thm 0.1.9 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b03e61c254df92335f35985f23c8857974154aeb
-  data.tar.gz: 45de914df6e4c5e0950b9852d0415124ad4ffbae
+  metadata.gz: aa7c387a68e5840edc14a7629620e22abb9ccb07
+  data.tar.gz: 9330f2f74820536f0b951bb2985076cceb7b691a
 SHA512:
-  metadata.gz: a63dac02431d17aae41b140e2bd691a849fca8e3b8262d7ccd41e00ca1263c5c4b6cd69fc261830c40fa188ceeec565af02d17dcf04bd984eca4dc14fcb68337
-  data.tar.gz: 146b860c9209e239957343de888934a3ad8d85f6867d6b7cdac25a48de9fc1d101cbb4acefe94d397daa36e6ba88b7c09fe3ce2b7f1ef75f108cd1013ec54cc7
+  metadata.gz: 215c395d5b190ca1f5fd6c2475e7f6799011fb098dea268904d3c57149369fa804a3dbf31a3c11a4829610f67dfd703cb1e5d0e433e4f04c70f654d422650466
+  data.tar.gz: 4cc76204aa3a73b7b0733026a2ee2f5e468672c7b4285aaa15acf3165be744cc0976dc6d027ca9b783bb67a6ba2094b25a267b2f0574cba8360a47733eb4bdf9

data/README.1ST

@@ -1,38 +1,47 @@
-Threatmonitor Overview
-======================
+Threatmonitor Packet Analysis Suite HOWTO
+=========================================
 
+To import example data.
 
-Sending data to a RabbitMQ queue so you can grab the data later.
+mclient -u monetdb -d threatmonitor < threatmonitor-exampledata.sql
 
-Please note that the queue prefix -q the queue will end up named wifi_iptables etc ...
+password same as username per monetdb default admin user setup.
 
-ruby thm-producer.rb -m capture -q wifi
+Will also need to import the GeoIP Data.
 
-Loading your data into a database.
+The web interface admin login is admin - default password goblin
 
-You can change the queue it reads from / databases tables it loads into in the code just make sure you've created the database tables.
+You will also need the GeoIP Data importing as well for the Web interface Dashboard the operate
 
-obj = Thm::Consumer.new
-obj.queueprefix = "wifi"
-obj.tblname_ippacket = "wifi_ippacket"
-obj.tblname_tcppacket = "wifi_tcppacket"
-obj.tblname_udppacket = "wifi_udppacket"
+mclient -u monetdb -d threatmonitor < geoip-import.sql
 
-ruby thm-consumer.rb
+Web Interface
 
-How to load a pcap file.
+http://172.17.0.1:4567/dashboard
 
-obj = Thm::Localmachine.new
-obj.tblname_ippacket = "wifi_ippacket"
-obj.tblname_tcppacket = "wifi_tcppacket"
-obj.tblname_udppacket = "wifi_udppacket"
-obj.dbconnect
+Your defaults file is the config.rb in the gem directory for now.
 
-ruby thm-pcap.rb -f Example2.pcap
+/usr/local/lib/ruby/gems/2.1.0/gems/thm-0.1.9/config.rb
+
+To Capture data:
+
+thm-producer -m capture -i eth0
+
+To Consume data into the Database
+
+thm-consumer -r
+
+For the RabbitMQ Admin http://172.17.0.1:15672 - admin password goblin
+
+Please note
+
+gem install thm
+
+To Keep everything upto date with the current release.
+
+Have fun!
 
-Thats really all the is to it.
 
-Enjoy!
 
 Brian Hood
 

data/README.md

@@ -11,11 +11,17 @@ RabbitMQ
 
 MonetDB or MySQL
 
-Ruby
+Ruby 2.1.x ( 2.2 we have a issue building eventmachine native )
+
+Libpcap 1.5.3 ( For pcaplet to build )
 
 Pcaplet - https://github.com/ahobson/ruby-pcap
 
-PCAPRUB - https://github.com/puppetpies/pcaprub - For Interface Realtime capture / dumping to disk
+PCAPRUB - https://github.com/puppetpies/pcaprub - For Interface Realtime capture / dumping to disk ( Comming soon )
+
+Docker Image ( https://hub.docker.com/u/puppetpies ( docker pull puppetpies/threatmonitor-suite ) )
+
+Rubygem released 0.1.9 at time of writing ( gem install thm ) https://rubygems.org/gems/thm
 
 ![Dashboard](https://raw.githubusercontent.com/puppetpies/threatmonitor/master/screenshot-1.jpg)
 

data/bin/thm-consumer

@@ -14,9 +14,8 @@ require File.expand_path(File.join(
           File.dirname(__FILE__),
           "../lib/thm.rb"))
 
-require File.expand_path(File.join(
-          File.dirname(__FILE__),
-	 "../config.rb"))
+conf = Thm::FileServices.new
+conf.thmhome?
 
 include Thm::Defaults
 

data/bin/thm-pcap

@@ -14,9 +14,8 @@ require File.expand_path(File.join(
           File.dirname(__FILE__),
           "../lib/thm.rb"))
 
-require File.expand_path(File.join(
-          File.dirname(__FILE__),
-	 "../config.rb"))
+conf = Thm::FileServices.new
+conf.thmhome?
 
 include Thm::Defaults
 

data/bin/thm-producer

@@ -14,9 +14,8 @@ require File.expand_path(File.join(
           File.dirname(__FILE__),
           "../lib/thm.rb"))
 
-require File.expand_path(File.join(
-          File.dirname(__FILE__),
-	 "../config.rb"))
+conf = Thm::FileServices.new
+conf.thmhome?
 
 include Thm::Defaults
 

data/bin/thm-session

@@ -21,7 +21,10 @@ require File.expand_path(File.join(
           File.dirname(__FILE__),
           "../thm-authentication.rb"))
 
-RELEASE = "Deedrah"
+require File.expand_path(File.join(
+          File.dirname(__FILE__),
+          "../lib/version.rb"))
+
 
 class Sinatra::Base
 
@@ -60,6 +63,8 @@ class Geocounter
   # Compile in array with the totals of all instance variables
   def geocount_compile
     countrycounts = Array.new
+    # You can't really inherit this class as the other class may also contain instance variables
+    # its not really an exact logic this class only works alone.
     instance_variables.each {|n|
       t = n.to_s.gsub("@", "")
       countrycounts << ["#{t}", instance_variable_get("#{n}")]

data/lib/thm/fileservices.rb

@@ -0,0 +1,50 @@
+
+module Thm
+
+  class FileServices
+      
+    def initialize
+      @fdata = String.new
+    end
+    
+    def conf_loader(file="config.rb", loadswitch=true)
+      file ||= file
+      if !File.exists?("#{Dir.home}/.thm/#{file}")
+        File.open("#{Dir.home}/.thm/#{file}", 'w') {|n|
+          n.write(@fdata)
+        }
+      end
+      begin
+        if loadswitch == true
+          require Dir.home+"/.thm/#{file}"
+        end
+       rescue
+        puts "Failed to load something went wrong check permissions !"
+      end
+    end
+
+    def thmhome?(file="config.rb")
+      file ||= file
+      if Dir.exists?("#{Dir.home}/.thm") == false
+        Dir.mkdir("#{Dir.home}/.thm")
+        puts "Creating .thm home subfolder copying config.rb"
+	#puts "#{File.getwd}"
+        File.open(File.expand_path(File.join(File.dirname(__FILE__), "../../#{file}")), 'r') {|n|
+          n.each_line {|l|
+            @fdata << l
+          }
+        }
+      end
+      begin
+	#puts "FDATA: #{@fdata}"
+	#puts "Begin"
+        conf_loader("#{file}")
+        conf_loader("config-original.rb", false)
+      rescue
+        puts "Error loading config from home directory"
+      end
+    end
+
+  end
+  
+end

data/lib/thm/producer.rb

@@ -163,18 +163,18 @@ module Thm
             udppacketsql = "SELECT * FROM #{@tblname_udppacket} WHERE guid = '#{guid}'"
             res3 = @conn.query("#{udppacketsql}")
             while row3 = res3.fetch_hash do
-              if v == 100
-                puts "UDP: MSGID: #{n} GUID: #{guid}"
-                v = 0
-              end
-              v = v + 1 unless v == 100
-              pcktdata = { 'udppacket' => {
-                      'guid' => row3["guid"],
-                      'recv_date' => row3["recv_date"],
-                      'udp_dport' => row3["udp_dport"],
-                      'udp_len' => row3["udp_len"],
-                      'udp_sum' => row3["udp_sum"],
-                      'udp_sport' => row3["udp_sport"]
+                if v == 100
+                  puts "UDP: MSGID: #{n} GUID: #{guid}"
+                  v = 0
+                end
+                v = v + 1 unless v == 100
+                pcktdata = { 'udppacket' => {
+                        'guid' => row3["guid"],
+                        'recv_date' => row3["recv_date"],
+                        'udp_dport' => row3["udp_dport"],
+                        'udp_len' => row3["udp_len"],
+                        'udp_sum' => row3["udp_sum"],
+                        'udp_sport' => row3["udp_sport"]
                     }
                 }
                 pcktyaml = pcktdata.to_yaml

data/lib/thm/version.rb

@@ -3,8 +3,8 @@ module Thm #:nodoc:
   module VERSION #:nodoc:
 
     MAJOR = 0
-    MINOR = 1
-    TINY = 9
+    MINOR = 2
+    TINY = 0
     CODENAME = "Deedrah"
 
     STRING = [MAJOR, MINOR, TINY].join('.')

data/lib/thm.rb

@@ -16,7 +16,6 @@ require 'guid'
 require 'yaml'
 require 'pcaplet'
 require 'pcaprub' # For Live capture / write
-#require '../datalayerlight.rb'
 require File.expand_path(File.join(
           File.dirname(__FILE__),
           "../datalayerlight.rb"))
@@ -38,7 +37,7 @@ module Tools
   end
   
 end
-puts Dir.pwd
+
 # Load Datasources
 require File.expand_path(File.join(
           File.dirname(__FILE__),
@@ -56,14 +55,11 @@ require File.expand_path(File.join(
           File.dirname(__FILE__), 
 	  "../lib/thm/localmachine.rb"))
 
+require File.expand_path(File.join(
+          File.dirname(__FILE__), 
+	  "../lib/thm/fileservices.rb"))
+
+# Versioning information
 require File.expand_path(File.join(
           File.dirname(__FILE__),
 	  "../lib/thm/version.rb"))
-          
-#require "#{File.dirname(__FILE__)}/"
-#require "#{File.dirname(__FILE__)}/"
-#require "#{File.dirname(__FILE__)}/"
-#require "#{File.dirname(__FILE__)}/"
-#require "#{File.dirname(__FILE__)}/"
-
-

data/thm-authentication.rb

@@ -10,9 +10,11 @@
 ########################################################################
 
 require "#{File.dirname(__FILE__)}/lib/thm.rb"
-require "#{File.dirname(__FILE__)}/config.rb"
 require "#{File.dirname(__FILE__)}/thm-privileges.rb"
 
+conf = Thm::FileServices.new
+conf.thmhome?
+
 #require File.expand_path(File.join(
 #          File.dirname(__FILE__),
 #          "/lib/thm.rb")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: thm
 version: !ruby/object:Gem::Version
-  version: 0.1.9
+  version: 0.2.0
 platform: ruby
 authors:
 - puppetpies
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-09 00:00:00.000000000 Z
+date: 2015-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -196,6 +196,7 @@ files:
 - lib/thm.rb
 - lib/thm/consumer.rb
 - lib/thm/dataservices.rb
+- lib/thm/fileservices.rb
 - lib/thm/localmachine.rb
 - lib/thm/producer.rb
 - lib/thm/version.rb