logstash-codec-nmap 0.0.9 → 0.0.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +3 -0
- data/README.md +12 -0
- data/lib/logstash/codecs/nmap.rb +31 -12
- data/logstash-codec-nmap.gemspec +1 -1
- data/spec/codecs/nmap_spec.rb +10 -2
- data/spec/fixtures/ip_down.xml +10 -0
- data/spec/fixtures/nothingup.xml +10 -0
- metadata +19 -16
- data/CONTRIBUTORS +0 -17
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: eb9b854678cab49c0f5832940e7881a0b7211cae
|
|
4
|
+
data.tar.gz: a8fb24f5c1b5e05f0e526e8a90016beebe80483c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 0e7242b4045a0f9a11ef48c23b7da3e840ae87c48545fdb0614c840c7183da3d76670a5dd5e534f7e450db6c30fde240d878801a8208ef334f4df596aa20e854
|
|
7
|
+
data.tar.gz: 46eca983628be28e86aee61adde73a7d775018024e402ac4c7c421935f46e243431bfa3b054a24dfa8a74614796ea1c54f163ae3aacbac6d26d973cf1c764bc9
|
data/CHANGELOG.md
CHANGED
data/README.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# Logstash Plugin
|
|
2
2
|
|
|
3
|
+
[](https://travis-ci.org/logstash-plugins/logstash-codec-nmap)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
|
7
|
+
|
|
8
|
+
@@ -86,4 +85,4 @@ Programming is not a required skill. Whatever you've seen about open source and
|
|
9
|
+
|
|
10
|
+
It is more important to the community that you are able to contribute.
|
|
11
|
+
|
|
12
|
+
+For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.
|
|
13
|
+
-For more information about contributing, see the [CONTRIBUTING](https://github.com/elastic/logstash/blob/master/CONTRIBUTING.md) file.It is more important to the community that you are able to contribute.This is a plugin for [Logstash](https://github.com/elastic/logstash).-Status](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Inputs/job/logstash-plugin-input-rabbitmq-unit/badge/icon)](http://build-eu-00.elastic.co/view/LS%20Plugins/view/LS%20Inputs/job/logstash-plugin-input-rabbitmq-unit/)
|
|
14
|
+
|
|
3
15
|
This is a plugin for [Logstash](https://github.com/elastic/logstash).
|
|
4
16
|
|
|
5
17
|
It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.
|
data/lib/logstash/codecs/nmap.rb
CHANGED
|
@@ -3,12 +3,20 @@ require "logstash/codecs/base"
|
|
|
3
3
|
require "nmap/xml"
|
|
4
4
|
require 'securerandom'
|
|
5
5
|
|
|
6
|
-
# This codec may be used to decode
|
|
7
|
-
#
|
|
6
|
+
# This codec may be used to decode only
|
|
7
|
+
#
|
|
8
|
+
# Event types are listed below
|
|
9
|
+
#
|
|
10
|
+
# `nmap_scan_metadata`: An object containing top level information about the scan, including how many hosts were up, and how many were down. Useful for the case where you need to check if a DNS based hostname does not resolve, where both those numbers will be zero.
|
|
11
|
+
# `nmap_host`: One event is created per host. The full data covering an individual host, including open ports and traceroute information as a nested structure.
|
|
12
|
+
# `nmap_port`: One event is created per host/port. This duplicates data already in `nmap_host`: This was put in for the case where you want to model ports as separate documents in Elasticsearch (which Kibana prefers).
|
|
13
|
+
# `nmap_traceroute_link`: One of these is output per traceroute 'connection', with a `from` and a `to` object describing each hop. Note that traceroute hop data is not always correct due to the fact that each tracing ICMP packet may take a different route. Also very useful for Kibana visualizations.
|
|
8
14
|
|
|
9
15
|
class LogStash::Codecs::Nmap < LogStash::Codecs::Base
|
|
10
16
|
config_name "nmap"
|
|
11
17
|
|
|
18
|
+
# Emit scan metadata
|
|
19
|
+
config :emit_scan_metadata, :validate => :boolean, :default => true
|
|
12
20
|
# Emit all host data as a nested document (including ports + traceroutes) with the type 'nmap_fullscan'
|
|
13
21
|
config :emit_hosts, :validate => :boolean, :default => true
|
|
14
22
|
# Emit each port as a separate document with type 'nmap_port'
|
|
@@ -25,25 +33,36 @@ class LogStash::Codecs::Nmap < LogStash::Codecs::Base
|
|
|
25
33
|
xml = Nmap::XML.parse(data)
|
|
26
34
|
scan_id = SecureRandom.uuid
|
|
27
35
|
|
|
36
|
+
base = {}
|
|
37
|
+
base['arguments'] = xml.scanner.arguments
|
|
38
|
+
base['version'] = xml.scanner.version
|
|
39
|
+
base['scan_id'] = scan_id
|
|
40
|
+
|
|
41
|
+
# This really needs to be put into ruby-nmap
|
|
42
|
+
scan_host_stats = Hash[xml.instance_variable_get(:@doc).xpath('/nmaprun[@scanner="nmap"]/runstats/hosts').first.attributes.map {|k,v| [k,v.value.to_i]}]
|
|
43
|
+
|
|
44
|
+
if @emit_scan_metadata
|
|
45
|
+
yield LogStash::Event.new(base.merge({
|
|
46
|
+
'type' => 'nmap_scan_metadata',
|
|
47
|
+
'host_stats' => scan_host_stats,
|
|
48
|
+
'run_stats' => xml.run_stats.first
|
|
49
|
+
}))
|
|
50
|
+
end
|
|
51
|
+
|
|
28
52
|
xml.hosts.each_with_index do |host,idx|
|
|
29
|
-
# Convert the host to a '
|
|
53
|
+
# Convert the host to a 'host_base' host event
|
|
30
54
|
# This will be used for the later port/hop types
|
|
31
|
-
|
|
55
|
+
host_base = hashify_host(host, xml).merge(base)
|
|
32
56
|
|
|
33
|
-
# Add some scanner-wide attributes
|
|
34
|
-
base['arguments'] = xml.scanner.arguments
|
|
35
|
-
base['version'] = xml.scanner.version
|
|
36
|
-
base['scan_id'] = scan_id
|
|
37
57
|
|
|
38
58
|
# Pull out the detail
|
|
39
59
|
ports = host.ports.map {|p| hashify_port(p)}
|
|
40
60
|
traceroute = hashify_traceroute(host.traceroute)
|
|
41
|
-
|
|
42
61
|
scan_host_id = scan_id + "-h#{idx}"
|
|
43
62
|
|
|
44
63
|
if @emit_ports && ports
|
|
45
64
|
ports.each.with_index do |port,idx|
|
|
46
|
-
yield LogStash::Event.new(
|
|
65
|
+
yield LogStash::Event.new(host_base.merge(
|
|
47
66
|
'type' => 'nmap_port',
|
|
48
67
|
'port' => port,
|
|
49
68
|
'scan_host_id' => scan_host_id,
|
|
@@ -55,7 +74,7 @@ class LogStash::Codecs::Nmap < LogStash::Codecs::Base
|
|
|
55
74
|
if @emit_traceroute_links && traceroute && (hops = traceroute['hops'])
|
|
56
75
|
hops.each_with_index do |hop,idx|
|
|
57
76
|
next_hop = hops[idx+1]
|
|
58
|
-
yield LogStash::Event.new(
|
|
77
|
+
yield LogStash::Event.new(host_base.merge(
|
|
59
78
|
'type' =>'nmap_traceroute_link',
|
|
60
79
|
'from' => hop,
|
|
61
80
|
'to' => next_hop,
|
|
@@ -67,7 +86,7 @@ class LogStash::Codecs::Nmap < LogStash::Codecs::Base
|
|
|
67
86
|
end
|
|
68
87
|
|
|
69
88
|
if @emit_hosts
|
|
70
|
-
yield LogStash::Event.new(
|
|
89
|
+
yield LogStash::Event.new(host_base.merge(
|
|
71
90
|
'type' => 'nmap_host',
|
|
72
91
|
'ports' => ports,
|
|
73
92
|
'traceroute' => traceroute,
|
data/logstash-codec-nmap.gemspec
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
Gem::Specification.new do |s|
|
|
2
2
|
|
|
3
3
|
s.name = 'logstash-codec-nmap'
|
|
4
|
-
s.version = '0.0.
|
|
4
|
+
s.version = '0.0.10'
|
|
5
5
|
s.licenses = ['Apache License (2.0)']
|
|
6
6
|
s.summary = "This codec may be used to decode Nmap XML"
|
|
7
7
|
s.description = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
|
data/spec/codecs/nmap_spec.rb
CHANGED
|
@@ -46,7 +46,6 @@ describe LogStash::Codecs::Nmap do
|
|
|
46
46
|
it_should_behave_like "a valid parse"
|
|
47
47
|
end
|
|
48
48
|
|
|
49
|
-
|
|
50
49
|
describe "localscan.xml" do
|
|
51
50
|
let(:xml_string) { File.open("spec/fixtures/localscan.xml").read }
|
|
52
51
|
it_should_behave_like "a valid parse"
|
|
@@ -57,12 +56,21 @@ describe LogStash::Codecs::Nmap do
|
|
|
57
56
|
it_should_behave_like "a valid parse"
|
|
58
57
|
end
|
|
59
58
|
|
|
60
|
-
|
|
61
59
|
describe "full_scan.xml" do
|
|
62
60
|
let(:xml_string) { File.open("spec/fixtures/full_scan.xml").read }
|
|
63
61
|
it_should_behave_like "a valid parse"
|
|
64
62
|
end
|
|
65
63
|
|
|
64
|
+
describe "nothingup.xml" do
|
|
65
|
+
let(:xml_string) { File.open("spec/fixtures/nothingup.xml").read }
|
|
66
|
+
it_should_behave_like "a valid parse"
|
|
67
|
+
end
|
|
68
|
+
|
|
69
|
+
describe "ip_down.xml" do
|
|
70
|
+
let(:xml_string) { File.open("spec/fixtures/ip_down.xml").read }
|
|
71
|
+
it_should_behave_like "a valid parse"
|
|
72
|
+
end
|
|
73
|
+
|
|
66
74
|
end
|
|
67
75
|
|
|
68
76
|
end
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!DOCTYPE nmaprun>
|
|
3
|
+
<?xml-stylesheet href="file:///usr/local/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
|
|
4
|
+
<!-- Nmap 7.01 scan initiated Tue Jan 26 15:54:25 2016 as: nmap -sP -oX - 192.168.88.88 -->
|
|
5
|
+
<nmaprun scanner="nmap" args="nmap -sP -oX - 192.168.88.88" start="1453845265" startstr="Tue Jan 26 15:54:25 2016" version="7.01" xmloutputversion="1.04">
|
|
6
|
+
<verbose level="0"/>
|
|
7
|
+
<debugging level="0"/>
|
|
8
|
+
<runstats><finished time="1453845268" timestr="Tue Jan 26 15:54:28 2016" elapsed="3.01" summary="Nmap done at Tue Jan 26 15:54:28 2016; 1 IP address (0 hosts up) scanned in 3.01 seconds" exit="success"/><hosts up="0" down="1" total="1"/>
|
|
9
|
+
</runstats>
|
|
10
|
+
</nmaprun>
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
+
<!DOCTYPE nmaprun>
|
|
3
|
+
<?xml-stylesheet href="file:///usr/local/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
|
|
4
|
+
<!-- Nmap 7.01 scan initiated Tue Jan 26 15:53:54 2016 as: nmap -sP -oX - ouercheuonheuonctueo.net -->
|
|
5
|
+
<nmaprun scanner="nmap" args="nmap -sP -oX - ouercheuonheuonctueo.net" start="1453845234" startstr="Tue Jan 26 15:53:54 2016" version="7.01" xmloutputversion="1.04">
|
|
6
|
+
<verbose level="0"/>
|
|
7
|
+
<debugging level="0"/>
|
|
8
|
+
<runstats><finished time="1453845234" timestr="Tue Jan 26 15:53:54 2016" elapsed="0.00" summary="Nmap done at Tue Jan 26 15:53:54 2016; 0 IP addresses (0 hosts up) scanned in 0.00 seconds" exit="success"/><hosts up="0" down="0" total="0"/>
|
|
9
|
+
</runstats>
|
|
10
|
+
</nmaprun>
|
metadata
CHANGED
|
@@ -1,17 +1,18 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-codec-nmap
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
4
|
+
version: 0.0.10
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elastic
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2016-01-
|
|
11
|
+
date: 2016-01-27 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
|
-
|
|
14
|
+
name: logstash-core
|
|
15
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
15
16
|
requirements:
|
|
16
17
|
- - '>='
|
|
17
18
|
- !ruby/object:Gem::Version
|
|
@@ -19,10 +20,7 @@ dependencies:
|
|
|
19
20
|
- - <
|
|
20
21
|
- !ruby/object:Gem::Version
|
|
21
22
|
version: 3.0.0
|
|
22
|
-
|
|
23
|
-
prerelease: false
|
|
24
|
-
type: :runtime
|
|
25
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
23
|
+
requirement: !ruby/object:Gem::Requirement
|
|
26
24
|
requirements:
|
|
27
25
|
- - '>='
|
|
28
26
|
- !ruby/object:Gem::Version
|
|
@@ -30,34 +28,36 @@ dependencies:
|
|
|
30
28
|
- - <
|
|
31
29
|
- !ruby/object:Gem::Version
|
|
32
30
|
version: 3.0.0
|
|
31
|
+
prerelease: false
|
|
32
|
+
type: :runtime
|
|
33
33
|
- !ruby/object:Gem::Dependency
|
|
34
|
+
name: ruby-nmap
|
|
35
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
36
|
+
requirements:
|
|
37
|
+
- - '>='
|
|
38
|
+
- !ruby/object:Gem::Version
|
|
39
|
+
version: '0'
|
|
34
40
|
requirement: !ruby/object:Gem::Requirement
|
|
35
41
|
requirements:
|
|
36
42
|
- - '>='
|
|
37
43
|
- !ruby/object:Gem::Version
|
|
38
44
|
version: '0'
|
|
39
|
-
name: ruby-nmap
|
|
40
45
|
prerelease: false
|
|
41
46
|
type: :runtime
|
|
47
|
+
- !ruby/object:Gem::Dependency
|
|
48
|
+
name: logstash-devutils
|
|
42
49
|
version_requirements: !ruby/object:Gem::Requirement
|
|
43
50
|
requirements:
|
|
44
51
|
- - '>='
|
|
45
52
|
- !ruby/object:Gem::Version
|
|
46
53
|
version: '0'
|
|
47
|
-
- !ruby/object:Gem::Dependency
|
|
48
54
|
requirement: !ruby/object:Gem::Requirement
|
|
49
55
|
requirements:
|
|
50
56
|
- - '>='
|
|
51
57
|
- !ruby/object:Gem::Version
|
|
52
58
|
version: '0'
|
|
53
|
-
name: logstash-devutils
|
|
54
59
|
prerelease: false
|
|
55
60
|
type: :development
|
|
56
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
57
|
-
requirements:
|
|
58
|
-
- - '>='
|
|
59
|
-
- !ruby/object:Gem::Version
|
|
60
|
-
version: '0'
|
|
61
61
|
description: This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program
|
|
62
62
|
email: info@elastic.co
|
|
63
63
|
executables: []
|
|
@@ -65,7 +65,6 @@ extensions: []
|
|
|
65
65
|
extra_rdoc_files: []
|
|
66
66
|
files:
|
|
67
67
|
- CHANGELOG.md
|
|
68
|
-
- CONTRIBUTORS
|
|
69
68
|
- Gemfile
|
|
70
69
|
- LICENSE
|
|
71
70
|
- NOTICE.TXT
|
|
@@ -74,8 +73,10 @@ files:
|
|
|
74
73
|
- logstash-codec-nmap.gemspec
|
|
75
74
|
- spec/codecs/nmap_spec.rb
|
|
76
75
|
- spec/fixtures/full_scan.xml
|
|
76
|
+
- spec/fixtures/ip_down.xml
|
|
77
77
|
- spec/fixtures/ipv6_all.xml
|
|
78
78
|
- spec/fixtures/localscan.xml
|
|
79
|
+
- spec/fixtures/nothingup.xml
|
|
79
80
|
- spec/fixtures/pingsweep.xml
|
|
80
81
|
- spec/fixtures/scanme.nmap.org
|
|
81
82
|
- spec/fixtures/scanme_A.xml
|
|
@@ -110,8 +111,10 @@ summary: This codec may be used to decode Nmap XML
|
|
|
110
111
|
test_files:
|
|
111
112
|
- spec/codecs/nmap_spec.rb
|
|
112
113
|
- spec/fixtures/full_scan.xml
|
|
114
|
+
- spec/fixtures/ip_down.xml
|
|
113
115
|
- spec/fixtures/ipv6_all.xml
|
|
114
116
|
- spec/fixtures/localscan.xml
|
|
117
|
+
- spec/fixtures/nothingup.xml
|
|
115
118
|
- spec/fixtures/pingsweep.xml
|
|
116
119
|
- spec/fixtures/scanme.nmap.org
|
|
117
120
|
- spec/fixtures/scanme_A.xml
|
data/CONTRIBUTORS
DELETED
|
@@ -1,17 +0,0 @@
|
|
|
1
|
-
The following is a list of people who have contributed ideas, code, bug
|
|
2
|
-
reports, or in general have helped logstash along its way.
|
|
3
|
-
|
|
4
|
-
Contributors:
|
|
5
|
-
* Colin Surprenant (colinsurprenant)
|
|
6
|
-
* Jordan Sissel (jordansissel)
|
|
7
|
-
* João Duarte (jsvd)
|
|
8
|
-
* Kurt Hurtado (kurtado)
|
|
9
|
-
* Nick Ethier (nickethier)
|
|
10
|
-
* Pier-Hugues Pellerin (ph)
|
|
11
|
-
* Richard Pijnenburg (electrical)
|
|
12
|
-
* Tal Levy (talevy)
|
|
13
|
-
|
|
14
|
-
Note: If you've sent us patches, bug reports, or otherwise contributed to
|
|
15
|
-
Logstash, and you aren't on the list above and want to be, please let us know
|
|
16
|
-
and we'll make sure you're here. Contributions from folks like you are what make
|
|
17
|
-
open source awesome.
|