SyslogPro/docs/module-SyslogPro-LEEF.html
2018-09-25 18:23:58 +00:00

1383 lines
22 KiB
HTML

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>LEEF - Documentation</title>
<script src="scripts/prettify/prettify.js"></script>
<script src="scripts/prettify/lang-css.js"></script>
<!--[if lt IE 9]>
<script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>
<![endif]-->
<link type="text/css" rel="stylesheet" href="styles/prettify.css">
<link type="text/css" rel="stylesheet" href="styles/jsdoc.css">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
</head>
<body>
<input type="checkbox" id="nav-trigger" class="nav-trigger" />
<label for="nav-trigger" class="navicon-button x">
<div class="navicon"></div>
</label>
<label for="nav-trigger" class="overlay"></label>
<nav>
<h2><a href="index.html">Home</a></h2><h3>Classes</h3><ul><li><a href="module-SyslogPro-CEF.html">CEF</a><ul class='methods'><li data-type='method'><a href="module-SyslogPro-CEF.html#buildMessage">buildMessage</a></li><li data-type='method'><a href="module-SyslogPro-CEF.html#send">send</a></li><li data-type='method'><a href="module-SyslogPro-CEF.html#validate">validate</a></li></ul></li><li><a href="module-SyslogPro-LEEF.html">LEEF</a><ul class='methods'><li data-type='method'><a href="module-SyslogPro-LEEF.html#buildMessage">buildMessage</a></li><li data-type='method'><a href="module-SyslogPro-LEEF.html#send">send</a></li></ul></li><li><a href="module-SyslogPro-RFC3164.html">RFC3164</a><ul class='methods'><li data-type='method'><a href="module-SyslogPro-RFC3164.html#alert">alert</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#buildMessage">buildMessage</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#crit">crit</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#critical">critical</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#debug">debug</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#emer">emer</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#emergency">emergency</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#err">err</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#error">error</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#info">info</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#informational">informational</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#log">log</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#note">note</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#notice">notice</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#send">send</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#setColor">setColor</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#warn">warn</a></li><li data-type='method'><a href="module-SyslogPro-RFC3164.html#warning">warning</a></li></ul></li><li><a href="module-SyslogPro-RFC5424.html">RFC5424</a><ul class='methods'><li data-type='method'><a href="module-SyslogPro-RFC5424.html#alert">alert</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#buildMessage">buildMessage</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#crit">crit</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#critical">critical</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#debug">debug</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#emer">emer</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#emergency">emergency</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#err">err</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#error">error</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#info">info</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#informational">informational</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#log">log</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#note">note</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#notice">notice</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#send">send</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#setColor">setColor</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#warn">warn</a></li><li data-type='method'><a href="module-SyslogPro-RFC5424.html#warning">warning</a></li></ul></li><li><a href="module-SyslogPro-Syslog.html">Syslog</a><ul class='methods'><li data-type='method'><a href="module-SyslogPro-Syslog.html#addTlsServerCerts">addTlsServerCerts</a></li><li data-type='method'><a href="module-SyslogPro-Syslog.html#send">send</a></li><li data-type='method'><a href="module-SyslogPro-Syslog.html#tcpMessage">tcpMessage</a></li><li data-type='method'><a href="module-SyslogPro-Syslog.html#tlsMessage">tlsMessage</a></li><li data-type='method'><a href="module-SyslogPro-Syslog.html#udpMessage">udpMessage</a></li></ul></li></ul><h3>Modules</h3><ul><li><a href="module-SyslogPro.html">SyslogPro</a><ul class='methods'><li data-type='method'><a href="module-SyslogPro.html#~rgbToAnsi">rgbToAnsi</a></li></ul></li></ul>
</nav>
<div id="main">
<h1 class="page-title">LEEF</h1>
<section>
<header>
<h2>
<span class="ancestors"><a href="module-SyslogPro.html">SyslogPro</a>~</span>
LEEF
</h2>
<div class="class-description">A class to work with IBM LEEF (Log Event Extended Format) messages this form
of system messages are designed to work with security systems. Messages can
be saved to file (Saving to file if not part of this module but a LEEF
formated mesage produced by this module can be saved externaly to it) or
sent via Syslog.
Most APIs will return a promise. These APIs can be used using
`then(...)/catch(...)`
A Syslog class with a configured Syslog server target can also be used as
the input into the formating classes so that it may run independtly. The
LEEF format is designed to send event data to a SIEM system and should not
be as a logging stream. This class is ment to be used once per message.</div>
</header>
<article>
<div class="container-overview">
<h2>Constructor</h2>
<h4 class="name" id="LEEF"><span class="type-signature"></span>new LEEF<span class="signature">(options<span class="signature-attributes">opt</span>)</span><span class="type-signature"></span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1705">line 1705</a>
</li></ul></dd>
<dt class="tag-version">Version:</dt>
<dd class="tag-version"><ul class="dummy"><li>0.0.0</li></ul></dd>
<dt class="tag-since">Since:</dt>
<dd class="tag-since"><ul class="dummy"><li>0.0.0</li></ul></dd>
</dl>
<div class="description">
Construct a new LEEF formating object with user options
</div>
<h5>Parameters:</h5>
<table class="params">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Attributes</th>
<th class="last">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="name"><code>options</code></td>
<td class="type">
<span class="param-type">object</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="description last">Options object
<h6>Properties</h6>
<table class="params">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Attributes</th>
<th>Default</th>
<th class="last">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="name"><code>vendor</code></td>
<td class="type">
<span class="param-type">string</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>'unknown'</code>
</td>
<td class="description last">The vendor of the system that
genrated the event being reported</td>
</tr>
<tr>
<td class="name"><code>product</code></td>
<td class="type">
<span class="param-type">string</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>'unknown'</code>
</td>
<td class="description last">The product name of the
system that genrated the event being reported</td>
</tr>
<tr>
<td class="name"><code>version</code></td>
<td class="type">
<span class="param-type">string</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>'unknown'</code>
</td>
<td class="description last">The version name of the
system that genrated the event being reported</td>
</tr>
<tr>
<td class="name"><code>eventId</code></td>
<td class="type">
<span class="param-type">string</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>'unknown'</code>
</td>
<td class="description last">The eventId of the
system that genrated the event being reported</td>
</tr>
<tr>
<td class="name"><code>attrabute</code></td>
<td class="type">
<span class="param-type">object</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
</td>
<td class="description last">LEEF message attrabutes which
defualts to all base attrabutes with null values, new attrabutes should
be added as new elements to this object</td>
</tr>
<tr>
<td class="name"><code>syslogHeader</code></td>
<td class="type">
<span class="param-type">boolean</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>'true'</code>
</td>
<td class="description last">Should the LEEF message
include a Syslog header with Timestamp and source</td>
</tr>
<tr>
<td class="name"><code>server</code></td>
<td class="type">
<span class="param-type">Syslog</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>false</code>
</td>
<td class="description last">A <a href="module-SyslogPro-Syslog.html"> Syslog server connection</a> that should be used to send messages directly
from this class. @see SyslogPro~Syslog</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<h5>Requires:</h5>
<ul>
<li>module:moment</li>
</ul>
</div>
<h3 class="subsection-title">Requires</h3>
<ul>
<li>module:moment</li>
</ul>
<h3 class="subsection-title">Members</h3>
<h4 class="name" id="attrabutes"><span class="type-signature"></span>attrabutes<span class="type-signature"> :object</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1743">line 1743</a>
</li></ul></dd>
</dl>
<h5>Type:</h5>
<ul>
<li>
<span class="param-type">object</span>
</li>
</ul>
<h4 class="name" id="constructor__"><span class="type-signature">(private) </span>constructor__<span class="type-signature"></span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1729">line 1729</a>
</li></ul></dd>
</dl>
<h4 class="name" id="eventId"><span class="type-signature"></span>eventId<span class="type-signature"> :string</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1738">line 1738</a>
</li></ul></dd>
</dl>
<h5>Type:</h5>
<ul>
<li>
<span class="param-type">string</span>
</li>
</ul>
<h4 class="name" id="product"><span class="type-signature"></span>product<span class="type-signature"> :string</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1734">line 1734</a>
</li></ul></dd>
</dl>
<h5>Type:</h5>
<ul>
<li>
<span class="param-type">string</span>
</li>
</ul>
<h4 class="name" id="server"><span class="type-signature">(private) </span>server<span class="type-signature"></span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1794">line 1794</a>
</li></ul></dd>
</dl>
<h4 class="name" id="syslogHeader"><span class="type-signature"></span>syslogHeader<span class="type-signature"> :boolean</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1740">line 1740</a>
</li></ul></dd>
</dl>
<h5>Type:</h5>
<ul>
<li>
<span class="param-type">boolean</span>
</li>
</ul>
<h4 class="name" id="vendor"><span class="type-signature"></span>vendor<span class="type-signature"> :string</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1732">line 1732</a>
</li></ul></dd>
</dl>
<h5>Type:</h5>
<ul>
<li>
<span class="param-type">string</span>
</li>
</ul>
<h4 class="name" id="version"><span class="type-signature"></span>version<span class="type-signature"> :string</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1736">line 1736</a>
</li></ul></dd>
</dl>
<h5>Type:</h5>
<ul>
<li>
<span class="param-type">string</span>
</li>
</ul>
<h3 class="subsection-title">Methods</h3>
<h4 class="name" id="buildMessage"><span class="type-signature"></span>buildMessage<span class="signature">()</span><span class="type-signature"> &rarr; {Promise}</span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1805">line 1805</a>
</li></ul></dd>
</dl>
<div class="description">
Build a formated message
</div>
<h5>Returns:</h5>
<div class="param-desc">
- string with formated message
</div>
<dl class="param-type">
<dt>
Type
</dt>
<dd>
<span class="param-type">Promise</span>
</dd>
</dl>
<h4 class="name" id="send"><span class="type-signature"></span>send<span class="signature">(options<span class="signature-attributes">opt</span>)</span><span class="type-signature"></span></h4>
<dl class="details">
<dt class="tag-source">Source:</dt>
<dd class="tag-source"><ul class="dummy"><li>
<a href="index.js.html">index.js</a>, <a href="index.js.html#line1833">line 1833</a>
</li></ul></dd>
</dl>
<h5>Parameters:</h5>
<table class="params">
<thead>
<tr>
<th>Name</th>
<th>Type</th>
<th>Attributes</th>
<th>Default</th>
<th class="last">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="name"><code>options</code></td>
<td class="type">
<span class="param-type">Syslog</span>
</td>
<td class="attributes">
&lt;optional><br>
</td>
<td class="default">
<code>false</code>
</td>
<td class="description last">A <a href="module-SyslogPro-Syslog.html"> Syslog server connection</a> that should be used to send messages directly
from this class. @see SyslogPro~Syslog</td>
</tr>
</tbody>
</table>
</article>
</section>
</div>
<br class="clear">
<footer>
Documentation generated by <a href="https://github.com/jsdoc3/jsdoc">JSDoc 3.5.5</a> on Tue Sep 25 2018 18:22:00 GMT+0000 (Coordinated Universal Time) using the <a href="https://github.com/clenemt/docdash">docdash</a> theme.
</footer>
<script>prettyPrint();</script>
<script src="scripts/linenumber.js"></script>
</body>
</html>