class Suricata::Nagios

This class offers all functionalities for a suricata-nagios-plugin

Attributes

ack[RW]

@!attribute whitelist

this whitelist can be used to exclude results from the search

@!attribute alertfile

this alertfile(fast.log) is used for the search

@!attribute return_found

this value is returned from search() on succes. (Default: 2)

@!attribute return_notfound

this value is returned from search() on failure (Default: 0)

@!attribute ack

it is possible to acknowlege alerts, so that they will be 
excluded from the next search. Use this member to set the acknowlege-file.
Default ack-file is: /tmp/surack.lst
alertfile[RW]

@!attribute whitelist

this whitelist can be used to exclude results from the search

@!attribute alertfile

this alertfile(fast.log) is used for the search

@!attribute return_found

this value is returned from search() on succes. (Default: 2)

@!attribute return_notfound

this value is returned from search() on failure (Default: 0)

@!attribute ack

it is possible to acknowlege alerts, so that they will be 
excluded from the next search. Use this member to set the acknowlege-file.
Default ack-file is: /tmp/surack.lst
fast[R]

@!attribute fast

this attribute stores the Suricata::Logfile-object

@!attribute found_str

this attribute stores the string found by search() in the Logfile-object

@!attribute search_str

the search-pattern is stored in this attribute
found_str[R]

@!attribute fast

this attribute stores the Suricata::Logfile-object

@!attribute found_str

this attribute stores the string found by search() in the Logfile-object

@!attribute search_str

the search-pattern is stored in this attribute
return_found[RW]

@!attribute whitelist

this whitelist can be used to exclude results from the search

@!attribute alertfile

this alertfile(fast.log) is used for the search

@!attribute return_found

this value is returned from search() on succes. (Default: 2)

@!attribute return_notfound

this value is returned from search() on failure (Default: 0)

@!attribute ack

it is possible to acknowlege alerts, so that they will be 
excluded from the next search. Use this member to set the acknowlege-file.
Default ack-file is: /tmp/surack.lst
return_notfound[RW]

@!attribute whitelist

this whitelist can be used to exclude results from the search

@!attribute alertfile

this alertfile(fast.log) is used for the search

@!attribute return_found

this value is returned from search() on succes. (Default: 2)

@!attribute return_notfound

this value is returned from search() on failure (Default: 0)

@!attribute ack

it is possible to acknowlege alerts, so that they will be 
excluded from the next search. Use this member to set the acknowlege-file.
Default ack-file is: /tmp/surack.lst
search_str[R]

@!attribute fast

this attribute stores the Suricata::Logfile-object

@!attribute found_str

this attribute stores the string found by search() in the Logfile-object

@!attribute search_str

the search-pattern is stored in this attribute
whitelist[RW]

@!attribute whitelist

this whitelist can be used to exclude results from the search

@!attribute alertfile

this alertfile(fast.log) is used for the search

@!attribute return_found

this value is returned from search() on succes. (Default: 2)

@!attribute return_notfound

this value is returned from search() on failure (Default: 0)

@!attribute ack

it is possible to acknowlege alerts, so that they will be 
excluded from the next search. Use this member to set the acknowlege-file.
Default ack-file is: /tmp/surack.lst

Public Class Methods

new(alertfile="/var/log/suricata/fast.log",whitelist=nil) click to toggle source

constructor @param [String] alertfile path to the suricata-log-file(default: /var/log/suricata/fast.log) @param [String] whitelist path to the whitelist(default: nil)

# File lib/suricata/nagios.rb, line 58
def initialize(alertfile="/var/log/suricata/fast.log",whitelist=nil)
        @whitelist = whitelist
        @alertfile = alertfile
        @return_found = 2
        @return_notfound = 0
        @ack = "/tmp/surack.lst"
end

Public Instance Methods

acknowlege(str) click to toggle source

this method performs a search(str). It will ask interactively for ever hit if it should be acknowleged. In case of “yes”, the routine will add a shortform of the entry to the acknowlege-file @param [String] str string to search @see ack

# File lib/suricata/nagios.rb, line 123
def acknowlege(str)

        if @fast.nil?
                init_log
        end

        list = File.open(@ack,'a')

        @fast.readline_parse do |fast_entry|
                if fast_entry.description =~ /#{str}/
                        if not search_list("#{fast_entry.timestamp} #{fast_entry.id} #{fast_entry.conn}",@ack)
                             printf("Acknowlege the following entry:\n")
                             printf("#{fast_entry}\n")
                             printf("Acknowlege(y|n): ")
                             answer = STDIN.gets
                             if answer == "y\n"
                                     list.write("#{fast_entry.timestamp} #{fast_entry.id} #{fast_entry.conn}\n")
                             end
                        end  
                end
        end

        list.close

end
init_log() click to toggle source

this method initializes the Suricata::Logfile(@fast) and opens the @alertfile @see alertfile

# File lib/suricata/nagios.rb, line 69
def init_log
        @fast = Suricata::Logfile.new(@alertfile)
end
runApp(args) click to toggle source

this is the check_suricata-application. this function exits with 3 on error @param [Array] args typically ARGV @return [Integer] @return_found if searchstring was found @return [Integer] @return_notfound if searchstring was not found @see return_found @see return_notfound

# File lib/suricata/nagios.rb, line 80
def runApp(args)
        help = nil
        interactive = false

        OptionParser.new do |opt|
                opt.banner = "Usage: #{$PROGRAM_NAME} [ -a alertfile ] [ -w whitelistfile ] -e searchstring"
                opt.on('-h', '--help', 'This help screen') do
                        $stderr.puts opt
                        exit 3
                end
                opt.on('-a','--alertfile ALERTFILE','alertfile(default: /var/log/suricata/fast.log)') { |o| @alertfile = o }
                opt.on('-w','--whitelist WHITELISTFILE','whitelistfile') { |o| @whitelist = o }
                opt.on('-e','--search STRING','searchstring') { |o| @search_str = o }
                opt.on('-i','--interactive','interactive acknowleges') { |o| interactive = o }
                opt.on('-k','--ackfile ACKFILE','ackfile(default: /tmp/surack.lst)') { |o| @ack = o }
                help = opt.help
        end.parse!(args)

        if @search_str.nil?
                $stderr.puts help
                exit 3
        end
        
        if interactive
                acknowlege(@search_str)
                exit 3
        end
        
        ret = search(@search_str)
        if ret > 0
                puts "FOUND"
        else
                puts "OK"
        end

        exit ret
end

Private Instance Methods

search_list(str,listfile) click to toggle source

this function performs a search for a line in a file @param [String] str search-query @param [String] listfile file to search @return [Boolean] true if it succeded @return [Boolean] false if it did not succed

# File lib/suricata/nagios.rb, line 199
def search_list(str,listfile)
        list = File.open(listfile,'r')
        begin
        while entry = list.readline
                entry = entry.chomp
                if str =~ /#{entry}/
                        list.close
                        return true
                end
        end
        rescue EOFError
        end
        list.close
        return false

end