ThreatIntelAdapter implements EnrichmentAdapter<CacheKey>,Serializable { @Override public JSONObject enrich(CacheKey value) { if(!isInitialized()) { initializeAdapter(null); } JSONObject enriched = new JSONObject(); List<String> enrichmentTypes = value.getConfig() .getThreatIntel().getFieldToTypeMap() .get(EnrichmentUtils.toTopLevelField(value.getField())); if(isInitialized() && enrichmentTypes != null) { int i = 0; try { for (Boolean isThreat : lookup.exists(Iterables.transform(enrichmentTypes , new EnrichmentUtils.TypeToKey(value.coerceValue(String.class) , lookup.getTable() , value.getConfig().getThreatIntel() ) ) , false ) ) { String enrichmentType = enrichmentTypes.get(i++); if (isThreat) { enriched.put(enrichmentType, "alert"); LOG.trace("Theat Intel Enriched value => {}", enriched); } } } catch(IOException e) { LOG.error("Unable to retrieve value: {}", e.getMessage(), e); initializeAdapter(null); throw new RuntimeException("Theat Intel Unable to retrieve value", e); } } LOG.trace("Threat Intel Enrichment Success: {}", enriched); return enriched; } ThreatIntelAdapter();  ThreatIntelAdapter(ThreatIntelConfig config); ThreatIntelAdapter withConfig(ThreatIntelConfig config); @Override void logAccess(CacheKey value); @Override JSONObject enrich(CacheKey value); boolean isInitialized(); @Override boolean initializeAdapter(Map<String, Object> configuration); @Override void updateAdapter(Map<String, Object> config); @Override void cleanup(); @Override String getOutputPrefix(CacheKey value);  }
@Test public void testEnrich() throws Exception { ThreatIntelAdapter tia = new ThreatIntelAdapter(); tia.lookup = lookup; SensorEnrichmentConfig broSc = JSONUtils.INSTANCE.load(sourceConfigStr, SensorEnrichmentConfig.class); JSONObject actualMessage = tia.enrich(new CacheKey("ip_dst_addr", "10.0.2.3", broSc)); assertNotNull(actualMessage); assertEquals(expectedMessage, actualMessage); }
@Test public void testEnrichNonString() throws Exception { ThreatIntelAdapter tia = new ThreatIntelAdapter(); tia.lookup = lookup; SensorEnrichmentConfig broSc = JSONUtils.INSTANCE.load(sourceConfigStr, SensorEnrichmentConfig.class); JSONObject actualMessage = tia.enrich(new CacheKey("ip_dst_addr", "10.0.2.3", broSc)); assertNotNull(actualMessage); assertEquals(expectedMessage, actualMessage); actualMessage = tia.enrich(new CacheKey("ip_dst_addr", 10L, broSc)); assertEquals(actualMessage,new JSONObject()); }