Merge branch 'develop' into csa-1.12.0-cdh-7.1.9

Author: stas-panasiuk

.github/workflows/build_and_test.yml

@@ -6,7 +6,7 @@
 # separate terms of service, privacy policy, and support
 # documentation.
 
-name: Java 8 Build and Test
+name: Build and Test
 
 on:
   push:
@@ -15,7 +15,7 @@ on:
     branches: [ "develop" ]
 
 jobs:
-  build_and_test_java8:
+  build_and_test_java:
     runs-on: ubuntu-latest
     container: maven:3-eclipse-temurin-8
     steps:

README.md

@@ -1,6 +1,6 @@
 # Cybersec Toolkit
 
-[![Java CI with Maven](https://github.com/cloudera/cybersec/actions/workflows/build_and_test.yml/badge.svg)](https://github.com/cloudera/cybersec/actions/workflows/build_and_test.yml)
+[![Build and Test](https://github.com/cloudera/cybersec/actions/workflows/build_and_test.yml/badge.svg)](https://github.com/cloudera/cybersec/actions/workflows/build_and_test.yml)
 
 ## Overview
 Enterprises deploy many point solutions to defend their networks.  These point solutions provide a wealth of data about the enterprise assets and networks but it is difficult to provide analytics on this data because there is no common repository and the events are in different formats.  The Cybersec Toolkit is a pipeline that ingests, correlates and prepares cybersecurity data for analytics.  The Cyber Toolkit leverages the Cloudera Data Platform to build a Security Data Lakehouse.

flink-cyber/caracal-parser/src/main/java/com/cloudera/cyber/caracal/SplittingFlatMapFunction.java

@@ -15,7 +15,7 @@
 import com.cloudera.cyber.Message;
 import com.cloudera.cyber.SignedSourceKey;
 import com.cloudera.cyber.parser.MessageToParse;
-import com.cloudera.cyber.rules.engines.JavascriptEngineBuilder;
+import com.cloudera.cyber.rules.RuleType;
 import com.cloudera.cyber.rules.engines.RuleEngine;
 import com.google.common.collect.Streams;
 import com.jayway.jsonpath.DocumentContext;
@@ -110,9 +110,7 @@ public void open(Configuration parameters) throws Exception {
         }
 
         if(config.getTimestampFunction() != null & !config.getTimestampFunction().isEmpty()) {
-            this.engine = new JavascriptEngineBuilder()
-                    .script("")
-                    .build();
+            this.engine = RuleType.JS.engine("");
 
             this.setTimestampFunction(config.getTimestampFunction());
         } else {

flink-cyber/data-management/pom.xml

@@ -27,7 +27,4 @@
         <module>retention-cleaner</module>
     </modules>
 
-    <properties>
-        <java.version>1.8</java.version>
-    </properties>
 </project>

flink-cyber/data-management/retention-cleaner/pom.xml

@@ -23,8 +23,6 @@
 
     <properties>
         <main.class>com.cloudera.cyber.pruner.Pruner</main.class>
-        <junit5.version>5.7.0</junit5.version>
-        <java.version>1.8</java.version>
     </properties>
 
     <artifactId>retention-cleaner</artifactId>
@@ -59,7 +57,6 @@
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>${junit5.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>

flink-cyber/flink-alert-scoring/src/main/java/com/cloudera/cyber/scoring/ScoringProcessFunction.java

@@ -63,9 +63,13 @@ protected void processMessages(Message message, Collector<ScoredMessage> collect
                     .map(r -> {
                         Map<String, Object> results = r.apply(message);
                         if (results != null) {
+                            Object score = results.get(RESULT_SCORE);
+                            if (!(score instanceof Double)){
+                                score = new Double(String.valueOf(score));
+                            }
                             return Scores.builder()
                                     .ruleId(r.getId())
-                                    .score((Double) results.get(RESULT_SCORE))
+                                    .score((Double) score)
                                     .reason((String) results.get(RESULT_REASON))
                                     .build();
                         } else {

flink-cyber/flink-indexing/flink-indexing-elastic/pom.xml

@@ -25,7 +25,6 @@
 
     <properties>
         <main.class>com.cloudera.cyber.indexing.ElasticJobKafka</main.class>
-        <java.version>1.8</java.version>
     </properties>
 
     <dependencies>

flink-cyber/flink-indexing/flink-indexing-hive/pom.xml

@@ -25,7 +25,6 @@
 
     <properties>
         <main.class>com.cloudera.cyber.indexing.hive.HiveJobKafka</main.class>
-        <java.version>1.8</java.version>
         <hive.version>3.1.3000.${cdh.version}</hive.version>
     </properties>
 

flink-cyber/flink-indexing/flink-indexing-parquet/pom.xml

@@ -25,7 +25,6 @@
 
     <properties>
         <main.class>com.cloudera.cyber.indexing.ParquetJobKafka</main.class>
-        <java.version>1.8</java.version>
     </properties>
 
     <dependencies>

flink-cyber/flink-indexing/flink-indexing-solr/pom.xml

@@ -25,7 +25,6 @@
 
     <properties>
         <main.class>com.cloudera.cyber.indexing.SolrJobKafka</main.class>
-        <java.version>1.8</java.version>
     </properties>
 
     <dependencies>