@Test public void testCEFFormatting() throws PwmUnrecoverableException { final String jsonInput = "{\"perpetratorID\":\"per|son\",\"perpetratorDN\":\"cn=per|son,o=org\"," + "\"perpetratorLdapProfile\":\"default\",\"sourceAddress\":\"2001:DB8:D:B8:35cc::/64\",\"sourceHost\":\"ws31222\"," + "\"type\":\"USER\",\"eventCode\":\"ACTIVATE_USER\",\"guid\":\"16ee0bf8-b0c9-41d7-8c24-b40110fc727e\"," + "\"timestamp\":\"2000-01-01T00:00:00Z\",\"message\":\"message pipe|Escape, slash\\\\Escape, equal=Escape, \\nsecondLine\"," + "\"xdasTaxonomy\":\"XDAS_AE_CREATE_SESSION\",\"xdasOutcome\":\"XDAS_OUT_SUCCESS\"}"; final UserAuditRecord auditRecord = JsonUtil.deserialize( jsonInput, UserAuditRecord.class ); final String appName = PwmConstants.PWM_APP_NAME; final String versionData = PwmConstants.SERVLET_VERSION; final String expectedOutput = "CEF:0|" + appName + "|" + appName + "|" + versionData + "|ACTIVATE_USER|Activate Account|Medium| type=USER eventCode=ACTIVATE_USER timestamp=" + "2000-01-01T00:00:00Z" + " message=message pipe\\|Escape, slash\\\\Escape, equal\\=Escape, \\nsecondLine" + " perpetratorID=per\\|son perpetratorDN=cn\\=per\\|son,o\\=org sourceAddress=2001:DB8:D:B8:35cc::/64 sourceHost=ws31222"; final CEFAuditFormatter cefAuditFormatter = new CEFAuditFormatter(); final PwmApplication pwmApplication = Mockito.mock( PwmApplication.class ); Mockito.when( pwmApplication.getConfig() ).thenReturn( new Configuration( StoredConfigurationFactory.newConfig() ) ); final String output = cefAuditFormatter.convertAuditRecordToMessage( pwmApplication, auditRecord ); Assert.assertEquals( expectedOutput, output ); }
@Override public String convertAuditRecordToMessage( final PwmApplication pwmApplication, final AuditRecord auditRecord ) throws PwmUnrecoverableException { final Configuration configuration = pwmApplication.getConfig(); final Settings settings = Settings.fromConfiguration( configuration ); final Map<String, Object> auditRecordMap = JsonUtil.deserializeMap( JsonUtil.serialize( auditRecord ) ); final Optional<String> srcHost = JavaHelper.deriveLocalServerHostname( configuration ); final StringBuilder cefOutput = new StringBuilder( ); cefOutput.append( makeCefHeader( pwmApplication, settings, auditRecord ) ); cefOutput.append( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ); srcHost.ifPresent( s -> appendCefValue( CEFAuditField.dvchost.name(), s, cefOutput, settings ) ); if ( StringUtil.isEmpty( settings.getCefTimezone() ) ) { appendCefValue( CEFAuditField.dtz.name(), settings.getCefTimezone(), cefOutput, settings ); } for ( final CEFAuditField cefAuditField : CEFAuditField.values() ) { if ( cefAuditField.getAuditField() != null ) { final String auditFieldName = cefAuditField.getAuditField().name(); final Object value = auditRecordMap.get( auditFieldName ); if ( value != null ) { final String valueString = value.toString(); appendCefValue( auditFieldName, valueString, cefOutput, settings ); } } } final int cefLength = CEFAuditFormatter.CEF_EXTENSION_SEPARATOR.length(); if ( cefOutput.substring( cefOutput.length() - cefLength ).equals( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ) ) { cefOutput.replace( cefOutput.length() - cefLength, cefOutput.length(), "" ); } return cefOutput.toString(); }
CEFAuditFormatter implements AuditFormatter { @Override public String convertAuditRecordToMessage( final PwmApplication pwmApplication, final AuditRecord auditRecord ) throws PwmUnrecoverableException { final Configuration configuration = pwmApplication.getConfig(); final Settings settings = Settings.fromConfiguration( configuration ); final Map<String, Object> auditRecordMap = JsonUtil.deserializeMap( JsonUtil.serialize( auditRecord ) ); final Optional<String> srcHost = JavaHelper.deriveLocalServerHostname( configuration ); final StringBuilder cefOutput = new StringBuilder( ); cefOutput.append( makeCefHeader( pwmApplication, settings, auditRecord ) ); cefOutput.append( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ); srcHost.ifPresent( s -> appendCefValue( CEFAuditField.dvchost.name(), s, cefOutput, settings ) ); if ( StringUtil.isEmpty( settings.getCefTimezone() ) ) { appendCefValue( CEFAuditField.dtz.name(), settings.getCefTimezone(), cefOutput, settings ); } for ( final CEFAuditField cefAuditField : CEFAuditField.values() ) { if ( cefAuditField.getAuditField() != null ) { final String auditFieldName = cefAuditField.getAuditField().name(); final Object value = auditRecordMap.get( auditFieldName ); if ( value != null ) { final String valueString = value.toString(); appendCefValue( auditFieldName, valueString, cefOutput, settings ); } } } final int cefLength = CEFAuditFormatter.CEF_EXTENSION_SEPARATOR.length(); if ( cefOutput.substring( cefOutput.length() - cefLength ).equals( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ) ) { cefOutput.replace( cefOutput.length() - cefLength, cefOutput.length(), "" ); } return cefOutput.toString(); } }
CEFAuditFormatter implements AuditFormatter { @Override public String convertAuditRecordToMessage( final PwmApplication pwmApplication, final AuditRecord auditRecord ) throws PwmUnrecoverableException { final Configuration configuration = pwmApplication.getConfig(); final Settings settings = Settings.fromConfiguration( configuration ); final Map<String, Object> auditRecordMap = JsonUtil.deserializeMap( JsonUtil.serialize( auditRecord ) ); final Optional<String> srcHost = JavaHelper.deriveLocalServerHostname( configuration ); final StringBuilder cefOutput = new StringBuilder( ); cefOutput.append( makeCefHeader( pwmApplication, settings, auditRecord ) ); cefOutput.append( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ); srcHost.ifPresent( s -> appendCefValue( CEFAuditField.dvchost.name(), s, cefOutput, settings ) ); if ( StringUtil.isEmpty( settings.getCefTimezone() ) ) { appendCefValue( CEFAuditField.dtz.name(), settings.getCefTimezone(), cefOutput, settings ); } for ( final CEFAuditField cefAuditField : CEFAuditField.values() ) { if ( cefAuditField.getAuditField() != null ) { final String auditFieldName = cefAuditField.getAuditField().name(); final Object value = auditRecordMap.get( auditFieldName ); if ( value != null ) { final String valueString = value.toString(); appendCefValue( auditFieldName, valueString, cefOutput, settings ); } } } final int cefLength = CEFAuditFormatter.CEF_EXTENSION_SEPARATOR.length(); if ( cefOutput.substring( cefOutput.length() - cefLength ).equals( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ) ) { cefOutput.replace( cefOutput.length() - cefLength, cefOutput.length(), "" ); } return cefOutput.toString(); }  }
CEFAuditFormatter implements AuditFormatter { @Override public String convertAuditRecordToMessage( final PwmApplication pwmApplication, final AuditRecord auditRecord ) throws PwmUnrecoverableException { final Configuration configuration = pwmApplication.getConfig(); final Settings settings = Settings.fromConfiguration( configuration ); final Map<String, Object> auditRecordMap = JsonUtil.deserializeMap( JsonUtil.serialize( auditRecord ) ); final Optional<String> srcHost = JavaHelper.deriveLocalServerHostname( configuration ); final StringBuilder cefOutput = new StringBuilder( ); cefOutput.append( makeCefHeader( pwmApplication, settings, auditRecord ) ); cefOutput.append( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ); srcHost.ifPresent( s -> appendCefValue( CEFAuditField.dvchost.name(), s, cefOutput, settings ) ); if ( StringUtil.isEmpty( settings.getCefTimezone() ) ) { appendCefValue( CEFAuditField.dtz.name(), settings.getCefTimezone(), cefOutput, settings ); } for ( final CEFAuditField cefAuditField : CEFAuditField.values() ) { if ( cefAuditField.getAuditField() != null ) { final String auditFieldName = cefAuditField.getAuditField().name(); final Object value = auditRecordMap.get( auditFieldName ); if ( value != null ) { final String valueString = value.toString(); appendCefValue( auditFieldName, valueString, cefOutput, settings ); } } } final int cefLength = CEFAuditFormatter.CEF_EXTENSION_SEPARATOR.length(); if ( cefOutput.substring( cefOutput.length() - cefLength ).equals( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ) ) { cefOutput.replace( cefOutput.length() - cefLength, cefOutput.length(), "" ); } return cefOutput.toString(); }  @Override String convertAuditRecordToMessage(
            final PwmApplication pwmApplication,
            final AuditRecord auditRecord
    ); }
CEFAuditFormatter implements AuditFormatter { @Override public String convertAuditRecordToMessage( final PwmApplication pwmApplication, final AuditRecord auditRecord ) throws PwmUnrecoverableException { final Configuration configuration = pwmApplication.getConfig(); final Settings settings = Settings.fromConfiguration( configuration ); final Map<String, Object> auditRecordMap = JsonUtil.deserializeMap( JsonUtil.serialize( auditRecord ) ); final Optional<String> srcHost = JavaHelper.deriveLocalServerHostname( configuration ); final StringBuilder cefOutput = new StringBuilder( ); cefOutput.append( makeCefHeader( pwmApplication, settings, auditRecord ) ); cefOutput.append( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ); srcHost.ifPresent( s -> appendCefValue( CEFAuditField.dvchost.name(), s, cefOutput, settings ) ); if ( StringUtil.isEmpty( settings.getCefTimezone() ) ) { appendCefValue( CEFAuditField.dtz.name(), settings.getCefTimezone(), cefOutput, settings ); } for ( final CEFAuditField cefAuditField : CEFAuditField.values() ) { if ( cefAuditField.getAuditField() != null ) { final String auditFieldName = cefAuditField.getAuditField().name(); final Object value = auditRecordMap.get( auditFieldName ); if ( value != null ) { final String valueString = value.toString(); appendCefValue( auditFieldName, valueString, cefOutput, settings ); } } } final int cefLength = CEFAuditFormatter.CEF_EXTENSION_SEPARATOR.length(); if ( cefOutput.substring( cefOutput.length() - cefLength ).equals( CEFAuditFormatter.CEF_EXTENSION_SEPARATOR ) ) { cefOutput.replace( cefOutput.length() - cefLength, cefOutput.length(), "" ); } return cefOutput.toString(); }  @Override String convertAuditRecordToMessage(
            final PwmApplication pwmApplication,
            final AuditRecord auditRecord
    );  }