File Coverage

blib/lib/RINO/Client.pm

Criterion	Covered	Total	%
statement	12	94	12.7
branch	0	30	0.0
condition	0	2	0.0
subroutine	4	10	40.0
pod			n/a
total	16	136	11.7

package RINO::Client;

use 5.008008;
use strict;
use warnings;

our $VERSION = '0.03';
$VERSION = eval $VERSION;  # see L

use Module::Pluggable require => 1;
require XML::IODEF;

# Preloaded methods go here.

sub _plugins {
    my @plugs = plugins();
    foreach (@plugs){
        $_ = lc($_);
        $_ =~ s/rino::client::plugin:://;
    }
    return(@plugs);
}

sub new {
    my ($class,%args) = (shift,@_);
    my $self = {};
    bless($self,$class);
    if($args{'iodef'}){
        $self->to_hash($args{'iodef'});
    }
    return($self);
}

sub write_out {
    my $self = shift;
    my $plugin = shift || 'csv';

    $plugin = 'RINO::Client::Plugin::'.ucfirst($plugin);
    eval "require $plugin";
    die($@) if($@);

    my $ref = $self->to_simple();
    return $plugin->write_out($ref);
}

sub to_hash {
    my $self = shift;
    my $xml = shift;
    return($self->{'_tree'}) if(defined($self->{'_tree'}));

    return unless($xml);
    my $iodef = XML::IODEF->new();
    $iodef->in($xml) || return('invalid iodef object',undef);
    $self->{'_xml'} = $iodef;
    $self->{'_tree'} = $iodef->to_tree();
    return(undef,$self->{'_tree'});
}

sub to_simple {
    my $self = shift;
    my $xml = shift;
    my $hash = $self->to_hash($xml);
    my @incidents;
    my @header = ['IncidentID','Description','Address','DetectTime','Port','Destination','AdditionalData'];

    $hash = $hash->{'Incident'};
    if(ref($hash) eq 'HASH'){
        push(@incidents,$hash);
    } else {
        @incidents = @{$hash};
    }

    #only pass back the header info if we're being called from a plugin
    my $caller = caller();
    my @return_array;
    if($caller =~ /Client$/){
        @return_array = @header;
    }

    foreach my $ri (@incidents) {
        ## embedded " in CSV needs to be ""
        $ri->{IncidentID}{content} =~ s/"/""/g;
        $ri->{Description} =~ s/"/""/g;

        ## within each Incident there may be one or more EventData, "normalize"
        my $re = $ri->{'EventData'};
        my @events_array = ();
        if(ref($re) eq 'HASH') { push(@events_array,$re); } else { @events_array = @{$re}; }

        ## process each EventData
        foreach my $re (@events_array) {
            $re->{DetectTime} =~ s/"/""/g;
            $re->{Flow}{System}{Node}{Address}{content} =~ s/"/""/g;
            if (exists $re->{Flow}{System}{Service}{Port}) {
                $re->{Flow}{System}{Service}{Port} =~ s/"/""/g;
            } else {
                $re->{Flow}{System}{Service}{Port} = '';
            }

            ## within each EventData there may be zero or more AdditionalData
            ## if "destination address" is one of those, it will have it's own position in the CSV
            ## all others will be combined into paired values (JSON-like) and placed in one position in the CSV
            my $destination = '';
            my $additional;

            if (exists $re->{AdditionalData}) {
                ## "normalize"
                my $ra = $re->{AdditionalData};
                my @additionaldata_array = ();
                if(ref($ra) eq 'HASH') { push(@additionaldata_array,$ra); } else { @additionaldata_array = @{$ra}; }

                ## process each AdditionalData
                foreach my $a (@additionaldata_array) {
                    ## if "destination address", then hold separately, otherwise accumulate pairs in $additional
                    if ($a->{meaning} eq 'destination address') {
                        $destination = $a->{content};
                    } else {
                        $additional .= qq|"$a->{meaning}":"$a->{content}", |;
                    }
                }
                ## if there is additiona, remove trailing comma and wrap in braces
                if ($additional) { $additional =~ s/, $//; $additional = '{ '.$additional.' }'; }
            }
            push(@return_array, {
                IncidentID  => $ri->{'IncidentID'}{'content'},
                Description => $ri->{'Description'},
                Address     => $re->{'Flow'}{'System'}{'Node'}{'Address'}{'content'},
                DetectTime  => $re->{'DetectTime'},
                Port        => $re->{'Flow'}{'System'}{'Service'}{'Port'},
                Destination => $destination,
                AdditionalData  => $additional
           });
        }
    }
    return(\@return_array);
}


sub sources {
    my $self = shift;
    return('you must ->to_hash($xml) first',undef) unless($self->{'_tree'});
    my $h = $self->{'_tree'};
    my @events = @{$h->{'Incident'}->{'EventData'}};
    foreach my $event (@events){
        my $sys = $event->{'Flow'}->{'System'};
        next unless($sys->{'category'} eq 'source');
    }

}
1;
__END__