brolog 0.0.2

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 88784c0ec15fac09e8315787e8ce49934210e2f8
+  data.tar.gz: 478b77128ba8d347f40931e513a36821340a9281
+SHA512:
+  metadata.gz: b5dbf9479673c0817ade7b562979b843ed6459a89bc3813760c2394f282b862bbe2e21c3c28ea5581bd6d229a649dfcf2ed2506269866e7badf7ecc6c2dd2f7d
+  data.tar.gz: 78a6e1187a2c031e39f94d0dd7f663f9f0c8069c5d568507af008af5ad24144a7c4a427b45ab4892ad1ffa48f08c7d777f376c5be992d1f7c316d6d5748572ad

data/lib/brolog.rb

@@ -0,0 +1,52 @@
+class Brolog
+	@@bro_log_directory = "/usr/local/bro/logs/current/"
+
+# Class methods
+	def self.set_log_directory(location="/usr/local/bro/logs/current/")
+		@@bro_log_directory = location
+	end
+
+	def self.version
+		return "0.0.2"
+	end
+
+#Instance methods
+	def initialize(log = "conn.log")
+		@this_log = log
+		@log_fields = Hash.new
+		self.get_log_fields
+	end
+
+	def get_log_fields
+		file = File.open(@@bro_log_directory + @this_log, "r") or return "Could not open #{@@bro_log_directory+@log}!"
+		@separator = file.gets.gsub(/#separator /,"").chomp.gsub("\\","0").hex.chr
+		@set_separator = file.gets.gsub(/#set_separator\t/,"").chomp
+		@empty_field = file.gets.gsub(/#empty_field\t/,"").chomp
+		@unset_field = file.gets.gsub(/#unset_field\t/,"").chomp
+		@path = file.gets.gsub(/#path\t/, "").chomp
+		@open = file.gets.gsub(/#open\t/, "").chomp
+		@fields = file.gets.gsub(/#fields\t/, "").chomp
+		@types = file.gets.gsub(/#types\t/, "").chomp
+
+		types = @types.split(@separator)
+		puts types.count
+		puts types
+		@fields.split(@separator).each_with_index { |name,x| @log_fields[name.to_s] = types[x] }
+		@rows = Array.new
+		while line = file.gets do
+			fields = line.chomp.split(@separator)
+			a=Hash.new
+			@log_fields.keys.each_with_index { |key,idx| a[key] = fields[idx] }
+			@rows << a
+		end
+		file.close
+	end
+
+	def rows
+		@rows
+	end
+
+	def fields
+		@log_fields
+	end
+end

metadata

@@ -0,0 +1,49 @@
+--- !ruby/object:Gem::Specification
+name: brolog
+version: !ruby/object:Gem::Version
+  version: 0.0.2
+platform: ruby
+authors:
+- David Hoelzer
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-07-26 00:00:00.000000000 Z
+dependencies: []
+description: The Bro IDS is a phenomenal event driven network analysis system but
+  interacting with the logs directly can be irritating. Even with the bro-cut tool,
+  more effort is required than should be necessary, especially if you'd like to parse
+  and interact with the logs within Ruby or some other language. While there are a
+  few gems out there that parse specific Bro logs, brolog supports any arbitrary Bro
+  log. This is absolutely Alpha software.
+email: dhoelzer@enclaveforensics.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/brolog.rb
+homepage: http://rubygems.org/gems/brolog
+licenses:
+- GPL
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: Gem for parsing and interacting with arbitrary Bro logs
+test_files: []