com.mozilla.secops.parser

Class SourcePayloadBase

java.lang.Object

com.mozilla.secops.parser.PayloadBase

com.mozilla.secops.parser.SourcePayloadBase

All Implemented Interfaces:

Serializable

Direct Known Subclasses:

AmoDocker, ApacheCombined, Auth0, BmoAudit, Cloudtrail, Duopull, FxaAuth, FxaContent, GcpAudit, GcpVpcFlow, GLB, IPrepdLog, Nginx, OpenSSH, Phabricator, Taskcluster

public abstract class SourcePayloadBase
extends PayloadBase
implements Serializable

Extension of PayloadBase that unifies source address field handling

Payload types that manipulate some indication of a source address field should likely inherit from this class.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
SourcePayloadBase() Initialize SourcePayloadBase

Method Summary

Modifier and Type	Method and Description
String	getSourceAddress() Get source address
Integer	getSourceAddressAsn() Get source address ASN
String	getSourceAddressAsOrg() Get source address AS organization
String	getSourceAddressCity() Get source address city
String	getSourceAddressCountry() Get source address country
String	getSourceAddressIsp() Get source address ISP
Double	getSourceAddressLatitude() Get source address latitude
Double	getSourceAddressLongitude() Get source address longitude
String	getSourceAddressTimeZone() Get source address time zone
void	setSourceAddress(String sourceAddress) Set source address field
void	setSourceAddress(String sourceAddress, com.mozilla.secops.parser.ParserState state, Normalized n) Set source address field

Methods inherited from class com.mozilla.secops.parser.PayloadBase

eventIntegerValue, eventStringValue, getType, matcher

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SourcePayloadBase

public SourcePayloadBase()

Initialize SourcePayloadBase

Method Detail

setSourceAddress

public void setSourceAddress(String sourceAddress,
                             com.mozilla.secops.parser.ParserState state,
                             Normalized n)

Set source address field

If the state value is non-null, elements within the parser state such as an initialized GeoIP object will be used as part of geo-ip resolution.

If n is non-null, the source address value will also be mirrored into the normalized event field.

Parameters:

sourceAddress - Source address

state - Parser state

n - Normalized field from base event

setSourceAddress

public void setSourceAddress(String sourceAddress)

Set source address field

Parameters:

sourceAddress - Source address

getSourceAddress

public String getSourceAddress()

Get source address

Returns:

Source address string or null if unset

getSourceAddressCity

public String getSourceAddressCity()

Get source address city

Returns:

Source address city field or null if unset

getSourceAddressCountry

public String getSourceAddressCountry()

Get source address country

Returns:

Source address country field or null if unset

getSourceAddressLatitude

public Double getSourceAddressLatitude()

Get source address latitude

Returns:

Latitude or null if unset

getSourceAddressLongitude

public Double getSourceAddressLongitude()

Get source address longitude

Returns:

Longitude or null if unset

getSourceAddressTimeZone

public String getSourceAddressTimeZone()

Get source address time zone

Returns:

Time zone or null if unset

getSourceAddressIsp

public String getSourceAddressIsp()

Get source address ISP

Returns:

ISP or null if unset

getSourceAddressAsn

public Integer getSourceAddressAsn()

Get source address ASN

Returns:

ASN or null if unset

getSourceAddressAsOrg

public String getSourceAddressAsOrg()

Get source address AS organization

Returns:

AS organization or null if unset