com.mozilla.secops.parser

Class EventFilterPayload

java.lang.Object

com.mozilla.secops.parser.EventFilterPayload

All Implemented Interfaces:

EventFilterPayloadInterface, Serializable

public class EventFilterPayload
extends Object
implements EventFilterPayloadInterface, Serializable

Can be associated with EventFilterRule for payload matching

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	EventFilterPayload.IntegerProperty Properties match integers from various payload event types
static class	EventFilterPayload.StringProperty Properties match strings from various payload event types

Constructor Summary

Constructors

Constructor and Description
EventFilterPayload() Create new empty payload filter
EventFilterPayload(Class<? extends PayloadBase> ptype) Create new payload filter that additionally verifies against the supplied payload class

Method Summary

Modifier and Type	Method and Description
Map<EventFilterPayload.IntegerProperty,Integer>	getIntegerMatchers() Get configured integer matchers
Map<EventFilterPayload.IntegerProperty,EventFilterPayloadRange<Integer>>	getIntegerRangeMatchers() Get configured integer range matchers
String	getPayloadType() Get payload filter
Map<EventFilterPayload.StringProperty,String>	getStringMatchers() Get configured string matchers
Map<EventFilterPayload.StringProperty,String>	getStringRegexMatchers() Get configured string regex matchers
Boolean	matches(Event e) Return true if payload criteria matches
void	setIntegerMatchers(Map<EventFilterPayload.IntegerProperty,Integer> integerMatchers) Set configured integer matchers
void	setIntegerRangeMatchers(Map<EventFilterPayload.IntegerProperty,EventFilterPayloadRange<Integer>> integerRangeMatchers) Set configured integer range matchers
void	setPayloadType(String className) Set payload filter
void	setStringMatchers(Map<EventFilterPayload.StringProperty,String> stringMatchers) Set configured string matchers
void	setStringRegexMatchers(Map<EventFilterPayload.StringProperty,String> stringRegexMatchers) Set configured string regex matchers
EventFilterPayload	withIntegerMatch(EventFilterPayload.IntegerProperty property, Integer i) Add a new simple integer match to the payload filter
EventFilterPayload	withIntegerRangeMatch(EventFilterPayload.IntegerProperty property, int low, int high) Add an integer range match to the payload filter
EventFilterPayload	withStringMatch(EventFilterPayload.StringProperty property, String s) Add a new simple string match to the payload filter
EventFilterPayload	withStringRegexMatch(EventFilterPayload.StringProperty property, String s) Add a new string regex match to the payload filter

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EventFilterPayload

public EventFilterPayload(Class<? extends PayloadBase> ptype)

Create new payload filter that additionally verifies against the supplied payload class

Parameters:

ptype - Payload class

EventFilterPayload

public EventFilterPayload()

Create new empty payload filter

Method Detail

matches

public Boolean matches(Event e)

Return true if payload criteria matches

Specified by:

matches in interface EventFilterPayloadInterface

Parameters:

e - Input event

Returns:

True on match

withStringRegexMatch

public EventFilterPayload withStringRegexMatch(EventFilterPayload.StringProperty property,
                                               String s)
                                        throws PatternSyntaxException

Add a new string regex match to the payload filter

Parameters:

property - EventFilterPayload.StringProperty

s - String regex pattern to match against

Returns:

EventFilterPayload for chaining

Throws:

PatternSyntaxException

setStringRegexMatchers

public void setStringRegexMatchers(Map<EventFilterPayload.StringProperty,String> stringRegexMatchers)

Set configured string regex matchers

Patterns are compiled immediately upon invocation of the method.

Parameters:

stringRegexMatchers - Map of key/value pairs

getStringRegexMatchers

public Map<EventFilterPayload.StringProperty,String> getStringRegexMatchers()

Get configured string regex matchers

Returns:

Map of key/value pairs

withStringMatch

public EventFilterPayload withStringMatch(EventFilterPayload.StringProperty property,
                                          String s)

Add a new simple string match to the payload filter

Parameters:

property - EventFilterPayload.StringProperty

s - String to match against

Returns:

EventFilterPayload for chaining

setStringMatchers

public void setStringMatchers(Map<EventFilterPayload.StringProperty,String> stringMatchers)

Set configured string matchers

Parameters:

stringMatchers - Map of key/value pairs

getStringMatchers

public Map<EventFilterPayload.StringProperty,String> getStringMatchers()

Get configured string matchers

Returns:

Map of key/value pairs

withIntegerMatch

public EventFilterPayload withIntegerMatch(EventFilterPayload.IntegerProperty property,
                                           Integer i)

Add a new simple integer match to the payload filter

Parameters:

property - EventFilterPayload.IntegerProperty

i - Integer to match against

Returns:

EventFilterPayload for chaining

setIntegerMatchers

public void setIntegerMatchers(Map<EventFilterPayload.IntegerProperty,Integer> integerMatchers)

Set configured integer matchers

Parameters:

integerMatchers - Map of key/value pairs

getIntegerMatchers

public Map<EventFilterPayload.IntegerProperty,Integer> getIntegerMatchers()

Get configured integer matchers

Returns:

Map of key/value pairs

withIntegerRangeMatch

public EventFilterPayload withIntegerRangeMatch(EventFilterPayload.IntegerProperty property,
                                                int low,
                                                int high)

Add an integer range match to the payload filter

Will match if the property value falls between low and high inclusively.

Parameters:

property - EventFilterPayload.IntegerProperty

low - Low value for range match

high - High value for range match

Returns:

EventFilterPayload for chaining

setIntegerRangeMatchers

public void setIntegerRangeMatchers(Map<EventFilterPayload.IntegerProperty,EventFilterPayloadRange<Integer>> integerRangeMatchers)

Set configured integer range matchers

Parameters:

integerRangeMatchers - Map of key/value pairs

getIntegerRangeMatchers

public Map<EventFilterPayload.IntegerProperty,EventFilterPayloadRange<Integer>> getIntegerRangeMatchers()

Get configured integer range matchers

Returns:

Map of key/value pairs

setPayloadType

public void setPayloadType(String className)

Set payload filter

Parameters:

className - Canonical name of class filter wants

getPayloadType

public String getPayloadType()

Get payload filter

Returns:

Canonical name of class filter expects, null if unset