Class: WinevtXMLDocumentREXML

Inherits:
Object
  • Object
show all
Defined in:
lib/fluent/plugin/winevt_sax_document_rexml.rb

Instance Method Summary collapse

Constructor Details

#initialize(preserve_qualifiers) ⇒ WinevtXMLDocumentREXML

Returns a new instance of WinevtXMLDocumentREXML.



4
5
6
7
8
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 4

def initialize(preserve_qualifiers)
  @stack = []
  @result = {}
  @preserve_qualifiers = preserve_qualifiers
end

Dynamic Method Handling

This class handles dynamic methods through the method_missing method

#method_missing(name, *args, &block) ⇒ Object 



95
96
97
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 95

def method_missing(name, *args, &block)
  # Ignore any SAX2 events we don't explicitly handle (e.g., progress)
end

Instance Method Details

#characters(string) ⇒ Object 



82
83
84
85
86
87
88
89
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 82

def characters(string)
  element = @stack.last
  return unless element

  if /^EventID|Level|Task|Opcode|Keywords|EventRecordID|ActivityID|Channel|Computer|Security|Version$/ === element
    @result[element] = (@result[element] || '') + string
  end
end

#end_element(*_) ⇒ Object 



91
92
93
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 91

def end_element(*_)
  @stack.pop
end

#event_id ⇒ Object 



14
15
16
17
18
19
20
21
22
23
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 14

def event_id
  if @result.has_key?("Qualifiers")
    qualifiers = @result.delete("Qualifiers")
    event_id = @result['EventID']
    event_id = MAKELONG(event_id.to_i, qualifiers.to_i)
    @result['EventID'] = event_id.to_s
  else
    @result['EventID']
  end
end

#MAKELONG(low, high) ⇒ Object 



10
11
12
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 10

def MAKELONG(low, high)
  (low & 0xffff) | (high & 0xffff) << 16
end

#result ⇒ Object 



25
26
27
28
29
30
31
32
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 25

def result
  return @result if @preserve_qualifiers

  if @result
    @result['EventID'] = event_id
  end
  @result
end

#start_element(*args) ⇒ Object 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/fluent/plugin/winevt_sax_document_rexml.rb', line 34

def start_element(*args)
  # REXML SAX2 may pass (uri, localname, qname, attributes) or (qname, attributes)
  name = if args.length >= 3
           args[1].to_s
         else
           args[0].to_s
         end
  # normalize namespace/prefix
  name = name.split('}').last if name.include?('}')
  name = name.split(':').last if name.include?(':')
  @stack << name

  attrs = args.last || {}

  # helper to fetch attribute value from different attribute containers
  get_attr = lambda do |a, k|
    begin
      if a.is_a?(Array)
        pair = a.find { |p| p && p[0] && p[0].to_s == k.to_s }
        pair && pair[1]
      elsif a.respond_to?(:[])
        a[k] || a[k.to_sym]
      else
        nil
      end
    rescue
      nil
    end
  end

  if name == "Provider"
    @result["ProviderName"] = get_attr.call(attrs, 'Name')
    @result["ProviderGUID"] = get_attr.call(attrs, 'Guid')
  elsif name == "EventID"
    @result["Qualifiers"] = get_attr.call(attrs, 'Qualifiers')
  elsif name == "TimeCreated"
    @result["TimeCreated"] = get_attr.call(attrs, 'SystemTime')
  elsif name == "Correlation"
    @result["ActivityID"] = get_attr.call(attrs, 'ActivityID')
    @result["RelatedActivityID"] = get_attr.call(attrs, 'RelatedActivityID')
  elsif name == "Execution"
    @result["ProcessID"] = get_attr.call(attrs, 'ProcessID')
    @result["ThreadID"] = get_attr.call(attrs, 'ThreadID')
  elsif name == "Security"
    @result["UserID"] = get_attr.call(attrs, 'UserID')
  end
end