Class: Smplkit::Audit::Forwarder

Inherits:
Object
  • Object
show all
Defined in:
lib/smplkit/audit/models.rb

Overview

A SIEM streaming forwarder configured on the customer’s account.

Active-record style: instantiate via mgmt.audit.forwarders.new_forwarder(…), mutate fields directly, and call #save to persist or #delete to remove. Header values in configuration.headers are returned redacted on reads — the GET path on the audit API replaces every header value with “<redacted>”. Re-supply real values before calling #save; the SDK does not cache them client-side.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(client = nil, name:, forwarder_type:, configuration:, id: nil, enabled: true, description: nil, filter: nil, transform: nil, transform_type: nil, created_at: nil, updated_at: nil, deleted_at: nil, version: nil) ⇒ Forwarder

Returns a new instance of Forwarder.



361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
 
# File 'lib/smplkit/audit/models.rb', line 361

def initialize(client = nil, name:, forwarder_type:, configuration:,
               id: nil, enabled: true, description: nil,
               filter: nil, transform: nil, transform_type: nil,
               created_at: nil, updated_at: nil, deleted_at: nil, version: nil)
  @client = client
  @id = id
  @name = name
  @forwarder_type = ForwarderType.coerce(forwarder_type)
  @configuration = configuration
  @enabled = enabled
  @description = description
  @filter = filter
  @transform = transform
  @transform_type = TransformType.coerce(transform_type)
  @created_at = created_at
  @updated_at = updated_at
  @deleted_at = deleted_at
  @version = version
end

Instance Attribute Details

#configuration ⇒ HttpConfiguration

Returns Destination request configuration.

Returns:



328
329
330
 
# File 'lib/smplkit/audit/models.rb', line 328

def configuration
  @configuration
end

#created_at ⇒ String?

Returns ISO-8601 timestamp of first persist. nil for an unsaved instance.

Returns:

  • (String, nil) —

    ISO-8601 timestamp of first persist. nil for an unsaved instance.



350
351
352
 
# File 'lib/smplkit/audit/models.rb', line 350

def created_at
  @created_at
end

#deleted_at ⇒ String?

Returns Soft-delete timestamp. nil for live forwarders.

Returns:

  • (String, nil) —

    Soft-delete timestamp. nil for live forwarders.



356
357
358
 
# File 'lib/smplkit/audit/models.rb', line 356

def deleted_at
  @deleted_at
end

#description ⇒ String?

Returns Optional free-text description.

Returns:

  • (String, nil) —

    Optional free-text description.



331
332
333
 
# File 'lib/smplkit/audit/models.rb', line 331

def description
  @description
end

#enabled ⇒ Boolean

Returns When false, the audit service skips delivery for this forwarder but still records filtered_out deliveries.

Returns:

  • (Boolean) —

    When false, the audit service skips delivery for this forwarder but still records filtered_out deliveries.



325
326
327
 
# File 'lib/smplkit/audit/models.rb', line 325

def enabled
  @enabled
end

#filter ⇒ Hash?

Returns Optional JSON Logic expression evaluated per event. When set, events that don’t match are recorded as filtered_out deliveries instead of being delivered to the destination.

Returns:

  • (Hash, nil) —

    Optional JSON Logic expression evaluated per event. When set, events that don’t match are recorded as filtered_out deliveries instead of being delivered to the destination.



336
337
338
 
# File 'lib/smplkit/audit/models.rb', line 336

def filter
  @filter
end

#forwarder_type ⇒ String

Returns One of Smplkit::Audit::ForwarderType::VALUES.

Returns:



321
322
323
 
# File 'lib/smplkit/audit/models.rb', line 321

def forwarder_type
  @forwarder_type
end

#id ⇒ String?

Returns Server-assigned UUID, nil until #save has run.

Returns:

  • (String, nil) —

    Server-assigned UUID, nil until #save has run.



315
316
317
 
# File 'lib/smplkit/audit/models.rb', line 315

def id
  @id
end

#name ⇒ String

Returns Display name. Free-form.

Returns:

  • (String) —

    Display name. Free-form.



318
319
320
 
# File 'lib/smplkit/audit/models.rb', line 318

def name
  @name
end

#transform ⇒ Object?

Returns Optional template applied to each event before delivery. Free-form — the audit service passes the value verbatim to the engine named by #transform_type. For TransformType::JSONATA a JSONata expression string; nil delivers the event JSON as-is. Must be paired with a non-nil #transform_type.

Returns:

  • (Object, nil) —

    Optional template applied to each event before delivery. Free-form — the audit service passes the value verbatim to the engine named by #transform_type. For TransformType::JSONATA a JSONata expression string; nil delivers the event JSON as-is. Must be paired with a non-nil #transform_type.



343
344
345
 
# File 'lib/smplkit/audit/models.rb', line 343

def transform
  @transform
end

#transform_type ⇒ String?

Returns Engine that evaluates #transform — one of TransformType::VALUES. Required whenever #transform is set.

Returns:



347
348
349
 
# File 'lib/smplkit/audit/models.rb', line 347

def transform_type
  @transform_type
end

#updated_at ⇒ String?

Returns ISO-8601 timestamp of the most recent mutation.

Returns:

  • (String, nil) —

    ISO-8601 timestamp of the most recent mutation.



353
354
355
 
# File 'lib/smplkit/audit/models.rb', line 353

def updated_at
  @updated_at
end

#version ⇒ Integer?

Returns Monotonic version counter, bumped on every server-side write.

Returns:

  • (Integer, nil) —

    Monotonic version counter, bumped on every server-side write.



359
360
361
 
# File 'lib/smplkit/audit/models.rb', line 359

def version
  @version
end

Class Method Details

.from_resource(resource, client: nil) ⇒ Object 



450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
 
# File 'lib/smplkit/audit/models.rb', line 450

def self.from_resource(resource, client: nil)
  a = resource.attributes
  new(
    client,
    id: resource.id,
    name: a.name,
    description: a.description,
    forwarder_type: a.forwarder_type,
    enabled: a.enabled.nil? || a.enabled,
    filter: a.filter.nil? ? nil : Smplkit::Helpers.deep_stringify_keys(a.filter),
    transform_type: a.transform_type,
    transform: a.transform,
    configuration: HttpConfiguration.from_wire(a.configuration),
    created_at: a.created_at,
    updated_at: a.updated_at,
    deleted_at: a.deleted_at,
    version: a.version
  )
end

.validate_transform_pair!(transform, transform_type) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Validate the (transform, transform_type) pair.

Both must be nil or both must be set. When transform_type is TransformType::JSONATA, transform must be a String (the JSONata expression). Other engines accept any value.

Raises:

  • (ArgumentError) 


437
438
439
440
441
442
443
444
445
446
447
448
 
# File 'lib/smplkit/audit/models.rb', line 437

def self.validate_transform_pair!(transform, transform_type)
  if transform.nil? != transform_type.nil?
    raise ArgumentError,
          "transform and transform_type must be specified together (both nil or both set)"
  end
  return if transform.nil?
  return unless transform_type == TransformType::JSONATA && !transform.is_a?(String)

  raise ArgumentError,
        "transform must be a String when transform_type is JSONATA " \
        "(got #{transform.class})"
end

Instance Method Details

#_apply(other) ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future. 



414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
 
# File 'lib/smplkit/audit/models.rb', line 414

def _apply(other)
  @id = other.id
  @name = other.name
  @forwarder_type = other.forwarder_type
  @configuration = other.configuration
  @enabled = other.enabled
  @description = other.description
  @filter = other.filter
  @transform = other.transform
  @transform_type = other.transform_type
  @created_at = other.created_at
  @updated_at = other.updated_at
  @deleted_at = other.deleted_at
  @version = other.version
end

#delete ⇒ nil Also known as: delete!

Soft-delete this forwarder on the server.

Returns:

  • (nil) 


406
407
408
409
410
 
# File 'lib/smplkit/audit/models.rb', line 406

def delete
  raise "Forwarder was constructed without a client or id; cannot delete" if @client.nil? || @id.nil?

  @client.delete(@id)
end

#save ⇒ self Also known as: save!

Create or update this forwarder on the server.

Upsert behavior is driven by #created_at: a forwarder with no created_at is created (POST); otherwise it’s full-replace updated (PUT). After the call, every field is refreshed from the server response (including newly-assigned id, created_at, updated_at, version).

Returns:

  • (self)

Raises:



393
394
395
396
397
398
399
400
 
# File 'lib/smplkit/audit/models.rb', line 393

def save
  raise "Forwarder was constructed without a client; cannot save" if @client.nil?

  self.class.send(:validate_transform_pair!, @transform, @transform_type)
  updated = @created_at.nil? ? @client._create_forwarder(self) : @client._update_forwarder(self)
  _apply(updated)
  self
end