File Coverage

blib/lib/XML/IODEF/Simple.pm

Criterion	Covered	Total	%
statement	12	67	17.9
branch	0	38	0.0
condition	0	21	0.0
subroutine	4	5	80.0
pod			n/a
total	16	131	12.2

package XML::IODEF::Simple;

use 5.008008;
use strict;
use warnings;

our $VERSION = '0.02';
$VERSION = eval $VERSION;  # see L

require XML::IODEF;
use Module::Pluggable require => 1;

# Preloaded methods go here.

sub new {
    my ($class,$info) = @_;

    my $description                 = lc($info->{'description'}) || 'unknown';
    my $confidence                  = $info->{'confidence'};
    my $severity                    = $info->{'severity'};
    my $source                      = $info->{'source'} || 'localhost';
    my $relatedid                   = $info->{'relatedid'};
    my $alternativeid               = $info->{'alternativeid'};
    my $alternativeid_restriction   = $info->{'alternativeid_restriction'} || 'private';
    my $purpose                     = $info->{'purpose'} || 'mitigation';
    my $reporttime                  = $info->{'reporttime'};
    my $lang                        = $info->{'lang'} || $info->{'language'} || 'EN';

    my $dt = $info->{'detecttime'};
    # default it to the hour
    unless($dt){
        require DateTime;
        $dt = DateTime->from_epoch(epoch => time());
        $dt = $dt->ymd().'T'.$dt->hour().':00:00Z';
    }
    if($dt =~ /^(\d{4})(\d{2})(\d{2})$/){
        $dt = $1.'-'.$2.'-'.$3.'T00:00:00Z';
    }
    $info->{'detecttime'} = $dt;

    unless($reporttime){
        require DateTime;
        $reporttime = DateTime->from_epoch(epoch => time());
        $reporttime = $reporttime->ymd().'T00:00:00Z';
    }
    if($reporttime =~ /^(\d{4})(\d{2})(\d{2})$/){
        $reporttime = $1.'-'.$2.'-'.$3.'T00:00:00Z';
    }

    my $iodef = XML::IODEF->new();
    $iodef->add('Incidentlang',$lang);
    $iodef->add('Incidentpurpose',$purpose);
    foreach($class->plugins()){
        if($_->prepare($info)){
            $iodef = $_->convert($info,$iodef);
        }
    }

    if($info->{'IncidentID'}){
        my $xid = $info->{'IncidentID'};
        $iodef->add('IncidentIncidentIDrestriction',$xid->{'restriction'}) if($xid->{'restriction'});
        $iodef->add('IncidentIncidentIDname',$xid->{'name'}) if($xid->{'name'});
        $iodef->add('IncidentIncidentIDinstance',$xid->{'instance'}) if($xid->{'instance'});
        $iodef->add('IncidentIncidentID',$xid->{'content'}) if($xid->{'content'});
    } else {
        $iodef->add('IncidentIncidentIDname',$source) if($source);
    }
    $iodef->add('IncidentReportTime',$reporttime) if($reporttime);
    $iodef->add('IncidentDetectTime',$dt) if($dt);
    $iodef->add('IncidentRelatedActivityIncidentID',$relatedid) if($relatedid);
    if($alternativeid){
        $iodef->add('IncidentAlternativeIDIncidentID',$alternativeid);
        $iodef->add('IncidentAlternativeIDIncidentIDrestriction',$alternativeid_restriction);
    }
    $iodef->add('Incidentrestriction',$info->{'restriction'} || 'private');
    $iodef->add('IncidentDescription',$description) if($description);
    if($confidence){
        $iodef->add('IncidentAssessmentConfidencerating','numeric');
        $iodef->add('IncidentAssessmentConfidence',$confidence);
    }
    my $impact = $info->{'impact'};
    $iodef->add('IncidentAssessmentImpact',$impact) if($impact && !$iodef->get('IncidentAssessmentImpact'));

    if(!$iodef->get('IncidentAssessmentImpactseverity') && $severity && $severity =~ /(low|medium|high)/){
        warn 'adding sev';
        $iodef->add('IncidentAssessmentImpactseverity',$severity);
    }

    return $iodef;
}


1;
__END__