDesc("description");
writer.write(sd);
- Args args = new Args();
- verify(receiver).submit(eq(args), matches(".*spring:example.*"));
+
+ verify(receiver).submit(eq(args), matches(".*spring:example.*\n"));
+
+ writer.stop();
}
- public static class TestConnectioniFactory implements ConnectionFactory {
+ public static class TestConnectionFactory implements ConnectionFactory {
/* (non-Javadoc)
* @see org.springframework.integration.splunk.core.ConnectionFactory#getConnection()
diff --git a/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java b/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java
index 9163964..8ba7612 100644
--- a/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java
+++ b/src/test/java/org/springframework/integration/splunk/support/SplunkExecutorTests.java
@@ -29,7 +29,7 @@ import org.junit.Test;
import org.springframework.integration.Message;
import org.springframework.integration.splunk.core.DataReader;
import org.springframework.integration.splunk.core.DataWriter;
-import org.springframework.integration.splunk.entity.SplunkData;
+import org.springframework.integration.splunk.event.SplunkEvent;
import org.springframework.integration.support.MessageBuilder;
/**
@@ -59,9 +59,9 @@ public class SplunkExecutorTests {
*/
@Test
public void testHandleMessage() throws Exception {
- SplunkData sd = new SplunkData("spring", "spring:example");
+ SplunkEvent sd = new SplunkEvent("spring", "spring:example");
sd.setCommonDesc("description");
- Message message = MessageBuilder.withPayload(sd).build();
+ Message message = MessageBuilder.withPayload(sd).build();
executor.handleMessage(message);
verify(writer).write(sd);
}
@@ -72,17 +72,17 @@ public class SplunkExecutorTests {
*/
@Test
public void testPoll() throws Exception {
- List data = new ArrayList();
- SplunkData sd = new SplunkData("spring", "spring:example");
+ List data = new ArrayList();
+ SplunkEvent sd = new SplunkEvent("spring", "spring:example");
sd.setCommonDesc("description");
data.add(sd);
- sd = new SplunkData("spring", "spring:example");
+ sd = new SplunkEvent("spring", "spring:example");
sd.setCommonDesc("description");
data.add(sd);
when(reader.search()).thenReturn(data);
- List result = executor.poll();
+ List result = executor.poll();
Assert.assertEquals(2, result.size());
}
diff --git a/src/test/resources/log4j.properties b/src/test/resources/log4j.properties
index 6142a0d..8051ac4 100644
--- a/src/test/resources/log4j.properties
+++ b/src/test/resources/log4j.properties
@@ -3,3 +3,5 @@ log4j.rootCategory=INFO, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d{HH:mm:ss.SSS} %-5p [%t][%c] %m%n
+
+log4j.category.org.springframework.integration.splunk=DEBUG
diff --git a/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml b/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml
index 997a716..5c6b358 100644
--- a/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml
+++ b/src/test/resources/org/springframework/integration/splunk/SplunkCommon-context.xml
@@ -14,6 +14,6 @@
-
+
diff --git a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml
index 07a05d4..df88cb2 100644
--- a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml
+++ b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserSavedSearchTests-context.xml
@@ -16,9 +16,9 @@
+ channel="inputFromSplunk" mode="SAVEDSEARCH" earliest-time="-1d" latest-time="now"
+ init-earliest-time="-1d" count="1000"
+ saved-search="savedSearch" owner="admin" app="search">
diff --git a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml
index bb3c7d1..65c9f7f 100644
--- a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml
+++ b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkInboundChannelAdapterParserTests-context.xml
@@ -16,8 +16,8 @@
+ channel="inputFromSplunk" mode="BLOCKING" earliest-time="-1d" latest-time="now"
+ init-earliest-time="-1d" field-list="field1, field2">
diff --git a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml
index b999717..0684e92 100644
--- a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml
+++ b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserStreamTests-context.xml
@@ -11,14 +11,14 @@
-
-
-
+
+
+ pool-server-connection="true" source-type="spring-integration" source="example5"
+ host="test.host" host-regex="test.host.*">
+
diff --git a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml
index 15ef044..9bb406d 100644
--- a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml
+++ b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkOutboundChannelAdapterParserTests-context.xml
@@ -11,14 +11,13 @@
-
-
+
+ pool-server-connection="true" source-type="spring-integration" source="example5"
+ >
+
-
diff --git a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml
index e263634..0860ee1 100644
--- a/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml
+++ b/src/test/resources/org/springframework/integration/splunk/config/xml/SplunkServerParserTests-context.xml
@@ -11,7 +11,7 @@
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">