module Capra
Constants
- PRIVATE_IPS
- VERSION
Public Class Methods
run_cli!()
click to toggle source
# File lib/capra.rb, line 17 def self.run_cli! CommandLion::App.run do name "Capra" version Capra::VERSION description "Intrusion Detection System" command :init do description "create a base Caprafile in the current working directory" action do if File.exists?("Caprafile") puts "error: Caprafile already exists!" exit 1 end File.open("Caprafile", 'w') do |file| file.puts '#!/usr/bin/env ruby' file.puts file.puts "interface '#{Interfacez.default}'" file.puts file.puts "# your rules go here" end end end command :start do description "start the engine" default "Caprafile" action do unless File.exists?(argument) puts "error: cannot find #{argument} in the current directory" puts puts "hint: run `capra init` to create a base Caprafile" exit 1 end Capra::Engine.new(file: argument) end end # $ capra convert 'alert tcp any any -> any 21 (msg:"ftp")' # rule 'TCP' do |packet| # next unless packet.tcp.dport == 21 # alert "ftp" # end command :convert do description "Convert Snort rule(s) to Caprafile syntax" type :string action do if File.file?(argument) File.foreach(argument) do |line| line = line.strip next if line.empty? Capra::SnortRuleParser.convert(line) end else Capra::SnortRuleParser.convert(argument) end end end end end