suricata 0.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +9 -0
- data/.rspec +2 -0
- data/.travis.yml +5 -0
- data/Gemfile +4 -0
- data/LICENSE.txt +340 -0
- data/README.md +71 -0
- data/Rakefile +6 -0
- data/bin/console +14 -0
- data/bin/setup +8 -0
- data/exe/check_suricata.rb +11 -0
- data/lib/suricata/connection.rb +76 -0
- data/lib/suricata/fast.rb +82 -0
- data/lib/suricata/logfile.rb +124 -0
- data/lib/suricata/nagios.rb +218 -0
- data/lib/suricata/version.rb +25 -0
- data/lib/suricata.rb +6 -0
- data/misc/fast.log +11 -0
- data/misc/whitelist.txt +1 -0
- data/suricata.gemspec +26 -0
- metadata +107 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 8a347bc8cc5e5dbf6907cdef669ea7eebc314d01
|
4
|
+
data.tar.gz: e59816882b172ef88dc4567cd6f8f40333a42efb
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: 81b095d2a8fdd94c61bd956b90b90cf2ae8b37aed0567052040f823ab8e9e2a256ea8d2e356663262f0ab1d3fd7d00110eb060b50c43ab23864c96f91a7c41d9
|
7
|
+
data.tar.gz: 6c0d068cba65906585acde1fb1ecdc1875419e20161c9ddf5f788c859a310e57c42bdd2a9e39aaa04caeda0f3b69c7d96aa33bb0cc8aece4516c15bd7c373611
|
data/.gitignore
ADDED
data/.rspec
ADDED
data/.travis.yml
ADDED
data/Gemfile
ADDED
data/LICENSE.txt
ADDED
@@ -0,0 +1,340 @@
|
|
1
|
+
GNU GENERAL PUBLIC LICENSE
|
2
|
+
Version 2, June 1991
|
3
|
+
|
4
|
+
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
5
|
+
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
6
|
+
Everyone is permitted to copy and distribute verbatim copies
|
7
|
+
of this license document, but changing it is not allowed.
|
8
|
+
|
9
|
+
Preamble
|
10
|
+
|
11
|
+
The licenses for most software are designed to take away your
|
12
|
+
freedom to share and change it. By contrast, the GNU General Public
|
13
|
+
License is intended to guarantee your freedom to share and change free
|
14
|
+
software--to make sure the software is free for all its users. This
|
15
|
+
General Public License applies to most of the Free Software
|
16
|
+
Foundation's software and to any other program whose authors commit to
|
17
|
+
using it. (Some other Free Software Foundation software is covered by
|
18
|
+
the GNU Library General Public License instead.) You can apply it to
|
19
|
+
your programs, too.
|
20
|
+
|
21
|
+
When we speak of free software, we are referring to freedom, not
|
22
|
+
price. Our General Public Licenses are designed to make sure that you
|
23
|
+
have the freedom to distribute copies of free software (and charge for
|
24
|
+
this service if you wish), that you receive source code or can get it
|
25
|
+
if you want it, that you can change the software or use pieces of it
|
26
|
+
in new free programs; and that you know you can do these things.
|
27
|
+
|
28
|
+
To protect your rights, we need to make restrictions that forbid
|
29
|
+
anyone to deny you these rights or to ask you to surrender the rights.
|
30
|
+
These restrictions translate to certain responsibilities for you if you
|
31
|
+
distribute copies of the software, or if you modify it.
|
32
|
+
|
33
|
+
For example, if you distribute copies of such a program, whether
|
34
|
+
gratis or for a fee, you must give the recipients all the rights that
|
35
|
+
you have. You must make sure that they, too, receive or can get the
|
36
|
+
source code. And you must show them these terms so they know their
|
37
|
+
rights.
|
38
|
+
|
39
|
+
We protect your rights with two steps: (1) copyright the software, and
|
40
|
+
(2) offer you this license which gives you legal permission to copy,
|
41
|
+
distribute and/or modify the software.
|
42
|
+
|
43
|
+
Also, for each author's protection and ours, we want to make certain
|
44
|
+
that everyone understands that there is no warranty for this free
|
45
|
+
software. If the software is modified by someone else and passed on, we
|
46
|
+
want its recipients to know that what they have is not the original, so
|
47
|
+
that any problems introduced by others will not reflect on the original
|
48
|
+
authors' reputations.
|
49
|
+
|
50
|
+
Finally, any free program is threatened constantly by software
|
51
|
+
patents. We wish to avoid the danger that redistributors of a free
|
52
|
+
program will individually obtain patent licenses, in effect making the
|
53
|
+
program proprietary. To prevent this, we have made it clear that any
|
54
|
+
patent must be licensed for everyone's free use or not licensed at all.
|
55
|
+
|
56
|
+
The precise terms and conditions for copying, distribution and
|
57
|
+
modification follow.
|
58
|
+
|
59
|
+
GNU GENERAL PUBLIC LICENSE
|
60
|
+
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
61
|
+
|
62
|
+
0. This License applies to any program or other work which contains
|
63
|
+
a notice placed by the copyright holder saying it may be distributed
|
64
|
+
under the terms of this General Public License. The "Program", below,
|
65
|
+
refers to any such program or work, and a "work based on the Program"
|
66
|
+
means either the Program or any derivative work under copyright law:
|
67
|
+
that is to say, a work containing the Program or a portion of it,
|
68
|
+
either verbatim or with modifications and/or translated into another
|
69
|
+
language. (Hereinafter, translation is included without limitation in
|
70
|
+
the term "modification".) Each licensee is addressed as "you".
|
71
|
+
|
72
|
+
Activities other than copying, distribution and modification are not
|
73
|
+
covered by this License; they are outside its scope. The act of
|
74
|
+
running the Program is not restricted, and the output from the Program
|
75
|
+
is covered only if its contents constitute a work based on the
|
76
|
+
Program (independent of having been made by running the Program).
|
77
|
+
Whether that is true depends on what the Program does.
|
78
|
+
|
79
|
+
1. You may copy and distribute verbatim copies of the Program's
|
80
|
+
source code as you receive it, in any medium, provided that you
|
81
|
+
conspicuously and appropriately publish on each copy an appropriate
|
82
|
+
copyright notice and disclaimer of warranty; keep intact all the
|
83
|
+
notices that refer to this License and to the absence of any warranty;
|
84
|
+
and give any other recipients of the Program a copy of this License
|
85
|
+
along with the Program.
|
86
|
+
|
87
|
+
You may charge a fee for the physical act of transferring a copy, and
|
88
|
+
you may at your option offer warranty protection in exchange for a fee.
|
89
|
+
|
90
|
+
2. You may modify your copy or copies of the Program or any portion
|
91
|
+
of it, thus forming a work based on the Program, and copy and
|
92
|
+
distribute such modifications or work under the terms of Section 1
|
93
|
+
above, provided that you also meet all of these conditions:
|
94
|
+
|
95
|
+
a) You must cause the modified files to carry prominent notices
|
96
|
+
stating that you changed the files and the date of any change.
|
97
|
+
|
98
|
+
b) You must cause any work that you distribute or publish, that in
|
99
|
+
whole or in part contains or is derived from the Program or any
|
100
|
+
part thereof, to be licensed as a whole at no charge to all third
|
101
|
+
parties under the terms of this License.
|
102
|
+
|
103
|
+
c) If the modified program normally reads commands interactively
|
104
|
+
when run, you must cause it, when started running for such
|
105
|
+
interactive use in the most ordinary way, to print or display an
|
106
|
+
announcement including an appropriate copyright notice and a
|
107
|
+
notice that there is no warranty (or else, saying that you provide
|
108
|
+
a warranty) and that users may redistribute the program under
|
109
|
+
these conditions, and telling the user how to view a copy of this
|
110
|
+
License. (Exception: if the Program itself is interactive but
|
111
|
+
does not normally print such an announcement, your work based on
|
112
|
+
the Program is not required to print an announcement.)
|
113
|
+
|
114
|
+
These requirements apply to the modified work as a whole. If
|
115
|
+
identifiable sections of that work are not derived from the Program,
|
116
|
+
and can be reasonably considered independent and separate works in
|
117
|
+
themselves, then this License, and its terms, do not apply to those
|
118
|
+
sections when you distribute them as separate works. But when you
|
119
|
+
distribute the same sections as part of a whole which is a work based
|
120
|
+
on the Program, the distribution of the whole must be on the terms of
|
121
|
+
this License, whose permissions for other licensees extend to the
|
122
|
+
entire whole, and thus to each and every part regardless of who wrote it.
|
123
|
+
|
124
|
+
Thus, it is not the intent of this section to claim rights or contest
|
125
|
+
your rights to work written entirely by you; rather, the intent is to
|
126
|
+
exercise the right to control the distribution of derivative or
|
127
|
+
collective works based on the Program.
|
128
|
+
|
129
|
+
In addition, mere aggregation of another work not based on the Program
|
130
|
+
with the Program (or with a work based on the Program) on a volume of
|
131
|
+
a storage or distribution medium does not bring the other work under
|
132
|
+
the scope of this License.
|
133
|
+
|
134
|
+
3. You may copy and distribute the Program (or a work based on it,
|
135
|
+
under Section 2) in object code or executable form under the terms of
|
136
|
+
Sections 1 and 2 above provided that you also do one of the following:
|
137
|
+
|
138
|
+
a) Accompany it with the complete corresponding machine-readable
|
139
|
+
source code, which must be distributed under the terms of Sections
|
140
|
+
1 and 2 above on a medium customarily used for software interchange; or,
|
141
|
+
|
142
|
+
b) Accompany it with a written offer, valid for at least three
|
143
|
+
years, to give any third party, for a charge no more than your
|
144
|
+
cost of physically performing source distribution, a complete
|
145
|
+
machine-readable copy of the corresponding source code, to be
|
146
|
+
distributed under the terms of Sections 1 and 2 above on a medium
|
147
|
+
customarily used for software interchange; or,
|
148
|
+
|
149
|
+
c) Accompany it with the information you received as to the offer
|
150
|
+
to distribute corresponding source code. (This alternative is
|
151
|
+
allowed only for noncommercial distribution and only if you
|
152
|
+
received the program in object code or executable form with such
|
153
|
+
an offer, in accord with Subsection b above.)
|
154
|
+
|
155
|
+
The source code for a work means the preferred form of the work for
|
156
|
+
making modifications to it. For an executable work, complete source
|
157
|
+
code means all the source code for all modules it contains, plus any
|
158
|
+
associated interface definition files, plus the scripts used to
|
159
|
+
control compilation and installation of the executable. However, as a
|
160
|
+
special exception, the source code distributed need not include
|
161
|
+
anything that is normally distributed (in either source or binary
|
162
|
+
form) with the major components (compiler, kernel, and so on) of the
|
163
|
+
operating system on which the executable runs, unless that component
|
164
|
+
itself accompanies the executable.
|
165
|
+
|
166
|
+
If distribution of executable or object code is made by offering
|
167
|
+
access to copy from a designated place, then offering equivalent
|
168
|
+
access to copy the source code from the same place counts as
|
169
|
+
distribution of the source code, even though third parties are not
|
170
|
+
compelled to copy the source along with the object code.
|
171
|
+
|
172
|
+
4. You may not copy, modify, sublicense, or distribute the Program
|
173
|
+
except as expressly provided under this License. Any attempt
|
174
|
+
otherwise to copy, modify, sublicense or distribute the Program is
|
175
|
+
void, and will automatically terminate your rights under this License.
|
176
|
+
However, parties who have received copies, or rights, from you under
|
177
|
+
this License will not have their licenses terminated so long as such
|
178
|
+
parties remain in full compliance.
|
179
|
+
|
180
|
+
5. You are not required to accept this License, since you have not
|
181
|
+
signed it. However, nothing else grants you permission to modify or
|
182
|
+
distribute the Program or its derivative works. These actions are
|
183
|
+
prohibited by law if you do not accept this License. Therefore, by
|
184
|
+
modifying or distributing the Program (or any work based on the
|
185
|
+
Program), you indicate your acceptance of this License to do so, and
|
186
|
+
all its terms and conditions for copying, distributing or modifying
|
187
|
+
the Program or works based on it.
|
188
|
+
|
189
|
+
6. Each time you redistribute the Program (or any work based on the
|
190
|
+
Program), the recipient automatically receives a license from the
|
191
|
+
original licensor to copy, distribute or modify the Program subject to
|
192
|
+
these terms and conditions. You may not impose any further
|
193
|
+
restrictions on the recipients' exercise of the rights granted herein.
|
194
|
+
You are not responsible for enforcing compliance by third parties to
|
195
|
+
this License.
|
196
|
+
|
197
|
+
7. If, as a consequence of a court judgment or allegation of patent
|
198
|
+
infringement or for any other reason (not limited to patent issues),
|
199
|
+
conditions are imposed on you (whether by court order, agreement or
|
200
|
+
otherwise) that contradict the conditions of this License, they do not
|
201
|
+
excuse you from the conditions of this License. If you cannot
|
202
|
+
distribute so as to satisfy simultaneously your obligations under this
|
203
|
+
License and any other pertinent obligations, then as a consequence you
|
204
|
+
may not distribute the Program at all. For example, if a patent
|
205
|
+
license would not permit royalty-free redistribution of the Program by
|
206
|
+
all those who receive copies directly or indirectly through you, then
|
207
|
+
the only way you could satisfy both it and this License would be to
|
208
|
+
refrain entirely from distribution of the Program.
|
209
|
+
|
210
|
+
If any portion of this section is held invalid or unenforceable under
|
211
|
+
any particular circumstance, the balance of the section is intended to
|
212
|
+
apply and the section as a whole is intended to apply in other
|
213
|
+
circumstances.
|
214
|
+
|
215
|
+
It is not the purpose of this section to induce you to infringe any
|
216
|
+
patents or other property right claims or to contest validity of any
|
217
|
+
such claims; this section has the sole purpose of protecting the
|
218
|
+
integrity of the free software distribution system, which is
|
219
|
+
implemented by public license practices. Many people have made
|
220
|
+
generous contributions to the wide range of software distributed
|
221
|
+
through that system in reliance on consistent application of that
|
222
|
+
system; it is up to the author/donor to decide if he or she is willing
|
223
|
+
to distribute software through any other system and a licensee cannot
|
224
|
+
impose that choice.
|
225
|
+
|
226
|
+
This section is intended to make thoroughly clear what is believed to
|
227
|
+
be a consequence of the rest of this License.
|
228
|
+
|
229
|
+
8. If the distribution and/or use of the Program is restricted in
|
230
|
+
certain countries either by patents or by copyrighted interfaces, the
|
231
|
+
original copyright holder who places the Program under this License
|
232
|
+
may add an explicit geographical distribution limitation excluding
|
233
|
+
those countries, so that distribution is permitted only in or among
|
234
|
+
countries not thus excluded. In such case, this License incorporates
|
235
|
+
the limitation as if written in the body of this License.
|
236
|
+
|
237
|
+
9. The Free Software Foundation may publish revised and/or new versions
|
238
|
+
of the General Public License from time to time. Such new versions will
|
239
|
+
be similar in spirit to the present version, but may differ in detail to
|
240
|
+
address new problems or concerns.
|
241
|
+
|
242
|
+
Each version is given a distinguishing version number. If the Program
|
243
|
+
specifies a version number of this License which applies to it and "any
|
244
|
+
later version", you have the option of following the terms and conditions
|
245
|
+
either of that version or of any later version published by the Free
|
246
|
+
Software Foundation. If the Program does not specify a version number of
|
247
|
+
this License, you may choose any version ever published by the Free Software
|
248
|
+
Foundation.
|
249
|
+
|
250
|
+
10. If you wish to incorporate parts of the Program into other free
|
251
|
+
programs whose distribution conditions are different, write to the author
|
252
|
+
to ask for permission. For software which is copyrighted by the Free
|
253
|
+
Software Foundation, write to the Free Software Foundation; we sometimes
|
254
|
+
make exceptions for this. Our decision will be guided by the two goals
|
255
|
+
of preserving the free status of all derivatives of our free software and
|
256
|
+
of promoting the sharing and reuse of software generally.
|
257
|
+
|
258
|
+
NO WARRANTY
|
259
|
+
|
260
|
+
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
261
|
+
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
262
|
+
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
263
|
+
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
264
|
+
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
265
|
+
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
266
|
+
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
267
|
+
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
268
|
+
REPAIR OR CORRECTION.
|
269
|
+
|
270
|
+
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
271
|
+
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
272
|
+
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
273
|
+
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
274
|
+
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
275
|
+
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
276
|
+
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
277
|
+
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
278
|
+
POSSIBILITY OF SUCH DAMAGES.
|
279
|
+
|
280
|
+
END OF TERMS AND CONDITIONS
|
281
|
+
|
282
|
+
How to Apply These Terms to Your New Programs
|
283
|
+
|
284
|
+
If you develop a new program, and you want it to be of the greatest
|
285
|
+
possible use to the public, the best way to achieve this is to make it
|
286
|
+
free software which everyone can redistribute and change under these terms.
|
287
|
+
|
288
|
+
To do so, attach the following notices to the program. It is safest
|
289
|
+
to attach them to the start of each source file to most effectively
|
290
|
+
convey the exclusion of warranty; and each file should have at least
|
291
|
+
the "copyright" line and a pointer to where the full notice is found.
|
292
|
+
|
293
|
+
<one line to give the program's name and a brief idea of what it does.>
|
294
|
+
Copyright (C) <year> <name of author>
|
295
|
+
|
296
|
+
This program is free software; you can redistribute it and/or modify
|
297
|
+
it under the terms of the GNU General Public License as published by
|
298
|
+
the Free Software Foundation; either version 2 of the License, or
|
299
|
+
(at your option) any later version.
|
300
|
+
|
301
|
+
This program is distributed in the hope that it will be useful,
|
302
|
+
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
303
|
+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
304
|
+
GNU General Public License for more details.
|
305
|
+
|
306
|
+
You should have received a copy of the GNU General Public License
|
307
|
+
along with this program; if not, write to the Free Software
|
308
|
+
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
|
309
|
+
|
310
|
+
|
311
|
+
Also add information on how to contact you by electronic and paper mail.
|
312
|
+
|
313
|
+
If the program is interactive, make it output a short notice like this
|
314
|
+
when it starts in an interactive mode:
|
315
|
+
|
316
|
+
Gnomovision version 69, Copyright (C) year name of author
|
317
|
+
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
318
|
+
This is free software, and you are welcome to redistribute it
|
319
|
+
under certain conditions; type `show c' for details.
|
320
|
+
|
321
|
+
The hypothetical commands `show w' and `show c' should show the appropriate
|
322
|
+
parts of the General Public License. Of course, the commands you use may
|
323
|
+
be called something other than `show w' and `show c'; they could even be
|
324
|
+
mouse-clicks or menu items--whatever suits your program.
|
325
|
+
|
326
|
+
You should also get your employer (if you work as a programmer) or your
|
327
|
+
school, if any, to sign a "copyright disclaimer" for the program, if
|
328
|
+
necessary. Here is a sample; alter the names:
|
329
|
+
|
330
|
+
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
331
|
+
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
332
|
+
|
333
|
+
<signature of Ty Coon>, 1 April 1989
|
334
|
+
Ty Coon, President of Vice
|
335
|
+
|
336
|
+
This General Public License does not permit incorporating your program into
|
337
|
+
proprietary programs. If your program is a subroutine library, you may
|
338
|
+
consider it more useful to permit linking proprietary applications with the
|
339
|
+
library. If this is what you want to do, use the GNU Library General
|
340
|
+
Public License instead of this License.
|
data/README.md
ADDED
@@ -0,0 +1,71 @@
|
|
1
|
+
# Suricata
|
2
|
+
|
3
|
+
[![GPL Licence](https://badges.frapsoft.com/os/gpl/gpl.png?v=103)](https://github.com/whotwagner/suricata/blob/master/LICENSE.txt)
|
4
|
+
[![Build Status](https://travis-ci.org/whotwagner/suricata.svg?branch=master)](https://travis-ci.org/whotwagner/suricata)
|
5
|
+
[![Inline docs](http://inch-ci.org/github/whotwagner/suricata.svg?branch=master)](http://inch-ci.org/github/whotwagner/suricata)
|
6
|
+
[![Code Climate](https://codeclimate.com/github/whotwagner/suricata/badges/gpa.svg)](https://codeclimate.com/github/whotwagner/suricata)
|
7
|
+
[![Gem Version](https://badge.fury.io/rb/suricata.svg)](https://badge.fury.io/rb/mindwave)
|
8
|
+
|
9
|
+
This gem offers classes for parsing suricata logfiles. It ships with a nagios-plugin.
|
10
|
+
|
11
|
+
## Installation
|
12
|
+
|
13
|
+
Add this line to your application's Gemfile:
|
14
|
+
|
15
|
+
```ruby
|
16
|
+
gem 'suricata'
|
17
|
+
```
|
18
|
+
|
19
|
+
And then execute:
|
20
|
+
|
21
|
+
$ bundle
|
22
|
+
|
23
|
+
Or install it yourself as:
|
24
|
+
|
25
|
+
$ gem install suricata
|
26
|
+
|
27
|
+
## Usage
|
28
|
+
|
29
|
+
### Nagios-Plugin
|
30
|
+
|
31
|
+
This gem comes with a Nagios-plugin to search suricata's fast-logfile for specific strings in the threat-description.
|
32
|
+
|
33
|
+
```
|
34
|
+
Usage: check_suricata.rb [ -a alertfile ] [ -w whitelistfile ] -e searchstring
|
35
|
+
-h, --help This help screen
|
36
|
+
-a, --alertfile ALERTFILE alertfile(default: /var/log/suricata/fast.log)
|
37
|
+
-w, --whitelist WHITELISTFILE whitelistfile
|
38
|
+
-e, --search STRING searchstring
|
39
|
+
-i, --interactive interactive
|
40
|
+
-k, --ackfile ACKFILE ackfile(default: /tmp/surack.lst)
|
41
|
+
```
|
42
|
+
|
43
|
+
It is possible to interactively acknowlege search hits so that they will not occur on the next search:
|
44
|
+
```
|
45
|
+
check_suricata.rb -i -e "ET CHAT"
|
46
|
+
Acknowlege the following entry:
|
47
|
+
10/04/2016-13:39:45.498785 [**] [1:2001595:10] ET CHAT Skype VOIP Checking Version (Startup) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.1:40460 -> 15.14.13.12:80
|
48
|
+
Acknowlege(y|n): y
|
49
|
+
Acknowlege the following entry:
|
50
|
+
10/05/2016-09:25:01.186862 [**] [1:2001595:10] ET CHAT Skype VOIP Checking Version (Startup) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.1:49491 -> 100.254.198.10:80
|
51
|
+
Acknowlege(y|n): n
|
52
|
+
```
|
53
|
+
|
54
|
+
## Documentation
|
55
|
+
|
56
|
+
[rubydoc.info](http://www.rubydoc.info/github/whotwagner/suricata/master)
|
57
|
+
|
58
|
+
|
59
|
+
## Development
|
60
|
+
|
61
|
+
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
62
|
+
|
63
|
+
|
64
|
+
## Contributing
|
65
|
+
|
66
|
+
Bug reports and pull requests are welcome on GitHub at https://github.com/whotwagner/suricata.
|
67
|
+
|
68
|
+
|
69
|
+
---
|
70
|
+
|
71
|
+
Powered by [Toscom](http://www.toscom.at)
|
data/Rakefile
ADDED
data/bin/console
ADDED
@@ -0,0 +1,14 @@
|
|
1
|
+
#!/usr/bin/env ruby
|
2
|
+
|
3
|
+
require "bundler/setup"
|
4
|
+
require "suricata"
|
5
|
+
|
6
|
+
# You can add fixtures and/or initialization code here to make experimenting
|
7
|
+
# with your gem easier. You can also use a different console, if you like.
|
8
|
+
|
9
|
+
# (If you use this, don't forget to add pry to your Gemfile!)
|
10
|
+
# require "pry"
|
11
|
+
# Pry.start
|
12
|
+
|
13
|
+
require "irb"
|
14
|
+
IRB.start
|
data/bin/setup
ADDED
@@ -0,0 +1,76 @@
|
|
1
|
+
#--
|
2
|
+
# Copyright (C) 2016 Wolfgang Hotwagner <code@toscom.at>
|
3
|
+
#
|
4
|
+
# This file is part of the suricata gem
|
5
|
+
#
|
6
|
+
# This mindwave gem is free software; you can redistribute it and/or
|
7
|
+
# modify it under the terms of the GNU General Public License
|
8
|
+
# as published by the Free Software Foundation; either version 2
|
9
|
+
# of the License, or (at your option) any later version.
|
10
|
+
#
|
11
|
+
# This gem is distributed in the hope that it will be useful,
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
14
|
+
# GNU General Public License for more details.
|
15
|
+
#
|
16
|
+
# You should have received a copy of the GNU General Public License
|
17
|
+
# along with this gem; if not, write to the
|
18
|
+
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
|
19
|
+
# Boston, MA 02110-1301 USA
|
20
|
+
#++
|
21
|
+
module Suricata
|
22
|
+
|
23
|
+
# This class splits a connection string into it's parts
|
24
|
+
class Connection
|
25
|
+
# @!attribute proto
|
26
|
+
# protocol
|
27
|
+
# @!attribute src
|
28
|
+
# source-ip
|
29
|
+
# @!attribute dst
|
30
|
+
# destination-ip
|
31
|
+
# @!attribute sport
|
32
|
+
# source port
|
33
|
+
# @!attribute dport
|
34
|
+
# destination port
|
35
|
+
attr_accessor :proto, :src, :dst, :sport, :dport
|
36
|
+
|
37
|
+
# This constructor calls parse(string) if string is not nil
|
38
|
+
#
|
39
|
+
# @param [String] string string to parse
|
40
|
+
def initialize(string=nil)
|
41
|
+
if not string.nil?
|
42
|
+
parse(string)
|
43
|
+
end
|
44
|
+
end
|
45
|
+
|
46
|
+
# This function parses a connection-string into it's parts
|
47
|
+
#
|
48
|
+
# @param [String] string string to parse
|
49
|
+
# @raise [Exception] Parsing error
|
50
|
+
def parse(string)
|
51
|
+
if string.nil?
|
52
|
+
raise "Invalid argument"
|
53
|
+
end
|
54
|
+
|
55
|
+
string = string.chomp
|
56
|
+
|
57
|
+
if string =~ /^\{(.+)\}\s+(.+)\:(\d{1,5})\s+\-\>\s+(.+)\:(\d{1,5})$/
|
58
|
+
@proto = $1
|
59
|
+
@src = $2
|
60
|
+
@sport = $3.to_i
|
61
|
+
@dst = $4
|
62
|
+
@dport = $5.to_i
|
63
|
+
else
|
64
|
+
raise "Parsing error: >>#{string}<<"
|
65
|
+
end
|
66
|
+
end
|
67
|
+
|
68
|
+
# converts parsed values back to string
|
69
|
+
# @return [String] connection-string
|
70
|
+
def to_s
|
71
|
+
"{#{proto}} #{src}:#{sport} -> #{dst}:#{dport}"
|
72
|
+
end
|
73
|
+
|
74
|
+
end
|
75
|
+
|
76
|
+
end
|
@@ -0,0 +1,82 @@
|
|
1
|
+
#--
|
2
|
+
# Copyright (C) 2016 Wolfgang Hotwagner <code@toscom.at>
|
3
|
+
#
|
4
|
+
# This file is part of the suricata gem
|
5
|
+
#
|
6
|
+
# This mindwave gem is free software; you can redistribute it and/or
|
7
|
+
# modify it under the terms of the GNU General Public License
|
8
|
+
# as published by the Free Software Foundation; either version 2
|
9
|
+
# of the License, or (at your option) any later version.
|
10
|
+
#
|
11
|
+
# This gem is distributed in the hope that it will be useful,
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
14
|
+
# GNU General Public License for more details.
|
15
|
+
#
|
16
|
+
# You should have received a copy of the GNU General Public License
|
17
|
+
# along with this gem; if not, write to the
|
18
|
+
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
|
19
|
+
# Boston, MA 02110-1301 USA
|
20
|
+
#++
|
21
|
+
|
22
|
+
module Suricata
|
23
|
+
|
24
|
+
require 'suricata/connection'
|
25
|
+
|
26
|
+
# This class parses suricatas fast.log-files
|
27
|
+
class Fast
|
28
|
+
|
29
|
+
# @!attribute timestamp
|
30
|
+
# log-time
|
31
|
+
# @!attribute id
|
32
|
+
# signature-id
|
33
|
+
# @!attribute description
|
34
|
+
# signature-description
|
35
|
+
# @!attribute classification
|
36
|
+
# threat-classification
|
37
|
+
# @!attribute priority
|
38
|
+
# priority
|
39
|
+
# @!attribute conn
|
40
|
+
# Suricata::Connection connection
|
41
|
+
attr_accessor :timestamp, :id, :description, :classification, :priority, :conn
|
42
|
+
|
43
|
+
# this function parses an entry of fast.log
|
44
|
+
# @param [String] string one line of fast.log
|
45
|
+
# @raise [Exception] if string is nil
|
46
|
+
def parse(string)
|
47
|
+
if string.nil?
|
48
|
+
raise "Invalid argument"
|
49
|
+
end
|
50
|
+
|
51
|
+
if string =~ /^([^ ]+)\s+/
|
52
|
+
@timestamp = $1.chomp(' ')
|
53
|
+
end
|
54
|
+
|
55
|
+
if string =~ /\[\*\*\]\s+\[(\d+\:\d+\:\d+)\]\s+(.*)\[\*\*\]/
|
56
|
+
@id = $1
|
57
|
+
@description = $2.chomp(' ')
|
58
|
+
end
|
59
|
+
|
60
|
+
if string =~ /\[Classification: ([^\]]+)\]/
|
61
|
+
@classification = $1
|
62
|
+
end
|
63
|
+
|
64
|
+
if string =~ /\[Priority: ([^\]]+)\]/
|
65
|
+
@priority = $1
|
66
|
+
end
|
67
|
+
|
68
|
+
if string =~ /\]\s+([^\]]+)$/
|
69
|
+
@conn = Suricata::Connection.new($1)
|
70
|
+
end
|
71
|
+
|
72
|
+
end
|
73
|
+
|
74
|
+
# this function converts the parsed entry back to string
|
75
|
+
# @return [String] converted string
|
76
|
+
def to_s
|
77
|
+
"#{@timestamp} [**] [#{@id}] #{@description} [**] [Classification: #{@classification}] [Priority: #{@priority}] #{@conn}"
|
78
|
+
end
|
79
|
+
|
80
|
+
end
|
81
|
+
|
82
|
+
end
|
@@ -0,0 +1,124 @@
|
|
1
|
+
#--
|
2
|
+
# Copyright (C) 2016 Wolfgang Hotwagner <code@toscom.at>
|
3
|
+
#
|
4
|
+
# This file is part of the suricata gem
|
5
|
+
#
|
6
|
+
# This mindwave gem is free software; you can redistribute it and/or
|
7
|
+
# modify it under the terms of the GNU General Public License
|
8
|
+
# as published by the Free Software Foundation; either version 2
|
9
|
+
# of the License, or (at your option) any later version.
|
10
|
+
#
|
11
|
+
# This gem is distributed in the hope that it will be useful,
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
14
|
+
# GNU General Public License for more details.
|
15
|
+
#
|
16
|
+
# You should have received a copy of the GNU General Public License
|
17
|
+
# along with this gem; if not, write to the
|
18
|
+
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
|
19
|
+
# Boston, MA 02110-1301 USA
|
20
|
+
#++
|
21
|
+
|
22
|
+
module Suricata
|
23
|
+
|
24
|
+
|
25
|
+
require "suricata/fast"
|
26
|
+
|
27
|
+
# This class opens a logfile, offers methods for reading logfiles
|
28
|
+
# and calls the logfile-parser
|
29
|
+
class Logfile
|
30
|
+
# @!attribute logfile
|
31
|
+
# path and filename of the logfile
|
32
|
+
# @!attribute parser
|
33
|
+
# parser to use(default: Suricata::Fast)
|
34
|
+
attr_accessor :logfile, :parser
|
35
|
+
# @!attribute file
|
36
|
+
# file-descriptor for logfile
|
37
|
+
# @!attribute line
|
38
|
+
# current line of the logfile. set by readline and readline_parse
|
39
|
+
attr_reader :file, :line
|
40
|
+
|
41
|
+
# constructor
|
42
|
+
# @param [String] logfile path and filename of the logfile
|
43
|
+
# @param [Boolean] autoopen calls open if true(default: true)
|
44
|
+
def initialize(logfile,autoopen=true)
|
45
|
+
@logfile = logfile
|
46
|
+
@parser = Suricata::Fast.new
|
47
|
+
|
48
|
+
if autoopen == true
|
49
|
+
open
|
50
|
+
end
|
51
|
+
end
|
52
|
+
|
53
|
+
# this method calls parser.parse(string)
|
54
|
+
# @param [String] string logfile-entry to parse
|
55
|
+
# @raise [Exception] "Invalid argument" if string is nil
|
56
|
+
# @raise [Exception] "Invalid parser" if parser is nil
|
57
|
+
# @return [Object] parser
|
58
|
+
def parse(string)
|
59
|
+
if string.nil?
|
60
|
+
raise "Invalid argument"
|
61
|
+
end
|
62
|
+
|
63
|
+
if @parser.nil?
|
64
|
+
raise "Invalid parser"
|
65
|
+
end
|
66
|
+
|
67
|
+
@parser.parse(string)
|
68
|
+
|
69
|
+
return @parser
|
70
|
+
|
71
|
+
end
|
72
|
+
|
73
|
+
# this method reads a line of the logfile and calls the parser
|
74
|
+
# @return [Object] parsed object if not called with a block(default: Surricata::Fast)
|
75
|
+
# @return [false] if there is nothing to read and if not called with a block
|
76
|
+
# @yieldparam [Object] @line parsed object(default Suricata::Fast)
|
77
|
+
def readline_parse
|
78
|
+
if block_given?
|
79
|
+
while readline
|
80
|
+
yield(parse(@line))
|
81
|
+
end
|
82
|
+
else
|
83
|
+
if not readline
|
84
|
+
return false
|
85
|
+
else
|
86
|
+
return parse(@line)
|
87
|
+
end
|
88
|
+
end
|
89
|
+
end
|
90
|
+
|
91
|
+
# this method reads a line of the logfile
|
92
|
+
# @return [String] line current logfile entry
|
93
|
+
# @return [Boolean] false when EOF reached
|
94
|
+
# @yieldparam [String] @line current logfile entry
|
95
|
+
def readline
|
96
|
+
begin
|
97
|
+
if block_given?
|
98
|
+
while @line = @file.readline
|
99
|
+
yield(@line)
|
100
|
+
end
|
101
|
+
else
|
102
|
+
@line = @file.readline
|
103
|
+
return @line
|
104
|
+
end
|
105
|
+
rescue EOFError
|
106
|
+
return false
|
107
|
+
end
|
108
|
+
|
109
|
+
|
110
|
+
end
|
111
|
+
|
112
|
+
# this method opens the logfile and initialises file
|
113
|
+
def open
|
114
|
+
@file = File.new(@logfile,"r")
|
115
|
+
end
|
116
|
+
|
117
|
+
# this method closes the logfile
|
118
|
+
def close
|
119
|
+
@file.close()
|
120
|
+
end
|
121
|
+
|
122
|
+
end
|
123
|
+
|
124
|
+
end
|
@@ -0,0 +1,218 @@
|
|
1
|
+
#--
|
2
|
+
# Copyright (C) 2016 Wolfgang Hotwagner <code@toscom.at>
|
3
|
+
#
|
4
|
+
# This file is part of the suricata gem
|
5
|
+
#
|
6
|
+
# This mindwave gem is free software; you can redistribute it and/or
|
7
|
+
# modify it under the terms of the GNU General Public License
|
8
|
+
# as published by the Free Software Foundation; either version 2
|
9
|
+
# of the License, or (at your option) any later version.
|
10
|
+
#
|
11
|
+
# This gem is distributed in the hope that it will be useful,
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
14
|
+
# GNU General Public License for more details.
|
15
|
+
#
|
16
|
+
# You should have received a copy of the GNU General Public License
|
17
|
+
# along with this gem; if not, write to the
|
18
|
+
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
|
19
|
+
# Boston, MA 02110-1301 USA
|
20
|
+
#++
|
21
|
+
|
22
|
+
module Suricata
|
23
|
+
|
24
|
+
require 'suricata/logfile'
|
25
|
+
require 'suricata/fast'
|
26
|
+
require 'optparse'
|
27
|
+
|
28
|
+
|
29
|
+
# This class offers all functionalities for a suricata-nagios-plugin
|
30
|
+
class Nagios
|
31
|
+
|
32
|
+
|
33
|
+
# @!attribute fast
|
34
|
+
# this attribute stores the Suricata::Logfile-object
|
35
|
+
# @!attribute found_str
|
36
|
+
# this attribute stores the string found by search() in the Logfile-object
|
37
|
+
# @!attribute search_str
|
38
|
+
# the search-pattern is stored in this attribute
|
39
|
+
attr_reader :fast, :found_str, :search_str
|
40
|
+
|
41
|
+
# @!attribute whitelist
|
42
|
+
# this whitelist can be used to exclude results from the search
|
43
|
+
# @!attribute alertfile
|
44
|
+
# this alertfile(fast.log) is used for the search
|
45
|
+
# @!attribute return_found
|
46
|
+
# this value is returned from search() on succes. (Default: 2)
|
47
|
+
# @!attribute return_notfound
|
48
|
+
# this value is returned from search() on failure (Default: 0)
|
49
|
+
# @!attribute ack
|
50
|
+
# it is possible to acknowlege alerts, so that they will be
|
51
|
+
# excluded from the next search. Use this member to set the acknowlege-file.
|
52
|
+
# Default ack-file is: /tmp/surack.lst
|
53
|
+
attr_accessor :whitelist, :alertfile, :return_found, :return_notfound, :ack
|
54
|
+
|
55
|
+
# constructor
|
56
|
+
# @param [String] alertfile path to the suricata-log-file(default: /var/log/suricata/fast.log)
|
57
|
+
# @param [String] whitelist path to the whitelist(default: nil)
|
58
|
+
def initialize(alertfile="/var/log/suricata/fast.log",whitelist=nil)
|
59
|
+
@whitelist = whitelist
|
60
|
+
@alertfile = alertfile
|
61
|
+
@return_found = 2
|
62
|
+
@return_notfound = 0
|
63
|
+
@ack = "/tmp/surack.lst"
|
64
|
+
end
|
65
|
+
|
66
|
+
# this method initializes the Suricata::Logfile(@fast) and opens
|
67
|
+
# the @alertfile
|
68
|
+
# @see alertfile
|
69
|
+
def init_log
|
70
|
+
@fast = Suricata::Logfile.new(@alertfile)
|
71
|
+
end
|
72
|
+
|
73
|
+
# this is the check_suricata-application. this function exits with 3
|
74
|
+
# on error
|
75
|
+
# @param [Array] args typically ARGV
|
76
|
+
# @return [Integer] @return_found if searchstring was found
|
77
|
+
# @return [Integer] @return_notfound if searchstring was not found
|
78
|
+
# @see return_found
|
79
|
+
# @see return_notfound
|
80
|
+
def runApp(args)
|
81
|
+
help = nil
|
82
|
+
interactive = false
|
83
|
+
|
84
|
+
OptionParser.new do |opt|
|
85
|
+
opt.banner = "Usage: #{$PROGRAM_NAME} [ -a alertfile ] [ -w whitelistfile ] -e searchstring"
|
86
|
+
opt.on('-h', '--help', 'This help screen') do
|
87
|
+
$stderr.puts opt
|
88
|
+
exit 3
|
89
|
+
end
|
90
|
+
opt.on('-a','--alertfile ALERTFILE','alertfile(default: /var/log/suricata/fast.log)') { |o| @alertfile = o }
|
91
|
+
opt.on('-w','--whitelist WHITELISTFILE','whitelistfile') { |o| @whitelist = o }
|
92
|
+
opt.on('-e','--search STRING','searchstring') { |o| @search_str = o }
|
93
|
+
opt.on('-i','--interactive','interactive acknowleges') { |o| interactive = o }
|
94
|
+
opt.on('-k','--ackfile ACKFILE','ackfile(default: /tmp/surack.lst)') { |o| @ack = o }
|
95
|
+
help = opt.help
|
96
|
+
end.parse!(args)
|
97
|
+
|
98
|
+
if @search_str.nil?
|
99
|
+
$stderr.puts help
|
100
|
+
exit 3
|
101
|
+
end
|
102
|
+
|
103
|
+
if interactive
|
104
|
+
acknowlege(@search_str)
|
105
|
+
exit 3
|
106
|
+
end
|
107
|
+
|
108
|
+
ret = search(@search_str)
|
109
|
+
if ret > 0
|
110
|
+
puts "FOUND"
|
111
|
+
else
|
112
|
+
puts "OK"
|
113
|
+
end
|
114
|
+
|
115
|
+
exit ret
|
116
|
+
end
|
117
|
+
|
118
|
+
# this method performs a search(str). It will ask interactively for ever
|
119
|
+
# hit if it should be acknowleged. In case of "yes", the routine will
|
120
|
+
# add a shortform of the entry to the acknowlege-file
|
121
|
+
# @param [String] str string to search
|
122
|
+
# @see ack
|
123
|
+
def acknowlege(str)
|
124
|
+
|
125
|
+
if @fast.nil?
|
126
|
+
init_log
|
127
|
+
end
|
128
|
+
|
129
|
+
list = File.open(@ack,'a')
|
130
|
+
|
131
|
+
@fast.readline_parse do |fast_entry|
|
132
|
+
if fast_entry.description =~ /#{str}/
|
133
|
+
if not search_list("#{fast_entry.timestamp} #{fast_entry.id} #{fast_entry.conn}",@ack)
|
134
|
+
printf("Acknowlege the following entry:\n")
|
135
|
+
printf("#{fast_entry}\n")
|
136
|
+
printf("Acknowlege(y|n): ")
|
137
|
+
answer = STDIN.gets
|
138
|
+
if answer == "y\n"
|
139
|
+
list.write("#{fast_entry.timestamp} #{fast_entry.id} #{fast_entry.conn}\n")
|
140
|
+
end
|
141
|
+
end
|
142
|
+
end
|
143
|
+
end
|
144
|
+
|
145
|
+
list.close
|
146
|
+
|
147
|
+
end
|
148
|
+
|
149
|
+
# this function performs a search for a string(str)
|
150
|
+
# in the alert-file. If a whitelistfile is given,
|
151
|
+
# or a acknowlege-file, it will search those files
|
152
|
+
# too and eventually exclude the hit from the result.
|
153
|
+
# @param [String] str search-query
|
154
|
+
# @return [Integer] @return_found on success
|
155
|
+
# @return [Integer] @return_notfound on failure
|
156
|
+
# @see return_found
|
157
|
+
# @see return_notfound
|
158
|
+
# @see ack
|
159
|
+
# @see whitelist
|
160
|
+
def search(str)
|
161
|
+
@search_str = str
|
162
|
+
@found_str = nil
|
163
|
+
|
164
|
+
if @fast.nil?
|
165
|
+
init_log
|
166
|
+
end
|
167
|
+
|
168
|
+
wl_found = false
|
169
|
+
ack_found = false
|
170
|
+
|
171
|
+
@fast.readline_parse do |fast_entry|
|
172
|
+
if fast_entry.description =~ /#{@search_str}/
|
173
|
+
if not @whitelist.nil?
|
174
|
+
wl_found = search_list(fast_entry.description,@whitelist)
|
175
|
+
end
|
176
|
+
|
177
|
+
if not @ack.nil? and File.file?(@ack)
|
178
|
+
ack_found = search_list("#{fast_entry.timestamp} #{fast_entry.id} #{fast_entry.conn}",@ack)
|
179
|
+
end
|
180
|
+
|
181
|
+
if wl_found == false and ack_found == false
|
182
|
+
@found_str = fast_entry.description
|
183
|
+
return @return_found
|
184
|
+
end
|
185
|
+
end
|
186
|
+
end
|
187
|
+
@fast.close
|
188
|
+
|
189
|
+
return @return_notfound
|
190
|
+
end
|
191
|
+
|
192
|
+
private
|
193
|
+
|
194
|
+
# this function performs a search for a line in a file
|
195
|
+
# @param [String] str search-query
|
196
|
+
# @param [String] listfile file to search
|
197
|
+
# @return [Boolean] true if it succeded
|
198
|
+
# @return [Boolean] false if it did not succed
|
199
|
+
def search_list(str,listfile)
|
200
|
+
list = File.open(listfile,'r')
|
201
|
+
begin
|
202
|
+
while entry = list.readline
|
203
|
+
entry = entry.chomp
|
204
|
+
if str =~ /#{entry}/
|
205
|
+
list.close
|
206
|
+
return true
|
207
|
+
end
|
208
|
+
end
|
209
|
+
rescue EOFError
|
210
|
+
end
|
211
|
+
list.close
|
212
|
+
return false
|
213
|
+
|
214
|
+
end
|
215
|
+
|
216
|
+
end
|
217
|
+
|
218
|
+
end
|
@@ -0,0 +1,25 @@
|
|
1
|
+
#--
|
2
|
+
# Copyright (C) 2016 Wolfgang Hotwagner <code@toscom.at>
|
3
|
+
#
|
4
|
+
# This file is part of the suricata gem
|
5
|
+
#
|
6
|
+
# This mindwave gem is free software; you can redistribute it and/or
|
7
|
+
# modify it under the terms of the GNU General Public License
|
8
|
+
# as published by the Free Software Foundation; either version 2
|
9
|
+
# of the License, or (at your option) any later version.
|
10
|
+
#
|
11
|
+
# This gem is distributed in the hope that it will be useful,
|
12
|
+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
13
|
+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
14
|
+
# GNU General Public License for more details.
|
15
|
+
#
|
16
|
+
# You should have received a copy of the GNU General Public License
|
17
|
+
# along with this gem; if not, write to the
|
18
|
+
# Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
|
19
|
+
# Boston, MA 02110-1301 USA
|
20
|
+
#++
|
21
|
+
|
22
|
+
module Suricata
|
23
|
+
# yes, this is the version
|
24
|
+
VERSION = "0.2.0"
|
25
|
+
end
|
data/lib/suricata.rb
ADDED
data/misc/fast.log
ADDED
@@ -0,0 +1,11 @@
|
|
1
|
+
10/04/2016-11:03:06.749577 [**] [1:2012843:3] ET POLICY Cleartext WordPress Login [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.1:50650 -> 8.8.8.8:80
|
2
|
+
10/04/2016-11:03:06.749577 [**] [1:2012888:3] ET POLICY Http Client Body contains pwd= in cleartext [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.1:50650 -> 8.8.8.1:80
|
3
|
+
10/04/2016-11:13:27.634427 [**] [1:2522676:2719] ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 339 [**] [Classification: Misc Attack] [Priority: 2] {UDP} 212.69.166.153:123 -> 1.2.3.4:59740
|
4
|
+
10/04/2016-12:17:46.482848 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.0.1:53182 -> 4.3.2.1:443
|
5
|
+
10/04/2016-13:39:45.498785 [**] [1:2001595:10] ET CHAT Skype VOIP Checking Version (Startup) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.1:40460 -> 15.14.13.12:80
|
6
|
+
10/04/2016-17:10:54.833594 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 10.12.32.6:50707 -> 42.42.42.42:443
|
7
|
+
10/04/2016-18:30:45.866312 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 10.12.32.6:44646 -> 9.1.2.1:443
|
8
|
+
10/04/2016-22:18:08.728614 [**] [1:2100230:3] GPL CHAT Jabber/Google Talk Outgoing Traffic [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} 192.168.0.1:33243 -> 8.4.3.7:5222
|
9
|
+
10/04/2016-22:57:41.158897 [**] [1:2200074:1] SURICATA TCPv4 invalid checksum [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.0.1:52912 -> 1.2.3.22:80
|
10
|
+
|
11
|
+
10/05/2016-09:25:01.186862 [**] [1:2001595:10] ET CHAT Skype VOIP Checking Version (Startup) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 192.168.0.1:49491 -> 100.254.198.10:80
|
data/misc/whitelist.txt
ADDED
@@ -0,0 +1 @@
|
|
1
|
+
ET CHAT Skype VOIP Checking Version
|
data/suricata.gemspec
ADDED
@@ -0,0 +1,26 @@
|
|
1
|
+
# coding: utf-8
|
2
|
+
lib = File.expand_path('../lib', __FILE__)
|
3
|
+
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
4
|
+
require 'suricata/version'
|
5
|
+
|
6
|
+
Gem::Specification.new do |spec|
|
7
|
+
spec.name = "suricata"
|
8
|
+
spec.version = Suricata::VERSION
|
9
|
+
spec.authors = ["Wolfgang Hotwagner"]
|
10
|
+
spec.email = ["code@toscom.at"]
|
11
|
+
|
12
|
+
spec.summary = %q{This gem offers classes to handle suricata logfiles.}
|
13
|
+
spec.description = %q{This gem offers classes to handle suricata logfiles. It ships with a nagios-plugin. }
|
14
|
+
spec.homepage = "https://github.com/whotwagner/suricata"
|
15
|
+
spec.licenses = ["GPL"]
|
16
|
+
|
17
|
+
|
18
|
+
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
19
|
+
spec.bindir = "exe"
|
20
|
+
spec.executables = [ "check_suricata.rb" ]
|
21
|
+
spec.require_paths = ["lib"]
|
22
|
+
|
23
|
+
spec.add_development_dependency "bundler", "~> 1.12"
|
24
|
+
spec.add_development_dependency "rake", "~> 10.0"
|
25
|
+
spec.add_development_dependency "rspec", "~> 3.0"
|
26
|
+
end
|
metadata
ADDED
@@ -0,0 +1,107 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: suricata
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.2.0
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- Wolfgang Hotwagner
|
8
|
+
autorequire:
|
9
|
+
bindir: exe
|
10
|
+
cert_chain: []
|
11
|
+
date: 2016-10-11 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: bundler
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - "~>"
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '1.12'
|
20
|
+
type: :development
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - "~>"
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '1.12'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: rake
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - "~>"
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: '10.0'
|
34
|
+
type: :development
|
35
|
+
prerelease: false
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
37
|
+
requirements:
|
38
|
+
- - "~>"
|
39
|
+
- !ruby/object:Gem::Version
|
40
|
+
version: '10.0'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: rspec
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
44
|
+
requirements:
|
45
|
+
- - "~>"
|
46
|
+
- !ruby/object:Gem::Version
|
47
|
+
version: '3.0'
|
48
|
+
type: :development
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - "~>"
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '3.0'
|
55
|
+
description: 'This gem offers classes to handle suricata logfiles. It ships with a
|
56
|
+
nagios-plugin. '
|
57
|
+
email:
|
58
|
+
- code@toscom.at
|
59
|
+
executables:
|
60
|
+
- check_suricata.rb
|
61
|
+
extensions: []
|
62
|
+
extra_rdoc_files: []
|
63
|
+
files:
|
64
|
+
- ".gitignore"
|
65
|
+
- ".rspec"
|
66
|
+
- ".travis.yml"
|
67
|
+
- Gemfile
|
68
|
+
- LICENSE.txt
|
69
|
+
- README.md
|
70
|
+
- Rakefile
|
71
|
+
- bin/console
|
72
|
+
- bin/setup
|
73
|
+
- exe/check_suricata.rb
|
74
|
+
- lib/suricata.rb
|
75
|
+
- lib/suricata/connection.rb
|
76
|
+
- lib/suricata/fast.rb
|
77
|
+
- lib/suricata/logfile.rb
|
78
|
+
- lib/suricata/nagios.rb
|
79
|
+
- lib/suricata/version.rb
|
80
|
+
- misc/fast.log
|
81
|
+
- misc/whitelist.txt
|
82
|
+
- suricata.gemspec
|
83
|
+
homepage: https://github.com/whotwagner/suricata
|
84
|
+
licenses:
|
85
|
+
- GPL
|
86
|
+
metadata: {}
|
87
|
+
post_install_message:
|
88
|
+
rdoc_options: []
|
89
|
+
require_paths:
|
90
|
+
- lib
|
91
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
92
|
+
requirements:
|
93
|
+
- - ">="
|
94
|
+
- !ruby/object:Gem::Version
|
95
|
+
version: '0'
|
96
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
97
|
+
requirements:
|
98
|
+
- - ">="
|
99
|
+
- !ruby/object:Gem::Version
|
100
|
+
version: '0'
|
101
|
+
requirements: []
|
102
|
+
rubyforge_project:
|
103
|
+
rubygems_version: 2.2.2
|
104
|
+
signing_key:
|
105
|
+
specification_version: 4
|
106
|
+
summary: This gem offers classes to handle suricata logfiles.
|
107
|
+
test_files: []
|