com.accelops.service.threatfeed

Class BaseStixUpdateService

java.lang.Object

com.accelops.service.threatfeed.BaseThreatFeedUpdateService

com.accelops.service.threatfeed.BaseStixUpdateService

Direct Known Subclasses:

StixMalwareDomainUpdateService, StixMalwareHashUpdateService, StixMalwareIPUpdateService, StixMalwareUrlUpdateService

public abstract class BaseStixUpdateService
extends BaseThreatFeedUpdateService

Created by xin.zhang on 7/21/16.

Field Summary

Fields inherited from class com.accelops.service.threatfeed.BaseThreatFeedUpdateService

DEFAULT_CSV_QUOTE_CHARACTER, DEFAULT_CSV_SEPARATOR

Constructor Summary

Constructors

Constructor and Description
BaseStixUpdateService()

Method Summary

Modifier and Type	Method and Description
String	download(ServiceContext context) The function to download External Thread Feeds from a third party web site.
abstract String	getParseType()
static void	main(String[] args)
Map<String,List<ThreatFeedDTO>>	parse(ServiceContext context, String filePath, String parentGroup, List<String> childGroups) The function to parse the Threat Feeds downloaded by the download function.

Methods inherited from class com.accelops.service.threatfeed.BaseThreatFeedUpdateService

appendCondition, download, download, getMaxReadLines, getReadByte, getStartLine, parseLine, setBackReadResult

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

BaseStixUpdateService

public BaseStixUpdateService()

Method Detail

download

public String download(ServiceContext context)

Description copied from class: BaseThreatFeedUpdateService

The function to download External Thread Feeds from a third party web site.

The default implementation of this function downloads all the available Threat Feeds and saves the downloaded raw content to a local file as same format as defined in the web site and return the file name as the result. This download method supports HTTP(s) Basic Authorization only.

This default implementation can be overwritten if this default implementation doesn't meet the API requirement of the third party web site.

Overrides:

download in class BaseThreatFeedUpdateService

Parameters:

context - The service context that holds setup parameters needed for the download.

Returns:

The file path or the Content String that holds the downloaded Threat Feeds if successfully or NULL if failed.

See Also:

ServiceContext

parse

public Map<String,List<ThreatFeedDTO>> parse(ServiceContext context,
                                             String filePath,
                                             String parentGroup,
                                             List<String> childGroups)
                                      throws Exception

Description copied from class: BaseThreatFeedUpdateService

The function to parse the Threat Feeds downloaded by the download function.

This API must be implemented to parse and convert a downloaded Threat Feed into ThreatFeedDTO object.

If you assign any Threat Feeds to a child group that doesn't exist in CMDB yet, this child group will be created during importing these Threat Feeds to this child group in CMDB. Also, if you would like assign the downloaded Threat Feeds to a child group, not the parent group named as 'groupName', you should not assign any of the Threat Feeds to this parent group in the return mapping.

Specified by:

parse in class BaseThreatFeedUpdateService

Parameters:

context - The service context which holds set up parameters you may need for parsing.

filePath - The file path or the download Content String that will be parsed by this function.

parentGroup - The CMDB group name that is being set up to schedule to download Threat Feeds.

childGroups - a list of child groups under the group 'groupName' that may hold the downloaded Threat Feeds.

Returns:

A map that contains the group name to list of ThreatFeedDTO object mapping.

Throws:

Exception - when error happened during parsing the downloaded Threat Feeds.

See Also:

ServiceContext, ThreatFeedDTO

getParseType

public abstract String getParseType()

main

public static void main(String[] args)