Class: AWSCDK::Logs::ParseToOCSFProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
logs/parse_to_ocsf_property.rb

Overview

Processor to parse events from CloudTrail, Route53Resolver, VPCFlow, EKSAudit and AWSWAF into OCSF V1.1 format.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(event_source:, ocsf_version:, source: nil) ⇒ ParseToOCSFProperty

Returns a new instance of ParseToOCSFProperty.

Parameters:

  • event_source (AWSCDK::Logs::OCSFSourceType) —

    Type of input log event source to convert to OCSF format.

  • ocsf_version (AWSCDK::Logs::OCSFVersion) —

    Version of OCSF schema to convert to.

  • source (String, nil) (defaults to: nil) —

    Path to the field in the log event that will be parsed.



10
11
12
13
14
15
16
17
 
# File 'logs/parse_to_ocsf_property.rb', line 10

def initialize(event_source:, ocsf_version:, source: nil)
  @event_source = event_source
  Jsii::Type.check_type(@event_source, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfbG9ncy5PQ1NGU291cmNlVHlwZSJ9")), "eventSource")
  @ocsf_version = ocsf_version
  Jsii::Type.check_type(@ocsf_version, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfbG9ncy5PQ1NGVmVyc2lvbiJ9")), "ocsfVersion")
  @source = source
  Jsii::Type.check_type(@source, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "source") unless @source.nil?
end

Instance Attribute Details

#event_source ⇒ AWSCDK::Logs::OCSFSourceType (readonly)

Type of input log event source to convert to OCSF format.

Returns:



22
23
24
 
# File 'logs/parse_to_ocsf_property.rb', line 22

def event_source
  @event_source
end

#ocsf_version ⇒ AWSCDK::Logs::OCSFVersion (readonly)

Version of OCSF schema to convert to.

Returns:



26
27
28
 
# File 'logs/parse_to_ocsf_property.rb', line 26

def ocsf_version
  @ocsf_version
end

#source ⇒ String? (readonly)

Note:

Default: '@message'

Path to the field in the log event that will be parsed.

Use dot notation to access child fields.

Returns:

  • (String, nil) 


33
34
35
 
# File 'logs/parse_to_ocsf_property.rb', line 33

def source
  @source
end

Class Method Details

.jsii_properties ⇒ Object 



35
36
37
38
39
40
41
 
# File 'logs/parse_to_ocsf_property.rb', line 35

def self.jsii_properties
  {
    :event_source => "eventSource",
    :ocsf_version => "ocsfVersion",
    :source => "source",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



43
44
45
46
47
48
49
50
51
 
# File 'logs/parse_to_ocsf_property.rb', line 43

def to_jsii
  result = {}
  result.merge!({
    "eventSource" => @event_source,
    "ocsfVersion" => @ocsf_version,
    "source" => @source,
  })
  result.compact
end