/* * Copyright 2011 NCHOVY * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.krakenapps.siem.engine; import java.util.HashMap; import java.util.Map; import java.util.Properties; import org.krakenapps.event.api.Event; import org.krakenapps.firewall.api.FirewallController; import org.krakenapps.firewall.api.FirewallGroup; import org.krakenapps.siem.response.ResponseAction; import org.krakenapps.siem.response.ResponseActionManager; import org.krakenapps.siem.response.ResponseType; public class FirewallResponseAction implements ResponseAction { private FirewallController controller; private ResponseActionManager manager; private String namespace; private String name; private String description; private Properties config; private String groupName; private int minutes; public FirewallResponseAction(ResponseActionManager manager, FirewallController controller, String namespace, String name, String description, Properties config) { this.controller = controller; this.manager = manager; this.namespace = namespace; this.name = name; this.description = description; this.config = config; this.groupName = config.getProperty("group_name"); this.minutes = Integer.valueOf(config.getProperty("minutes")); } @Override public ResponseActionManager getManager() { return manager; } @Override public String getNamespace() { return namespace; } @Override public String getName() { return name; } @Override public String getDescription() { return description; } @Override public Properties getConfig() { return config; } @Override public ResponseType getType() { return ResponseType.Block; } public String getTargetGroup() { return groupName; } @Override public void handle(Event event) { FirewallGroup group = controller.getGroup(groupName); if (group == null) return; group.blockSourceIp(event.getSourceIp(), minutes); } @Override public String toString() { return "firewall response, group [" + groupName + "], block interval [" + minutes + "] min"; } @Override public Map<String, Object> marshal() { Map<String, Object> m = new HashMap<String, Object>(); m.put("manager", manager.getName()); m.put("namespace", namespace); m.put("name", name); m.put("description", description); m.put("group_name", groupName); m.put("minutes", minutes); return m; } }