cef-parserImpl

A pom for deploying to maven central.

License

License

GroupId

GroupId

com.github.jcustenborder
ArtifactId

ArtifactId

cef-parser
Last Version

Last Version

0.0.1.7
Release Date

Release Date

Type

Type

jar
Description

Description

cef-parserImpl
A pom for deploying to maven central.
Project URL

Project URL

https://github.com/jcustenborder/cef-parser
Source Code Management

Source Code Management

https://github.com/jcustenborder/cef-parser

Download cef-parser

How to add to project

<!-- https://jarcasting.com/artifacts/com.github.jcustenborder/cef-parser/ -->
<dependency>
    <groupId>com.github.jcustenborder</groupId>
    <artifactId>cef-parser</artifactId>
    <version>0.0.1.7</version>
</dependency>
// https://jarcasting.com/artifacts/com.github.jcustenborder/cef-parser/
implementation 'com.github.jcustenborder:cef-parser:0.0.1.7'
// https://jarcasting.com/artifacts/com.github.jcustenborder/cef-parser/
implementation ("com.github.jcustenborder:cef-parser:0.0.1.7")
'com.github.jcustenborder:cef-parser:jar:0.0.1.7'
<dependency org="com.github.jcustenborder" name="cef-parser" rev="0.0.1.7">
  <artifact name="cef-parser" type="jar" />
</dependency>
@Grapes(
@Grab(group='com.github.jcustenborder', module='cef-parser', version='0.0.1.7')
)
libraryDependencies += "com.github.jcustenborder" % "cef-parser" % "0.0.1.7"
[com.github.jcustenborder/cef-parser "0.0.1.7"]

Dependencies

compile (1)

Group / Artifact Type Version
com.google.guava : guava jar 18.0

provided (1)

Group / Artifact Type Version
org.slf4j : slf4j-api jar 1.7.21

test (6)

Group / Artifact Type Version
com.fasterxml.jackson.core : jackson-databind jar 2.6.3
org.junit.jupiter : junit-jupiter-engine jar 5.0.0-M3
org.junit.jupiter : junit-jupiter-api jar 5.0.0-M3
org.mockito : mockito-core jar 1.10.19
ch.qos.logback : logback-classic jar 1.1.8
org.reflections : reflections jar 0.9.10

Project Modules

There are no modules declared in this project.

Introduction

Maven Central

This library is used to parse the ArcSight Common Event Format (CEF). CEF is a logging protocol that is typically sent over syslog. Messages will be formatted similar to this:

Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|detected a \| in message|10|src=10.0.0.1 act=blocked a | dst=1.1.1.1
Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|detected a \\ in packet|10|src=10.0.0.1 act=blocked a \\ dst=1.1.1.1
CEF:0|security|threatmanager|1.0|100|detected a \\ in packet|10|src=10.0.0.1 act=blocked a \\ dst=1.1.1.1

This is over the standard Syslog protocol. A typical syslog message will include the timestamp, host, and the message for the event. This library can parse entries that contain that have the timestamp and host, or will also work if they are missing.

Example

Below is a simple example of how to use the parser.

import com.github.jcustenborder.cef.CEFParserFactory;
import com.github.jcustenborder.cef.CEFParser;
import com.github.jcustenborder.cef.Message;

class Foo {
  static void main(String... args) throws Exception {
    CEFParser f = CEFParserFactory.create();
    Message message = f.parse("Sep 19 08:26:10 host CEF:0|security|threatmanager|1.0|100|detected a \| in message|10|src=10.0.0.1 act=blocked a | dst=1.1.1.1");
  }
}

Versions

Version
0.0.1.7
0.0.1.5