/* * Copyright 2011 NCHOVY * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.krakenapps.siem.engine; import java.util.List; import java.util.Properties; import org.apache.felix.ipojo.annotations.Component; import org.apache.felix.ipojo.annotations.Invalidate; import org.apache.felix.ipojo.annotations.Requires; import org.apache.felix.ipojo.annotations.Validate; import org.krakenapps.api.PrimitiveConverter; import org.krakenapps.confdb.Config; import org.krakenapps.confdb.ConfigCollection; import org.krakenapps.confdb.ConfigDatabase; import org.krakenapps.confdb.ConfigIterator; import org.krakenapps.confdb.Predicates; import org.krakenapps.siem.ConfigManager; import org.krakenapps.siem.model.ResponseActionConfig; import org.krakenapps.siem.model.ResponseActionInstance; import org.krakenapps.siem.response.ResponseAction; import org.krakenapps.siem.response.ResponseActionManager; import org.krakenapps.siem.response.ResponseActionManagerEventListener; import org.osgi.framework.BundleContext; import org.osgi.framework.ServiceReference; import org.osgi.util.tracker.ServiceTracker; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @Component(name = "siem-response-action-loader") public class ResponseActionLoader extends ServiceTracker implements ResponseActionManagerEventListener { private final Logger logger = LoggerFactory.getLogger(ResponseActionLoader.class.getName()); @Requires private ConfigManager configManager; public ResponseActionLoader(BundleContext bc) { super(bc, ResponseActionManager.class.getName(), null); } @Validate public void start() { super.open(); } @Invalidate public void stop() { super.close(); } private void loadActions(ResponseActionManager manager) { ConfigCollection col = getCol(); ConfigIterator it = col.find(Predicates.field("manager", manager.getName())); try { while (it.hasNext()) { Config c = it.next(); ResponseActionInstance instance = PrimitiveConverter.parse(ResponseActionInstance.class, c.getDocument()); manager.newAction(instance.getNamespace(), instance.getName(), instance.getDescription(), toProperties(instance.getConfigs())); } } finally { if (it != null) it.close(); } } private Properties toProperties(List<ResponseActionConfig> configs) { Properties p = new Properties(); for (ResponseActionConfig c : configs) { p.put(c.getName(), c.getValue()); } return p; } @Override public Object addingService(ServiceReference reference) { ResponseActionManager manager = (ResponseActionManager) super.addingService(reference); loadActions(manager); manager.addEventListener(this); return manager; } @Override public void removedService(ServiceReference reference, Object service) { ResponseActionManager manager = (ResponseActionManager) service; manager.removeEventListener(this); super.removedService(reference, service); } @Override public void actionCreated(ResponseActionManager manager, ResponseAction action) { logger.info("kraken siem: insert new action to database [{}]", action); ConfigCollection col = getCol(); Config c = findAction(col, manager, action); if (c != null) return; ResponseActionInstance instance = new ResponseActionInstance(); instance.setManager(manager.getName()); instance.setNamespace(action.getNamespace()); instance.setName(action.getName()); instance.setDescription(action.getDescription()); Properties config = action.getConfig(); for (Object key : config.keySet()) { Object value = config.get(key); if (value == null) continue; instance.getConfigs().add(new ResponseActionConfig(key.toString(), value.toString())); } col.add(PrimitiveConverter.serialize(instance)); } @Override public void actionRemoved(ResponseActionManager manager, ResponseAction action) { logger.info("kraken siem: delete action from database [{}]", action); ConfigCollection col = getCol(); Config c = findAction(col, manager, action); if (c != null) col.remove(c); } private Config findAction(ConfigCollection col, ResponseActionManager manager, ResponseAction action) { Config c = col.findOne(Predicates.and( // Predicates.field("manager", manager.getName()),// Predicates.field("namespace", action.getNamespace()),// Predicates.field("name", action.getName()))); return c; } private ConfigCollection getCol() { ConfigDatabase db = configManager.getDatabase(); return db.ensureCollection("response_action_instance"); } }