"P4": jfloat})
#datagen = bogusd.Generator()
#datagen.append(bogusd.Point('P1'))
#datagen.append(bogusd.Point('P2'))
#datagen.append(bogusd.Point('P3'))
#datagen.append(bogusd.Point('P4'))
def callback(data_new, data_old):
print("New Data:" + str(data_new))
print("Old Data:" + str(data_old))
def endcallback():
print('Input terminated')
stmt = cep.create_query('select * from BogusEvent(P2 > 2.0).win:length(3)')
stmt.addListener(EventListener(callback))
cep.send_event({"P1": 1.1, "P2": 1.2, "P3": 1.3, "P4": 1.4},
"BogusEvent")
cep.send_event({"P1": 2.1, "P2": 2.2, "P3": 2.3, "P4": 2.4},
"BogusEvent")
cep.send_event({"P1": 3.1, "P2": 3.2, "P3": 3.3, "P4": 3.4},
"BogusEvent")
cep.send_event({"P1": 4.1, "P2": 4.2, "P3": 4.3, "P4": 4.4},
"BogusEvent")
cep.send_event({"P1": 5.1, "P2": 5.2, "P3": 5.3, "P4": 5.4},
"BogusEvent")
cep.send_event({"P1": 6.1, "P2": 6.2, "P3": 6.3, "P4": 6.4},
"BogusEvent")
cep.send_event({"P1": 7.1, "P2": 7.2, "P3": 7.3, "P4": 7.4},
"Status": jstr,
"TargetUserName": jstr,
"syslog_message": jstr,
"syslog_hostname": jstr,
"syslog_program": jstr})
def callback(stmtname, data_new, data_old):
print "#" * 30
print "\n%s" % stmtname
if data_old:
print("Old Data:" + str(data_old))
if data_new:
print("New Data:" + str(data_new))
stmtname = 'EventLog: Bruteforce blocked accounts'
stmt = cep.create_query('select * from Events(eventlog_id = 4776 and Status = "0xc0000234").win:time(120 sec) GROUP BY TargetUserName HAVING count(eventlog_id) > 5')
stmt.addListener(EventListener(callback, stmtname))
stmtname = 'EventLog: Account blocked multiple times (5)'
stmt = cep.create_query('select * from Events(eventlog_id = 4740).win:time(24 hours) GROUP BY TargetUserName HAVING count(eventlog_id) > 5')
stmt.addListener(EventListener(callback, stmtname))
stmtname = 'Syslog: Linux SSH bruteforce'
stmt = cep.create_query('select * from Events(syslog_message like "Failed password for%").win:time(120 sec) GROUP BY syslog_hostname HAVING count(syslog_message) > 5')
stmt.addListener(EventListener(callback, stmtname))
while True:
for item in pubsub.listen():
if item['type'] != 'subscribe':
event = json.loads(item['data'])
cep.send_event(event, "Events")
