BasicPaloAltoFirewallParser extends BasicParser { @Override @SuppressWarnings({"unchecked", "unused"}) public List<JSONObject> parse(byte[] msg) { JSONObject outputMessage = new JSONObject(); String toParse = ""; List<JSONObject> messages = new ArrayList<>(); try { toParse = new String(msg, getReadCharset()); _LOG.debug("Received message: {}", toParse); parseMessage(toParse, outputMessage); long timestamp = System.currentTimeMillis(); outputMessage.put("timestamp", System.currentTimeMillis()); outputMessage.put("original_string", toParse); messages.add(outputMessage); return messages; } catch (Exception e) { e.printStackTrace(); _LOG.error("Failed to parse: {}", toParse); return null; } }  @Override void configure(Map<String, Object> parserConfig); @Override void init(); @Override @SuppressWarnings({"unchecked", "unused"}) List<JSONObject> parse(byte[] msg); static final String PaloAltoDomain; static final String ReceiveTime; static final String SerialNum; static final String Type; static final String ThreatContentType; static final String ConfigVersion; static final String GenerateTime; static final String SourceAddress; static final String DestinationAddress; static final String NATSourceIP; static final String NATDestinationIP; static final String Rule; static final String SourceUser; static final String DestinationUser; static final String Application; static final String VirtualSystem; static final String SourceZone; static final String DestinationZone; static final String InboundInterface; static final String OutboundInterface; static final String LogAction; static final String TimeLogged; static final String SessionID; static final String RepeatCount; static final String SourcePort; static final String DestinationPort; static final String NATSourcePort; static final String NATDestinationPort; static final String Flags; static final String IPProtocol; static final String Action; static final String Seqno; static final String ActionFlags; static final String Category; static final String DGH1; static final String DGH2; static final String DGH3; static final String DGH4; static final String VSYSName; static final String DeviceName; static final String ActionSource; static final String ParserVersion; static final String Tokens; static final String SourceVmUuid; static final String DestinationVmUuid; static final String TunnelId; static final String MonitorTag; static final String ParentSessionId; static final String ParentSessionStartTime; static final String TunnelType; static final String EventId; static final String Object; static final String Module; static final String Description; static final String Command; static final String Admin; static final String Client; static final String Result; static final String ConfigurationPath; static final String BeforeChangeDetail; static final String AfterChangeDetail; static final String URL; static final String HOST; static final String ThreatID; static final String Severity; static final String Direction; static final String SourceLocation; static final String DestinationLocation; static final String ContentType; static final String PCAPID; static final String WFFileDigest; static final String WFCloud; static final String UserAgent; static final String WFFileType; static final String XForwardedFor; static final String Referer; static final String WFSender; static final String WFSubject; static final String WFRecipient; static final String WFReportID; static final String URLIndex; static final String HTTPMethod; static final String ThreatCategory; static final String ContentVersion; static final String Bytes; static final String BytesSent; static final String BytesReceived; static final String Packets; static final String StartTime; static final String ElapsedTimeInSec; static final String PktsSent; static final String PktsReceived; static final String EndReason; }
@SuppressWarnings("unchecked") @Test public void testParseSystem61() { final String SYSTEM_61 = "1,2017/08/11 12:37:58,008900008659,SYSTEM,general,1,2017/08/11 11:37:58,vsys1,eventId_test,object_test,Futureuse1_test,futureuse2_test,management,high,Description_test,1354,0x0"; JSONObject actual = parser.parse(SYSTEM_61.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/08/11 12:37:58"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "008900008659"); expected.put(BasicPaloAltoFirewallParser.Type, "SYSTEM"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "general"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/08/11 11:37:58"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.EventId, "eventId_test"); expected.put(BasicPaloAltoFirewallParser.Object, "object_test"); expected.put(BasicPaloAltoFirewallParser.Module, "management"); expected.put(BasicPaloAltoFirewallParser.Severity, "high"); expected.put(BasicPaloAltoFirewallParser.Description, "Description_test"); expected.put(BasicPaloAltoFirewallParser.Seqno, "1354"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 61); expected.put("original_string", SYSTEM_61); expected.put("timestamp", actual.get("timestamp")); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseSystem80() { final String SYSTEM_80 = "1,2017/08/11 12:37:58,008900008659,SYSTEM,general,1,2017/08/11 11:37:58,vsys1,eventId_test,object_test,Futureuse1_test,futureuse2_test,management,high,Description_test,1354,0x0,12,34,45,0,virSys1,dev-something200-01"; JSONObject actual = parser.parse(SYSTEM_80.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/08/11 12:37:58"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "008900008659"); expected.put(BasicPaloAltoFirewallParser.Type, "SYSTEM"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "general"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/08/11 11:37:58"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.EventId, "eventId_test"); expected.put(BasicPaloAltoFirewallParser.Object, "object_test"); expected.put(BasicPaloAltoFirewallParser.Module, "management"); expected.put(BasicPaloAltoFirewallParser.Severity, "high"); expected.put(BasicPaloAltoFirewallParser.Description, "Description_test"); expected.put(BasicPaloAltoFirewallParser.Seqno, "1354"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.DGH1, "12"); expected.put(BasicPaloAltoFirewallParser.DGH2, "34"); expected.put(BasicPaloAltoFirewallParser.DGH3, "45"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.VSYSName, "virSys1"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "dev-something200-01"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 80); expected.put("original_string", SYSTEM_80); expected.put("timestamp", actual.get("timestamp")); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseConfig61NoCustomFields() { final String CONFIG_61_customFields = "1,2017/08/11 12:37:58,008900008659,CONFIG,0,1,2017/08/11 11:37:58,192.168.14.162,vsys1,edit,admin,Web,Succeeded, config shared log-settings config,1354,0x0"; JSONObject actual = parser.parse(CONFIG_61_customFields.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/08/11 12:37:58"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "008900008659"); expected.put(BasicPaloAltoFirewallParser.Type, "CONFIG"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "0"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/08/11 11:37:58"); expected.put(BasicPaloAltoFirewallParser.HOST, "192.168.14.162"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.Command, "edit"); expected.put(BasicPaloAltoFirewallParser.Admin, "admin"); expected.put(BasicPaloAltoFirewallParser.Client, "Web"); expected.put(BasicPaloAltoFirewallParser.Result, "Succeeded"); expected.put(BasicPaloAltoFirewallParser.ConfigurationPath, "config shared log-settings config"); expected.put(BasicPaloAltoFirewallParser.Seqno, "1354"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 61); expected.put("original_string", CONFIG_61_customFields); expected.put("timestamp", actual.get("timestamp")); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseConfig61CustomFields() { final String CONFIG_61_noCustomFields = "1,2017/08/11 12:37:58,008900008659,CONFIG,0,1,2017/08/11 11:37:58,192.168.14.162,vsys1,edit,admin,Web,Succeeded, config shared log-settings config,1354,0x0,/FatherNode/KidNode/GrandsonNode1,/FatherNode/KidNode/GrandsonNode2"; JSONObject actual = parser.parse(CONFIG_61_noCustomFields.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/08/11 12:37:58"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "008900008659"); expected.put(BasicPaloAltoFirewallParser.Type, "CONFIG"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "0"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/08/11 11:37:58"); expected.put(BasicPaloAltoFirewallParser.HOST, "192.168.14.162"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.Command, "edit"); expected.put(BasicPaloAltoFirewallParser.Admin, "admin"); expected.put(BasicPaloAltoFirewallParser.Client, "Web"); expected.put(BasicPaloAltoFirewallParser.Result, "Succeeded"); expected.put(BasicPaloAltoFirewallParser.ConfigurationPath, "config shared log-settings config"); expected.put(BasicPaloAltoFirewallParser.Seqno, "1354"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.BeforeChangeDetail, "/FatherNode/KidNode/GrandsonNode1"); expected.put(BasicPaloAltoFirewallParser.AfterChangeDetail, "/FatherNode/KidNode/GrandsonNode2"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 61); expected.put("original_string", CONFIG_61_noCustomFields); expected.put("timestamp", actual.get("timestamp")); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseConfig70And80NoCustomFields() { final String CONFIG_70_80_noCustomFields = "1,2017/08/11 12:37:58,008900008659,CONFIG,0,1,2017/08/11 11:37:58,192.168.14.162,vsys1,edit,admin,Web,Succeeded, config shared log-settings config,1354,0x0,12,34,45,0,virSys1,dev-something200-01"; JSONObject actual = parser.parse(CONFIG_70_80_noCustomFields.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/08/11 12:37:58"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "008900008659"); expected.put(BasicPaloAltoFirewallParser.Type, "CONFIG"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "0"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/08/11 11:37:58"); expected.put(BasicPaloAltoFirewallParser.HOST, "192.168.14.162"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.Command, "edit"); expected.put(BasicPaloAltoFirewallParser.Admin, "admin"); expected.put(BasicPaloAltoFirewallParser.Client, "Web"); expected.put(BasicPaloAltoFirewallParser.Result, "Succeeded"); expected.put(BasicPaloAltoFirewallParser.ConfigurationPath, "config shared log-settings config"); expected.put(BasicPaloAltoFirewallParser.Seqno, "1354"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.DGH1, "12"); expected.put(BasicPaloAltoFirewallParser.DGH2, "34"); expected.put(BasicPaloAltoFirewallParser.DGH3, "45"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.VSYSName, "virSys1"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "dev-something200-01"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 80); expected.put("original_string", CONFIG_70_80_noCustomFields); expected.put("timestamp", actual.get("timestamp")); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseConfig70And80CustomFields() { final String CONFIG_70_80_customFields = "1,2017/08/11 12:37:58,008900008659,CONFIG,0,1,2017/08/11 11:37:58,192.168.14.162,vsys1,edit,admin,Web,Succeeded,config shared log-settings config,/FatherNode/KidNode/GrandsonNode1,/FatherNode/KidNode/GrandsonNode2,1354,0x0,12,34,45,0,virSys1,dev-something200-01"; JSONObject actual = parser.parse(CONFIG_70_80_customFields.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/08/11 12:37:58"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "008900008659"); expected.put(BasicPaloAltoFirewallParser.Type, "CONFIG"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "0"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/08/11 11:37:58"); expected.put(BasicPaloAltoFirewallParser.HOST, "192.168.14.162"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.Command, "edit"); expected.put(BasicPaloAltoFirewallParser.Admin, "admin"); expected.put(BasicPaloAltoFirewallParser.Client, "Web"); expected.put(BasicPaloAltoFirewallParser.Result, "Succeeded"); expected.put(BasicPaloAltoFirewallParser.ConfigurationPath, "config shared log-settings config"); expected.put(BasicPaloAltoFirewallParser.BeforeChangeDetail, "/FatherNode/KidNode/GrandsonNode1"); expected.put(BasicPaloAltoFirewallParser.AfterChangeDetail, "/FatherNode/KidNode/GrandsonNode2"); expected.put(BasicPaloAltoFirewallParser.Seqno, "1354"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.DGH1, "12"); expected.put(BasicPaloAltoFirewallParser.DGH2, "34"); expected.put(BasicPaloAltoFirewallParser.DGH3, "45"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.VSYSName, "virSys1"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "dev-something200-01"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 80); expected.put("original_string", CONFIG_70_80_customFields); expected.put("timestamp", actual.get("timestamp")); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseThreat60() { JSONObject actual = parser.parse(THREAT_60.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "reset-both"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.Application, "web-browsing"); expected.put(BasicPaloAltoFirewallParser.Category, "any"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.Direction, "client-to-server"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "US"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x80004000"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "internal"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "ethernet1/2"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "216.0.10.198"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "80"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "10.0.0.115"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "54180"); expected.put(BasicPaloAltoFirewallParser.LogAction, "LOG-Default"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "0"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "0.0.0.0"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "0"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "0.0.0.0"); expected.put("original_string", THREAT_60); expected.put(BasicPaloAltoFirewallParser.OutboundInterface, "ethernet1/1"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 60); expected.put(BasicPaloAltoFirewallParser.PCAPID, "1200568889751109656"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "tcp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2015/01/05 05:38:58"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "EX-Allow"); expected.put(BasicPaloAltoFirewallParser.Seqno, "347368099"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "0006C110285"); expected.put(BasicPaloAltoFirewallParser.SessionID, "12031"); expected.put(BasicPaloAltoFirewallParser.Severity, "high"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "10.0.0.0-10.255.255.255"); expected.put(BasicPaloAltoFirewallParser.SourceUser, "example\\user.name"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2015/01/05 05:38:58"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "vulnerability"); expected.put(BasicPaloAltoFirewallParser.ThreatID, "HTTP: IIS Denial Of Service Attempt(40019)"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2015/01/05 05:38:58"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "external"); expected.put(BasicPaloAltoFirewallParser.Type, "THREAT"); expected.put(BasicPaloAltoFirewallParser.URL, "ad.aspx?f=300x250&id=12;tile=1;ord=67AF705D60B1119C0F18BEA336F9"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseTraffic60() { JSONObject actual = parser.parse(TRAFFIC_60.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "allow"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.Application, "ms-ds-smb"); expected.put(BasicPaloAltoFirewallParser.Bytes, "2229"); expected.put(BasicPaloAltoFirewallParser.BytesReceived, "942"); expected.put(BasicPaloAltoFirewallParser.BytesSent, "1287"); expected.put(BasicPaloAltoFirewallParser.Category, "any"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "10.0.0.0-10.255.255.255"); expected.put(BasicPaloAltoFirewallParser.DestinationUser, "example\\\\user.name"); expected.put(BasicPaloAltoFirewallParser.ElapsedTimeInSec, "30"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x401a"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "v_external"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "ethernet1/2"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "10.1.0.163"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "445"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "10.0.0.39"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "52688"); expected.put(BasicPaloAltoFirewallParser.LogAction, "LOG-Default"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "0"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "0.0.0.0"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "0"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "0.0.0.0"); expected.put("original_string", TRAFFIC_60); expected.put(BasicPaloAltoFirewallParser.OutboundInterface, "ethernet1/1"); expected.put(BasicPaloAltoFirewallParser.Packets, "10"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 60); expected.put(BasicPaloAltoFirewallParser.PktsSent, "6"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "tcp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2015/01/05 12:51:33"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "EX-Allow"); expected.put(BasicPaloAltoFirewallParser.Seqno, "17754932062"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "0011C103117"); expected.put(BasicPaloAltoFirewallParser.SessionID, "33760927"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "10.0.0.0-10.255.255.255"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2015/01/05 12:51:01"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "end"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2015/01/05 12:51:33"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "v_internal"); expected.put(BasicPaloAltoFirewallParser.Type, "TRAFFIC"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseThreat70() { JSONObject actual = parser.parse(THREAT_70.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "reset-both"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.Application, "web-browsing"); expected.put(BasicPaloAltoFirewallParser.Category, "computer-and-internet-info"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "0"); expected.put(BasicPaloAltoFirewallParser.Direction, "server-to-client"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "10.0.0.0-10.255.255.255"); expected.put(BasicPaloAltoFirewallParser.DestinationUser, "user"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x400000"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "Untrust"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "ethernet1/1"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "10.1.8.7"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "51787"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "217.1.2.3"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "80"); expected.put(BasicPaloAltoFirewallParser.LogAction, "Std-Log-Forward"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "25025"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "214.123.1.2"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "80"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "217.1.2.3"); expected.put("original_string", THREAT_70); expected.put(BasicPaloAltoFirewallParser.OutboundInterface, "vlan.1"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 70); expected.put(BasicPaloAltoFirewallParser.PCAPID, "0"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "tcp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/05/24 09:53:10"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "WLAN-Internet"); expected.put(BasicPaloAltoFirewallParser.Seqno, "329423829"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "001801000001"); expected.put(BasicPaloAltoFirewallParser.SessionID, "49567"); expected.put(BasicPaloAltoFirewallParser.Severity, "medium"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "DE"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2017/05/24 09:53:10"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "virus"); expected.put(BasicPaloAltoFirewallParser.ThreatID, "Virus/Win32.WGeneric.lumeo(2457399)"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/05/24 09:53:10"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "wifi_zone"); expected.put(BasicPaloAltoFirewallParser.Type, "THREAT"); expected.put(BasicPaloAltoFirewallParser.URL, "abcdef310.exe"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.URLIndex, "1"); expected.put(BasicPaloAltoFirewallParser.WFReportID, "0"); expected.put(BasicPaloAltoFirewallParser.DGH1, "19"); expected.put(BasicPaloAltoFirewallParser.DGH2, "0"); expected.put(BasicPaloAltoFirewallParser.DGH3, "0"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "PAN1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseTraffic70() { JSONObject actual = parser.parse(TRAFFIC_70.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "deny"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.ActionSource, "from-policy"); expected.put(BasicPaloAltoFirewallParser.Application, "not-applicable"); expected.put(BasicPaloAltoFirewallParser.Bytes, "114"); expected.put(BasicPaloAltoFirewallParser.BytesReceived, "0"); expected.put(BasicPaloAltoFirewallParser.BytesSent, "114"); expected.put(BasicPaloAltoFirewallParser.Category, "any"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "DE"); expected.put(BasicPaloAltoFirewallParser.ElapsedTimeInSec, "0"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x0"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "intern"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "vlan.1"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "192.168.1.10"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "137"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "10.2.1.8"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "137"); expected.put(BasicPaloAltoFirewallParser.LogAction, "Std-Log-Forward"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "0"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "0.0.0.0"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "0"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "0.0.0.0"); expected.put("original_string", TRAFFIC_70); expected.put(BasicPaloAltoFirewallParser.Packets, "1"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 70); expected.put(BasicPaloAltoFirewallParser.PktsReceived, "0"); expected.put(BasicPaloAltoFirewallParser.PktsSent, "1"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "udp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/05/25 21:38:13"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "DropLog"); expected.put(BasicPaloAltoFirewallParser.Seqno, "9953744"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "001606000003"); expected.put(BasicPaloAltoFirewallParser.EndReason, "policy-deny"); expected.put(BasicPaloAltoFirewallParser.SessionID, "0"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "192.168.0.0-192.168.255.255"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2017/05/25 21:38:12"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "drop"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/05/25 21:38:13"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "VPN"); expected.put(BasicPaloAltoFirewallParser.Type, "TRAFFIC"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.DGH1, "19"); expected.put(BasicPaloAltoFirewallParser.DGH2, "0"); expected.put(BasicPaloAltoFirewallParser.DGH3, "0"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "PAN1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseTraffic71() { JSONObject actual = parser.parse(TRAFFIC_71.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "deny"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.ActionSource, "from-policy"); expected.put(BasicPaloAltoFirewallParser.Application, "not-applicable"); expected.put(BasicPaloAltoFirewallParser.Bytes, "60"); expected.put(BasicPaloAltoFirewallParser.BytesReceived, "0"); expected.put(BasicPaloAltoFirewallParser.BytesSent, "60"); expected.put(BasicPaloAltoFirewallParser.Category, "any"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "0"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "DE"); expected.put(BasicPaloAltoFirewallParser.ElapsedTimeInSec, "0"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x0"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "untrust"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "vlan.1"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "201.1.4.5"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "123"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "185.94.1.1"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "59836"); expected.put(BasicPaloAltoFirewallParser.LogAction, "Standard-Syslog"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "0"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "0.0.0.0"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "0"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "0.0.0.0"); expected.put("original_string", TRAFFIC_71); expected.put(BasicPaloAltoFirewallParser.Packets, "1"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 70); expected.put(BasicPaloAltoFirewallParser.PktsReceived, "0"); expected.put(BasicPaloAltoFirewallParser.PktsSent, "1"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "udp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/05/31 23:59:57"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "DropLog"); expected.put(BasicPaloAltoFirewallParser.Seqno, "3433072193"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "0006C000005"); expected.put(BasicPaloAltoFirewallParser.EndReason, "policy-deny"); expected.put(BasicPaloAltoFirewallParser.SessionID, "0"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "RU"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2017/05/31 23:59:57"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "drop"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/05/31 23:59:57"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "untrust"); expected.put(BasicPaloAltoFirewallParser.Type, "TRAFFIC"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.DGH1, "16"); expected.put(BasicPaloAltoFirewallParser.DGH2, "11"); expected.put(BasicPaloAltoFirewallParser.DGH3, "0"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "PAN1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseThreat71() { JSONObject actual = parser.parse(THREAT_71.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "alert"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.Application, "ssl"); expected.put(BasicPaloAltoFirewallParser.Category, "computer-and-internet-info"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "0"); expected.put(BasicPaloAltoFirewallParser.Direction, "client-to-server"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "IE"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x40b000"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "mgmt"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "vlan.199"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "140.177.26.29"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "443"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "192.168.1.7"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "56059"); expected.put(BasicPaloAltoFirewallParser.LogAction, "Standard-Syslog"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "443"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "140.177.26.29"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "14810"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "201.1.4.5"); expected.put("original_string", THREAT_71); expected.put(BasicPaloAltoFirewallParser.OutboundInterface, "vlan.1"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 70); expected.put(BasicPaloAltoFirewallParser.PCAPID, "0"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "tcp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2017/05/25 19:31:13"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "ms_out"); expected.put(BasicPaloAltoFirewallParser.Seqno, "10030265"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "0006C000005"); expected.put(BasicPaloAltoFirewallParser.SessionID, "50556"); expected.put(BasicPaloAltoFirewallParser.Severity, "informational"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "192.168.0.0-192.168.255.255"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2017/05/25 19:31:13"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "url"); expected.put(BasicPaloAltoFirewallParser.ThreatID, "(9999)"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2017/05/25 19:31:13"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "untrust"); expected.put(BasicPaloAltoFirewallParser.Type, "THREAT"); expected.put(BasicPaloAltoFirewallParser.URL, "settings-win.data.microsoft.com/"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.URLIndex, "0"); expected.put(BasicPaloAltoFirewallParser.WFReportID, "0"); expected.put(BasicPaloAltoFirewallParser.DGH1, "16"); expected.put(BasicPaloAltoFirewallParser.DGH2, "11"); expected.put(BasicPaloAltoFirewallParser.DGH3, "0"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "PAN1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseThreat80() { JSONObject actual = parser.parse(THREAT_80.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "reset-server"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.Application, "web-browsing"); expected.put(BasicPaloAltoFirewallParser.Category, "computer-and-internet-info"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.ContentVersion, "AppThreat-771-4450"); expected.put(BasicPaloAltoFirewallParser.Direction, "server-to-client"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "172.16.0.0-172.31.255.255"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x402000"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "internet"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "ethernet1/1"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "172.16.2.6"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "53161"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "213.211.198.62"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "80"); expected.put(BasicPaloAltoFirewallParser.LogAction, "test"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "32812"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "192.168.178.202"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "80"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "213.211.198.62"); expected.put("original_string", THREAT_80); expected.put(BasicPaloAltoFirewallParser.OutboundInterface, "ethernet1/2.2"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParentSessionId, "0"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 80); expected.put(BasicPaloAltoFirewallParser.PCAPID, "0"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "tcp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2018/02/01 21:29:03"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "Outgoing"); expected.put(BasicPaloAltoFirewallParser.Seqno, "27438839"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "001606000007"); expected.put(BasicPaloAltoFirewallParser.SessionID, "18720"); expected.put(BasicPaloAltoFirewallParser.Severity, "medium"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "Germany"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2018/02/01 21:29:03"); expected.put(BasicPaloAltoFirewallParser.ThreatCategory, "code-execution"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "vulnerability"); expected.put(BasicPaloAltoFirewallParser.ThreatID, "Eicar File Detected(39040)"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2018/02/01 21:29:03"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "guest"); expected.put(BasicPaloAltoFirewallParser.TunnelId, "0"); expected.put(BasicPaloAltoFirewallParser.TunnelType, "N/A"); expected.put(BasicPaloAltoFirewallParser.Type, "THREAT"); expected.put(BasicPaloAltoFirewallParser.URL, "www.eicar.org/download/eicar.com"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.URLIndex, "9"); expected.put(BasicPaloAltoFirewallParser.WFReportID, "0"); expected.put(BasicPaloAltoFirewallParser.DGH1, "0"); expected.put(BasicPaloAltoFirewallParser.DGH2, "0"); expected.put(BasicPaloAltoFirewallParser.DGH3, "0"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "PAN1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseTraffic80() { JSONObject actual = parser.parse(TRAFFIC_80.getBytes(StandardCharsets.UTF_8)).get(0); JSONObject expected = new JSONObject(); expected.put(BasicPaloAltoFirewallParser.Action, "allow"); expected.put(BasicPaloAltoFirewallParser.ActionFlags, "0x0"); expected.put(BasicPaloAltoFirewallParser.ActionSource, "from-policy"); expected.put(BasicPaloAltoFirewallParser.Application, "ssl"); expected.put(BasicPaloAltoFirewallParser.Bytes, "7936"); expected.put(BasicPaloAltoFirewallParser.BytesReceived, "6205"); expected.put(BasicPaloAltoFirewallParser.BytesSent, "1731"); expected.put(BasicPaloAltoFirewallParser.Category, "computer-and-internet-info"); expected.put(BasicPaloAltoFirewallParser.ConfigVersion, "1"); expected.put(BasicPaloAltoFirewallParser.DestinationLocation, "United States"); expected.put(BasicPaloAltoFirewallParser.ElapsedTimeInSec, "1395"); expected.put(BasicPaloAltoFirewallParser.Flags, "0x40001c"); expected.put(BasicPaloAltoFirewallParser.SourceZone, "guest"); expected.put(BasicPaloAltoFirewallParser.InboundInterface, "ethernet1/2.2"); expected.put(BasicPaloAltoFirewallParser.DestinationAddress, "134.19.6.22"); expected.put(BasicPaloAltoFirewallParser.DestinationPort, "443"); expected.put(BasicPaloAltoFirewallParser.SourceAddress, "172.16.2.31"); expected.put(BasicPaloAltoFirewallParser.SourcePort, "41537"); expected.put(BasicPaloAltoFirewallParser.LogAction, "test"); expected.put(BasicPaloAltoFirewallParser.NATDestinationPort, "443"); expected.put(BasicPaloAltoFirewallParser.NATDestinationIP, "134.19.6.22"); expected.put(BasicPaloAltoFirewallParser.NATSourcePort, "12211"); expected.put(BasicPaloAltoFirewallParser.NATSourceIP, "192.168.18.2"); expected.put("original_string", TRAFFIC_80); expected.put(BasicPaloAltoFirewallParser.OutboundInterface, "ethernet1/1"); expected.put(BasicPaloAltoFirewallParser.Packets, "24"); expected.put(BasicPaloAltoFirewallParser.PaloAltoDomain, "1"); expected.put(BasicPaloAltoFirewallParser.ParentSessionId, "0"); expected.put(BasicPaloAltoFirewallParser.ParserVersion, 80); expected.put(BasicPaloAltoFirewallParser.PktsReceived, "10"); expected.put(BasicPaloAltoFirewallParser.PktsSent, "14"); expected.put(BasicPaloAltoFirewallParser.IPProtocol, "tcp"); expected.put(BasicPaloAltoFirewallParser.ReceiveTime, "2018/02/01 21:24:11"); expected.put(BasicPaloAltoFirewallParser.RepeatCount, "1"); expected.put(BasicPaloAltoFirewallParser.Rule, "Outgoing"); expected.put(BasicPaloAltoFirewallParser.Seqno, "62977478"); expected.put(BasicPaloAltoFirewallParser.SerialNum, "001606000007"); expected.put(BasicPaloAltoFirewallParser.EndReason, "tcp-rst-from-client"); expected.put(BasicPaloAltoFirewallParser.SessionID, "19468"); expected.put(BasicPaloAltoFirewallParser.SourceLocation, "172.16.0.0-172.31.255.255"); expected.put(BasicPaloAltoFirewallParser.StartTime, "2018/02/01 21:00:42"); expected.put(BasicPaloAltoFirewallParser.ThreatContentType, "end"); expected.put(BasicPaloAltoFirewallParser.GenerateTime, "2018/02/01 21:24:11"); expected.put("timestamp", actual.get("timestamp")); expected.put(BasicPaloAltoFirewallParser.DestinationZone, "internet"); expected.put(BasicPaloAltoFirewallParser.TunnelId, "0"); expected.put(BasicPaloAltoFirewallParser.TunnelType, "N/A"); expected.put(BasicPaloAltoFirewallParser.Type, "TRAFFIC"); expected.put(BasicPaloAltoFirewallParser.VirtualSystem, "vsys1"); expected.put(BasicPaloAltoFirewallParser.DGH1, "0"); expected.put(BasicPaloAltoFirewallParser.DGH2, "0"); expected.put(BasicPaloAltoFirewallParser.DGH3, "0"); expected.put(BasicPaloAltoFirewallParser.DGH4, "0"); expected.put(BasicPaloAltoFirewallParser.DeviceName, "PAN1"); assertEquals(expected, actual); }
@SuppressWarnings("unchecked") @Test public void testParseInvalidLogTypeMessage() { final String unsupportedLogTypeMessage = "1,2017/08/11 12:37:58,008900008659,INVALIDlogType,0,1,2017/08/11 11:37:58,192.168.14.162,vsys1,edit,admin,Web,Succeeded, config shared log-settings config,1354,0x0"; List<JSONObject> actual = parser.parse(unsupportedLogTypeMessage.getBytes( StandardCharsets.UTF_8)); assertNull(actual); }
@SuppressWarnings("unchecked") @Test public void testParseInvalidVersionMessage() { final String invalidLengthMessage = "1,2017/08/11 12:37:58,008900008659,CONFIG,0,1,2017/08/11 11:37:58,192.168.14.162,vsys1,edit,admin,Web,Succeeded, config shared log-settings config"; JSONObject actual = parser.parse(invalidLengthMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedParserVersion = actual.get(BasicPaloAltoFirewallParser.ParserVersion).toString(); assertEquals(expectedParserVersion, "0"); }