SIEM json corelation engine

siem_corelation.cpp

#include <iostream>
#include <fstream>
#include <vector>
#include <unordered_map>
#include <functional>
#include <cstdlib>
#include <nlohmann/json.hpp>

using json = nlohmann::json;

struct CorrelationRule {
    int rule_id;
    std::string rule_name;
    std::vector<std::string> conditions;
    std::string action;
};

class CorrelationEngine {
public:
    void AddRule(const CorrelationRule& rule) {
        rules.push_back(rule);
    }

    void ProcessEvent(const std::unordered_map<std::string, std::string>& event) {
        for (const auto& rule : rules) {
            if (rule.evaluate(event)) {
                rule.executeAction(event);
            }
        }
    }

private:
    std::vector<CorrelationRule> rules;
};

bool evaluateCondition(const std::unordered_map<std::string, std::string>& event, const std::string& condition) {
    return event.find(condition) != event.end();
}

void executeProgram(const std::string& programPath) {
    std::system(programPath.c_str());
}

int main() {
    // Read rules from JSON file
    std::ifstream rulesFile("rules.json");
    if (!rulesFile.is_open()) {
        std::cerr << "Failed to open rules.json" << std::endl;
        return 1;
    }

    json rulesJson;
    rulesFile >> rulesJson;
    rulesFile.close();

    // Create correlation engine
    CorrelationEngine correlationEngine;

    // Add rules to the engine
    for (const auto& ruleJson : rulesJson) {
        CorrelationRule rule {
            .rule_id = ruleJson["rule_id"],
            .rule_name = ruleJson["rule_name"],
            .conditions = ruleJson["conditions"],
            .action = ruleJson["action"]
        };

        correlationEngine.AddRule(rule);
    }

    // Simulate events
    std::unordered_map<std::string, std::string> event1 {
        {"source_ip", "192.168.1.10"},
        {"destination_ip", "10.0.0.5"},
        {"event_type", "Login"}
    };
    std::unordered_map<std::string, std::string> event2 {
        {"username", "admin"},
        {"event_type", "Login"}
    };
    std::unordered_map<std::string, std::string> event3 {
        {"event_type", "Logout"}
    };

    // Process events
    correlationEngine.ProcessEvent(event1);
    correlationEngine.ProcessEvent(event2);
    correlationEngine.ProcessEvent(event3);

    return 0;
}

siem_corelation.go

package main

import (
    "encoding/json"
    "fmt"
    "io/ioutil"
    "log"
    "os"
    "os/exec"
)

type CorrelationRule struct {
    RuleID     int      `json:"rule_id"`
    RuleName   string   `json:"rule_name"`
    Conditions []string `json:"conditions"`
    Action     string   `json:"action"`
}

type CorrelationEngine struct {
    Rules []CorrelationRule
}

func (ce *CorrelationEngine) AddRule(rule CorrelationRule) {
    ce.Rules = append(ce.Rules, rule)
}

func (ce *CorrelationEngine) ProcessEvent(event map[string]string) {
    for _, rule := range ce.Rules {
        if rule.evaluate(event) {
            rule.executeAction(event)
        }
    }
}

func (rule CorrelationRule) evaluate(event map[string]string) bool {
    for _, condition := range rule.Conditions {
        if _, ok := event[condition]; !ok {
            return false
        }
    }
    return true
}

func (rule CorrelationRule) executeAction(event map[string]string) {
    cmd := exec.Command(rule.Action)
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr
    if err := cmd.Run(); err != nil {
        log.Println("Failed to execute action:", err)
    }
}

func main() {
    // Read rules from JSON file
    rulesFile, err := ioutil.ReadFile("rules.json")
    if err != nil {
        log.Fatal("Failed to open rules.json:", err)
    }

    var rules []CorrelationRule
    err = json.Unmarshal(rulesFile, &rules)
    if err != nil {
        log.Fatal("Failed to parse rules.json:", err)
    }

    // Create correlation engine
    correlationEngine := CorrelationEngine{}

    // Add rules to the engine
    for _, rule := range rules {
        correlationEngine.AddRule(rule)
    }

    // Simulate events
    event1 := map[string]string{
        "source_ip":       "192.168.1.10",
        "destination_ip":  "10.0.0.5",
        "event_type":      "Login",
    }
    event2 := map[string]string{
        "username":        "admin",
        "event_type":      "Login",
    }
    event3 := map[string]string{
        "event_type":      "Logout",
    }

    // Process events
    correlationEngine.ProcessEvent(event1)
    correlationEngine.ProcessEvent(event2)
    correlationEngine.ProcessEvent(event3)
}

siem_corelation.jl

using JSON

struct CorrelationRule
    rule_id::Int
    rule_name::String
    conditions::Vector{String}
    action::String
end

struct CorrelationEngine
    rules::Vector{CorrelationRule}
end

function add_rule!(ce::CorrelationEngine, rule::CorrelationRule)
    push!(ce.rules, rule)
end

function process_event(ce::CorrelationEngine, event::Dict{String, String})
    for rule in ce.rules
        if evaluate(rule, event)
            execute_action(rule, event)
        end
    end
end

function evaluate(rule::CorrelationRule, event::Dict{String, String})
    for condition in rule.conditions
        if !(condition in keys(event))
            return false
        end
    end
    return true
end

function execute_action(rule::CorrelationRule, event::Dict{String, String})
    run(`$(rule.action)`)
end

# Read rules from JSON file
rules_file = "rules.json"
rules_data = JSON.parsefile(rules_file)

# Create correlation engine
correlation_engine = CorrelationEngine(CorrelationRule[])

# Add rules to the engine
for rule_data in rules_data
    rule = CorrelationRule(
        rule_data["rule_id"],
        rule_data["rule_name"],
        rule_data["conditions"],
        rule_data["action"]
    )
    add_rule!(correlation_engine, rule)
end

# Simulate events
event1 = Dict("source_ip" => "192.168.1.10", "destination_ip" => "10.0.0.5", "event_type" => "Login")
event2 = Dict("username" => "admin", "event_type" => "Login")
event3 = Dict("event_type" => "Logout")

# Process events
process_event(correlation_engine, event1)
process_event(correlation_engine, event2)
process_event(correlation_engine, event3)

siem_corelation.py

import json
import subprocess

class CorrelationRule:
    def __init__(self, rule_id, rule_name, conditions, action):
        self.rule_id = rule_id
        self.rule_name = rule_name
        self.conditions = conditions
        self.action = action

    def evaluate(self, event):
        for condition in self.conditions:
            if condition not in event:
                return False
        return True

    def execute_action(self, event):
        subprocess.run(self.action, shell=True)

class CorrelationEngine:
    def __init__(self):
        self.rules = []

    def add_rule(self, rule):
        self.rules.append(rule)

    def process_event(self, event):
        for rule in self.rules:
            if rule.evaluate(event):
                rule.execute_action(event)

# Read rules from JSON file
with open('rules.json') as file:
    rules_data = json.load(file)

# Create correlation engine
correlation_engine = CorrelationEngine()

# Add rules to the engine
for rule_data in rules_data:
    rule = CorrelationRule(
        rule_data['rule_id'],
        rule_data['rule_name'],
        rule_data['conditions'],
        rule_data['action']
    )
    correlation_engine.add_rule(rule)

# Simulate events
event1 = {
    'source_ip': '192.168.1.10',
    'destination_ip': '10.0.0.5',
    'event_type': 'Login'
}
event2 = {
    'username': 'admin',
    'event_type': 'Login'
}
event3 = {
    'event_type': 'Logout'
}

# Process events
correlation_engine.process_event(event1)
correlation_engine.process_event(event2)
correlation_engine.process_event(event3)