Skip to content

Commit 151b936

Browse files
MoonBow-1MoonBow-1
authored
Add PowerPlatformAdminActivity support (#64)
* Implement PowerPlatformAdminActivityType and unit tests for it * Fix JSON key value for PowerPAA files * Add PowerPlatformAdminActivityType support to NLFPlugin.syslogMessage - Includes unit test for this * Add ValidKey to PowerPlatformAdminActivityType * Use Fakes for PowerPlatformAdminActivityTypeTest.testIdealCase
1 parent a921dfd commit 151b936

6 files changed

Lines changed: 564 additions & 0 deletions

File tree

‎src/main/java/com/teragrep/nlf_01/NLFPlugin.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,9 @@ else if (jsonObject.getString("Type").equals("LogicAppWorkflowRuntime")) {
124124
else if (jsonObject.getString("Type").equals("PowerAutomateActivity")) {
125125
eventTypes.add(new PowerAutomateActivityType(parsedEvent, realHostname));
126126
}
127+
else if (jsonObject.getString("Type").equals("PowerPlatformAdminActivity")) {
128+
eventTypes.add(new PowerPlatformAdminActivityType(parsedEvent, realHostname));
129+
}
127130
else if (jsonObject.getString("Type").endsWith("fluent_audit_log_events_CL")) {
128131
eventTypes.add(new CCType(parsedEvent, realHostname));
129132
}

‎src/main/java/com/teragrep/nlf_01/types/PowerPlatformAdminActivityType.java‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
/*
2+
* Teragrep Neon log format plugin for AKV_01
3+
* Copyright (C) 2025 Suomen Kanuuna Oy
4+
*
5+
* This program is free software: you can redistribute it and/or modify
6+
* it under the terms of the GNU Affero General Public License as published by
7+
* the Free Software Foundation, either version 3 of the License, or
8+
* (at your option) any later version.
9+
*
10+
* This program is distributed in the hope that it will be useful,
11+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
12+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13+
* GNU Affero General Public License for more details.
14+
*
15+
* You should have received a copy of the GNU Affero General Public License
16+
* along with this program. If not, see <https://www.gnu.org/licenses/>.
17+
*
18+
*
19+
* Additional permission under GNU Affero General Public License version 3
20+
* section 7
21+
*
22+
* If you modify this Program, or any covered work, by linking or combining it
23+
* with other code, such other code is not for that reason alone subject to any
24+
* of the requirements of the GNU Affero GPL version 3 as long as this Program
25+
* is the same Program as licensed from Suomen Kanuuna Oy without any additional
26+
* modifications.
27+
*
28+
* Supplemented terms under GNU Affero General Public License version 3
29+
* section 7
30+
*
31+
* Origin of the software must be attributed to Suomen Kanuuna Oy. Any modified
32+
* versions must be marked as "Modified version of" The Program.
33+
*
34+
* Names of the licensors and authors may not be used for publicity purposes.
35+
*
36+
* No rights are granted for use of trade names, trademarks, or service marks
37+
* which are in The Program if any.
38+
*
39+
* Licensee must indemnify licensors and authors for any liability that these
40+
* contractual assumptions impose on licensors and authors.
41+
*
42+
* To the extent this program is licensed as part of the Commercial versions of
43+
* Teragrep, the applicable Commercial License may apply to this file if you as
44+
* a licensee so wish it.
45+
*/
46+
package com.teragrep.nlf_01.types;
47+
48+
import com.teragrep.akv_01.event.ParsedEvent;
49+
import com.teragrep.akv_01.plugin.PluginException;
50+
import com.teragrep.nlf_01.PropertiesJson;
51+
import com.teragrep.nlf_01.util.ASCIIString;
52+
import com.teragrep.nlf_01.util.MD5Hash;
53+
import com.teragrep.nlf_01.util.ResourceId;
54+
import com.teragrep.nlf_01.util.ValidKey;
55+
import com.teragrep.nlf_01.util.ValidRFC5424AppName;
56+
import com.teragrep.nlf_01.util.ValidRFC5424Hostname;
57+
import com.teragrep.nlf_01.util.ValidRFC5424Timestamp;
58+
import com.teragrep.nlf_01.util.ValidStringKey;
59+
import com.teragrep.rlo_14.Facility;
60+
import com.teragrep.rlo_14.SDElement;
61+
import com.teragrep.rlo_14.Severity;
62+
import jakarta.json.JsonObject;
63+
import java.time.Instant;
64+
import java.util.HashSet;
65+
import java.util.Set;
66+
import java.util.UUID;
67+
68+
public final class PowerPlatformAdminActivityType implements EventType {
69+
70+
private final ParsedEvent parsedEvent;
71+
private final String realHostname;
72+
73+
public PowerPlatformAdminActivityType(final ParsedEvent parsedEvent, final String realHostname) {
74+
this.parsedEvent = parsedEvent;
75+
this.realHostname = realHostname;
76+
}
77+
78+
@Override
79+
public Severity severity() {
80+
return Severity.NOTICE;
81+
}
82+
83+
@Override
84+
public Facility facility() {
85+
return Facility.AUDIT;
86+
}
87+
88+
@Override
89+
public String hostname() throws PluginException {
90+
final JsonObject record = parsedEvent.asJsonStructure().asJsonObject();
91+
92+
final ValidKey<String> validKey = new ValidStringKey(record, "_Internal_WorkspaceResourceId");
93+
final String resourceId = validKey.value();
94+
95+
return new ValidRFC5424Hostname(
96+
"md5-".concat(new MD5Hash(resourceId).md5().concat("-").concat(new ASCIIString(new ResourceId(resourceId).resourceName()).withNonAsciiCharsRemoved()))
97+
).hostnameWithInvalidCharsRemoved();
98+
99+
}
100+
101+
@Override
102+
public String appName() throws PluginException {
103+
final JsonObject record = parsedEvent.asJsonStructure().asJsonObject();
104+
105+
final ValidKey<String> validKey = new ValidStringKey(record, "EnvironmentId");
106+
107+
// Prepend 'PowerPAA_' before the actual environment name. PAA standing for PlatformAdminActivity
108+
return new ValidRFC5424AppName(new ASCIIString("PowerPAA_" + validKey.value()).withNonAsciiCharsRemoved())
109+
.appName();
110+
}
111+
112+
@Override
113+
public long timestamp() throws PluginException {
114+
final JsonObject record = parsedEvent.asJsonStructure().asJsonObject();
115+
116+
final ValidKey<String> validKey = new ValidStringKey(record, "TimeGenerated");
117+
118+
return new ValidRFC5424Timestamp(validKey.value()).validTimestamp();
119+
}
120+
121+
@Override
122+
public Set<SDElement> sdElements() throws PluginException {
123+
final Set<SDElement> elems = new HashSet<>();
124+
final String time;
125+
if (!parsedEvent.enqueuedTimeUtc().isStub()) {
126+
time = parsedEvent.enqueuedTimeUtc().zonedDateTime().toString();
127+
}
128+
else {
129+
time = "";
130+
}
131+
132+
final String fullyQualifiedNamespace;
133+
final String eventHubName;
134+
final String partitionId;
135+
final String consumerGroup;
136+
if (!parsedEvent.partitionCtx().isStub()) {
137+
fullyQualifiedNamespace = String
138+
.valueOf(parsedEvent.partitionCtx().asMap().getOrDefault("FullyQualifiedNamespace", ""));
139+
eventHubName = String.valueOf(parsedEvent.partitionCtx().asMap().getOrDefault("EventHubName", ""));
140+
partitionId = String.valueOf(parsedEvent.partitionCtx().asMap().getOrDefault("PartitionId", ""));
141+
consumerGroup = String.valueOf(parsedEvent.partitionCtx().asMap().getOrDefault("ConsumerGroup", ""));
142+
}
143+
else {
144+
fullyQualifiedNamespace = "";
145+
eventHubName = "";
146+
partitionId = "";
147+
consumerGroup = "";
148+
}
149+
150+
elems
151+
.add(new SDElement("aer_02_partition@48577").addSDParam("fully_qualified_namespace", fullyQualifiedNamespace).addSDParam("eventhub_name", eventHubName).addSDParam("partition_id", partitionId).addSDParam("consumer_group", consumerGroup));
152+
153+
elems
154+
.add(new SDElement("event_id@48577").addSDParam("uuid", UUID.randomUUID().toString()).addSDParam("hostname", realHostname).addSDParam("unixtime", Instant.now().toString()).addSDParam("id_source", "aer_02"));
155+
156+
final String partitionKey;
157+
if (!parsedEvent.systemProperties().isStub()) {
158+
partitionKey = String.valueOf(parsedEvent.systemProperties().asMap().getOrDefault("PartitionKey", ""));
159+
}
160+
else {
161+
partitionKey = "";
162+
}
163+
164+
final String offset;
165+
if (!parsedEvent.offset().isStub()) {
166+
offset = parsedEvent.offset().value();
167+
}
168+
else {
169+
offset = "";
170+
}
171+
172+
elems
173+
.add(new SDElement("aer_02_event@48577").addSDParam("offset", offset).addSDParam("enqueued_time", time).addSDParam("partition_key", partitionKey).addSDParam("properties", new PropertiesJson(parsedEvent.properties()).toJsonObject().toString()));
174+
175+
elems
176+
.add(new SDElement("aer_02@48577").addSDParam("timestamp_source", time.isEmpty() ? "generated" : "timeEnqueued"));
177+
178+
elems.add(new SDElement("nlf_01@48577").addSDParam("eventType", this.getClass().getSimpleName()));
179+
180+
return elems;
181+
}
182+
183+
@Override
184+
public String msgId() throws PluginException {
185+
final String sequenceNumber;
186+
if (!parsedEvent.systemProperties().isStub()) {
187+
sequenceNumber = String.valueOf(parsedEvent.systemProperties().asMap().getOrDefault("SequenceNumber", ""));
188+
}
189+
else {
190+
sequenceNumber = "";
191+
}
192+
return sequenceNumber;
193+
}
194+
195+
@Override
196+
public String msg() throws PluginException {
197+
return parsedEvent.asString();
198+
}
199+
}

‎src/test/java/com/teragrep/nlf_01/NLFPluginTest.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -810,6 +810,62 @@ void logicAppWorkflowRuntimeTest() {
810810
Assertions.assertTrue(sdElementMap.get("aer_02_event@48577").containsKey("properties"));
811811
}
812812

813+
@Test
814+
void testPowerPlatformAdminActivityType() {
815+
final String json = Assertions
816+
.assertDoesNotThrow(
817+
() -> Files.readString(Paths.get("src/test/resources/powerplatformadminactivity.json"))
818+
);
819+
final ParsedEvent parsedEvent = new ParsedEventFactory(
820+
new UnparsedEventImpl(json, new EventPartitionContextImpl(new HashMap<>()), new EventPropertiesImpl(new HashMap<>()), new EventSystemPropertiesImpl(new HashMap<>()), new EnqueuedTimeImpl("2020-01-01T00:00:00"), new EventOffsetImpl("0"))
821+
).parsedEvent();
822+
823+
final NLFPlugin plugin = new NLFPlugin(new FakeSourceable());
824+
final List<SyslogMessage> syslogMessages = Assertions
825+
.assertDoesNotThrow(() -> plugin.syslogMessage(parsedEvent));
826+
Assertions.assertEquals(1, syslogMessages.size());
827+
828+
final SyslogMessage syslogMessage = syslogMessages.get(0);
829+
Assertions
830+
.assertEquals(
831+
"{\n" + " \"ActorName\": \"[email protected]\",\n"
832+
+ " \"ActorUserId\": \"bb41a487-309b-4d21-9ab8-2a8b948b2d18\",\n"
833+
+ " \"ActorUserType\": \"Admin\",\n" + " \"EnvironmentId\": \"Environment-01\",\n"
834+
+ " \"EventOriginalType\": \"OriginalType\",\n"
835+
+ " \"EventOriginalUid\": \"bb41a487-309b-4d21-9ab8-2a8b948b2d18\",\n"
836+
+ " \"EventResult\": \"Succeeded\",\n"
837+
+ " \"OrganizationId\": \"bb41a487-309b-4d21-9ab8-2a8b948b2d18\",\n"
838+
+ " \"Properties\": \"{}\",\n" + " \"PropertyCollection\": \"{}\",\n"
839+
+ " \"RecordType\": \"exchangeAdmin\",\n"
840+
+ " \"RequiresCustomerKeyEncryption\": true,\n" + " \"SourceSystem\": \"Azure\",\n"
841+
+ " \"Type\": \"PowerPlatformAdminActivity\",\n"
842+
+ " \"TenantId\": \"bb41a487-309b-4d21-9ab8-2a8b948b2d18\",\n"
843+
+ " \"TimeGenerated\": \"2025-10-06T00:00:00.0000000Z\",\n"
844+
+ " \"Workload\": \"Service1\",\n"
845+
+ " \"_ItemId\": \"bb41a487-309b-4d21-9ab8-2a8b948b2d18\",\n"
846+
+ " \"_ResourceId\": \"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}\",\n"
847+
+ " \"_SubscriptionId\": \"bb41a487-309b-4d21-9ab8-2a8b948b2d18\",\n"
848+
+ " \"_TimeReceived\": \"2025-10-06T00:00:00.0000000Z\",\n"
849+
+ " \"_Internal_WorkspaceResourceId\": \"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}\"\n"
850+
+ "}",
851+
syslogMessage.getMsg()
852+
);
853+
Assertions.assertEquals("md5-0ded52ef915af563e25778bf26b0f129-resourceName", syslogMessage.getHostname());
854+
Assertions.assertEquals("PowerPAA_Environment-01", syslogMessage.getAppName());
855+
Assertions.assertEquals("2025-10-06T00:00:00Z", syslogMessage.getTimestamp());
856+
857+
final Map<String, Map<String, String>> sdElementMap = syslogMessage
858+
.getSDElements()
859+
.stream()
860+
.collect(Collectors.toMap((SDElement::getSdID), (sdElem) -> sdElem.getSdParams().stream().collect(Collectors.toMap(SDParam::getParamName, SDParam::getParamValue))));
861+
862+
Assertions.assertEquals(1, sdElementMap.get("nlf_01@48577").size());
863+
Assertions
864+
.assertEquals(PowerPlatformAdminActivityType.class.getSimpleName(), sdElementMap.get("nlf_01@48577").get("eventType"));
865+
866+
Assertions.assertTrue(sdElementMap.get("aer_02_event@48577").containsKey("properties"));
867+
}
868+
813869
@Test
814870
void unexpectedType() {
815871
final String json = Assertions

0 commit comments

Comments
 (0)