cef-parserImpl

A pom for deploying to maven central.

License	Apache License 2.0
GroupId	com.github.jcustenborder
ArtifactId	cef-parser
Last Version	0.0.1.7
Release Date	May 2, 2017
Type	jar
Description	cef-parserImpl A pom for deploying to maven central.
Project URL	https://github.com/jcustenborder/cef-parser
Source Code Management	https://github.com/jcustenborder/cef-parser

Download cef-parser

Filename	Size
cef-parser-0.0.1.7.pom
cef-parser-0.0.1.7.jar	14 KB
cef-parser-0.0.1.7-sources.jar	12 KB
cef-parser-0.0.1.7-javadoc.jar	49 KB

How to add to project

Apache Maven

<!-- https://jarcasting.com/artifacts/com.github.jcustenborder/cef-parser/ -->
<dependency>
    <groupId>com.github.jcustenborder</groupId>
    <artifactId>cef-parser</artifactId>
    <version>0.0.1.7</version>
</dependency>

Gradle Groovy

// https://jarcasting.com/artifacts/com.github.jcustenborder/cef-parser/
implementation 'com.github.jcustenborder:cef-parser:0.0.1.7'

Gradle Kotlin

// https://jarcasting.com/artifacts/com.github.jcustenborder/cef-parser/
implementation ("com.github.jcustenborder:cef-parser:0.0.1.7")

Apache Buildr

'com.github.jcustenborder:cef-parser:jar:0.0.1.7'

Apache Ivy

<dependency org="com.github.jcustenborder" name="cef-parser" rev="0.0.1.7">
  <artifact name="cef-parser" type="jar" />
</dependency>

Groovy Grape

@Grapes(
@Grab(group='com.github.jcustenborder', module='cef-parser', version='0.0.1.7')
)

Scala SBT

libraryDependencies += "com.github.jcustenborder" % "cef-parser" % "0.0.1.7"

Leiningen

[com.github.jcustenborder/cef-parser "0.0.1.7"]

Dependencies

compile (1)

Group / Artifact	Type	Version
com.google.guava : guava	jar	18.0

provided (1)

Group / Artifact	Type	Version
org.slf4j : slf4j-api	jar	1.7.21

test (6)

Group / Artifact	Type	Version
com.fasterxml.jackson.core : jackson-databind	jar	2.6.3
org.junit.jupiter : junit-jupiter-engine	jar	5.0.0-M3
org.junit.jupiter : junit-jupiter-api	jar	5.0.0-M3
org.mockito : mockito-core	jar	1.10.19
ch.qos.logback : logback-classic	jar	1.1.8
org.reflections : reflections	jar	0.9.10

Project Modules

There are no modules declared in this project.

Introduction

This library is used to parse the ArcSight Common Event Format (CEF). CEF is a logging protocol that is typically sent over syslog. Messages will be formatted similar to this:

Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|detected a \| in message|10|src=10.0.0.1 act=blocked a | dst=1.1.1.1
Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|detected a \\ in packet|10|src=10.0.0.1 act=blocked a \\ dst=1.1.1.1
CEF:0|security|threatmanager|1.0|100|detected a \\ in packet|10|src=10.0.0.1 act=blocked a \\ dst=1.1.1.1

This is over the standard Syslog protocol. A typical syslog message will include the timestamp, host, and the message for the event. This library can parse entries that contain that have the timestamp and host, or will also work if they are missing.

Example

Below is a simple example of how to use the parser.

import com.github.jcustenborder.cef.CEFParserFactory;
import com.github.jcustenborder.cef.CEFParser;
import com.github.jcustenborder.cef.Message;

class Foo {
  static void main(String... args) throws Exception {
    CEFParser f = CEFParserFactory.create();
    Message message = f.parse("Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|detected a \| in message|10|src=10.0.0.1 act=blocked a | dst=1.1.1.1");
  }
}

Versions

Version
0.0.1.7 May 2, 2017
0.0.1.5 Apr 25, 2017