Skip to content

Commit 3d90945

Browse files
Feat/add opswat vendor (#2826)
* feat:Added opswat parser and docs * feat:added tests for oswat
1 parent 1f54853 commit 3d90945

File tree

7 files changed

+135
-0
lines changed

7 files changed

+135
-0
lines changed
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Metadefender Core
2+
3+
## Key facts
4+
5+
* MSG Format based filter
6+
* Legacy BSD Format default port 514
7+
8+
## Links
9+
10+
| Ref | Link |
11+
|----------------|---------------------------------------------------------------------------------------------------------|
12+
| Splunk Add-on | None |
13+
| Product Manual | https://www.opswat.com/docs/mdcore/configuration/syslog-message-format |
14+
15+
16+
## Sourcetypes
17+
18+
| sourcetype | notes |
19+
|----------------|---------------------------------------------------------------------------------------------------------|
20+
| opswat:mscl:cef | None
21+
| opswat:mscw:cef | None |
22+
23+
## Sourcetype and Index Configuration
24+
25+
| key | sourcetype | index | notes |
26+
|----------------|----------------|----------------|----------------|
27+
| opswat_mscl_cef | opswat:mscl:cef | netwaf | none |
28+
| opswat_mscw_cef | opswat:mscw:cef | netwaf | none |
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
block parser app-cef-opswat() {
2+
channel {
3+
rewrite {
4+
r_set_splunk_dest_default(
5+
index('netwaf'),
6+
vendor('opswat'),
7+
product('${.metadata.cef.device_product}'),
8+
source('opswat:$(lowercase ${.metadata.cef.device_product})'),
9+
sourcetype('opswat:$(lowercase ${.metadata.cef.device_product}):cef')
10+
);
11+
};
12+
};
13+
};
14+
15+
application app-cef-opswat[cef] {
16+
filter{
17+
match("OPSWAT" value(".metadata.cef.device_vendor"))
18+
};
19+
parser { app-cef-opswat(); };
20+
};
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
block parser app-cef-opswat-mscl() {
2+
channel {
3+
rewrite {
4+
r_set_splunk_dest_default(
5+
index('netwaf'),
6+
vendor('opswat'),
7+
product('${.metadata.cef.device_product}'),
8+
source('opswat:$(lowercase ${.metadata.cef.device_product})'),
9+
sourcetype('opswat:$(lowercase ${.metadata.cef.device_product}):cef')
10+
);
11+
};
12+
};
13+
};
14+
15+
application app-cef-opswat-mscl[cef] {
16+
filter{
17+
match("OPSWAT" value(".metadata.cef.device_vendor"))
18+
};
19+
parser { app-cef-opswat-mscl(); };
20+
};
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
name: "opswat"
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
block parser app-cef-opswat-mscl() {
2+
channel {
3+
rewrite {
4+
r_set_splunk_dest_default(
5+
index('netwaf'),
6+
vendor('opswat'),
7+
product('${.metadata.cef.device_product}'),
8+
source('opswat:$(lowercase ${.metadata.cef.device_product})'),
9+
sourcetype('opswat:$(lowercase ${.metadata.cef.device_product}):cef')
10+
);
11+
};
12+
};
13+
};
14+
15+
application app-cef-opswat-mscl[cef] {
16+
filter{
17+
match("OPSWAT" value(".metadata.cef.device_vendor"))
18+
};
19+
parser { app-cef-opswat-mscl(); };
20+
};

package/lite/etc/config.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,4 @@ addons:
8787
- aviatrix
8888
- veeam
8989
- suricata
90+
- opswat

tests/test_opswat.py

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright 2023 Splunk, Inc.
2+
#
3+
# Use of this source code is governed by a BSD-2-clause-style
4+
# license that can be found in the LICENSE-BSD2 file or at
5+
# https://opensource.org/licenses/BSD-2-Clause
6+
import datetime
7+
import pytest
8+
9+
from jinja2 import Environment, select_autoescape
10+
11+
from .sendmessage import sendsingle
12+
from .splunkutils import splunk_single
13+
from .timeutils import time_operations
14+
15+
env = Environment(autoescape=select_autoescape(default_for_string=False))
16+
17+
18+
@pytest.mark.addons("opswat")
19+
def test_opswat(
20+
record_property, setup_splunk, setup_sc4s, get_host_key
21+
):
22+
host = get_host_key
23+
mt = env.from_string(
24+
"{{ mark }}{{ bsd }} {{ host }} OPSWATPC CEF:0|OPSWAT|MSCL|4.16.0|core.network|MSCL[7548] New maximum agent count is set|2|maxAgentCount='1' msgid=665"
25+
)
26+
dt = datetime.datetime.now(datetime.timezone.utc)
27+
_, bsd, _, _, _, _, epoch = time_operations(dt)
28+
message = mt.render(mark="<134>", bsd=bsd, host=host)
29+
30+
# Tune time functions
31+
epoch = epoch[:-7]
32+
sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
33+
34+
st = env.from_string(
35+
'search index=netwaf sourcetype="opswat:mscl:cef" earliest={{ epoch }}'
36+
)
37+
search = st.render(epoch=epoch)
38+
39+
result_count, _ = splunk_single(setup_splunk, search)
40+
41+
record_property("resultCount", result_count)
42+
record_property("message", message)
43+
44+
assert result_count == 1

0 commit comments

Comments
 (0)